1
vote
0answers
5 views

XSS with a torrent

Is it possible to XSS using a BitTorrent tracker. I have been hearing that you can use a torrent to perform XSS. Is it possible ? If so whats the general idea ?
0
votes
0answers
4 views

WPA2 Protection (books?)

I have recently read this article: http://www.tomshardware.com/reviews/wireless-security-hack,2981-5.html. It gives an excellent basic insight on how WPA work. However I want to learn more, I want to ...
0
votes
0answers
14 views

What lessons learned can be gained from the Sands Casino hack?

I'm looking for a concise summary of what was done right, and what lessons could be learned with the Sands Casino hack. One take away that I saw is the need to audit for, and purge locally cached ...
0
votes
0answers
4 views

FireFTP security

I've just installed the FireFTP plugin for Firefox, I have been using Adobe Dreamweaver's FTP up to now but wanted to try something different. When I opened it up and saw all of my computer's files ...
0
votes
1answer
7 views

SSH: What's the difference or interplay between /etc/ssh/[host files] and ~/.ssh/[public key]

I'm new to SSH after a decade of dabbling with Ubuntu and other Linux builds. Today I successfully setup SSH, but I had a few hangups and headaches along the way. Although the system is now running ...
0
votes
0answers
13 views

someone may be doing something nasty

I have an ssh server. earlier toady, I was about to login to my server, when I got a message that said something along the lines of "Someone may be trying to do something nasty" and indicating a man ...
0
votes
1answer
15 views

Diceware & Database hosting

I'm currently setting up a new SQL database with DotEasy as my Hosting/Database provider. I've heard a lot about Diceware being one of the best methods of creating a really strong password, so I ...
0
votes
0answers
18 views

Webserver Stress Tool [on hold]

Can you recommend me a stress tool for my web server? I'm running debian 7 with webmin (VPS), currently i'm using apache,mysql,ssh,fail2ban. I also have scanned my server with nessus and LSAT without ...
6
votes
0answers
20 views

Why can't we bypass DNSSEC

DNSSEC is a suite of security extensions to enhance DNS security. (e.g.: avoid cache poisoning) However I was wondering how does the resolver know that the next NS will use DNSSEC? E.g.: Someone ...
-1
votes
1answer
27 views

Do I need dedicated firewall?

I have two servers in the datacenter. FreeBSD <--> Windows Server FreeBSD configured as a gateway for Windows Server. What is the best: FreeBSD has only firewall. All services are on the Win ...
1
vote
2answers
36 views

Protecting the BIOS from malware

The BIOS operates at a lower level than the OS, so antivirus software cannot scan it. Is there any other security software that we should use to protect the BIOS?
1
vote
3answers
39 views

Securing a secondary login page for inputting a multi-factor auth token

I would like to implement the following use case: User lands on the login page User submits login credentials Credentials are validated and they are redirected to another page for inputting the ...
0
votes
0answers
26 views

Windows Server 2008 R2 - SHA2 based Cipher Suites

I am currently in the process of upgrading the SSL certificates for various websites that I manage from SHA1 to SHA2 compatible certificates. To date we have always used 'RSA' as the key exchange ...
5
votes
1answer
51 views

Showing bank routing/account numbers, and storing them safely

EDIT: This is for the UK/Europe region. I've been scratching my head reading other posts similar to this one about safely storing bank routing and account numbers. I know that routing numbers can be ...
1
vote
3answers
136 views

Sending database name in request headers

I am doing a project with an architecture of single server and multiple database. Every client request will contain a header containing database name that this request should connect. Is this a good ...
4
votes
2answers
106 views

Why CBC in AES mode decrypts 16 bytes lesser for the first time?

While decrypting a file by CBC mode of AES algorithm, the output length is 16 bytes lesser than that of the input length. For example if you pass a buffer of 512 bytes it decrypts 496 bytes. It ...
5
votes
2answers
590 views

Facebook POST request capture

I have been trying to test a sniff on facebook POST request forms using wireshark (filtered HTTP). At login form, I would try login, and then check wireshark and see that no packet was captured. ...
1
vote
2answers
74 views

How can I find out who is behind a Mac address?

