0
votes
0answers
3 views

SQL injection with database issue

I want to secure website firstly I detect vulnerable points using a crawler which says SQL injection vulnerability is present or not present and this is store in MYsql database but this results are ...
0
votes
0answers
6 views

Credentials for scanning a database server's vulnerabilities

what is the required credentials for scanning a database server's vulnerabilities by using vulnerability assessment tools such as Rapid 7 Nexpose?
0
votes
0answers
7 views

Localhost - OpenSSL in Xamp Mac OSX

First, I got localhost.csr, localhost.key and localhost.crt using the following commands on terminal: Request: openssl req -new -newkey rsa:2048 -nodes -keyout localhost.key -out localhost.csr ...
-1
votes
0answers
19 views

Relating SQL injection test results

for detection I used hidden web crawler at client side whose results are doubt full ,false positive and negative and store this results in database and to confirm all vulnerability and to prevent it ...
0
votes
1answer
15 views

Abnormal SYN traffic from Blackhole DNS servers

I have been getting alerts from an anomaly based signatures for abnormally high SYN traffic. The traffic is coming from blackhole DNS servers. I hadn't had any experience with Blackhole servers prior ...
0
votes
1answer
10 views

Root android apps to Tor

I have an android and I can only use Tor through orbot to browse the Internet. Is there a way I can run all of my apps through Tor so that every app I use on my phone will be secured and untraceable?
1
vote
0answers
12 views

API Keys for REST

So I'm developing a RESTful API, but I can't for the life of me understand how API keys work. I'm using PHP, which has an HMAC function, which I've read is a good way to sign requests, but what I ...
0
votes
1answer
30 views

Are there any security disadvantages of using production SSL certificate in non-prod environments?

My client has a wildcard certificate *.thierdomain.com that they are using for half a dozen of production web sites. For each of theses sites there are duplicates in several environments, dev, qa, ...
1
vote
2answers
34 views

Can a network admin see my computer's screen if I'm logged into their wifi network?

I had a friend try to convince me today that simply by signing into a wifi network, without any physical access to your computer, the network admin can see your computer's screen. Obviously this is ...
0
votes
0answers
11 views

How would iOS or Android app “firewall” for extended permissions (location, etc) work?

I'm interested in blocking or reporting any application's usage of extended permissions, regardless if they are granted those rights, such as: GPS / Location / Wifi Radio signal data Telemetry My ...
-2
votes
1answer
25 views

IP hijacking during SSL

I was wondering, does SSL protect from IP hijacking (an active, authenticated connection between two hosts is disrupted and the attacker takes the place of one of the hosts) and how?
6
votes
4answers
735 views

Are routers vulnerable?

I apologize if this is an obvious question, I'm not very familiar with hardware. I am planning on hosting a few personal websites from my home, but I'm concerned about my security. I'm using a fairly ...
2
votes
1answer
25 views

Who can see the traffic of others in different kinds of LAN

I would like to consider three types of LAN: a) 2 computers are connected to a Hub, this Hub is connected to a router for e.g. internet access. b) 2 computers are connected to a Switch, this Switch ...
0
votes
1answer
25 views

Are wired and wireless networks on a router nessassarily one network, when they are not bridged?

I know, that if I bridge the wireless and the wired NIC of my router, that both networks are composed to one. In this case computers from the wireless and the wired LAN can reach each other (they are ...
-1
votes
1answer
31 views

Someone is using my website email to send spam [on hold]

I have an email hosted by my website. Somehow someone is using this email to send spam. These emails are not being sent by me. Someone else has access to it and I don't know how to stop it. This has ...
-1
votes
0answers
17 views

Email alert for browsing a site

I want to be able to set an email alert for every site whenever my friends access the internet from my home Wi-fi modem or router. How can I achieve this in a very simple way with the website details ...
4
votes
1answer
123 views

What is the “Moose” worm and how can I protect myself from it?

