0
votes
1answer
14 views

Cloud based SaaS with large database - what should we ensure we have in place?

We are developing software which will be cloud based and have a hopefully massive database once we get users in. Now, I am the founder with very basic knowledge, so I am asking the basic question. ...
0
votes
0answers
11 views

Nmap from Kali Linux and from Amazon EC2 instance - vastly differing results

I'm running a basic scan using nmap from 1) a VM of Kali Linux running on personal machine 2) an instance of Amazon Linux, running on Amazon's EC2 cloud These two runs (against any target) are ...
0
votes
0answers
6 views

Difference between SSL connection and SSL session

What is the difference between SSL connection and SSL session ??? This is what my lecture notes has to say which I makes no sense to me ( I am new to SSL) SSL Connection: A transient ...
3
votes
3answers
38 views

W3af and automated vulnerability scanners vs manual testing

How effective are tools such as w3af in looking for web app vulnerabilities compared to looking for vulnerabilities manually? Are they able to find all vulnerabilities from OWASP top 10 such as ...
4
votes
3answers
75 views

Steps to find out whether a SSL certificate is trustworthy

For doing business with a company I have to browse to https://www.prioenergie.de/nc/mein-prioenergie.html (German website). Firefox says the certificate is invalid, because it is not signed by a ...
0
votes
2answers
93 views

Trust level of whole disk encryption software

For example, if we take this software into account: Symantec Endpoint Encryption Sophos Safeguard Encryption How can we trust suppliers of whole disk encryption software in the lights of the ...
-1
votes
1answer
8 views

google reCAPTCHA V2 “Use of undefined constant ..”

I'm implementing google's reCAPTCHA V2. It works almost perfectly except for the following error located in the recaptchalib.php: Notice: Use of undefined constant success - assumed 'success' in ...
9
votes
6answers
7k views

how to protect my USB stick from Viruses

I repair a lot of computers with viruses, malware, and what not, and I have one problem that I am struggling to find a solution for. Whenever I connect my USB stick that has the tools I need for the ...
4
votes
2answers
886 views

Hacked Ubuntu server, probably hacked commands (netstat, ps, …), how to replace them?

An Ubuntu server of my company has been hacked to carry out a DoS attack. I found the shellshock bug had not been fixed by my colleagues, and I think it's the problem. Then, I found an ELF file that ...
0
votes
0answers
30 views

Windows CTF/war games/reverse engineering/exploit challenges

War Games are fun but mainly deal with Linux reverse engineering. Example: http://blackbox.smashthestack.org:85/ Does anyone know of similar online games for Windows security?
-1
votes
0answers
10 views

How to put WLAN card in promisc mode? [on hold]

My WLAN card driver is ath9k and using CentOs 7. I used ifconfig wlp1s0 promisc to set it in promisc mode. When using tcpdump I am only able to see unicast traffic to my pc. How can I set my card to ...
0
votes
0answers
29 views

To work in the information security field [on hold]

I am a first-year Cryptology graduate student in university, focusing on both engineering and mathematical aspects of information security. I plan to proceed to a doctorate degree right after my ...
1
vote
1answer
42 views

Secure voice app [on hold]

When I look in the Google play store (android apps market), I see that there are a lot of apps to make secure phone calls. However, all the apps I have seen so far all seem to use data packets over ...
3
votes
1answer
93 views

Why does my openssl connection fail with elliptic curve cipher ECDH-RSA-AES128-SHA?

I am using openssl example server and client with specific cipher in ubuntu 14.10 pc. The openssl version is 1.0.1. When I use the RC4-SHA cipher in both sides, the connection is established ...
1
vote
0answers
63 views

Algorithm to Transaction Data Signing

Transaction Data Signing I need an idea to develop a very secure algorithm to authenticate online operations using PHP in the server and an Android app in the user's device. What is the idea? The ...
1
vote
0answers
26 views

Is there an alternative AES schedule? [migrated]

I'm currently reversing an AES implementation for disk encryption. The odd thing I'm stumbled about is a key schedule where the encryption round keys are not the same as the decryption round keys (in ...
1
vote
1answer
137 views

What is attacker trying to do with my server?

