All Questions

0
votes
0answers
4 views

Cracking WPA2 using Intel HD Graphics GPU

I use Linux Kali and yesterday have captured a WPA handshake of my network. I want to crack it's password - but my CPU with aircrack-ng checks only about 2000 keys per second. In my laptop I have got ...
0
votes
0answers
3 views

SIP Provider stores credentials, is it required for some SIP phones?

My SIP provider stores my SIP call time password as AES encrypted in stead of hashed. I understand that SIP authentication has the capability to NOT store the password, and in stead store a ...
0
votes
0answers
3 views

Backdoor under Akismet wordpress plugin

my site recently got hacked or my users leaked out their passwords. The hacker install this plugin with a shell or backdoor in it. The file name is the "honda.zip" and inside is some Akismet plugin's ...
0
votes
0answers
5 views

LFI Waf Bypassing help

i encountered a LFI, where the WAF strips the slashes and some strings near to it: I tried using a truncated payload, it doesn't works! Example behavior of the app: Payload: ...
-1
votes
0answers
8 views

/etc/httpd/conf/httpd.conf and /etc/httpd/conf.d/owncloud.http /Directory directives

Below is a segment from the owncloud.conf file in /etc/httpd/conf.d. It is the intent to lock out all access except the 10.0 intranet and a limited set of external ip address xx.yy.0.0. However the ...
-1
votes
0answers
13 views

DNS Amplification attacks

For an academic paper,I need to simulate a DNS amplification attack and show how it can be mitigated.How to go around simulating a DDOs attack,because I don't have zombies at my disposal and I don't ...
1
vote
2answers
62 views

How secure is a password with English words?

I typed the following password in howsecureismypassword.net: yummy candy yummy It said it would take 100 billion years for a personal computer to crack. Is this accurate? Even though it has English ...
1
vote
1answer
27 views

Is it possible to modify the last time a user logged into Windows?

On my digital forensics course I need to analyze an image and look for evidences to ask a couple of questions. One question was to find out when was the system installed, and another one was to find ...
10
votes
3answers
902 views

How do major sites prevent DDoS?

As far as I know, I have never heard of or seen any large scale web sites like Amazon, Microsoft, Apple, Google, or Ebay ever suffer from DDoS. Have you? I have a personal philosophy that the bigger ...
0
votes
1answer
27 views

What technique should I use to prevent unpermitted access to my REST API

I need to build an REST API that can be accessed via HTTPS when given valid credentials. How should I implement those credentials? I am looking for advice whether I should use plain old passwords, ...
0
votes
2answers
56 views

Encrypted retrievable password

I have a password conundrum. I need to store an encrypted password in a DB table but in such a manner that would allow me to retrieve the password as plain text afterwards. Please note that this is a ...
0
votes
1answer
27 views

Poodle vulnerability and eCommerce

Our client has recently stopped getting new orders placed on their Magento eCommerce site. Could this be related with the Poodle vulnerability, as their server is still on SSLv3. Is there any ...
-1
votes
0answers
6 views

KSN in DUPKT algorithm

I am testing DUKPT pin translation block and i have the BDK in place.. i need to know how can i generate my first KSN and then further increments.. Simply i need to know how to make up the KSN to ...
0
votes
0answers
17 views

Information Gathering - Passive

I have several subnet to assess for a VA but the assessing will start next week. What could I do with the subnet that the client has already provided to me, without break anything or be intrusive ...
0
votes
1answer
38 views

Can a botnet be used to effectively break encryption keys?

Can a botnet amass and coordinate enough computing power to break encryption keys that are typically considered to be secure (through brute force)? If this is the case, do we need to make our ...
0
votes
0answers
6 views

Is there an extension/command line for OSX Chromium to save website passwords in LOCALSTORAGE instead of the system's keychain?

My situation: I want to use a portable-app implementation of Chromium running on a removable drive, so I never leave any passwords stored on the kaychain of any computer I use. Portable Chromium is ...
0
votes
0answers
9 views

How does WebID fit in the SAML picture?

