0
votes
0answers
4 views
Identify code being run on website
I do not normally deal with internet security problems but this one has got me interested.
The issue is with a specific site, lets say test.com, and how it it visited.
If the address is typed ...
0
votes
0answers
6 views
Force clients to use proxy
Here's my network configuration:
The proxy server is running Ubuntu with Squid on port 3128 and DansGuardian on port 8080.
I'd like to force all clients to use the proxy server - specifically, ...
-3
votes
1answer
30 views
cant connect to network after spoofing mac [closed]
Just spoofed my mac at my school connected to router got past the fire wall but now I don't have internet access. Can some one help I am using windows 7.
1
vote
3answers
60 views
How to know if two IP addresses point to the same web server?
Doing some testing against two IP address in the scope I find one web server in each one. Both host what it seems the same web application.
They are different IP addresses and there are no explicit ...
-1
votes
0answers
27 views
Certificate usage [closed]
My company wants to have security by using a certificate stored at the client. The certificate will be used by other mobile webapps as well.
What are products which can be used for this situation? Do ...
-1
votes
1answer
42 views
Ways to look for changes on a PC
The other day I got the password for our school's Wifi but even though that's the case, I still can't connect. So I visited the guys at my school's IT department and they said they need to borrow my ...
4
votes
5answers
159 views
How to make a site vulnerable to SQLi?
I've recently taken an interest in SQL injections - it (for some reason, correct me if I'm wrong) seemed like a good place to start (I am pretty much a beginner). Anyways, I want to make a site that I ...
3
votes
2answers
46 views
Secure way to establish PHP database connections
I've read the advice (example: store them in php file in a location inaccessible as a URL) but can't help thinking there must be a better way of storing/accessing database credentials.
Ideally it ...
2
votes
1answer
27 views
Can attacker break out of apparmor jail with the following profile?
Below is an example profile I've created for web apps, in which I've limited files / commands it can access. It includes profiles to nginx, php-fpm and mysql, no commands is allowed, only few ...
-2
votes
3answers
56 views
If a hacker is on the same Wifi Network as I am, what can he do?
Ok so when a hacker has the wifi network's password and gets on the network, he can do things like monitor traffic, catch passwords, even access PCs, etc.
But what I'm interested of knowing is what ...
1
vote
2answers
57 views
Free space shredding
I'm an avid fan of file system forensics but I'm an amateur so far. I've been reading up on NTFS forensics and I've noticed you sometimes can know if a file was on a certain volume even if it was ...
3
votes
2answers
68 views
Is there a dictionary of visibly similar Unicode characters for Spam processing?
I have spam that looks like this:
мy вυddy'ѕ мoм мαĸeѕ $74/нoυr oɴ тнe lαpтop. ѕнe нαѕ вeeɴ lαιd oғғ ғor
ѕeveɴ мoɴтнѕ вυт lαѕт мoɴтн нer pαy cнecĸ wαѕ $19420 jυѕт worĸιɴɢ oɴ
тнe lαpтop ғor α ...
1
vote
2answers
74 views
How to allow only some specific computer systems to access website? [duplicate]
I need a process to allow only certain computer systems access to the website irrespective of the network they are using.
Much like a Licensing system, I can provide a private key or something ...
1
vote
1answer
57 views
Considerations for information exchange agreement between governmental agencies
Question: When drafting an information exchange agreement between governmental agencies what security related sections should be considered for inclusion? Example agreements?
What is the security ...
-1
votes
0answers
25 views
Routable Domain for DC?
What is the impact of having a routable domain name in windows network infrastucture ?
Having example.com in place of exemple.local as domain name have an critical impact ? if yes what should I keep ...
1
vote
0answers
23 views
SSH says Authentication tried for XX with correct key but not from a permitted host
I am using and authorized_hosts file to authorise certain keys. One of those is restricted with the prefix from="1.2.3.4", the others are valid from anywhere.
When accessing from a machine that has ...
1
vote
1answer
47 views
What is the entropy of just 1 Diceware passphrase like my passphrase?
A 5-word Diceware passphrase gives an entropy of 7776^5 = 3E19 = 19 Bans (or ~64 bits). Apparently monster cracking systems can currently guess passphrases for MD5 at a rate of 180 billion/sec (2E11). ...