I was connecting a bluetooth device to my tablet and noticed that when scanning for the devices one "device" was actually a Mac address. We (me and my husband) have been under a hacker attack already ...
1
vote
0answers
43 views

How to recreate the Freak attack?

Currently I am trying to recreate the Freak attack on a virtual machine. For this purpose I set up a Linux Mint 17.1 system with Apache 2.4.7 (with a self signed certificate) and OpenSSL 1.0.1f. I ...
2
votes
0answers
28 views

Are there any Distributed/mesh-like/P2P VPNs? [migrated]

I have my personal VPN, connecting several devices so they can have fixed IP addresses on an always-reachable network (as long as they are connected to the Internet). This is necessary for me, since ...
0
votes
0answers
21 views

How exactly BitDefender Box achieve its “security” ? Should i trust them? [on hold]

BitDefender Box is a hardware from BitDefender company that acts as AV to all devices connected to network and can be a router too, but they disclose very little about how they achieve their ...
1
vote
0answers
9 views

OBKG on smartcard with PKCS#11

I have a new smart card with an on board PKCS#11 module and operate in a Win 8 environment. Like many cards, it can generate its own key pairs for enhanced security (only the public key can leave ...
1
vote
1answer
55 views

Storing encryption key in a cookie?

I have a website issue that I am addressing by storing an encryption key in a cookie. I want to describe my issue and my solution, and see if someone smarter about such things than I thinks this is a ...
0
votes
0answers
21 views

bell lapadula model and composite services

I am studying the security of composite services. The Bell-Lapadula model is useful for access control. Can I use this model for access control in composite services? The security level of each ...
0
votes
1answer
21 views

Boot Attacks possible on encryption keys used in virtual machines

Is it possible for an attacker to restore passwords or encryption keys that one has used in a virtual machine the same way like restoring keys that have been used in a standard system applying a boot ...
-1
votes
1answer
49 views

How to test if my server is secure? [on hold]

I'm using a debian7 VPS for hosting my websites. I have only installed webmin, apache, mysql, SSH and a wordpress website. I always update my packages and wordpress version. What is the best (free) ...
38
votes
2answers
2k views

How to publish scanned documents anonymously?

I was thinking of the following question for a long time and did not find a lot of material* in the web and nothing at all on Security.SE. I think its a very interesting question as it covers ...
1
vote
3answers
59 views

Methods to have multiple Anti Virus installed on one machine

I am running Windows 8.1 Pro, Ideally I would like to have the top 5 Anti Virus installed but I am aware it is not advised as they can clash with each other. I was wondering if there is a favoured ...
8
votes
2answers
585 views

Should password reset tokens be hashed when stored in a database?

Passwords are hashed so that if someone gains access to a database of passwords then they won't know what the actual passwords are and so they can't log in. If I can get a valid password reset token ...
18
votes
5answers
2k views

Does read-only access to the database prevent sql injection?

I have a web api that connects to my SQL Server using a read-only connection and want to allow tech savvy users of my api to enter an SQL where clause on the querystring. I basically just want to tack ...
0
votes
1answer
15 views

Any Value in an AIA Extension in a Certificate Issued by Root CA

While most documentation I've read states that there is no requirement to have the AIA extension in a self-signed Root certificate (logical enough), I can't find anything that tells me not to do so in ...
0
votes
0answers
30 views

startups - securing data and applications on laptop [on hold]

I am starting an organisation of web development. I owned some laptop(s) for same reason. Employee can carry those laptops at home. But when they will be login to system in office, they can have ...
1
vote
1answer
46 views

Android email encryption [on hold]

Is there a reliable (in terms of security), open-source application for handling (send/receive + en-/decrypt) encrypted emails on Android? Something like TextSecure for emails. I just found a command ...
0
votes
0answers
25 views

On firefox behind corporate proxy, intercepting on WebGoat using burp Suite error [migrated]

i'm following a tutorial on hacking web application WebGoat using burp suite I've downloaded webGoat which now runs on port 8080, set up burp suit and the browser connection as in the pictures, but ...
1
vote
1answer
49 views

How could honeypot be vulnerable?

