-1
votes
1answer
23 views

Oracle Sql Injection Reverse Shell

I am testing for SQL Injection on a website that uses ASP code. I can successfully get all the databases and tables. Current user has DBA privileges. I wonder how can I get a reverse shell by using ...
1
vote
1answer
20 views

Sign certificate for localhost

I'm using HTTPS Node.js server on my localhost, and every restart (PC), when I go to 'https://localhost' I get the certificate message (Chrome). I want to ask how to install the certificate?
1
vote
2answers
22 views

TLS domain name mismatch

Suppose I want to talk to example.com over TLS the and server I am redirected to is foo.com. But during the handshake it can prove it holds the private key that matches example.com certificate. Why ...
-3
votes
2answers
35 views

How does SSL work? Simpler Explanation?

I'd like to explain my understanding first then ask a question. This question is meant as a simpler overview of other question..and talks about implication and not process as much. My understanding ...
0
votes
0answers
17 views

What's the difference between 127.0.0.1 and 0.0.0.0? [migrated]

I understand that 127.0.0.1 points to localhost, and so does 0.0.0.0 (correct me if I'm wrong). So, what's the difference between 127.0.0.1 and 0.0.0.0?
1
vote
1answer
30 views

Are there any ways to defraud a fundraising site?

I have developed a many e-commerce stores for clients over the years; almost all of them selling physical products. Recently, one client in particular was repeatedly getting hit with fraudulent ...
2
votes
0answers
12 views

How to generate keystore for root signed certificate?

I need to create keystore and truststore with root signed certificates. I have these files (at this step they are identical for client and for server): client_cert.pem client_prv_key.pem ...
1
vote
1answer
23 views

What kind of attacks can target static resources?

Static resources and their caching interests me from the security perspective. Let's say we have an .jpg file requisted from the origin -> going through a reverse proxy with caching -> reaching the ...
8
votes
3answers
483 views

Is HTML5 vibrate feature a security vulnerability?

While surfing a news website on my mobile, I receive a virus infection alert warning that triggers my phone to vibrate incessantly. The alert looks like the following: I didn't expect my phone to ...
1
vote
0answers
32 views

Token based approach to authentication over SSL Rest API - refresh tokens

I'm quite a newbie at security. I'm developing an android app with a token based approach to authentication. I'm not using Oauth as the OAuth 2.0 is not an authentication protocol but rather used to ...
0
votes
2answers
41 views

which hash algorithm takes longer time if we compare between md5 or sha256?

Which hash algorithm takes longer time to compute if we compare between md5 and sha256? I do not want to use it for security reasons so I do not care about which one is more secure, I just want to ...
6
votes
4answers
268 views

How can I handle open ports?

After port scanning my company's network, I found a lot of open ports. What are the risks that will result out of these ports, if I left them open? And is there any way to handle them without ...
-2
votes
1answer
39 views

How to identify this hash?

I have one hash, I know its value, but not its type. Here is it: 6dfb036bf703d75f9bc8219ba1224d876783fa61 I tried something like php -r "echo sha1('abc');", but it gave me another value, so this ...
3
votes
3answers
141 views

Website knows that I'm connected via OpenVPN

When I'm connected to a OpenVPN server and visit http://ip-api.com/ I get this: OpenVPN UDP bs128 SHA256 Can somebody explain to me how this is possible and how can I stop this information leak?
-2
votes
0answers
22 views

debugging zeus botnet in visual studio 2010 [on hold]

I am a newbie in the area of botnet detection,IDS.I want to understand the control flow of zeus botnet by running it in Visual studio. I am successfully able to build zeus in visual studio,however ...
1
vote
0answers
28 views

Encrypting data before sending to SaaS tool and decrypting on browser view

I'd like to send data to a SaaS tool, where the data is stored in the cloud. I'll use Google Analytics as an example, but it applies to any similar service. Google Analytics does not allow you to ...
4
votes
1answer
34 views

Storing personal information in cookies

I'm trying to do a simple display integration between two websites. One on: domain.com and another on: subdomain.domain.com All I want to do is show a "Hello John, Return to Client Area" ...
2
votes
1answer
38 views

SSL certificate trust chain shows root certificate with 1024-bit public key - Is this evidence of a MITM attack?