2
votes
0answers
26 views
Validate XML-DSig by DVCS
Is it possible to validate an XML message (with XML-DSig or XAdES signature) by a Data Validation and Certification Server (RFC 3029)? Should it understand XML signatures or not? Could it parse XML? ...
2
votes
1answer
56 views
What cellular network is used for automobile theft recovery? Can that be used for PCs and mobile devices?
I'm interested in sending a remote wipe command to stolen IT devices, such as a cell phone, or wifi connected device. However most remote wipe technologies require that the cellular service (or wifi) ...
1
vote
0answers
44 views
What parts of Bouncy Castle are affected by patents? [migrated]
Given that Bouncy Castle is an Open Source project, it's entirely possible that the contents contains implementations protected by various patents.
Since it's possible for the patent holder to sue ...
0
votes
1answer
76 views
What are some recommended certifications that do not require industry experience?
I am interested in gaining some certifications through self-study, however many certifications seem to require you to either take an official class or have relevant experience.
For example, CEH seems ...
2
votes
1answer
52 views
What about AD2P vulnerability?
My goal is to create a simple one-way intercom using B Speech TX2 and B Speech RX2, an Audio2Bluetooth and Bluetooth2Audio converter.
My question is, how secure is the audio(in my case voice) being ...
4
votes
2answers
90 views
Is KeePass a good defense against keyloggers?
KeePass is a program in which you can store your password and copy and paste them into websites. Does anyone know if it is safe against key logging software? Does key logging software pick up what you ...
-2
votes
2answers
36 views
Looking for safe, simple way to store passwords with PHP 5.2.17 [duplicate]
I've found many posts on StackOverflow and other sites using Google, but since security is always changing, and what was safe a few months ago not me anymore... I felt the need to ask on here.
...
-5
votes
0answers
24 views
MAC osx strange behaviour [closed]
I have a mac desktop that has worked well for years.
Max osx 10.8 lotsa tols and software installed.
Some how a new window has appeared ![enter image description here][1]What is this??
I do have a ...
0
votes
1answer
45 views
Indexed link is taking to google brazil [closed]
It's happening in FF and Safari - Chrome works fine.
That, if I search for courfleurie.com in one of the two browsers, and when I click on the link, there, I am taken to google.com.br
I can visit ...
-3
votes
0answers
29 views
How much can I recover memory data from memory dump created when BSOD occurred? [closed]
Let's say in Windows 7 every Windows setting is set to default. Computer suddenly goes onto BSOD, and creates memory dump automatically. In this case, how much would one be able to read into memory ...
2
votes
1answer
58 views
Can Windows 7 hibernation files be recovered?
As curiosity, according to my knowledge, hibernation basically moves memory data from memory to hard disk. First of all, is this true? And if so, is it possible to recover the deleted hibernation data ...
5
votes
2answers
143 views
Using EnCase to recover InPrivate browsing history
I heard that it is possible to use EnCase to recover IE InPrivate browsing history. Is this really possible?
If so, suppose that a computer has been shut down right after usage of InPrivate browsing ...
5
votes
3answers
241 views
How to find live hosts on my network?
I am trying to find the live hosts on my network using nmap. I am scanning the network in Ubuntu using the command sudo nmap -sP 192.168.2.1/24. However, i am unable to find the live hosts. I just get ...
4
votes
1answer
81 views
How to secure application VM?
This question is derived from my previous question on Isolating Web application where two approaches were recommended.
Apache Chroot Jail
Isolation through Virtualization
My question is if one of ...
8
votes
2answers
409 views
“Friend” stole SD card. Tracing an SD card?
First off, let me say that I currently live in Mexico, a land filled with petty theft. I had a group of friends over last night, and they were looking at the photos on my camera. Today, I looked at my ...
-2
votes
0answers
24 views
Enable hardware virtualization in samsung netbook(Pheonix secureboot Setup BIOS)? [closed]
I have searched all the setting in my bios but coud not find a way to enable VT.
I have Pheonix Tech motherboard with an Intel Core i5. It supports VT according to the Intel Tool. When i run Apple ...
-4
votes
1answer
104 views
Am I part of a botnet or hack? [closed]
(FYI: my network has been hacked before...see other thread).
