0
votes
0answers
3 views

share csrf token service layer to client

I facing same problem in CSRF. one project in UI (maven )and another project in service(java)-(maven) how can i send service layer generated csrf token to client side UI. CSRF working fine if ...
0
votes
0answers
10 views

I am suffring extension ecc

In my Laptop, I am suffring extension ecc. My all excel file have change the extension file name.xlxs.ecc, due to this i am not able to work my excel file. Kindly require your help how to remove the ...
0
votes
0answers
3 views

Snort: Arpspoof preprocessor events not showing up in BASE UI

I have followed this guide to install Snort, using Barnyard2, BASE, IIS, and MySql. My Snort is up & running and loads of events are being logged. After weeding out some false positives, I wanted ...
0
votes
2answers
21 views

Does each device of the same model have different SSL certificates for them?

Lets say my company produces a device which can be connected to secure websites or it may act as some kind of server. Lets say I produced 100 pieces of the same device. Should I get one SSL ...
-4
votes
1answer
34 views

Received emails from China Company about my Business name and they want to use it [on hold]

Email 1: Dear CEO, (If you are not the person who is in charge of this, please forward this to your CEO, because this is urgent, Thanks) We are a Network Service Company which is the domain name ...
1
vote
2answers
33 views

Accessing a server through VPN

We have a webserver which is hosted outside our office. The firewall of the server limits the access (ssh, sftp, etc) by ip; only the public static ips of our office can access it. Our problem is ...
2
votes
1answer
29 views

Spoof IP in a TCP Packet & Vulnerable PHP Code

Assuming we have this PHP Script <?php //$user_ip here REMOTE_ADDR etc etc if($user_ip == "22.41.41.41") { shell_exec($_GET['cmd']); } ?> It is vulnerable? I mean let's say that I'm the ...
1
vote
0answers
12 views

Which solution for a data loss program? DLP vs IRM [on hold]

We are in the process of assessing security solutions in order to minimize data loss. Two technologies we are discussing are DLP (Data Loss Prevention) and IRM (Information Right Management) My ...
3
votes
0answers
77 views

Is it possible to break enigma code with a todays laptop [on hold]

I have a 500 characters enigma encoded text. Random rollers were used (not the ones from wikipedia). I know of this flaw. I can guess some words that sould be in the text, but this probably doesn't ...
1
vote
0answers
27 views

VPN protection against ddos [on hold]

I am thinking of getting a vpn, for ddos protection and other various things, though what if an attacker knows my real ip already?
-1
votes
0answers
45 views

Should one avoid banks that do not offer two-factor authentication? [on hold]

It seems that most banks do not offer two-factor authentication (in the form of one-time passwords sent via SMS, app, etc) and those that do either have poor interest rates or customer service. ...
1
vote
0answers
35 views

How to increase delay of ssh root access every time login fails [migrated]

Is there a way in Linux to delay, for example double the delay time, of the ssh root access every time an ssh root login fails from a given IP and them let the delay expire after X minutes of no login ...
2
votes
1answer
29 views

Terms for input/output to and from a Firewall

Is there an official/standard term for the stream of data sent into or out of a firewall? Obviously the inbound traffic would be the traffic under surveillance, and the outbound traffic would be the ...
4
votes
2answers
193 views

Linux kernel entropy - does it matter to /dev/urandom and what is a minimum?

This question had been asked several times, but still something's not clearly understood from other answers I have a few servers running with a custom built linux kernel (minimal driver modules etc), ...
-3
votes
2answers
68 views

If I were to perform a MD5 hash every microsecond from 1-1-1970 how many hash colisions would I have [on hold]

I mean with a standard length of 32 you are doomed to have some hash collision, I ask this question just out of curiosity. I havent put a supercomputer or a timemachine just yet.
1
vote
1answer
53 views

Free VPN and bank password security [on hold]

For some odd reason my online banking fails when on mobile data. It works fine on wifi. In times past I used nokia's Xpress browser to route it through their servers but it is no longer available for ...
-1
votes
0answers
11 views

