2
votes
1answer
22 views

Secure voice app

When I look in the Google play store (android apps market), I see that there are a lot of apps to make secure phone calls. However, all the apps I have seen so far all seem to use data packets over ...
2
votes
1answer
14 views

Why does my openssl connection fail with elliptic curve cipher ECDH-RSA-AES128-SHA?

I am using openssl example server and client with specific cipher in ubuntu 14.10 pc. The openssl version is 1.0.1. When I use the RC4-SHA cipher in both sides, the connection is established ...
0
votes
0answers
18 views

Program exiting after executing int 0x80 instruction when running shellcode

In school I was given an assignment to perform a buffer overflow, which would execute some shellcode and open a new shell. After a bit of fiddling the buffer overflow succeeded, and when I ran the ...
0
votes
0answers
26 views

Good book about creating malware, not just analyzing it

Good book about creating malware, not just analyzing it. I've been looking at a practical book on how malware works and how it is implemented. Most books I've seen just tell from a high-level ...
-8
votes
0answers
52 views

Cracking Password [on hold]

I've forgot my email password password and I haven't set my number and security question. Now I am unable to open my email. Please help me to crack my password.
-1
votes
1answer
37 views

What does “unknown” status in nmap mean?

scanned my IP number with nmap and I got all "unknown" status ports. What does that mean?
1
vote
0answers
19 views

Encrypt Lightning event invite mails with pgp [migrated]

I use Thunderbirds/Icedoves Lightning add-on to manage my calendar, tasks and notes. When creating an event I can add attendees and send invitations to them, but they won't use their public pgp keys ...
2
votes
2answers
462 views

Hacked Ubuntu server, probably hacked commands (netstat, ps, …), how to replace them?

An Ubuntu server of my company has been hacked to carry out a DoS attack. I found the shellshock bug had not been fixed by my colleagues, and I think it's the problem. Then, I found an ELF file that ...
2
votes
2answers
37 views

How to exploit via Metasploit vulnerabilities found with Nessus?

I am new in the field and trying to pentest a php web app locally stored on my host pc using metasploit from a kali vm. I have run some scanners like wmap,OpenVAS and Nessus and found some ...
0
votes
0answers
12 views

Facebook Login and OpenID Connect [on hold]

Can someone confirm whether Facebook Login API (https://developers.facebook.com/docs/facebook-login/v2.2) is based on OpenID Connect (http://openid.net/connect/) specification? Thanks, Sameer
1
vote
3answers
41 views

Moving /boot to USB and Preventing booting from other USB devices (Allow boot from only one USB)

I'm going to move my /boot/ folder to a USB to as a security measure to protect against Full Disk Encryption exploits. My question is, is it possible to only allow boot from USB from a single USB ...
0
votes
1answer
55 views

Can you trace network attacker by ip address? [on hold]

Is it possible to prove the identity by ip address of someone that has compromised a router on your network?
2
votes
1answer
39 views

Level 4 merchants becoming PCI Compliant

I was prompted recently to take a deeper look into some of the PCI requirement information, and I have found some pretty serious discrepancies with regard to the reporting obligations of Level 4 ...
2
votes
2answers
27 views

Separate normal traffic [on hold]

Is there any tool or method to separate normal traffic and malicious traffic from pcap? For example : if malicious traffic detected with snort i need to store those packets .only if malicious traffic ...
5
votes
1answer
38 views

DNS Rebinding attack - will the victim's browser send cookies?