I have 2 routers daisy-chained. Router #1 hosts Windows PCs and a VOIP box on subnet 172. Its LAN4 goes to WAN of Router#2, which serves ...
-2
votes
0answers
75 views
History of RAT + Strange networking recently… was I hacked again?
(FYI, my PCs were infected and remote accessed in the past by a friend/stalker, & I’ve reinstalled the network few times already. Recently added Router#2 to double-NAT).
My network has 2 routers ...
3
votes
6answers
116 views
Is cookie-based XSS exploitable?
Today I've found interesting site that output your cookie value directly to the page, so if I modify the cookie value I can XSS myself.
e.g <span id=statistics>Last visit: ...
0
votes
1answer
48 views
What triggers a Firewall to block a TCP Socket?
I was wondering what would cause a Firewall to block a TCP Java Socket from connecting. What would trigger that? Thanks!
3
votes
1answer
115 views
Known plaintext; What cipher is being used here? [closed]
plaintext: CANDY VERY CRANBERRY
ciphertext: TXOtWjYhVk 8&O$4AmSA
plaintext: http
ciphertext: cZf.
plaintext: http
ciphertext: r5Hz
This is definitely somehow decodable from ...
-3
votes
0answers
34 views
VirtualBox Guest OS Backtrack 5 cant access Internet [closed]
My Host OS is windows 7 Home Basic (64 bit).
I am using Tata Photon Plus (India) Wireless device to connect Internet.
My Guest OS is Backtrack 5 64 bit.
I am not able to connect to Internet from ...
5
votes
1answer
43 views
'Trusted CA Certificates' and 'Trusted remote Certificates'
What is the difference between Trusted CA Certificates and Trusted remote Certificates?
3
votes
3answers
127 views
How can I verify the identity of a US | UK -based person and prevent *fake identities* from being accepted?
Given that it's possible to fake ID cards and fake social security numbers are created, I need to ensure that all users of my site are US or UK based citizens, and don't have more than one account.
A ...
-4
votes
2answers
60 views
Can a windows phone be traced without a SIM and battery [closed]
I lost my lumia 800 mobile two days back. If the sim and battery is removed can it be traced with the IMEI number by the cops if I lodge a complain? Or can the location be traced if a new sim is used ...
0
votes
1answer
87 views
Please recommend scanner that allows to find XSS and SQL injections vulnerabilities for Web Application [closed]
We develop Web Application:
Platform is Redhat 6.3/6.4
Presentation tier is JSF2
Persistence tier is Hibernate
Server is JBoss 4
Database is PostgreSQL 9.0.13.
We want to run scanner during our ...
0
votes
0answers
19 views
Why this k parameter is in unary in adversary PPT algorithm? [migrated]
While reading some text on cryptography, I found that algorithm A, that the adversary (called Eve by convention) runs to break the cipher message, needs two parameters, candidate message (y) and ...
3
votes
1answer
60 views
Do websocket-powered web apps (e.g. “comet” apps) have to worry about CSRF?
The standard advice for HTTP applications wanting to prevent Cross Site Request Forgery is to include a random token on each state-changing request (usually POST) which is verified by the server ...
-3
votes
0answers
45 views
User entered Javascript security implications [duplicate]
I'm creating a web site that lets people create their own site using a subdomain. Are there any security implications by letting people add custom javascript to their pages? If so, which ones? XSS? ...
5
votes
2answers
84 views
User entered Javascript security implications
I'm creating a web site that lets people create their own site using a subdomain. Are there any security implications by letting people add custom javascript to their pages? If so, which ones? XSS? ...
3
votes
2answers
130 views
Login with a hash. Is this secure enough?
I need to provide store's clients with a tool to check the status of their repair orders.
The clients doesn't have a user or password. They are only a record in the database. Yet I need to give them a ...
2
votes
2answers
60 views
Is it safer to store the XSRF value inside your JavaScript?
To protect yourself against XSRF, you need to have a separate token on a page.
See: Coding Horror: Preventing CSRF and XSRF Attacks, by Jeff Atwood
As the posting suggests, its best to have those ...
3
votes
4answers
63 views
How to prevent restrict access to a web application to authorized devices only?
I have developed an MVC web app.
Right now, the client using this app in office area.
The client has requested that no one should use this app on any device except the office's PC/tablets.
Now ...