How does WebID fit in the SAML picture? Are they related or completely unrelated? Can they work together? If yes, what are the benefits?
1
vote
0answers
16 views

Mcafee endpoint protection doesn't see previously encrypted partition after Windows 7 reinstallation

My partitions C and D were encrypted and Windows 7 was installed on C. I copied all important files to D and then changed harddrive controller from IDE to AHCI, removed C and created it again and then ...
0
votes
1answer
32 views

Are 2FA soft-tokens flawed if the user can log into the website from the same mobile device?

If I'm using something like Authy for soft tokens for my users, and they log into the web application on the mobile device itself, haven't they just lost the benefit of 2FA (ie loss of the mobile ...
-1
votes
1answer
23 views

Calculating the breakability of a given encryption method

I will soon be doing a very important project for school. The main goal of my project is to find a mathematical way to calculate the breakability of a given encryption method of ciphertext. Is there ...
0
votes
1answer
9 views

Endpoint for checking if user exists in system

I have question regarding users point of view of this endpoint /api/user which requires POST data: email=user@domain.com and returns {"user@domain.com": "exists"} I am concerned if users might think ...
0
votes
0answers
27 views

How can I Run my Kali Tools on a Remote Server

I am currently ssh-ed into a remote server. However, I do not have root permissions on the remote server and therefore am unable to install and use tools such as nmap. I've been trying to figure out ...
2
votes
3answers
167 views

Is it safe to ignore DoS attacks on my router?

There are several entries in my router's log file showing recent DoS attempts on some ports on my router. They look like this: [DoS Attack: ACK Scan] from source: 213.61.245.234, port 80, Friday, ...
1
vote
1answer
27 views

Security implication of non-free drivers

I was wondering what the security implications are of using non-free drivers on a linux laptop. Especially for graphics and wifi.
4
votes
1answer
41 views

Can virtual machines be used to isolate vulnerable software?

I have had a look at most of the previous questions about virtual machines (VMs) and they all appear to be focused on hosting malware in the VM and preventing it breaking out of the VM. What I can’t ...
3
votes
2answers
180 views

how to know which encryption is been used [duplicate]

Is there a way to find what type of encryption/encoding is being used? For example, I am testing a web application which stores the password in the database in an encrypted format."azOwKPoUYP4=" is ...
-1
votes
0answers
34 views

bank of england cbest [on hold]

Mainly for UK guys but has anyone started working with - http://www.bankofengland.co.uk/financialstability/fsc/Pages/cbest.aspx It would be interesting to get any feedback on how well this works / ...
1
vote
0answers
54 views

Can a physical attacker compromise a Windows machine with UEFI, secure boot and bitlocker?

Machines such as the MS Surface Pro 3 comes with bitlocker encryption and UEFI secure boot out of the box. However, the default boot order is network -> usb -> ssd. If an attacker gets physical ...
1
vote
0answers
95 views

Has 100+USD, accidentally

Yesterday, I just visit a shopping site which use serial payment method and I type in some serials randomly then my account have 100USD; I just want to 'test' that website (for the bug bounty), is my ...
0
votes
3answers
23 views

Pre-filling username for access to online web application

When sending web application users a reminder email, is it reasonably safe to include a link in the email to take them to the web application sign in form whereby the link has their username as a ...
0
votes
2answers
59 views

Legality of cookie(set by other sites) tracking

I have created a website A which asks username & password, there exists another closed source website B which again asks for login credentials. A user uses both these websites .I want to ...
0
votes
3answers
54 views

Does Wifi encryption create a private tunnel between the adapter and the accesspoint?

When non HTTP/S data is sent over Wifi, can that data be seen by other machines that happen to also be connected to that same access point? Does the privacy of the HTTP data depend on the encryption ...
1
vote
0answers
17 views

Mutual Authentication Protocol based on MAC & shared secret key

I am quite unsure about how to approach this question, was wondering if anyone could give me a nudge in the right direction, I would be most appreciative! So I've learned about the 4-way handshake ...
-1
votes
0answers
22 views

Configuration file with 12-character XML-encoded passwords

I have received a configuration file with 3 passwords I'm trying to crack. However, I'm having a hard time determining what hashing/encryption mechanisms are used for the passwords. The cipher ...
-3
votes
0answers
20 views

My site is being redirected to an app site when anyone tries to access site from an ipad [on hold]

My website is being redirected to this site: apps.rumobi.info
0
votes
1answer
51 views

Confirming a phone is still registered to someone [on hold]

My tenant s answering his phone pretending to be someone else and not paying his rent. I need to know the phone is still registered to him Is this possible ? Thank you I have tried a few times in the ...
2
votes
1answer
70 views

Do payload sizes reveal URLs when HTTPS is deployed on news, blogs, etc?

