0
votes
0answers
10 views

VPN security/compromise

I want to get a VPN with one of the known providers. I don't know much about VPNs but I know they issue certificates which you download and it authenticates the connection and basically gives access. ...
1
vote
0answers
3 views

Multiple “rundll32.exe mhunk.dme” instances. Is my PC Infected with Something?

So, I have this strange list of rundll32.exe There are quite a lot of rows of it (see attached image) when I open the process tab in my task manager I've already read the link here: Multiple running ...
2
votes
0answers
16 views

Distributed Denial Of Service Attack Mitigation

Is there any way in which you can stop a DDoS attack(or any measure that you can take), if the packets sent by the attacker look like normal traffic? I got the question on an interview (how would you ...
1
vote
1answer
34 views

“Allow __ to be fullscreen?”

It's sometime I ask myself what's the purpose of that popup showing up in pretty much all the modern browsers upon entering the full-screen mode of a video or website. It appears to be a security ...
1
vote
0answers
22 views

Obfuscate IDS rules

Are there known techniques to obfuscate IDS rules, so they can't be easily used by attackers to reverse-engineer the vulnerability that they detect? Let me provide some context. Sometimes IDS ...
0
votes
0answers
12 views

csrf best practices [duplicate]

I store the csrf token in a form and compare it against what I have in cache. Sometimes I store the csrf token in cookie and compare it against what I have in cache. I generate new csrf tokens every ...
0
votes
1answer
33 views

RHEL 6: PHP 5.3.3 - Is it inherently insecure?

I am talking about the PHP 5.3.3 package that is available in the Red Hat Enterprise Linux repository, running on Apache. From what I can see, as of RHEL 6, it is the latest version (no updates ...
-1
votes
0answers
18 views

Is there a GPG-compatible tool that downloads all the keys that have signed some of my downloaded keys? [on hold]

I just had my first key signing party with just some friends from a much bigger group of loose friends. So I signed a few keys within the big group, but it is safe to assume that a lot of people in ...
0
votes
0answers
13 views

If you have option to choose between static code analysis vs dynamic code analysis which one would you pick and why? [duplicate]

If you were in charge of web application security and needed vulnerability scanner and had option between static code or dynamic code analysis which one would you prefer? (Of course, I realize, having ...
0
votes
1answer
13 views

Context-dependent attacker

In the context of the following statement what is meant by context-dependent attacker? The MySQL Client contains an overflow condition in client/mysql.cc. The issue is triggered as user-supplied ...
2
votes
0answers
39 views

Is it secure to derive an AES key from a MAC?

I'm working on a project where we need to encrypt a large number of files and store them on the cloud. And I'm wondering if the following process would be secure. Since the volume of the files is too ...
0
votes
0answers
5 views

Problems implementing Authority Information Access in a certificate

I am implementing SSL certificates for internal use in an application. Due to the nature of this app, I'm basically implementing my own CA. I have created a self-signed cert for the CA to issue ...
0
votes
1answer
98 views

Hackers attack against wp-config.php

my wordpress site suddenly be hacked via wp-config.php. I have never known this type of attack. When i scan my site, wpscan warn against this errors: How can i protect my site from this attack? ...
4
votes
0answers
41 views

What sensitive information can be leaked in a Vim's swap file?

Often it occurs that when bulk uploading files somewhere, the author forgets that some of the files are being open by Vim and uploads their swap files as well. Can this leak some sensitive ...
0
votes
3answers
76 views

How secure are sentence passwords? [duplicate]

Lately I've been doing the trend of using passwords that are sentences, at least on sites that have a reasonable maximum character length and allow spaces. So for example the most basic variation is ...
0
votes
0answers
8 views

Delay time clicking of contextual menu on the mouse [migrated]

I have such trouble: when i choose a folder/softwares and clicking second right clicker of mouse on the my desktop or elsewhere context window needs time to appear. Why needs it time to appear? what ...
2
votes
2answers
45 views

Should expired compromised certificates be taken care of if the time is always correct?

