0
votes
0answers
2 views

Jradius Client : Invalid or unexpected EAP payload received

I am trying to integrate with jradius client to communicate with Cisco ISE server for EAP-TLS authentication. I ran a sample test and below is the issue I am seeing in ISE logs: "TLS packet parsing ...
0
votes
2answers
12 views

One Time Password via Text Message: Possible exploits?

Is there a credible scenario in which the OTP (One Time Password) for online credit card transactions ( specifically for Verified by Visa) can be bypassed? Context: A guy I know was cheated via the ...
0
votes
1answer
9 views

AES CCMP SECURITY ENGINE [on hold]

256 bit AES encryption with HMAC/SHA-256 does this do only encryption or decryption also and whether aes-ccmp protocol is more advantageous than this or not ?? which is more prefered in security ...
-2
votes
0answers
8 views

Detecting kernel process?

How to detect the process running in the kernel of windows ? is any API is there to see the process. i don't have any idea to check.this is to check weather any illegal process is running inside the ...
0
votes
0answers
4 views

Mobile Monitoring [on hold]

Concerning monitoring the mobile device regardless to the reason behind this monitoring. What are the methods of Mobile monitoring including all installed application such as WhatsApp, Hangouts etc? ...
0
votes
0answers
16 views

KeePassX and Dropbox [duplicate]

I am currently using KeePassX on Linux to allow me to have a different strong password for each website. With this program there comes two major inconveniences: I lose access to everything in the case ...
0
votes
3answers
25 views

Sending an encrypted PGP email to someone who doesn't yet have my public key

Suppose I have the public key of a recipient I'd like to send an email to, and I've never sent this person an email before. Does it make sense to encrypt my first email to this recipient and also ...
0
votes
3answers
20 views

Clarifying self-signed certificates vs root certificate authority

I hope someone can help me understand some fundamentals on SSL certificates that I've had trouble picking up from docs, Wikipedia, and just about everywhere else on the internet. I'm working on an ...
0
votes
0answers
2 views

Prevent children of process protected by seccomp from having same seccomp protections? [migrated]

I'm writing an application which is protected by seccomp. This application uses fork() and then execvp() to run certain programs. It seems as though any child process of my program will be constrained ...
0
votes
2answers
34 views

How to make undetectable malware

Fred Cohen in 1986 has proved in his Ph.D. thesis the undecidability of viral detection (no perfect virus checker can ever exist). My question is : Is it possible for a malware to stay very long time ...
0
votes
1answer
18 views

Does a browser have to make multiple requests to verify an SSL certificate chain?

I've learned that SSL certificates can be chained, and the browser will use the issuer's public key to verify the issuer's signature. I have read this article, which has a very helpful diagram, but it ...
0
votes
2answers
19 views

Do all non-CA certs have to be End Entity certs?

Still learning the differences between certs. Can someone explain? The internet has so far been surprising not lucid in describing certificates. *EDIT to clarify EE
0
votes
1answer
17 views

Infection through Virtual machine in NAT mode

I have a VM box configured using NAT to my host OS. It seems I can ping to the machines in my LAN. If my VM box got infected somehow my malware while surfing, would the malware be able to infect ...
1
vote
0answers
36 views

Disable webcam in Firefox [migrated]

Firefox has introduced a new "feature" called Hello, which accesses your webcam and microphone to allow you to start "conversations" with friends. For obvious reasons, I find it quite disconcerting ...
0
votes
2answers
27 views

Does preventing buffer overflow attacks prevent ROP attacks?

Would preventing buffer overflow attacks prevent Return Oriented Programming (ROP) attacks?
1
vote
0answers
15 views

CCM instead of key wrap

Is there any instance of NIST or other encryption standards using AES-CCM to encrypt/authenticate key data? I would like to use CCM over a keywrap function, but cannot find any precedent for this in ...
-3
votes
0answers
21 views

using a php hash function [duplicate]

I am a student majoring in IES specialization. Currently I have a project where I want to encrypt important information using php and I want the best hash function for storing passwords.
5
votes
0answers
16 views

I want trusted SMIME certificates for 3rd parties. Is this a reasonable configuration?

