3
votes
3answers
96 views
+50

How to verify personal information (identity)?

I've been trying to find this information but all I can find are answers saying to use a credit card for verification, not real answers. I am trying to figure out how/where companies get information ...
1
vote
1answer
16 views

Should I worry that GitHub using IP addresses that are described as having an unknown host?

Today, I got a message while doing a git push, saying Warning: Permanently added the RSA host key for IP address '192.30.253.112' to the list of known hosts. It seems as if it's consistent with ...
8
votes
2answers
164 views

Prevent and/or detect installation of root certificates on Windows?

I noticed that some applications installed root certificates on my computer. Is it possible to prevent this? Or is there a firewall or such that notifies me?
0
votes
1answer
6 views

How secure is HTML5 web storage (sessionStorage and localStorage)?

Is it safe to assume that data stored in sessionStorage or localStorage cannot be modified or deleted by a malicious attacker? If not, what precautions do I need to take?
-1
votes
4answers
3k views

How to hack into a remote mysql database?

(Moved from Stack Overflow as other users said it was a security question) I have a mysql database sitting on a remote server. Nothing else, ie no web site using it, no server side scripts etc, ...
1
vote
3answers
24 views

Can nmap take a list of ports to scan from a file?

Nmap can take a file containing a list of hosts to scan using the -iL flag. Is there similar functionality for a file containing a list of port numbers? I've scoured the man page, online docs at nmap....
4
votes
5answers
206 views

Possible security vulnerability of public interest

Let's say I found a possible vulnerability in a security system. The system has been universally considered sound for years and nowadays is used worldwide. I am not an expert in security, but there ...
5
votes
2answers
737 views

XSS in HTML title tag without forward slash

I am trying to find out whether this is vulnerable against XSS: I can control the content of the title tag through the URL. This would make the site vulnerable if it wasn't for the fact that the site ...
0
votes
2answers
24 views

What can be done to limit corporate Identity theft?

Modern fraudsters commit identity theft by impersonation in social media, since a lot of personal information such as our names, location, contact info and other personal details are available for ...
-2
votes
1answer
43 views

Brute force symmetric knowing asymmetric

Lets say message A is encrypted with symmetric encryption. BUT before encrypting the message, it is asymmetrically encrypted (let's say to implement VPN ...). Now if a man in the middle captures the ...
-2
votes
4answers
38 views

How is the private key kept secret in digital signatures?

A digital signature is verified using an algorithm that takes three inputs: the message, the digital signature (message encrypted with private key)* and the public key. If the public key is used to ...
1
vote
1answer
14 views

Is it possible to lock down the http / https proxy settings on a Windows Phone?

Is there any way to lock down the proxy settings on a Windows Phone so that they can't be changed by anyone but the person with the password?
6
votes
6answers
1k views

What extra security does a 2-step website login process with a PIN provide?

I am currently working on a web application with a significant security risk attached to its function. We're using Microsoft Identity Framework to handle user logins, with the system forcing strong ...
1
vote
1answer
15 views

Is it possible to lock down the http / https proxy settings on an Android phone?

Is there any way to lock down the proxy settings on an Android Phone so that they can't be changed by anyone but the person with the password?
3
votes
2answers
125 views

Caging unsecure internet facing IOT device

Suppose I bought a domotic IOT device which connects to the internet via an ADSL modem and permits access to it via web browser or smartphone app without SSL encryption and several other weaknesses. ...
-1
votes
0answers
13 views

Yahoo email origin syntaxes

I have several e-mails from a friend with the first (bottom-most) receive line in the general form of: Received: by 66.196.81.106; Tue, 10 Nov 2015 17:41:33 +0000 Date: Tue, 10 Nov 2015 17:41:30 +...
-2
votes
0answers
12 views

Which software can log All the files transafered to external storage (DVD & Flash Disk)

I need a software that I can use it to log all the files that are being transferred from my computer to any external storage like DVD or Flash disk
5
votes
1answer
402 views

WLCTL protocol detected by sniffer in an Android tablet

I detected that my rooted Android tablet had a slow connection. Trying to find what is taking the bandwith, I installed a firewall (DroidWall) and I blocked all the applications thinking that one of ...
54
votes
9answers
7k views

Hosting company advised us to avoid PHP for security reasons. Are they right?

