1
vote
2answers
25 views

How should I store a physical written copy of my password?

I can employ all the fancy encryption and the randomest of passwords to my hard drive, but it won't do me any good if I don't remember how to log in. It seems sensible to write down my password, ...
0
votes
1answer
18 views

Determining Firewall settings (Ports, etc) for specific applications

How can we identify the network or network firewall requirements for a Desktop or Web application. Meaning what ports are required by the applications. How the Cloud and non Cloud networks communicate ...
0
votes
0answers
10 views

Stealth scanning and IDS detection

Is it true that "stealth scanning" techniques are not detected by IDS? If so, how it is not detected while it still uses ICMP messages?
1
vote
1answer
20 views

Can setting the date on your iPhone to the epoch really brick it? [on hold]

So, I've started seeing warnings that there is a troll/hoax saying that people should set the date on their phone to 1st January 1970 to get a retro logo to display. The warnings say that this will ...
-3
votes
0answers
28 views

I am at an impasse here, I keep getting listed on blacklists for spamming [on hold]

I am not a spammer nor would I ever consider it, however I do run a server just a personal family server consisting of an 8 bay NAS running QTS OS. I run the net2ftp appliance. For network ...
0
votes
0answers
11 views

message integrity under ssl connection [duplicate]

I read this article which is a great article to everyone wants to know how SSL works but still I have one other thing which I want to know about the communication using the SSL layer, my question is ...
0
votes
0answers
15 views

Is it possible to use 2-words column names in SQL? [on hold]

I have a Exel file ('accommodation.xls'). AFter a lot of experimentatiion with ADO and Delhi 7 I finally managed to make it work (almost).. because when I do a SQL " SELECT * FROM Accommodation$ " it ...
2
votes
0answers
19 views

What is this injected script doing? [on hold]

I have found the script below inserted into multiple website files. Can anyone tell me what the script does and possibly how it got into my website files? <?php $mlhrym = ...
0
votes
0answers
7 views

Capture SATA Commands sent to controller

I want to capture commands sent to the SATA controller to protocolize when data is read and writen on a really fundamental level. I did find some commercial hardware based solutions that provice this ...
-1
votes
0answers
16 views

Port explotation of servers [on hold]

I'm voluntary scanning a website, not for money, but just for testing and learning. I decided that now I'll be looking for more complex vulnerabilities than just XSS and SQLi. So, I started scanning ...
2
votes
0answers
30 views

How can I detect screenshots? [migrated]

I was wondering if a program can check if another (unknown) process is taking screenshots regularly? System: windows 7 environment. My program is a java program that takes screenshots ( say 100 per ...
2
votes
0answers
24 views

Can timing attacks over a webservice be eliminated by standardizing the time it takes to return a request?

For example, would this (pseudo)-code work? let t = timeRightNow() let message = stuffWhoseTimingCantBeLeaked() waitUntilTime(t+1 second) send message Or similar? That way the time that the message ...
-1
votes
0answers
9 views

How to protect my Audio book on micro SD card [on hold]

I am into audio book store on micro SD card but most time people do copyright of my production. I need your advice on best way to protect my product on micro SD card.
1
vote
0answers
33 views

Would adding daily changing nulls infront of their messages have made the Engima harder to crack? [migrated]

The British decrypted the German enigma because they knew that they would repeat the message key twice at the start of every message. Of course, technology to encrypt enigma without the repetition ...
0
votes
1answer
46 views

Brute force a hard drive when most of the password is known

I need to access a hard drive that is encrypted with LUKS. The password provided is incorrect, however it is only incorrect by a character or so. The password itself is very strong and above 30 ...
-1
votes
0answers
21 views

do web browsers have digital certificates from CAs? [on hold]

do web browsers have digital certificates from CAs, if not how the servers can guarantee that they are talking to the right client? could any one explain me how the web browsers prove themselves to ...
-3
votes
1answer
41 views

How many viruses has the average computer? [on hold]