I want to send out SMIME certificates with my emails, and want to deploy the following PKI Root01 (All EKU, All Constrants, No Restrictions) PolicyInt01 (Internal applications, not trusted by 3rd ...
-1
votes
1answer
31 views

Android Device Manager lockout [on hold]

I have been HACKED!!! Someone logged into my Android Device Manager and locked me out of my own phone. Not only did they lock me out, they also wiped my phone and changed my Google, Dropbox, Lookout, ...
8
votes
1answer
366 views

“Secure” third-party inbox

My business sometimes receives emails from our clients that are sent through a "secure" third-party inbox. The client send the message through this third-party service. The third party creates an ...
-6
votes
0answers
43 views

is linux NSA-free? [on hold]

Does Linux have backdoors for 3-letter agency? or 3-letter agencys have to hack to access a computer running linux? I asked it, beacuse i believe close-source programs etc. windows, osx has nsa ...
1
vote
1answer
73 views

Weird visitor from Samara ----forum.topic5982…908.darodar.com? [on hold]

I have seen this question asked about a user from Samara,Russia, and when I sifted through all the other occurances,everything everyone else is experiencing matched my experience, except for one ...
1
vote
0answers
22 views

IIS | Block execution of files in directory

I am dealing with user uploads via a PHP application. I want to secure the server so no exploits are available to the user, such as uploading a php shell and executing it. I have set it so all ...
1
vote
1answer
58 views

Limiting Login Attempts

I have to set up a server that will allow remote logins. Obviously security is an issue. In this first pass we are discussing:- Locking a person for 15 minutes if they fail to login correctly three ...
1
vote
0answers
28 views

Spring-MVC : Encryption/Decryption with user password [migrated]

I am working on a Spring-MVC application which uses Hibernate as the ORM and PostgreSQL as the database, in which I am looking for on-the-fly encryption decryption solution, but only for 2 columns in ...
2
votes
1answer
35 views

Kerberos replay attack

Suppose I want to send a command to a print server on a netwerk that has been secured with Kerberos. To do so, I authenticate myself to the KDC and get a TGT, and then another ticket from the TGS for ...
2
votes
2answers
41 views

Account-lock security policy (username/password)

I am currently working on an application with regard to applying a security policy to the application. We are locking the account after X failed login attempts in Y minute. The account will be locked ...
1
vote
1answer
17 views

How to know an Apache web server mod_cgi module is enabled?

I am currently working on penetration test of a web site that uses an Apache HTTP server. To test a vulnerability which is related to mod_cgi module, I need to know whether this web site uses mod_cgi ...
1
vote
1answer
61 views

Preventing XXE Injection

I've stumbled upon an exploit method which I haven't really had time to investigate before. XML eXternal Entity is said to be susceptible of a server-side type of injection. I can specify a Document ...
1
vote
1answer
38 views

Tamper with post data before it is sent

I am currently doing some pentesting for my work (not my job role but i always wanted to learn). I am trying to modify post and get data as it is sent (intercept, tamper), the web app I am trying to ...
1
vote
1answer
66 views

How to detect when your RAM is being copied or scanned by a hypervisor

I am working in a Virtual Machine (Ubuntu LTS 14) that is on a ESXi server on a remote machine. I am not the only one who has access to the ESXi and other people can take memory snapshots of my ...
-1
votes
0answers
24 views

Security risks in Crowdsourced Software Development [on hold]

What are the main security risks while implementing software development using crowdsourcing ?
-1
votes
0answers
14 views

Average Packet drop in Wireless sensor network? [on hold]

what is the average packet drop value in the wireless sensor network? Please let me know
0
votes
0answers
13 views

Usefulness of checking MS-CHAP-Challenge by TTLS Server

I've spotted what may be a "missed opportunity" in the EAP-TTLS specification for "Challenge"-based authentication protocols (for instance MS-CHAP-V2). The client initiates MS-CHAP-V2 by tunneling ...
0
votes
0answers
9 views