Some is trying to access this link (and similar ones) frequently in my site: http://example.com/upload/RS=%5EADAJVxZ5NB.GMTgFV3EMEJX3sN22Jw- Note that my server doesn't have an upload folder inside ...
0
votes
2answers
107 views

bot detection via browser fingerprinting

I've recently noticed that a few companies have begun to offer bot and scraping protection services based on the idea of browser fingerprinting to detect them, and then blocking the specific ...
0
votes
0answers
25 views

Program exiting after executing int 0x80 instruction when running shellcode

In school I was given an assignment to perform a buffer overflow, which would execute some shellcode and open a new shell. After a bit of fiddling the buffer overflow succeeded, and when I ran the ...
1
vote
3answers
50 views

Moving /boot to USB and Preventing booting from other USB devices (Allow boot from only one USB)

I'm going to move my /boot/ folder to a USB to as a security measure to protect against Full Disk Encryption exploits. My question is, is it possible to only allow boot from USB from a single USB ...
2
votes
4answers
279 views

Recently received a odd email

http://photomi.co.kr/httpcnbc9home-2.com.php?subpage216 Learn How to Make Money 0nline Fast __________________ . louanne visszakuldod Sun, 22 Jul 2012 0:33:42 Is there a way to identify what ...
-8
votes
0answers
60 views

Cracking Password [on hold]

I've forgot my email password password and I haven't set my number and security question. Now I am unable to open my email. Please help me to crack my password.
2
votes
3answers
2k views

Why is it easy to detect network layer DDoS attacks?

I have seen numerous research papers that claim it is "easy to detect network layer DDoS attacks" without saying why. Usually these research papers focus on detection or prevention of application ...
5
votes
2answers
77 views

Can a caller “Hijack” your SIM information?

We have all heard them, rumors about people randomly calling you on your Mobile Phone number, and asking you to confirm something by typing in a specific combination onto your dial pad (the rumor I'm ...
-1
votes
0answers
38 views

Good book about creating malware, not just analyzing it [on hold]

Good book about creating malware, not just analyzing it. I've been looking at a practical book on how malware works and how it is implemented. Most books I've seen just tell from a high-level ...
5
votes
1answer
42 views

DNS Rebinding attack - will the victim's browser send cookies?

How does a DNS Rebinding attack works? How can it violate the Same-origin policy? Will the victim's browser send cookies to the remote server (specified by IP), when the domain is not the same as is ...
2
votes
1answer
518 views

Is keystore file(server.jks), my private key file?

My task is to convert .p7b to .pfx. It would be great, if you could provide me some pointers. Below are the steps I did to generate .p7b file. I generated jks(java keystore) file using below ...
3
votes
1answer
44 views

Level 4 merchants becoming PCI Compliant

I was prompted recently to take a deeper look into some of the PCI requirement information, and I have found some pretty serious discrepancies with regard to the reporting obligations of Level 4 ...
-1
votes
1answer
41 views

What does “unknown” status in nmap mean? [duplicate]

scanned my IP number with nmap and I got all "unknown" status ports. What does that mean?
3
votes
3answers
1k views

Is this PHP code XSS proof?

Is the following PHP code XSS proof? <?php $site = $_GET["url"]; echo "<a href='".str_replace(array("\"", "'", "javascript:", "vbscript:"), array("%22", "%27", "", ""), ...
1
vote
0answers
19 views

Encrypt Lightning event invite mails with pgp [migrated]

I use Thunderbirds/Icedoves Lightning add-on to manage my calendar, tasks and notes. When creating an event I can add attendees and send invitations to them, but they won't use their public pgp keys ...
1
vote
1answer
56 views

Test if an email address is spammer's

How can I test if an email address is a spammer's? I received a reply to my Craigslist post, with a gmail address in the email body. Craigslist uses some way to hide my email addresses, if I choose ...
3
votes
2answers
43 views

How to exploit via Metasploit vulnerabilities found with Nessus?