I am trying to set up a CA for my company, and issuing every employee a digital certificate and a private key. I am worrying about revocation and expiration. In my case, the root certificate of CA is ...
0
votes
2answers
41 views

Create honeypot for remote desktop applications

Due recent breaches that have occurred using weak remote access application passwords. I would like to setup my own honey pot on a windows machine to study their malicious intents. This is pretty easy ...
0
votes
0answers
16 views

Deauth attack without being able to contact the AP

In my home pentest lab I though it would be interesting to try this scenario and see if it works: I have 2 computers and 1 AP, computer A is authenticated to the access point with WPA2 and computer B ...
0
votes
0answers
96 views

New DDos Attack on WordPress website

Recently I saw something new (at least for me) in log file [% tools.ua.random() %] as below: 199.246.2.10 - - [21/Aug/2014:13:25:15 +0545] "POST /wp-login.php HTTP/1.1" 200 2809 ...
2
votes
2answers
22 views

ByPass usb GPO with iphone -and probably other mobile-

So I am running pentest on a device running Win7 and admin user set group policy to disable all mass storage devices and all usb's. I have access to local user without privs. Although my usb stick ...
0
votes
0answers
29 views

What are the leading web application security organisations? [on hold]

I am aware of a number of prominent organisations that are an authority on web application security, for example: OWASP Web Application Security Consortium SANS (as they provide web app sec ...
0
votes
0answers
21 views

Encryption test failed [migrated]

I am facing a problem when attempting to send an encrypted email via Enigmail (Thunderbird) in Ubuntu 14.04. I was following the Email Self-Defense guide https://emailselfdefense.fsf.org/en/ ...
0
votes
1answer
16 views

emailing a direct link to executable file blacklist risk

I hope this is in the right place, don't know where else to ask. I would like to automatically send a download link to people that directly downloads an executable. The executable is a verified and ...
1
vote
1answer
46 views

Why OpenVPN is using both certificates and DH?

I am reading about OPENVPN and I am a little bit confused. In the OPENVPN howto website, there is a step by step setup guide for generating certificates and diffie-hellman (DH) params. However, I cant ...
-1
votes
0answers
19 views

DOM based XSS manual testing

How can firebug be used to inspect DOM of web application and find the vulerable location for DOM xss?
-1
votes
0answers
35 views

What are some good tips/resources/guidelines for a highschooler trying to get into IT? [on hold]

I'm a sophomore in high school, and I want to learn about Information Security. Currently, I am taking AP Computer Science and I am also on a 15-member student team that goes to CyberPatriot, which ...
0
votes
1answer
26 views

What multiplier to use when calculating the average time to crack passwords with a given entropy?

Suppose that we have a process that generates passwords with entropy E. I'd like to compute the average time it would take for a brute-force attack to crack an MD5-hashed instance of such a password. ...
1
vote
1answer
52 views

how to wipe RAM in Windows 7

How can i wipe RAM completeley before or during the shutdown process of Windows 7? I tried several programs and a script but later i noticed that all those options only claim to free unused RAM ...
0
votes
1answer
37 views

Plausible deniability regarding KeepassX files

I recently installed Guest Additions in my Windows 7 Virtual Machine because I could not stand working without widescreen and high resolution. I have read somewhere that this could be a possible ...
-1
votes
1answer
34 views

Which hardening methods are used in large linux desktops environments (i.e. Goobuntu)? [on hold]

Im courious to know about how these large enterprises secure their linux desktop as Google does with ubuntu LTS. I am the only user at home with linux on the desktop and had already created some ...
0
votes
0answers
10 views

Add third party exploit to metasploit under kali linux 1.0.6

I want to add custom exploits in metasploit running inside kali linux system version 1.0.6. I start using this methode : cd /root/.msf4 cd modules mkdir -p exploits/windows/browser mv ...
1
vote
2answers
59 views

Are digital signature algorithms subject to the same types of attack as public-key encryption algorithms?

