0
votes
0answers
3 views

Is it bad to put a certificate as CA in Firefox?

I know I can add a self-signed certificate from a website to Firefox, but only in the CA list of it. Question: does this mean I have to ultimately trust that self-signed certificate? Can someone ...
0
votes
0answers
3 views

Is it safe to use localstorage to store session variables and user password?

I'm trying to make a web application in Java with a login/session system using com.sun.net.httpserver and as far I know, it does not have an inbuilt method to this. So, I had the following idea: 1 - ...
0
votes
1answer
5 views

Why an attacker would use a trojan over a spyware?

I'm trying to figure out some possible attack scenarios for a project I'm conducting. I've read plenty of material about malware and, in particular, spyware and trojans. While it's hard to find unique ...
0
votes
1answer
15 views

Sql injection is not working on my site?

I have set up a page and database so i can practise SQL injection. Ive tried some examples and it doesnt seem to work. It seems to add the username and password to that database, even though i input ...
0
votes
1answer
15 views

Hidding ip address in a peer to peer connection

I'm curious is it possible to hide the ip address in a peer to peer connection. Mainly considering you have 2 computer connected remotly in a browser session. I would like to know if it's possible to ...
0
votes
6answers
49 views

How can I allow only authorized browsers to access a website?

I have a website and I want it to be accessible only by authorized clients/browsers (ex. with a certficate). The idea is that the users can only access the webpage in their office's computers ...
0
votes
2answers
14 views

openssl aes 256 cbc strange bug

This is extremely strange but I have already tried this twice and am completely sure it is openSSL and not me doing the bug. I am encrypting the data 'Hygiene' with the password '*' (sorry can't tell ...
0
votes
2answers
15 views

Is there any mail service accepting real id?

Most webmail services like gmail, facebook, yahoo,.. allow anonymous to create a mail address. If there is a security breach, user may lost important information on that address. They may add phone ...
0
votes
0answers
5 views

Client-server authentication protocol suggestion

I'm designing an authentication methods for my client/server system consisting of: a windows desktop client application (.NET) windows/linux servers (C++) one "security server" which authorizes the ...
1
vote
2answers
20 views

Risks associated with compiling open source projects

After reading this question about if it's safer to download and compile the source for an open source project or download and run the installer, I thought of another possible vulnerability: is it ...
0
votes
1answer
20 views

DHCP Exhaustion

I am trying to look for another tool to perform DHCP Exhaustion, I currently use metasploit, but I want to see what other open source are out there. Please let me know if you use something else.
7
votes
4answers
236 views

What needs to happen for email encryption to go mainstream?

PGP has been around for almost 20 years, but email encryption is not used by most 'regular people'. At the moment, with Snowden's NSA revelations (which should not be a huge surprise to anyone), the ...
1
vote
1answer
39 views

Is it secure to have two password managers?

For various reasons I use both Keepass 2 and Lastpass. They have 90% the same password database. Is it secure to be using and maintaining both of them? Is it secure if they both use the same password ...
0
votes
0answers
21 views

Content-Security-Policy & Facebook login

This question seems to be related to http://stackoverflow.com/questions/15913200/facebook-js-sdk-not-executed-in-my-chrome-extension , but I am not developing a chrome extension. I am developing a ...
-2
votes
1answer
61 views

How do I hack this login page by using SQL injection?

I'm testing a client's web site vulnerability to SQL injection, which appears to be the case. The web site is hosted in IIS on a Windows server and is using Microsoft's .NET framework with SQL. I'm ...
0
votes
1answer
38 views

How do password suites store and encrypt their metadata and prevent attacks based on that knowledge?

If someone uses a password manager and tries to organize the credentials well, doesn't that make attacks easier? Let's assume an attacker has the encrypted credentials available for offline attacks, ...
0
votes
3answers
48 views

Are backups really secure?

In many places a common practice is to connect in a backup drive at the end of the day and let the computer do an automatic backup in case of an emergency. I have been doing that for the past 2 years ...
1
vote
1answer
22 views

How do two Tor relays communicate with one another?