My account at my domain name registrar was hacked and I am trying to understand how the hackers were able to steal my login credentials. Because the root certificate in the trust chain for the ssl ...
1
vote
0answers
33 views

building Hydra login router web page input

I am still trying to hack into my router. I am attaching my Hydra and page elements. I realized that sometimes when I type a password the password name numbers change, for example password_1338101351 ...
2
votes
2answers
23 views

Securing microsoft access database

Let's say I have a website which is written in ASP and I keep my .mdb database in a random directory like /asd8asd/dkdgk32/asdmv/askdasd/kasldk.mdb Can an attacker find database's location without ...
1
vote
2answers
37 views

2 External IPs to prevent DDoS?

In my home network I currently have a Hitron cgnm-2250 acting as a modem/router combo with an IP Passthrough option enabled for a 2nd router connected to it (ddwrt nighthawk x6 r8000). I already have ...
7
votes
2answers
404 views

Privacy of my company's guest Wi-Fi

I use my company's guest Wi-Fi along with another maybe 1500 other people across our site. On my breaks I access some random chat servers. Can my company see and hear my conversation?
1
vote
0answers
18 views

How to prevent swapping on Mac osx? [migrated]

I am inclined to run Tails through a virtual machine so that I could chain two VPNs. One running through the host Mac osx and one more running from inside the virtual machine that's running Tails. ...
18
votes
2answers
502 views

Is it unsafe to keep multiple versions of a KeePass database?

I keep my KeePass .kdb database in a remote location, and I never overwrite the old versions, I just append the date to the new version which I'm uploading. So it looks like this: db.kdb_2015-01-01 ...
1
vote
1answer
22 views

Use of server and root certificate in ssl termination and inspection

I'm researching vendors which allow SSL termination and inspection, I came across Cisco CWSA technology, the technology was somewhat easy to understand the stuff which really boggled my mind was the ...
6
votes
2answers
309 views

Is allowing unfiltered curl request from a website a vulnerability?

Recently I was on a website which provided some non-sense feature: Enter a URL Press enter HTML source of a given URL is displayed It basically fetched a URL and just dumped the contents of it. ...
0
votes
0answers
13 views

Java CertificateVerifier as a generic module

Where can I get a CertificateVerifier like the one here as a generic versioning module (jar, preferable as maven dependency). I dont't want to copy and past the java class files.
0
votes
0answers
13 views

kb3072000 security Update for windows server 2008 R2

I'm trying to apply this security patch to resolve Microsoft Windows Hyper-V Remote Code Execution in microsoft windows 2008 R2. so according to download page I downloaded Security Update for Windows ...
2
votes
0answers
17 views

Are there any type safe languages with deterministic compilers?

This article about BIND9 concludes with the statement: The point I'm trying to make here is that BIND9 should not be exposed to the public. It has code problems that should be unacceptable in ...
1
vote
2answers
75 views

Opened Ports on a Router attack vectors

I have read somewhere that it could be dangerous to use unknown networks because the router owner could open ports and attack programs that would run on the victim's system on precisely those ports. ...
3
votes
0answers
36 views

How safe are data you dial to a call center?

Sometimes when you call an administrative service it tells you "Dial 1 to access such service. Dial 2 to access some other service. Otherwise, dial 3." No harm if somebody comes to learn I chose "2". ...
2
votes
2answers
30 views

Meaning of many failed login into my website

I installed Sucuri Security plugin on my wordpress site, and it reported me that my website has 10 failed login attempts by my registered username with from last night until now. My website hasn`t ...
0
votes
1answer
48 views

Block Ciphers Terminology?

I have been looking at block ciphers, and I found this: Do the little circles with the plus symbols mean XOR? And how are the plaintext blocks split, and ciphertext blocks combined? Also, how can ...
4
votes
1answer
34 views

Is SEC P-384 and P-521 broken in Windows 10?