How does a DNS Rebinding attack works? How can it violate the Same-origin policy? Will the victim's browser send cookies to the remote server (specified by IP), when the domain is not the same as is ...
2
votes
2answers
43 views

Certificate Errors with bad Date Time settings

I have recently solved an issue with IE 11 where I was getting certificate errors to google.com bing.com was fine no problems I tried a number of different things till seeing a post referring to ...
0
votes
0answers
17 views

how to disable keyring in windows 7 [on hold]

I don't want my mercurial to save the password. But due to mercurial_keyring my passwords gets saved in windows credentials. I need to clean up everytime using below procedure ...
0
votes
2answers
54 views

SSL certificate expired

Some company was trying to sell me their security system. They said that the SSL certificate was expired on my laptop, which they showed me. They said that I wasn't protected. What are my options?
0
votes
1answer
14 views

Definitions of PKCS#11 abbreviations

Is there a complete definition list for all CKx abbreviations in PKCS#11? I believe I gathered most of them: CK = Cryptoki CKA = ... Attribute CKC = ... Certificate type CKD = ... Key derivation ...
3
votes
1answer
36 views

Can javascript code served by a server under HTTPS talk to another server under a subdomain with a different certificate?

Lets assume we have two servers : (1) https://adomain.com (2) https://abc.x.adomain.com The each have different certificates, (2) has a wildcard and (1) does not. If we remove https from the ...
2
votes
3answers
59 views

Steps to find out whether a SSL certificate is trustworthy

Starting from a incredibly high debit for electricity, I wanted to check my invoice. Unfortunately I get those invoices online only, so i have to browse to ...
1
vote
0answers
26 views

Is there an alternative AES schedule? [migrated]

I'm currently reversing an AES implementation for disk encryption. The odd thing I'm stumbled about is a key schedule where the encryption round keys are not the same as the decryption round keys (in ...
0
votes
2answers
65 views

Can you still be tracked when using a VPN?

If I am using a VPN on twitter, can an organisation like Anonymous or Lulzec track me and find out my identity?
1
vote
1answer
53 views

Risk when attacker has only physical access to a computer's USB port

Attacker has only access to USB port and can either attach a device or pen-drive to a computer, that can be on or off. Imagine a scenario where non-reliable people have access to offices, either ...
-3
votes
0answers
38 views

Anonymity on Facebook. Most of the answers are at least partially incorrect [on hold]

I cannot see how I have gotten some people on a "People You May Know" result since I identified someone I know that I never emailed, nor have any similar interests with at all -I did not even list my ...
0
votes
0answers
12 views

Error 207: ERR_CERT_INVALID [migrated]

I'm trying to make it so people can create a private key via the browser via the element and then after have it so that an X.509 cert is sent to them that's then installed into the browser. But I ...
-3
votes
0answers
25 views

Which is less complex web or network pen-testing? [on hold]

I know both network and web pen-testing but wanted to know people think is less complex. I would really appreciate your answers and looking forward for it. From my prospective i think network is more ...
0
votes
0answers
80 views

Cryptolocker virus removal [migrated]

I am facing cryptolocker virus problem, I have tried decryptcryptolocker website but it did not work. In the below link you will find an example encrypted file in my pc. ...
0
votes
2answers
96 views

typical request, what type of encryption is this? [on hold]

so our company's CTO quit, and i replaced him and we need to change the system's passwords, however some passwords are encrypted in our database and i need to know what encryption to use in order to ...
2
votes
2answers
70 views

is it sufficient to convert '(single-quote) to ` ' `

Is it sufficient to convert ' to &#039; , > converted to &gt; and < converted to &lt; to avoid xss A bit of context: the payload would be going through the URL and landing in a ...
2
votes
2answers
92 views

Why Google Chrome complains about mozilla.org identity?

On a "brand new" (but fully updated) Windows XP installation (an Asus EeePC that I restored to factory setting and than updated with all Microsoft's upgrades) I installed a few days ago Google Chrome. ...
1
vote
1answer
20 views

Will changing the 'Action' for Heartbleed signatures in PAN from 'alert' to 'drop' have any production impact in my organization?

I have been seeing some Heart-bleed PAN alerts. I want to set the default action from 'alert' to 'drop'. But I am not sure if this would block some legitimate packets. Since there are a vast number ...
0
votes
0answers
13 views

Authorization using shibboleth sso

We have integrated shibboleth web sso into our application to authenticate the user, Now we want to do authorization for our application. The below is the process which is i am thinking for authz. ...
25
votes
6answers
3k views

How do you explain to experts that a Database Server should not reside in the DMZ?