Malware hides, so you cannot expect your computer to be malware-free, even when you have antivirus. My computer works fine, but I am fairly sure that I might have something lurking in there. Rootkits ...
1
vote
0answers
48 views

Is control theory of any use in the Infosec disciplines? [on hold]

I'm currently studying Engineering in a European university (not CEng, though), and I've always been fascinated by the network security/information security field. As far as I know, crypto is the ...
-4
votes
0answers
22 views

Use hydra to crack password-only forms [on hold]

I want to hack this site http://attack.samsclass.info/samsgame1/2/ because I can't find the password, and I want to brute force it because I see it only accepts 1 word. But there is only the password ...
0
votes
1answer
21 views

Any way to get high quality live proxies other than buying them from a website?

Free & public proxies are not safe when transmitting sensitive info, but even if they were are much too slow. I can't purchase due a potential security risk. I looked into and tried proxy ...
-2
votes
0answers
38 views

How to become an admin? [on hold]

I have tried to resolve a pwn task in a ctf since three days !! but i didn't get the idea to do it . as a hint , the description said that i must be an admin to read the flag, the host id is ...
1
vote
0answers
31 views

Is that a way break Linux user password by bypassing grub protected?

The best way to delve into others Linux machine is by editing the grub. Many will start by, editing the line ro quite splash as rw init=/bin/bash during the startup (usually by pressing button e on ...
3
votes
1answer
35 views

OS fingerprinting [on hold]

I have been asked to write a small tool that detects the running OS on a victim device. The tool should be able to fingerprint Linux versus Android versus iOS. Extra credit for version info. It needs ...
-2
votes
0answers
12 views

Authorization Models - Good books about the subject [on hold]

I've always been interested in authorization models (and security in general). Because of this, I've slowly been moving into the position of the in-company 'security guy'. Although I had no formal ...
-5
votes
1answer
20 views

Mobile number tracking

Is there any way we can track our mobile when it is lost? I have done a google search on the same and found that we have websites which give us the details of where the SIM was purchased & ...
1
vote
2answers
42 views

Is a vpn connection through a proxy more secure?

At the moment there are a number of online services (Hide my ass or PIA) that offer some type of security through an VPN connection. This of course can work, but the big problem (for me at least) ...
4
votes
2answers
41 views

What are the use cases for anonymous SSL cipher suites?

SSL supports several anonymous cipher suites such as TLS_DH_anon_WITH_AES_256_GCM_SHA384. When these are used, no authentication is performed and no certificates are exchanged. This means that if they ...
0
votes
0answers
5 views

Where can i find information about Ipsec Xfrm framework?

I have searched online and found very little information about the ipsec xfrm framework, including the book Networking implementation and Theory.. Where can i get more information about xfrm ...
2
votes
3answers
73 views

How is IRC so secure/untraceable that hackers and pirates use it to communicate?

Whats is special about IRC that hackers use it to do online meetings ignoring every other way like messengers or social media? It seems to be very secure that it gets used to send commands to victims ...
0
votes
1answer
16 views

TLS record layer implementation

I have some general confusion about TLS protocol. One question is about session id. Should a session id inside the TLS hellomessage have a session id length field? I do not read anything about it in ...
1
vote
1answer
30 views

A question about arpspoof command

The arpspoof command will spoof default_router_ip's MAC address on all victims in the subnet arpspoof -i <NIC> <default_router_ip> How does it fool the router about the MAC addresses ...
1
vote
2answers
40 views

Is it a good idea to combine words from different languages to increase a password's strength? [duplicate]

I was thinking of a way to generate a password that is easy to remember, but hard to crack, like the famous "correct horse battery staple" suggested by XKCD, also discussed here, and I've realized ...
1
vote
2answers
48 views

Does information security justifies Iphone 6's “error 53”? [on hold]

An update of IPhone 6 software left several IPhones that were previously repaired by an non-certified phone repairer dead. See e.g. this news. Apple claims that this is due to security: A ...
-1
votes
1answer
23 views

Linux distribution on USB stick used to banking for begginers [on hold]

Is it good idea to use up-to-date Linux on USB stick instead liveCD to online banking? What is the best Linux distribution for not advanced people who commonly use Windows to make online payments ...
0
votes
0answers
27 views

How to lock down a Guest Wi-fi? [migrated]

I have a modem/router from my ISP which I'm forced to use. I would like to provide a Wifi AP for random guest that might show up at my house but I don't want to have their virus-laden PC on my network ...
0
votes
0answers
21 views

Are There Any Measurements for Web-Application Complexity That Positively Correlates to Num. Vulnerabilities?