I have heard from others that there is a new worm called "moose". This actively targets and exploits home routers. What are the effects of this exploit? How can I protect myself from this? Can I ...
0
votes
0answers
24 views

Tunneling SSH traffic through tor

I have encountered a somewhat bizarre issue while playing around with tor and SSH. After a connection to the server has been established the source address of the client(in this case the tor exit ...
2
votes
1answer
42 views

Is a newly installed server with no services running (but connected to the web) at risk?

A new server has just been installed but literally has nothing else running on it, no services setup to SSH in or anything yet (it's a Linux server). However, it is hooked up to the web so I can ...
0
votes
1answer
43 views

Server full disk encryption protection from malware

A group of LINUX servers is using dm-crypt to encrypt data. The servers do not store data long-term but are only temporary stopping points for data before it is sent to other systems. The time the ...
0
votes
0answers
12 views

Exchange Autodiscover XML question (Exploit related)

Recently we had an issue with the Exchange autodiscover.xml appending ".com" to our mail servers autodiscover address. It resulted in a certificate error due to the name not matching the certificate. ...
0
votes
1answer
34 views

How do I audit the effect of security policy on a computer

I have developed different templates for local security policy. I have been using the program Nexpose to test the effects of those security policy but so far i am not able to detect the visible ...
2
votes
0answers
32 views

chroot ssh users

I am using CentOS 7. I need to give shell access to ssh users but restrict them in a jail. I have used jailkit to set up the jail. I have copied all necessary libraries, binaries that are needed for ...
0
votes
4answers
106 views

What mail applications use crypto?

I just read that everyone in the world can ready my mails (if intercepted in traffic by eavesdropping?). Also, it reads that current versions (book's from 2004 so I assume that new versions adopt ...
1
vote
2answers
33 views

Certificate chaining:Intermediate Certificate Authorities

Wikipedia says: For example, if a certificate issued to "example.com" and issued by "Intermediate CA1", and the visiting web browser trusts "Root CA", trust may be established in the following manner: ...
1
vote
2answers
44 views

Encryption / Decryption algorithm generic across JRE (Sun/IBM)

Is there any encryption algorithm that is generic across all platforms? Is RSA generic across SUN/IBM JRE? Another question: will base64Encoder / base64Decoder sun.misc.BASE64Decode / ...
0
votes
0answers
26 views

Complicated HTTP-POST-FORM's with Hydra

So, long story short, I have been talking with a developer that is designing a website for us under a very high recommendation. They have had some break in's of late, and the developer has claimed it ...
0
votes
4answers
226 views

Is end to end email encryption possible without unique domain/subdomain for each user?

Lets say Alice@gmail.com wants to send message to Bob@secureMail.com Alice <--> gmail.com <--> secureMail.com <--> Bob We know gmail.com can read the unencrypted message. Is it possible for ...
0
votes
0answers
12 views

Can a TPM's EK's public key (hash) be used to fingerprint a device?

The question How to use TPM to perform platform authentication is basically asking if the TPM's EK can be used to "authenticate" a host/device. And one of the answers says The Endorsement Key ...
0
votes
0answers
40 views

How to get into penetration testing profession? [on hold]

I am 28 year old and holding master of information security. I don't have any practical experience of pen testing. I would like to study and sit for some relevant certifications such as CEH. But ...
3
votes
2answers
60 views

Can a RootCA be revoked?

I have created a New Trusted certification authority which issues certificate to the end entity and the end entity will use this certificate as trusted one for all their PKI operations. Some how the ...
1
vote
1answer
41 views

Linux Kernel module signing

If the linux kernel is compiled to check for kernel modules signing, it checks the validity of the public key (X.509) w.r.t the current system time. For the first time the system is booting up, it ...
0
votes
0answers
95 views

Design Principle violated by Certificate Revocation List (CRL)

I need help with my homework assignment, The question asked is: can you explain me which design principle between Least Privilege Fail-Safe Defaults Economy of Mechanism Complete ...
0
votes
2answers
49 views

SQL Injection Attack - Permissions Defenses

SQL injection attacks work by the attacker putting valid SQL into the text that goes back from the page to the server; something like "Delete * from tblAccounts where 1=1" What I cannot understand is ...
2
votes
2answers
75 views

Why is information obtained from public records considered a secure way of confirming your identity?