I am new in the field and trying to pentest a php web app locally stored on my host pc using metasploit from a kali vm. I have run some scanners like wmap,OpenVAS and Nessus and found some ...
2
votes
3answers
93 views

PBKDF2 used to generate an encryption key: long shared secret (password) vs iterations count

I want to use pbkdf2 to generate a key for a symetric encryption (DES, 3DES, may be AES) algorith, that will be used to secure private data between an AS/400 and another computer (probably running ...
0
votes
1answer
53 views

Ensuring security of web based games and contests

I have previously analysed an online contest and found that it was trivial to reverse engineer the handshake process since it was all done in javascript. As a result, it was possible to code an ...
0
votes
0answers
17 views

Facebook Login and OpenID Connect [on hold]

Can someone confirm whether Facebook Login API (https://developers.facebook.com/docs/facebook-login/v2.2) is based on OpenID Connect (http://openid.net/connect/) specification? Thanks, Sameer
2
votes
2answers
38 views

Email Encryption

I'm hoping someone can point me in the right direction. If I wanted to implement email encryption within an organisation what would be the best way? I've been searching the web tonight but all my ...
1
vote
1answer
15 views

Definitions of PKCS#11 abbreviations

Is there a complete definition list for all CKx abbreviations in PKCS#11? I believe I gathered most of them: CK = Cryptoki CKA = ... Attribute CKC = ... Certificate type CKD = ... Key derivation ...
0
votes
1answer
338 views

CloudFlare - prompted for “attention required”

I am getting a CloudFlare - attention required / security check prompt on most of the sites I visit through my Macbook running OS X Yosemite, these sites work perfectly on other devices (such as iPad, ...
1
vote
1answer
201 views

Is it safe to store public key encrypted password in the Mobile Device for authentication purposes?

I have a Apache Cordova hybrid mobile app that needs to authenticate users, but we don't want to prompt for credentials every time the app is used. Some options came to my mind: Store the password ...
1
vote
0answers
46 views

Certificate Errors with bad Date Time settings [migrated]

I have recently solved an issue with IE 11 where I was getting certificate errors to google.com bing.com was fine no problems I tried a number of different things till seeing a post referring to ...
0
votes
1answer
536 views

ShellShock vulnerability and Java Web Applications

I am running a java webapplication ( Spring 3.2 based) on linux hosts. The linux hosts are vulnerable to the ShellShock vulnerability. Can someone exploit this vulnerabiity on my website ?
0
votes
1answer
57 views

Can you trace network attacker by ip address? [on hold]

Is it possible to prove the identity by ip address of someone that has compromised a router on your network?
-2
votes
0answers
20 views

WebGoat Access Control Flaws help

I am using Web Security Dojo 2.1 and I am trying to complete an exercise in WebGoat, but it isn't working out the way it did in the video. The objective is to use the Tamper Data add-on with the ...
0
votes
2answers
59 views

SSL certificate expired

Some company was trying to sell me their security system. They said that the SSL certificate was expired on my laptop, which they showed me. They said that I wasn't protected. What are my options?
1
vote
2answers
29 views

Separate normal traffic [on hold]

Is there any tool or method to separate normal traffic and malicious traffic from pcap? For example : if malicious traffic detected with snort i need to store those packets .only if malicious traffic ...
0
votes
3answers
62 views

Is there a way to make Tor network your full VPN?

Is there a way to use Tor network as your VPN, proxy or something alike? I have been gone to their website but I've seen just browser (Tor Browser), bridge, relay and exit. Is there way to tell ...
0
votes
4answers
179 views

How safe is it to use older/unknown Encryption methods for plaintext?

When mailing or chatting with people, it had crossed my mind, what if, for simple communication, someone would use an older encryption method (i.e., ENIGMA), to encrypt their message? Would because ...
1
vote
1answer
166 views

What causes a powershell payload to run the first time but not the second?

I created a windows/meterpreter/reverse_https powershell payload using the python script provided at the end of this article. In the first run, the meterpreter session opened successfully, when I ...
6
votes
1answer
138 views

Google Authenticator Error on Reboot

I have set up an SSH server to accept only login using codes generated by Google Authenticator (I have disabled all other forms of authentication on that port). After having rebooted my remote ...

15 30 50 per page