I'm doing a redesign for a client who's understandably concerned about security after having been hacked in the past. I had initially suggested using a simple PHP include for header and footer ...
22
votes
2answers
3k views

Does the amount of bandwidth available on a network determine how strong a DoS attack should be?

Does bandwidth alone determine how many packets a router or server can handle before the server is overran and then goes offline?
4
votes
2answers
63 views

Is it safe to submit personal information over a website with a gray (not green) https?

I am required to submit personal information as part of a form. I looked under developer tools and found this: Is it safe to submit personal information over this website?
0
votes
1answer
28 views

Is HTTP POST insecure?

Is it possible to perform a MITM attack or even bruteforce a HTTP POST? If so how does one perform an attack and how can a developer protect his/her site from such an attack?
1
vote
0answers
10 views

Should pypi subdirectories be accessible from web browser?

I am a security researcher and when I was fingerprinting one web application I found out that all the subdirectories of domain.com/pypi were accessible from the web browser. The main directory pypi ...
0
votes
2answers
106 views

Why not have an identical session cookie for different user's devices?

Here is my table structure: // users +----+--------+------------------------+------------------+-------------------------------+ | id | name | email | cookie | /* some ...
2
votes
0answers
26 views

Help converting string to NTLM

I'm trying to covert a string into a NTLM hash. From what I understand you just have to covert the characters in the string to unicode, format it to little endian and then hash it with the MD4 ...
0
votes
1answer
21 views

Administrative recovery control mentions antivirus - error?

I am reading through Version 7 of the CISSP study guide and stumbled on a possible error. It mentions - in the administrative controls section - that Recovery is a subset/alternate version of ...
1
vote
1answer
25 views

How does the recent discovered PowerPoint exploit work?

One of the recent blogs in Project Zero described a bug in the Symantec virus scanner in relation with PowerPoint files. But I do not understand how the rounding up to the length of the cache can ...
2
votes
0answers
33 views

How can I tell if a zip file uses the 7-Zip exploit?

Let's say I have a zip file from a potentially suspicious source, and that at least one person has attempted to extract it. Conventional wisdom used to be that bad stuff™ didn't happen from ...
134
votes
14answers
23k views

SQL injection is 17 years old. Why is it still around?

I'm no techie and would like your expertise in understanding this. I recently read a detailed article on SQLi for a research paper. It strikes me as odd. Why do so many data breaches still happen ...
0
votes
0answers
4 views

Risk assessment? og:url meta tag, with url encoded original URL, in error page

I'm asked to advise on a scenario where meta tags in a 404 error page include the Open Graph og:url, which is (I'm told) being populated by React libraries. The full url as presented to the server ...
1
vote
0answers
28 views

How safe is this “Multidimensional-Encryption method” (includes xAES, familiar from Unseen.is)?

My first time here. I would like to ask about this encryption method that I found:Link to USPTO patent and it is related to this question here: A service that claims beyond army level encryption The ...
0
votes
0answers
48 views

Is SaySocket secure?

A friend of mine installed SaySocket onto his personal macbook pro (he intended to prank people, but wanted to try it first). He quickly realized that he had just installed an unknown piece of ...
0
votes
0answers
14 views

Enigmail: Issue about sending to old key

So I have set up a new GPG key for myself. I previously had one under the same email, but it has since been revoked. I installed enigmail on my new system with this new key and It seems that it is ...
0
votes
1answer
55 views

Do I need to detect user's device for “remember me” system?