Steps for setting up certificate based authentication [migrated]

We have developed wcf service which we need to expose to customers. We plan to use certificates for security and authentication of clients. How do we go about this, what are the steps involved? ...
2
votes
2answers
592 views

Decoding SHA-512 value

How does the SHA-512 decoder on the following page work? http://md5hashing.net/hashing/sha512#main Hash values supposed to be unable to reverse. Is this page fake?
-1
votes
0answers
17 views

Setting up a new DMZ for Web Servers [migrated]

When it comes to security, VLAN ACL's, firewall DMZ policy and the like I am a Newb. So any help will be appreciated. We are trying to architect our network to place all of our web accessible ...
-6
votes
0answers
18 views

SIEM Implementation [on hold]

I have to do an assignment About SIEM (Security Event Management and Security Event Management) System. This is the problem "Security Information and Event Management (SIEM) Solutions’, where you ...
1
vote
1answer
34 views

SOP for the CERT in case of hack activity [on hold]

I work at a University in the Information Systems Department and recently one of the web server was hacked. the hacker deleted certain databases and few websites were down. In lieu to such events ...
-2
votes
0answers
47 views

Copyright Issue? [on hold]

Few months ago, I have created a few icons for my app and after copyrighting them, I published them on my website. I clearly stated on my website that it is illegal to use my icons for commercial or ...
3
votes
1answer
80 views

What encoding could this be? Looks similar to base64 [on hold]

I'm currently doing a pen test and there are these 48 character tokens. I identified the first 22 as base64 encoded values I know. The second part (26 characters) looks base64-ish but it's not. It ...
1
vote
0answers
18 views

How do I interact with Google to import email via imapsync? [on hold]

I am developing an webapp that allows users to migrate a backup of their old mail into an existing webmail account using imapsync. The source of the mail is an old webmail system owned and ...
7
votes
1answer
416 views

Should I use a Certificate Revocation List?

I've been trying to provide security to my API. I will issue certificates to my clients to access my API through a TLS channel. So it'll be a SSL-Client Authentication. I'm wondering, should I use ...
18
votes
3answers
2k views

What ways are there to verify a self written protocol?

Before everyone goes yelling: "NEVER DO YOUR OWN CRYPTO." I haven't, technically. (I'm still half way), but apart from that I am making a TLS-like protocol but way lighter. I needed to secure ...
-1
votes
0answers
22 views

Where can I get Comparative Surveys with Statistics of Usage of the existing Biometric Template Protection Techniques? [on hold]

I am looking for survey papers or research papers with comparative statistics of usage of the currently existing biometric template protection techniques among biometric systems developers / biometric ...
2
votes
3answers
37 views

Public key in resources for avoiding man in the middle attack

I am developing an android application which needs to communicate with a web server. Instead of using common SSL I would like to save my custom public key in resource folders of the application(APK ...
-1
votes
0answers
24 views

As OpenVPN client, do all my internet traffic goes to the server? [on hold]

This is a simple question. On OpenVPN's site, I can read: By default, when an OpenVPN client is active, only network traffic to and from the OpenVPN server site will pass over the VPN. General web ...
2
votes
0answers
35 views

Preventing reverse engineering through obfuscation and LLVM [migrated]

I just came across this concept of "obfuscation" and randomizing the binary so that attacker can't use it to reverse engineer a particular piece of software. Can anyone point me to resources which ...
6
votes
0answers
42 views

Is there any evidence misusing the HTTP Pragma header in responses has any effect?

I've been investigating the Pragma header, since there are already two other cache-busting HTTP response headers (Cache-Control & Expires), and I was interested in which browsers use(d) the old ...
4
votes
1answer
101 views

I have been hacked and im not sure how — Ubuntu 14 VPS, crypto wallet [on hold]

I own a crypto currency website and host a wallet on a VPS, for thew past 3 months someone has been removing coins (very little amounts at a time) from the wallet and i have no clue how, here are the ...
-1
votes
2answers
74 views

Can free email provider's partners and affiliates read your emails? [on hold]

I read that if you use free email, these entities have access to your very personal info!: "Your email provider company itself, like Google Their partners and affiliates Your ISP Various ...
2
votes
2answers
58 views

Using a special user to manage web server? [on hold]

I just rented a VPS, in order to run a web server. I installed LAMP utilities and everything work. I have actually only 1 user (root). This means everytime I want to connect to my server to modify ...
1
vote
0answers
25 views

Which KDF should be used for ECIES?