Even though HTTPS keeps HTTP paths private, is it not the case that the generally-unique payload sizes for particular URLs (on news articles, blogs, etc) provides a mechanism to reveal the URL anyhow ...
-1
votes
4answers
72 views

How and why does not having https allow people to trace my browsing habits if at home? [on hold]

How can my browsing habits be traced when I am at home on my own local network? Technically how is it done ?
0
votes
2answers
57 views

Is Certificate-Based Authentication Really Better Than Password Authentication in OpenSSH?

I recently set myself up with a VPS and have been hardening it to the greatest extent of my limited knowledge! I was configuring OpenSSH to use certificate based authentication when something did not ...
0
votes
1answer
31 views

How are SCrypt's memory-hard requirements substituted with more CPU?

I've implemented scrypt with two separate APIs and in both there existed no settings providing a way to substitute CPU for memory. Both were locked one-to-one with rounds and memory. However in ...
0
votes
0answers
12 views

Kerberos based infrastructure with artifactory repo for our java artifcts with Apache reverse proxy and mod auth kerb. how can I access with gradle? [on hold]

We recently migrated our company to a kerberos-based infrastructure. I successfully set up an Artifactory repo for our java artifacts, with Apache reverse proxy and mod_auth_kerb. How can I access ...
0
votes
1answer
26 views

PCI Compliance - Antivirus in host and virtual environment?

We have a couple servers with a host system, and virtual DB and Web instances. Is it possible to be compliant with PCI if you install the Antivirus only on the host system, or does it need to be ...
0
votes
1answer
41 views

Should one worry about using an outdated version of Firefox? [duplicate]

I have access (and the general public) to a computer lab with many workstations. Each workstation is identical in terms of software, hardware and the version of firefox. The version that is installed ...
-1
votes
0answers
23 views

Can you tell me the best tool to reset PC window password? [on hold]

I forgot my PC windows password and want to reset it so can you tell me the best process or tool to reset PC windows forgotten password?
2
votes
0answers
29 views

Advice on if I should talk at my local user group about NIST, InfoSec etc [on hold]

I have been toying with the idea for a while now about doing my first talk, on my last project I was building a Risk Management portal for information security so I had to read all about Risk ...
1
vote
0answers
16 views

Cisco ASA acl deny hit rule but traffic permitted

interface "ldap" access-group ldap_access_in in interface ldap access-group ldap_access_out out interface ldap I had zero hits until I started to try ssh; access-list ldap_access_out line 1 ...
2
votes
1answer
46 views

How to exploit vulnerabilities found from OpenVAS?

I could not find any match for the vulnerabilities with their CVE numbers found from OpenVAS scanner with exploits using sites such as Rapid 7 Vulnerability DB and Exploit DB, or by using a command ...
0
votes
0answers
9 views

ITR(Interactive TCP Relay) Configuration for penetration testing on Thick client Application [duplicate]

I am trying to do penetration testing on Thick client application. In some article I read like ITR(Interactive TCP Relay) will help in intercepting and modifying the traffic. I don't know how to ...
0
votes
0answers
42 views

Penetration Testing on Thick Client Application

I am trying to do penetration testing on thick client application. Is there any tool for intercepting the traffic from thick client application? I have tried with burp invisible proxy but it is not ...
1
vote
2answers
32 views

GPG Web-of-Trust Level

(and really sorry for my english) I have a question about Web-of-Trust of GPG. Let's say A and B signed each other's public keys and B and C signed each other's public keys. In this case A can trust ...

15 30 50 per page