I'm following solution #1 of this answer. After a while, there will be some redundant rows in the table. Suppose this table: // cookies +---------+-------------------------+------------------+--------...
0
votes
1answer
64 views

return-to-libc can't get the system function address

I'm trying to exploit my own code, just to learn how the "return-to-libc" technique works. I'm following a tutorial which basically says that to use this, I must find the address of the function I ...
0
votes
0answers
13 views

Is this an effective obfuscation technique? [migrated]

Long ago I created a simple program which obfuscated a file by taking the first byte, then X-ORing it with the second, etc, down the line. The file size was unchanged, and I could invoke the same ...
-3
votes
1answer
31 views

What this netstat -t output mean?

I ran netstat -t on my Ubuntu 14.04LTS and found following output: At that time, only Firefox was running with following add-ons: And I found following output showing way more servers. Is this ...
3
votes
1answer
235 views

My friend was fired from her job. Overnight, on her personal phone all her work contacts mysteriously disappeared

As the title stated. My friend personal email is connected to her personal phone. She works on the iPad and her work iPad is connected to her work email. She never checked her personal email on her ...
3
votes
0answers
78 views

How does a Sign tool work?

My basic understanding of how a sign tool works is: Load the zip-file (may be exe, jar, ddl, apk, etc.) which has to be signed to its memory (cache memory of the sign tool). Verify it and unzip the ...
1
vote
2answers
178 views

Nmap says host down when host is up

I am using nmap 7.12 on Mac OS X. The host that is being scanned is a Linux RHEL server in VirtualBox. I can ping the server and receive ICMP replies and vice versa. I am scanning an IP inside the ...
1
vote
0answers
5 views

Why do I need to redirect in order to send the external OAuth2 authentication token to the client?

In an OAuth2 scenario: user confirmed his identity, allows the app to access his details server got the external access token I intend to respond directly with a local access token as opposed to ...
0
votes
2answers
254 views

Monitor traffic that is going through my router

I want to monitor the HTTP traffic of all clients connected via wifi to my wireless router. I want to capture the traffic with my Notebook which is also wirelessly connected to the router. Hardware &...
0
votes
0answers
7 views

How to enable information logging for all traffic - Cisco ASA

How do I enable information logging for all traffic in the Cisco ASA. I do not want to manually go to each rule and set the logging to informational (right now on default)? Also if I do this will ...
0
votes
0answers
32 views

Setting specific geoIP in Piratebrowser

I'm using Piratebrowser. In order to set a specific country's IP, I used the line ExitNodes {in} which is working. I'm getting an Indian IP in dnsleaktest, but my geolocation is getting a Japanese ...
1
vote
1answer
15 views

Does the auth server have to be separate from the resource server when using OAuth 2.0?

I'm trying to implement OAuth 2.0 and I noticed in the spec they mention two servers - an auth server to pass access tokens back to and a resource server to use the access tokens on. My question is, ...
11
votes
7answers
214 views

What risk rating models are used for calculating risk scores of web vulnerabilities?

What risk rating methods, models, assessments or methodologies are used for calculating or estimating a risk score of vulnerabilities (for example, like described in the OWASP top 10) and which of ...
2
votes
2answers
70 views

Does “Certificate Authority” refer to the organization or the software?

Does the term "certificate authority" refer to the organization issuing certificates (symantec, comodo, let's encrypt, ...) or to the device and software that issues certificates from CSRs or both?
6
votes
1answer
130 views

How did my browsing choices reach an Alibaba seller?

Events, spaced about evenly over 2 months: Repeatedly ordered small amounts of webbing on a rather reputable Polish site (Allegro.pl, much like ebay). Got targeted ads in Skype for webbing on ...
3
votes
2answers
560 views

Stealing OAuth2 Tokens from IoT Devices

As I am delving into different forms of session authentication and persistence, I started to question how tokens are stored and the risk of a token being compromised. The scenario I have in mind is as ...

15 30 50 per page