0
votes
0answers
3 views

Nmap SSL service detection: How to check all open ports only for SSL service?

I am evaluating Heartbleed vulnerability at our site by running the nmap ssl-heartbleed script. In order to detect vulnerability in non-standard ports, I am using -sV option to perform service ...
0
votes
0answers
5 views

error in net excess

Incorrect certificate for host. The server presented a certificate that doesn't match built-in expectations. These expectations are included for certain, high-security websites in order to protect ...
0
votes
3answers
23 views

Why does MD5 hash starts from $1$ and SHA-512 from $6$? Isn't it weakness in itself?

I have moved this question from stackoverflow to this place. I know it may be a question about 'opinion' but I am not looking for a private opinion but a source of the final decision to keep it this ...
0
votes
0answers
7 views

How to prevent attacks before HSTS is established for the first time?

What is the best way to accomplish this and prevent attacks like SSL Strip?
0
votes
0answers
6 views

Secure Azure to Data Centre Web Service Calls via Trusted IP?

Background The company I work for have a system with some data. This system's hosted in our private data centre. This system provides some ReST web services. We're looking to create a website, hosted ...
-1
votes
0answers
8 views

How do you identify a websites form-type? [on hold]

How do you know which attack method to use, http-get, https-get, http-form-get, http-form-post, etc. etc.?
0
votes
0answers
25 views

Why is the SSL handshake not shown in Wireshark?

I am trying to figure out if some Android applications with login functions are vulnerable to man in the middle attacks or not. I have set up a MITM proxy (as an attacker) on my lubuntu machine and ...
0
votes
1answer
23 views

Hashing password for secure storage (generating salt)

I wanted to check if the following means of generating a hash for storage of a password was secure. I have an username and password combo. In order to generate a secure hash, I am doing the ...
1
vote
2answers
32 views

Go through proxy server to Find an original IP Address

I work for a small company who has troubles with third parties selling our products on Amazon. Sometimes those third parties have websites and when I use an IP address finder online it gives me ...
0
votes
0answers
15 views

How do I ensure programs ask for permission to access the internet?

I am just beginning to use Debian 7 which happens to be my first ever Linux OS. I chose the default installation for Debian 7. It came with Gnome (gdm3) desktop and a lot of programs. Below are my ...
0
votes
0answers
19 views

Are there any “offline” open source software with I can check my HTTPS site?

There are many sites that can rank the quality of an HTTPS enabled website. But are there any that is open-source and can be used "offline"? So example in an intranet environment. The tool needs to ...
0
votes
2answers
8 views

Using the Synchronizer Token pattern, should you ensure the CSRF token is only communicated via HTTPS?

Put simply, CSRF tokens can be sniffed out of responses from the server unless the request/response are transmitted using encryption. Is this enough of a concern to worry about, or is it reasonable ...
0
votes
0answers
11 views

How to make a captcha maker [on hold]

I want to make a captcha maker. I am using PIL library of python to generate an image. I would like to know how should the image be (i.e. numbers with weird font style or some mathematical ...
3
votes
3answers
189 views

What's wrong with my own authentication scheme?

So I want to write my own authentication scheme for a web-app server, as follows. I assume this is a Bad Idea from either security or cost-effectiveness reasons and I know the conventional wisdom is ...
1
vote
0answers
14 views

Force all traffic through VPN [migrated]

I am using PfSense as a firewall, with its VPN functionality. The client I use is Shrew Soft VPN client. As it is a split tunnel, is there a way I can force all traffic through the VPN connection, ...
0
votes
0answers
28 views

Pattern extraction [on hold]

I got a DB (152.4 million users) (My own fake one).I did not hash the passwords, but encrypted them. So anyone that uses the same password, lets say, "123456", will have the same encryption/cipherkey. ...
0
votes
2answers
62 views

Can you write OS-related virus using high level languages like Python

It is a well known fact that OS-related viruses are commonly written in low level languages like C or C++ which require direct access to the kernel of the CPU , I am just wondering if its possible ...
0
votes
0answers
18 views

Kohnfelder Certificate [on hold]

The Kohnfelder certificate standard is very similar to that of X.509 certificate standard. Comparing the two standards, does one have an advantage edge over the other? or what are the pros and cons of ...
4
votes
2answers
376 views

How are two systems able to set up a secure SSH tunnel over a public connection?