EDIT: Supporting code, output and certificates are at https://github.com/sidshetye/win10secp384Issue. Just noticed that ECDiffieHellmanCng.DeriveKeyMaterial(...) behaves differently on Windows 8.1 ...
4
votes
3answers
63 views

No SMS Spoofing attack vector in Kali Linux!

I just realized that there is no SMS spoofing attack vector included in the latest version of Kali Linux. Is there a work around?
0
votes
1answer
92 views

Can this text be figured out?

It seems that as long as a computer is connected to the network, any encryption used by that computer makes it insecure, because the computer can be compromised. I wonder if in this scenario is it ...
1
vote
1answer
45 views

Brute force attack [on hold]

I'm trying to make a simple script (brute force attack) on Joomla to try if it works. #! /usr/bin/python import re #regex import urllib import urllib2 x = ...
2
votes
0answers
19 views

DynDNS alongside Tor?

Is there a way to resolve Dynamic DNS with Tor so that I can connect to my computer behind a NAT even if I am in a country that consider supicious connections to my native country ?
6
votes
3answers
68 views

Stalking and harassment [on hold]

I believe my ex wife is redirecting my Yahoo and Google accounts and somehow has access to anything I do online. How can I know if my suspicions are true? She is director of I.T. of a large company, ...
-4
votes
0answers
9 views

Looking for a good wireless access point incident response scenario for PCI review. Any suggestions? [on hold]

Looking to build a wireless access point scenario to test out our Incident Reponse planning.
0
votes
0answers
37 views

Are there any paper/human strong crypto systems? [migrated]

Are there any paper/human executed crypto systems that have reasonable strength? I am aware of a few candidates so far Solitare from Cryptonomicon https://en.wikipedia.org/wiki/Solitaire_(cipher) ...
-1
votes
0answers
37 views

Do iPhone Chrome & Safari keep refreshing and sending my IP address to websites while in background?

You can put a browser like Safari or Chrome into the background on iOS without closing your tabs. Will they keep refreshing themselves and send out personal details like your IP address? What about ...
-5
votes
1answer
37 views

Opinions on Vpn service [on hold]

I am interested in unspyable.com Vpn service as it does not log any data, offers off shore servers and offer multi log servers. Is there any Vpn service that does everything so anonymously?
1
vote
1answer
14 views

Are X.509 nameConstraints on certificates supported on OS X?

I have the "chain" of certificates on a test machine right now: A self-signed CA cert, in my Keychain and trusted & trusted by Firefox. A CA cert with with the following, X509v3 Name ...
1
vote
4answers
182 views

about CSRF on form submit [duplicate]

I'm surely missing something in the picture of how CSRF attacks and protections are working. My understanding in a form-submit scenery is the protection rely on a unpredictable token, someway is ...
-1
votes
1answer
38 views

Installing Ubuntu with a potentially compromised USB drive

I would like to use an USB Stick that is possibly flashed with the Bad USB firmware as an Ubuntu Live System while having an USB Disk containing a PDF file connected as well. The reason for this is ...
-10
votes
0answers
35 views

Simple question about lists [on hold]

Question When data changes In multiple lists and all lists are not updated, this causes ? Options (1) Data redundancy (2) Information overload (3) Duplicate data (4) Data consistency (5) Data ...
1
vote
1answer
43 views

SSLStrip performs DOS

I was trying SSLstrip on my Windows PC as a target since Internet Explorer seems to be the only browser vulnerable to this attack. I deleted all my browsing history and when the site gets stripped to ...
0
votes
0answers
30 views

Security implications of CA signed SSL cert for local development

Curious to know the security implications and potential risks involved with getting a CA signed cert for localdev.mydomain.com, and issuing it to all the developers who might need to spin up a local ...
2
votes
0answers
41 views

Is it possible to Exploit this Line Feed?

During a security assessment on a website I found a a redirection link that was reflecting the values in the Location header. The first thing that came to my mind was CRLF injection so I tried a few ...

15 30 50 per page