Nodes don't know each other's IP address right? So how do they manage to address one another when it comes to sending data?
0
votes
1answer
29 views

Is a properly configured server secure against unauthorized data access?

Take for example a game. Typically, when you buy or download a game that can be played offline, all of the data required to run the game is shipped with the executable. In order to protect these ...
3
votes
2answers
39 views

How can you detect an insecure, non-random token?

I know that some of PHP's random functions are insecure due to them not being completely random and are considered a bad practice. My question is how an attacker go about finding that the developer ...
0
votes
0answers
31 views

OpenSSL Code Review

Is there to be a review in the code of OpenSSL any time in the near future? It seems OpenBSD is doing a controversial one, in that the review is also "Ripping out some windows-specific cruft". But is ...
1
vote
1answer
36 views

How does the NSA restrict public access to cryptography?

In Bruce Schneier's book Applied Cryptography (1994?) he writes The NSA uses its power to restrict the public availability of cryptography, so as to prevent national enemies from employing ...
-2
votes
0answers
24 views

Exploiting CVE-2013-6282 vulnerability

On October 25, 2013, a Linux kernel bug CVE-2013-6282 was published. It was largely exploited around that time to get root access on existing Android devices. After reading tons of user review, I also ...
2
votes
0answers
18 views

Is there a way to get msfpayload to generate a regular cmd.exe reverse tcp shell? [on hold]

It looks like msfpayload now generates a powershell-based payload when you pass it windows/reverse_tcp_shell. Is there a way to generate a regular cmd.exe reverse shell instead? Thanks!
5
votes
1answer
55 views

What security mechanisms are used in BGP and why do they fail?

I just read about Indosat trying to take over the Internet by mistake. I read on a Polish infosec-related website that most of their announced routes failed to propagate, but some of them reach the ...
3
votes
2answers
60 views

TrueCrypt vs “native” whole-disk encryption on Linux?

When preparing to encrypt an entire partition, is it better to rely on "native" whole-disk encryption (eg following this tutorial), or an external tool like TrueCrypt? The wikipedia article comparing ...
2
votes
2answers
84 views

What prevents me from using ARP poisoning to force a client to use HTTP?

So I was just thinking about how ARP poisoning can be used to intercept a clients request, forge an SSL cert, and send it back, with the caveat of not meeting certificate validation, but what if I ...
17
votes
1answer
712 views

Does TCP/IP protocol offer a reliable way of determining who the actual sender was?

So I'm just poking around the TCP/IP protocol using a Ruby library called PacketFu, and it seems to me that in each packet, it is possible to set all of the following Source IP Destination IP Source ...
1
vote
1answer
70 views

Confused about the most relevant way to secure my APIs

I own a Javascript application (Single Page Application) hitting some apis from my own RESTful backend. What I expect for my authentication/(authorization) mechanism is three things: Preventing ...
1
vote
1answer
40 views

Any known protocol for establishing trust between an inherently untrustworthy source and a server without a 3rd party?

Is there any kind of protocol, scheme, or theoretical paper out there that implements or examines the problem of establishing trust between two parties (communicating, listening) where the ...
2
votes
1answer
30 views

How to sign data with OpenSSL 0.9.8?

I am building a license generator for nodejs and I am currently testing on Heroku. On my local machine running OpenSSL 1.0.1g, I'm able to test my key pairs (sign and verify) like this: # data.txt's ...
10
votes
5answers
2k views

How many Stack Exchange logins should I have?