Websphere Message Queue pen-testing

I am responsible for pen-testing client-server Message Queue system. I have access to MQ Websphere client and MQ Websphere server machines. I want to have a document which shows security test cases ...
0
votes
0answers
12 views

Using a website as a middleman for Oauth

I am working with a customer that has started to look at an unusual solution for Oauth. They have a mobile application that they want to authenticate using Oauth. To do this they are setting up a ...
0
votes
0answers
23 views

why tor nodes maintain tls keys with all other tor nodes?

I read that tor proxy maintains session key with tor nodes and use it while encrypting data but why tor nodes maintain keys with other tor nodes?
1
vote
2answers
54 views

Using free subdomains to circumvent web filtering systems

(I was told that this was the place to ask this by someone from Webmasters, if I've got it wrong again please give me a chance!) I'm running a personal proxy service for the use of myself and some of ...
-2
votes
0answers
14 views

How to host email server From Windows server 2012 [on hold]

Hello I want to add unlimited email id with my domain.com and This to be done from my home server which is running on windows server 2012 Is it Possible to run email server from home or give some ...
0
votes
0answers
14 views

Did anyone encounter a problem with ssl certificate from network solutions on mobile device? [migrated]

We have a mobile app that calls Web Service on our server. We are planning to setup ssl on the server and going to buy a wildcard certificate from network solutions. Wildcard certificate from Network ...
0
votes
1answer
69 views

Secure way to encrypt (not hash) passwords?

I'm building a system that for reasons I'll outline below, can't used hashed passwords, but I'd still like to encrypt them so that it's as hard as possible to crack them, in the (unlikely) event the ...
1
vote
1answer
79 views

Completely getting rid of SSLv3 on Apache

Our security team is asking that we completely disable SSLv3 on some of our servers running Apache. I've used the SSLProtocol entry in the ssl.conf file (like SSLProtocol ALL -SSLv2 -SSLv3) and ...
0
votes
0answers
23 views

Windows 2000 System Profile [migrated]

I have found a computer (W2000 operating system) with a System Profile under Document and Settings Folder. As far I know this user doesn´t log in the computer. In a new W2000 PC this system profile ...
3
votes
0answers
12 views

Open source tools to run generic audit of user entitlements? [on hold]

Over the past years, my team has been asked to conduct audits/reviews for other teams. Most of these audits have been compliance-driven and almost all of them have followed the same format: some group ...
1
vote
1answer
54 views

What are the traces of a mysql attack on a server when the attacker has full permissions?

I just turned my server off yesterday, after it began to distribute comment spam across the internet, at an astounding rate over 70 "spams"/min, bottom of the line 1/2 gig ram VPS. I'm still trying to ...
1
vote
0answers
34 views

Can we send and receive uTorrent packets through TOR? [migrated]

I just started using pcapy python module to capture network packets. Is it possible to capture packets going out from uTorrent (on my own machine) with pcapy or scapy and sending them over the TOR ...
3
votes
4answers
369 views

Mitigate resend confimartion email flooding

While writing server code for resend confirmation page something came to my mind: an attacker could make several requests to /resendemail?user=blah (example URL) and flood such user with registration ...
-4
votes
1answer
44 views

is it that easy to listen a phone? [on hold]

In movies, police or government or secret services, they can easily listen a phone, and locate it. i read a lot of things about it, and i need ask it here. 1) listening a phone, is it easy for ...
-2
votes
0answers
33 views

Torrent Blocking [on hold]

I'm a student at a university, and recently the system admin has installed a proxy server.By doing do, he has blocked nearly all ports (for security). Torrenting is not against the university ...
-4
votes
0answers
33 views

Slash Cipher??? Decrypt message of slashes? [on hold]

So in a CTF from a year ago that I'm doing for practice right now, I'm given this text file of just slashes and backslashes and I'm told to figure out what this message means...How do I decrypt this ...

15 30 50 per page