Web-applications have vulnerabilities. Generally, a more complex web-application has more vulnerabilities, compared with a simpler and smaller web-application. For example, white hat hackers have ...
-1
votes
0answers
30 views

i found a website with mysql error but sqlmap give error [on hold]

so i found a website with an error and i tried to inject him so it give me this error [17:45:35] [WARNING] GET parameter 'pageno' is not injectable [17:45:35] [CRITICAL] all tested parameters ...
1
vote
1answer
32 views

How to prevent IoT devices from phoning home via the neighbor's wifi?

I'm wondering what, if anything, can be done to thwart the sort of attack described below. First, you can assume the following: (1) There are several devices in your home which you have deliberately ...
0
votes
4answers
57 views

Are credentials sent via plain text to HTTP proxy?

If a proxy server requires authentication, and that proxy communicates over HTTP, are the credentials sent over plain text to the proxy server? If this is the case, isn't it possible to sniff the ...
1
vote
0answers
28 views

Pros and cons of this password reset scheme?

I handle the process of password resets at the institution where I work. Currently, we require users to make up questions and answers (three minimum and five maximum); the questions cannot repeat, nor ...
1
vote
1answer
62 views

is it possible to intercept network packets outside lan?

User A is in a different country than user B and they have different IP ranges and ISPs. Is it possible for A to intercept B's communication sent to a third party, without using techniques like ...
0
votes
1answer
18 views

Purpose of nonce validation in OpenID Connect implicit flow

The OpenID Connect specification requires implicit flow clients to generate and validate a nonce: String value used to associate a Client session with an ID Token, and to mitigate replay attacks. ...
3
votes
1answer
45 views

What techniques do advertisement companies use to get my browsing information, and how can I stop them?

In the past year, I've noticed a strangely increasing incidence of advertisements on various web sites being for products that I was browsing for elsewhere. This makes me extremely uncomfortable. It ...
2
votes
1answer
18 views

What are the advantages to OpenPGP “subkeys”?

I'm trying to get started with OpenPGP encryption. I understand the concept of keeping your master key safe, and using other keys signed by that key (which can be revoked if stolen) for encryption and ...
0
votes
0answers
10 views

Followup to one-liner to create cert request with SAN

I've been trying to use the openssl line from this older thread to create a CSR with subject alternative name: Provide subjectAltName to openssl directly on command line If I run the line from that ...
0
votes
2answers
39 views

Guarantee one unique identity per node

I'm in the early stages of designing a decentralised systems protocol, based on a blockchain, for a thesis. For the protocol to remain secure, each node in the system must be capable of generating ...
2
votes
2answers
53 views

Making a file immutable (against kernel exploits)

I'd like to know how to make files completely immutable. "Completely" refers in this case to: immutable while the system is running. I could live with something like physical access where someone e.g ...
0
votes
2answers
45 views

Antivirus connects to their server over port 80

I ran a netstat and noticed that my computer has an always-established connection with my anti-virus (Avast) over port 80. I haven't gone as far as to parse through it in Wireshark, so I can only ...
0
votes
0answers
9 views

Should javascript and css “.map” source maps be included on production servers?

Source maps are a convenient way to work with directly with code that has been obfuscated and/or minified, yet trace errors back to the original "pretty" code. My understanding is that obfuscating ...
0
votes
0answers
12 views

Are there any scareware that install an actual antivirus? [on hold]

I got to thinking about this after reading a bit about scareware, and I thought, could there be a malware example out there that installs a free version of, say, superantispyware or something, but ...

15 30 50 per page