Various financial institutions, government agencies, etc., use public records information to confirm people's identities, as touched upon in UPS my choice -- How can I access my public records? The ...
5
votes
3answers
708 views

What if someone steals a Certificate authority's private key? [duplicate]

What if someone could steal a Certificate authority's private key? I know this will (probably) never happen, but what would happen to the certificates that were already signed with this private key? ...
1
vote
1answer
40 views

Does it make sense to scan localhost site?

I was playing around with wpscan a little while ago. I was wondering if it makes sense to scan a site on your localhost server. I think that it is since there are examples like DVWA, but I imagine it ...
1
vote
1answer
91 views

Why does Google.com still support SSL v3?

The POODLE vulnerability was discovered by Google in October 2014, and unlike heartbleed, it had a simple solution: just disable SSL v3. Now, most of the websites have disabled SSL v3 but ironically ...
0
votes
2answers
49 views

Hijack attacked SSL/TLS-connections?

I think we all heard the news that China used unencrypted HTTP-connections to drive DDoS attacks on targeted websites. Now within the last few months we've learned about three new attacks ...
4
votes
1answer
68 views

How can I delete a password and lock the account in one step?

I have a minimal server install on a remote machine with a root password set to a temporary, but chosen, value. I have added a separate administrator user. This user has an authorized key for SSH, no ...
4
votes
2answers
188 views

How to be safe from wifikill!

I recently found that my friend is using wifikill apk on his rooted android and I would like to get rid of that software as I always get kicked from my wifi. I have to give him the password of my wifi ...
2
votes
2answers
38 views

Is it secure to SMS your Credit card info (or other info) to someone else?

I am buying some products and have mostly communicated with the store via email. I am planning on paying by credit card, but the store doesn't have online billing. Normally, I would just phone the ...
1
vote
1answer
56 views

iOS Unicode Notification Bug

Evidently, someone has discovered a Unicode bug in iOS, where if an app receives a specific Unicode sequence (infinitely-repeating Unicode code point), the OS will kill the Springboard as it allocates ...
2
votes
2answers
158 views

How is it possible that a text message can reboot an Apple device?

I was reading through my infosec newsfeed and found this article: http://www.theguardian.com/technology/2015/may/27/iphone-crash-bug-text-imessage-ios It basically talks about a bug iOS has while ...
0
votes
0answers
38 views

How do you restore your hard drive after a crash if you use KeePass? [on hold]

If you keep all passwords in KeePass, and the drive is destroyed/lost/corrupted, how do you restore? Currently my online backup is using a password that I memorize, but not as strong as KeePass would ...
2
votes
0answers
30 views

Simple method requiring no installation of special tools to share a file over the internet

I have searched for related topics, but found other existing answers to not be satisfactory, because they require installing special tools. This is a very common use case. For example, I want to ...
9
votes
5answers
1k views

Is this way of encoding cryptographic hashes safe?

I'm looking at the code of a particular web application that handle file uploads. For some reason, instead of using the cryptographic hash function (SHA-256 in this case), they derive an ID from it, ...
7
votes
1answer
75 views

How to fix a repeatedly hacked gmail account (where 2FA is enabled and passwords are changed)?

A friend of mine came to me for help with this issues. Her Gmail account has been hacked and keeps sending out spam emails to her contacts. This is happening to her on a monthly basis. Each time it ...
0
votes
0answers
20 views

Saving user data (IP, location…) on mobile app in USA [on hold]

I'm working on the implementation of a service that measures advertisement campaign efficiency on mobile devices; it'll be shipped as an SDK (Android and iOS) that other apps can implement. I retrieve ...
1
vote
2answers
78 views

Is it safe to publish some internal IP of my company?

Sometimes when asking networking questions on StackExchange I want to publish some output where several internal IP adresses from my company appear (output of traceroute command for example). Since I ...

15 30 50 per page