On Stack Exchange's Add a login page, one can add logins with Google, Facebook, Yahoo, etc. How many logins should I have to provide the least chance of a hacker gaining access to my Stack Exchange ...
0
votes
0answers
29 views

Suggestion for developing project that is related to android [on hold]

I want to contribute open source projects for improve my skills. There's not many android open source projects that is related to security. I developed some project but I have no experience with open ...
1
vote
1answer
33 views

Simple protection against reflected XSS

I was going through some CLIENT side defenses against reflected XSS e.g. XSS auditor(chrome), IE8 XSS Filters, Noscript. They use regular expression and other sophisticated techniques. My question ...
1
vote
1answer
35 views

PCI Compliance relating to 'other' passwords

I see PCI compliance related only to password security, as far as storage and transmission goes, for user names and email accounts. How does this relate to passwords for programs that run on a PCI ...
1
vote
1answer
43 views

-bash: -sudo: command not found [on hold]

Some dependencies were missing when I installed THC Hydra. I found this site which directs me to install the missing package: sudo apt-get install libsvn-dev libapr1-dev libaprutil1-dev But when I ...
17
votes
7answers
2k views

What makes it illegal to use the information learned by exploiting a bug?

According to news reports, arrests have already been made in relation to the Heartbleed bug. It sounds like this person managed to gain access to the website's database by capturing the credentials ...
2
votes
1answer
46 views

Risk analysis Information Security Checklist

I wouldn't bother asking this question if it was easy to find. In the past I've used a risk-analysis-checklist which was split up in serveral factors. For example, there are Human factors, Hardware ...
1
vote
1answer
24 views

X509Certificate - How to set validation Policies?

I have an X509Certificate (say Certificate-A) for signing purpose. While validating this certificate, I have to check its path with Intermediate & Root certificate which I have implemented fully. ...
1
vote
2answers
66 views

How to build a secure affiliate network

I'm going to build a demo affiliate network, which needs to be secured. Let say I have a web application called Affiliate Network Manager that manages all affiliates associated with my online book ...
1
vote
1answer
50 views

Cracking encrypted SQB databases

I've recovered a .SQB SQL database backup file from a backup server and do not have the password. As I do not have the password available to me, I'm looking to determine what type of encryption is ...
2
votes
1answer
50 views

Unsafe sanitization? Is this code SQLi vulnerable?

Function RemoveSuspeitos(ByVal strTXT) Dim txtAux As String txtAux = strTXT txtAux = Replace(txtAux, chr(34), "") txtAux = Replace(txtAux, ...
0
votes
0answers
18 views

Does DNSSEC provide signed statements that a certain domain does NOT yet support DNSSEC? If not, why not?

In my security class with David Wagner, we talked about some of the reasons why DNSSEC is not widely adopted right now. One of the reasons was that for backward compatibility reasons, clients need to ...
-1
votes
1answer
71 views

can you get someone's ip address using skype?

Like if you're chatting with them via skype, how can you get their ip address? do you need some kind of program or is there a simple, obvious way? is it illegal?
-2
votes
0answers
51 views

okcupid hackable with Hydra? [on hold]

Is it possible to hack an okcupid account using THC Hydra, Brutus, or Cain and Abel? *I'm not asking for anything illegal, just asking if it's possible using one of those tools
2
votes
2answers
67 views

What can my university see if they have my MAC address?

when i first got to my university i had to provide my MAC address to get access to the internet. What i want to know is what information can they get from having my MAC address linked to my name. i ...
1
vote
1answer
36 views

How do you identify a website's form-type?

How do you know which attack method to use when using software like thc hydra, brutus, etc? e.g. http-get, https-get, http-form-get, http-form-post, etc? For example, for sites like Yahoo, Gmail, and ...
0
votes
1answer
102 views

Nmap SSL service detection: How to check all open ports only for SSL service?

I am running nmap to probe services that use SSL.¹ In order to detect vulnerability in non-standard ports, I am using the -sV option to perform service discovery. But it is very slow since it runs ...
0
votes
0answers
17 views

error in net excess [on hold]

Incorrect certificate for host. The server presented a certificate that doesn't match built-in expectations. These expectations are included for certain, high-security websites in order to protect ...
2
votes
4answers
118 views

Why does MD5 hash starts from $1$ and SHA-512 from $6$? Isn't it weakness in itself? [duplicate]

I have moved this question from stackoverflow to this place. I know it may be a question about 'opinion' but I am not looking for a private opinion but a source of the final decision to keep it this ...

15 30 50 per page