As I understand it, when two systems create a secure SSH tunnel, the first step involves communicating the 'guidelines' for the encryption of that tunnel. If an third system is able to listen in on ...
3
votes
3answers
388 views

How does SFTP function without a manually generated public/private key pair

I am learning about SSH and how to use it to secure file transfers and commands between a windows machine and a Linux server. Everything that I have read so far indicates that I need to use an SFTP ...
1
vote
2answers
89 views

Hacked HTML page - what's in the comment following the obfuscated code?

Chrome just warned me about malicious content when visiting a site - so I visited it. The source code is like the following: <html> <head> <link href="images/DPT2.ico" title="Dynamic ...
0
votes
0answers
54 views

Squid upgrade HTTP to HTTPS [migrated]

I want to use Squid to upgrade HTTP request to HTTPS using my own certificate, in order to make clients handshake with a server (a reverse proxy) that requires mutual authentication. How can I ...
18
votes
1answer
1k views

Why would the BBC web site always ask for a personal certificate, and how do I avoid giving it away?

After installing a CAcert personal certificate, every time I land on the BBC weather site it asks me to identify myself with a certificate. Why would any non-malicious web site do that unless I've ...
3
votes
0answers
34 views

VB.NET stored procedure implementation?

While reviewing code for a vb.net application I have come across the following implementation of stored procedures using ExecuteDataSet Result = DBInstance.ExecuteDataSet(Name, ...
-1
votes
0answers
21 views

How can I setup my local server and do a heartbleed attack on it? [migrated]

I want to know how can i setup my server (apache) vulnerable to heartbleed attack and subsequently do an heartbleed attack on it?
-1
votes
0answers
44 views

possible to work in IT security without doing programming? [duplicate]

Prefer to concentrate on IPS/IDS system,IT forensic ,threat investigation , DRP etc hence staying competitive in the industry What kind of roles is suitable for me ?
1
vote
2answers
40 views

Is it possible to sign/verify a key-pair?

We currently have the need to authenticate and verify generated keypairs. Our system allows users to register for our service which generates them a key-pair for use on our network. We are in need of ...
0
votes
1answer
34 views

CNN Money Portfolio and Heartbleed [duplicate]

Is/was CNN Money Portfolio ever vulnerable to heartbleed? It states 256 bit SSL bank level encryption on the website..
2
votes
1answer
42 views

How To Find Out What Software is Trying to 'Phone Home'?

I have seen some suspicious outbound communications blocked on my VPS, which hosts a small experimental Web site, and am wanting to find out which application is making the attempt. The server is ...
1
vote
1answer
49 views

What to do with .hash files when cracking WPA2

So, I'd say I'm one level above n00b. I've gotten to the point where I have accomplished a WPA Handshake (and saved the output as xxx-01.cap). I have also downloaded these hash tables (if that is the ...
1
vote
1answer
34 views

IE11 on windows 8.1 and ssl fallback

I'm having problems with SSL certs and my SSL accelerator. I have a Sonicwall SSL-R and it only supports SSLv2, SSLv3, and TLS1.0. I have it configured to decode SSL with SSLv3 as the TLS1.0 ...
1
vote
1answer
33 views

Is a VirtualBox Host-only Adapter safe?

I have a VM in VirtualBox with two network adapters: a Host-only adapter and a NAT adapter; I was wondering if the VM gets compromised, is my Host-only adapter putting my host in danger? --- ...
7
votes
1answer
57 views

How can I verify if a website revoked its old SSL certificate keys? [duplicate]

Through reading from multiple sources and watching Security Now's How the Heartbleeds, I have come to the understanding that the following procedure is recommended to be safe from the Heartbleed ...
4
votes
3answers
130 views

Why do some websites need time to log you in securely, while others can do it instantly?