I understand that digital signatures are usually implemented by encrypting a message digest with a private key, decrypting the resulting signature with a public key, and verifying that the message ...
0
votes
0answers
12 views

KDBG usage in volatility

I am using volatility recently and I noticed that it uses kdbgscan command, that is about kernel debugger block. Can someone explain in plain words what is it and why are we using it?
0
votes
2answers
59 views

Printer SSL certificates [on hold]

Is a printer SSL cert really necessary if you just print? I don't use https for any administration; just http. I got a vulnerability saying that my cert was out of date.
0
votes
1answer
41 views

Trying to get control of spam? [on hold]

Hopefully this question is deemed acceptable for this area of stackexchange. if not let me know what other site to use. Anyways i'm seeking advice on how you try to eliminate spam in your daily ...
1
vote
2answers
47 views

Open Source Security Dashboard? [on hold]

I'm looking for an open source security dashboard that gives a basic overview of security warnings. Google has pointed me in a few directions but nothing promising. I need something to deal w/ selinux ...
-1
votes
1answer
60 views

Can HMAC leak the password? [duplicate]

Imaging the following pseudo-code: h = hash(sha512) h.input(password) h.input(message) send h, message to client If the user has the hash and the message, and the only missing variable is the ...
1
vote
2answers
45 views

History of drive-by exploits [on hold]

I am interested in drive-by download attacks. For the moment, the oldest article I found on internet treating about it is this one. Does someone know when first the expression drive-by download ...
0
votes
2answers
51 views

Encrypting using the private key in Identity-Based Cryptography

In normal asymmetric crpyto like RSA, if Alice encrypts something using her private key, Bob can decrypt it using Alice's public key. Is the same possible in Identity-Based Cryptography, where the ...
0
votes
1answer
35 views

Sandbox environment for “php malware” analysis [on hold]

I would like to know how can I analyse an obfuscated malware php code ? I heard about cuckoo sandbox, but it seems too overwhelming for this particular task. So I decided to run a Vagrant box, install ...
13
votes
5answers
1k views

How to protect source code locally when traveling with it [duplicate]

I will be traveling abroad for several weeks on a business trip as a consultant. I will carry a laptop with an IDE and all the necessary source code so I can make changes on site (which is the ...
1
vote
0answers
31 views

Squid proxy and VPN software

I have some questions about squid proxies, in my office , IT guys set a squid proxy server to block certain web sites for users. and some users only can access one website that related to our work. ...
1
vote
2answers
117 views

So, how dead is antivirus exactly? [on hold]

Symantec recently made a loud statement that antivirus is dead (http://online.wsj.com/news/article_email/SB10001424052702303417104579542140235850578-lMyQjAxMTA0MDAwNTEwNDUyWj ) and that they don’t ...
0
votes
2answers
38 views

ECDSA ciphers and forward secrecy question about key exchange

I have heard that with forward secrecy that the ECDSA ciphers generate different keys for "each session" because they are not dependent on the private key of the server. My question is how is "each ...
0
votes
1answer
65 views

How to delete YouTube zombie cookies

Some days ago I noticed that YouTube knows the videos I watched even though I deleted my cookies. I also was not using a YouTube-account. When I noticed I used IE 11. After some research I found out ...
0
votes
0answers
27 views

Is threr any artifacts for filesystem forensics in memory?

I have a memory dump I know it is infected by a rootkit use its own filesystem installed at the end of the disk, is there ny artifacts in dmp file to show this? thanks
2
votes
2answers
163 views

It is possible to decrypt HTTPS traffic when a man in the middle proxy is already in place?

I have the following question regarding the decryption of SSL traffic. The topology that I have in mind is like this: User-------MitM Proxy--------WebServer In the environment described earlier there ...
-1
votes
3answers
74 views

Sample test cases for all owasp top 10 vulnerabilities

I am looking for sample test cases for all 10 vulnerabilities to exploit those scenarios. I would highly appreciate if any one share or share the link for test cases for a web application with all 10 ...
0
votes
0answers
10 views

security issues with OOXML of POI

I read the announcement today related to security issues with OOXML. These issues are fixed as part of 3.10.1 version (issue : CVE-2014-3574 and CVE-2014-3529). However it does not list which all ...

15 30 50 per page