Our security experts, DBAs, network team and infrastructure team are all saying it's ok to have the DB server located in the DMZ along with the HTTP server and middle-ware server. Their reason: ...
5
votes
2answers
71 views

Can a caller “Hijack” your SIM information?

We have all heard them, rumors about people randomly calling you on your Mobile Phone number, and asking you to confirm something by typing in a specific combination onto your dial pad (the rumor I'm ...
1
vote
1answer
28 views

SSL/TLS Session Resumption with Session Tickets

We already have SSL session resumption enabled using a session cache. Based on an in-house performance report, enabling Session Resumption using Session Tickets is recommended. Is the performance ...
-2
votes
0answers
20 views

WebGoat Access Control Flaws help

I am using Web Security Dojo 2.1 and I am trying to complete an exercise in WebGoat, but it isn't working out the way it did in the video. The objective is to use the Tamper Data add-on with the ...
0
votes
1answer
43 views

Security concerns on API

I just encountered API which I find pretty vulnerable. Could you clarify if my concerns are wrong? 1)For retrieving user data, API KEY, which is unique for every user i used. This api key is stored ...
26
votes
4answers
2k views

Password Storage - Self Encryption vs Hashing?

Self Encryption: Encrypting a password using the password itself (as a symmetric key). Basically, by doing this, I'll get random data as an output. Now, in order to retrieve the password from this ...
0
votes
1answer
30 views

How to protect publicly placed NFC tags?

Recently, the appearance of public NFC tags are growing in major populated areas. The company I am currently working along side with wants to increase their advertisements with a NFC tag placed on the ...
1
vote
1answer
67 views

What is the right way to implement Keyed Password Hashing?

As mentioned in this wonderful link, the way to get a PBKDF2 Hash of a user given password given a password (of course), a salt (generated Cryptographically Secure Random Number Generator. iteration ...
2
votes
1answer
90 views

Transmitting Credit Card Information

I want to know how secure it is to transmit Credit Card details as plain text to the payment gateway from my website using HTTPS. We are not storing any details in our database but I read that ...
0
votes
1answer
33 views

Is there a security difference between remote desktop or VPN?

Is there any difference in security between browsing the internet on a remote desktop and using a VPN to browse the internet on a local machine? In this case assume both use the same encryption ...
-7
votes
0answers
34 views

How do they usually do to discover security issue [on hold]

I just wonder how they usually do to discover the security issue? I have heard of fuzzing tool like american-fuzzy-lop developed by Michal Zalewski is one of tool which will can be used to detect ...
3
votes
3answers
1k views

Is this PHP code XSS proof?

Is the following PHP code XSS proof? <?php $site = $_GET["url"]; echo "<a href='".str_replace(array("\"", "'", "javascript:", "vbscript:"), array("%22", "%27", "", ""), ...
2
votes
2answers
32 views

W3af and automated vulnerability scanners vs manual testing

How effective are tools such as w3af in looking for web app vulnerabilities compared to looking for vulnerabilities manually? Are they able to find all vulnerabilities from OWASP top 10 such as ...
0
votes
1answer
47 views

Ensuring security of web based games and contests

I have previously analysed an online contest and found that it was trivial to reverse engineer the handshake process since it was all done in javascript. As a result, it was possible to code an ...
0
votes
0answers
48 views

SSL certificate expired on laptop what does that mean? [on hold]

SSL certificate says it is expired on my laptop. What are the implications.
1
vote
1answer
35 views

how to find a cryptography scheme (either authentication or encryption) for which some formal analysis of security has not been done yet

I have a project in Cryptography where I have to discuss the provable security of any proposed scheme (encryption or authentication) which has not been discussed yet. Any pointers on how and where to ...
0
votes
0answers
23 views

How to add basicConstraints extention to a self signed certificate

Using openssl to create a self signed certificate. The certificate needs to have the Basic Constraints value defined and showing in the cert but I can't seem to be finding the right location to modify ...

15 30 50 per page