I noted that on a lot of money-related websites (banks, paypal, etc), you are brought to a page that "logs you in securely". This is an example of one: Meanwhile, websites that also store very ...
1
vote
3answers
83 views

Can an attacker sniff physical network traffic through WiFi?

So, I am wondering - is it possible for an attacker to sniff traffic on an Ethernet connection if they are not physically plugged into the modem/router hardware but they are connected through wifi? In ...
0
votes
0answers
6 views

Does analyst API Flurry break Australian Privacy Act or any other Legal, Regulations, Compliance?

I want introduce Flurry API in my iOS app. But I heard since 2014 Australia start an act to against web page and mobile app to collect user information. My question is simple: Does using of API ...
3
votes
1answer
55 views

What happens if biometric data is stolen?

As we move toward a future where fingerprints might possibly replace passwords, I see one issue. While passwords can be stolen, they can be changed by the owner after being notified of the security ...
2
votes
3answers
50 views

Is there any point to connecting to a VPN server while on the local network?

I plan on installing a VPN server on one of my computers that is running Ubuntu for purposes of connecting to my local network while I am not at home. At home I also have a desktop computer (separate ...
2
votes
1answer
18 views

Is it possible to slow down the Blue Midnight Wish cryptographic hash function?

In the Blue Midnight Wish (BMW) cryptographic hash function, is there a variable I can use to increase memory/CPU resource consumption to slow down the password hashing process? Call me crazy, but I ...
4
votes
1answer
27 views

Understanding Session Fixation Vulnerability

What I've Read I'm read the following resources on session fixation, but I'm still having difficulty understanding some aspects of this kind of vulnerability: Ruby on Rails Security Guide § ...
1
vote
0answers
67 views

I believe my Domain has been hijacked I am not receiving in sales in shopping cart

My IP address is 181.224.153.95 Domain: www.ashaybythebay.com FTP Hostname: m23.siteground.biz I added private domain servers to my domain name ashaybythebay.com and I see the two IP server ...
2
votes
0answers
73 views

Decrypt Passwords based on using a user's password

I am creating a database to store our client's information at work (a heritage center specializing in DNA based genealogy). Once the results of a test come back, we have people that use the ...
4
votes
1answer
28 views

Why does a web site operator need to trust an openid provider?

I am working on a web site and am considering using OpenID for authentication. The site will have some low cost ($3-$5) premium services, but will not be protecting particularly sensitive user data, ...
1
vote
1answer
16 views

what are the current best practices for key generation

What is the difference between these openssl commands: "openssl genrsa" "openssl genpkey" "openssl req -newkey rsa:bits [everything else]" Which one should I be using when preparing a new CSR?
1
vote
2answers
52 views

One computer with multiple OSs in different drives

I use my personal computer for both programming work and gaming at my free time(and sometimes penetration testing) all these in different operating systems each. The problem is that I dont really ...
0
votes
1answer
22 views

Issues of using HOTP w/ iteration window

I am using HOTP to generate OTP to validate a request, in order to prevent replay attacks. I'm thinking about using a window of 10 (or so) iterations to accommodate a possible mismatch in the counter ...
1
vote
1answer
42 views

TestSSLServer Results

I ran TestSSLServer.exe (from http://www.bolet.org/TestSSLServer/) against a web server in my organization. The results seemed self explanatory save for one section I'm not sure how to interpret. ...
2
votes
2answers
29 views

When using PGP/GPG, is it safe to use the same public/private key pair on multiple computers for the same person?

It seems somewhat unsafe to move the private portion of one's key around to multiple machines...but it also seems odd to have multiple identities floating around.
0
votes
0answers
29 views

Snort reading pcap

I have 2000 something .pcap files I need to read with snort. I want to: Save all the alerts, and only the alerts, in a .pcap Run a very small ruleset What I have so far is this: read files in ...
1
vote
1answer
117 views

Explain the Heartbleed Python code [on hold]

first post here so be gentle please! I understand the Heartbleed vulnerability concept, and I have a general grasp of Python. I'm struggling to understand the PoC Python code though, so was after a ...

15 30 50 per page