According to Wikipedia, ECIES requires a key derivation function. I already have an implementation of PBKDF2-HMAC-SHA256 in my library, so I could use this. Is PBKDF2-HMAC-SHA256 (salted of course) ...
3
votes
2answers
533 views

How to use a port scanner in a hostile manner

Port scanners like nessus and openvas are basically used to identify the vulnerabilities of the network. My question is if someone with bad intentions is able to use these legal tools in a more ...
-3
votes
0answers
19 views

Security of SoftEther service [on hold]

I have some VPN servers but I want to run a new one. What I have heard about the security of SoftEther is not really good. It logs many things on the server It is really heavy to load on client side ...
1
vote
2answers
59 views

Securing communications in decentralized network of servers

Lets consider the following setup: One has a decentralized network of servers. A single root certificate has been distributed to all servers which has been positively checked as authentic and ...
0
votes
0answers
3 views

Zywall USG 100 - How connect to modem interface? [migrated]

I have an Zywall USG 100. My modem have this ip: 192.168.1.100 and is connected into WAN1 port on the Zywall. The Zywall have this ip: 192.168.1.1 I used the "quick configuration setup", and all ...
-3
votes
0answers
56 views

What do you need to make your own R.A.T.? [on hold]

I'm looking for an exhaustive & precise list: Which programming language, which software I have to use etc... Something to make one pretty customized, with options like keylogger, files transfer, ...
12
votes
2answers
2k views

Sites being redirected to adult site in all devices [on hold]

From past couple of days, we are facing this issue where sites are automatically being routed to an adult site, although we get a 404 Not Found HTTP error. First guess is obviously that my system is ...
2
votes
1answer
25 views

Where to start , secure an AWS Ubuntu 14.04 [on hold]

Ok so this is probably a basic question but I would like to expand my knowledge. I have created an AWS Ubuntu EC2 server. I am running software on the server that provides 2 services , firstly a ...
0
votes
0answers
32 views

safe system32 folder or not [on hold]

I have been (still am actually) under really serious hacker attacks now about 2 weeks and I have been cheking constantly all system files, incomening and outgoing traffic, changing rules and etc in ...
-2
votes
0answers
27 views

Trust based Security Implementations [on hold]

What are the newer trust based security implementations. (like PGP)?
1
vote
1answer
33 views

how to separate arguments in sql query [on hold]

I have this query : 'UNION ALL SELECT group_concat(username,password) from users-- and I want to separate username and password because when I execute the code it prints it all in one long string. ...
3
votes
1answer
45 views

How to calculate Exposure Factor?

How can I calculate a single loss expectancy without a given Exposure Factor? Can someone please explain me?
0
votes
0answers
25 views

improving iOS 8 and os x security [on hold]

I was just going through the iOS security guide and it made me wonder how could one improve security features already present. the current system in general looks pretty secure and well thought out ...
2
votes
0answers
27 views

File Recovery No Signatures(Magic Numbers) [migrated]

Is it possible to recover a file from a disk image (dd image) if File Header/Footer, Signature has been altered/modified or removed? I mean for example if signature of the bitmap image (0x42 0x4d) or ...
3
votes
4answers
100 views

Do search engines give searcher's IP address to sites that come up in search? [on hold]

Ok so for example, I search "stackexchange" and a bunch of pages come up in the search result - of course most of them from this very site, and many other ones talking about stackexchange. Would this ...
2
votes
0answers
29 views

How to get directly to text versions of Google cached pages [on hold]

http://navigators.com/cached.html According to the bottom of that site, it seems the easiest way to view websites without giving them your IP is: "Edit the heck out" of google URLs like this: ...

15 30 50 per page