We've been hacked for the 2nd time without knowing how/who did it. Luckily we were able to shutdown everything! We're trying to deploy Honeypot to be in control of what is going on from our local ...
0
votes
0answers
26 views

Is it possible to lock guest VMs (or processes) to sticks of physical RAM to prevent row hammer attacks?

I was wondering if it is possible through some means to isolate processes (or preferably guest VMs) to physical sticks of RAM. This would be to prevent row hammer like attacks from using physical ...
0
votes
1answer
39 views

Suspicious wifi networks from distant places and hotels

When I check my Macbook's network settings, I see some unfamiliar wifi networks from distant places like famous hotels. It's impossible to connect to those networks because I've never been to those ...
0
votes
0answers
33 views

Are there any regulations regarding password storing schemes in the EU or US? [on hold]

I'm interested in the existence of regulations (mostly EU, but US is also relevant) that particularly state some minimal requirements on the schemes used for storing passwords, applicable for ...
-2
votes
0answers
22 views

What is the most secure way to stream video? [on hold]

If the privacy is primary, when video is streaming from RPi surveillance camera to only one user, what is the best protection of transferred data, which encoding and which protocols are suitable? ...
3
votes
1answer
77 views

Deleting credit card information after every transaction

There have been many reports of hackers compromising credit card information in the databases of online shopping websites. Will deleting my credit card information from my account after every ...
-1
votes
0answers
21 views

Split Wireless Card For Fake Access Point? [on hold]

I'm trying to make a fake access point. Here are the steps I'm taking. How can I split my wireless card, so I have one half being the Access Point, and the other half leading to the internet. Is this ...
-3
votes
0answers
22 views

verification code problem, can't continue on my Yahoo inbox [on hold]

Please help. I can log in with my Yahoo but it needs a verification code to continue to my inbox and I've lost my phone.
1
vote
3answers
204 views

Is browsing http sites insecure?

So for example this site, security.stackexchange.com, when I look in my browser it doesn't say that it uses https and it does say that my connection is not encrypted. The same goes for, say, ...
-6
votes
0answers
26 views

Public and private key geerating in C Code source ? [on hold]

I'm looking to a public and private pair key with C ( like this one in the link below ) , is there any one have the source code of it ? any help would be appreciated ! Thank you . Create RSA public, ...
-7
votes
0answers
22 views

shared wifi router problen [on hold]

i have shared wifi in my home but one of our member once she used her laptop the signal goes too slow and shutoff my signal, is he had been hacked? or how can i protect my router even one of my shared ...
0
votes
2answers
49 views

Ways to secure administrative pages of a portable site

I made a CMS (using PHP) that is basically drag and drop to be live (under linux/apache hosts), now I need the communications between the administrative/login pages of said CMS and the client (recent ...
3
votes
1answer
55 views

Bypassing XSS filter

<script> Something.execute("injectionpoint"); }, true); </script> I am trying to bypass an XSS filter but its not working since since " is filtered as \" or ;\" depending on where " is ...
-4
votes
0answers
18 views

Server side script to check if browser is vulnarable to SSLv3 Poodle [migrated]

I want to implement a browser SSLv3 Poodle vulnerability test like https://zmap.io/sslv3/sslv3test.html on my web application. My idea is to put a routine in the application first page to tell to my ...
2
votes
0answers
32 views

Securely delete a file in Ubuntu? [migrated]

I have been reading about government standards for secure data erasure by overwriting the file location with random data [wikipedia: data erasure standards]. I am wondering if Ubuntu's default Delete ...
0
votes
1answer
23 views

Are DLLs in URLs executed on users local machine or on the remove machine?

In this question I am referring to DLLs listed in URLs such as this one: http://survey1.sendyouropinions.com/mrIWeb/mrIWeb.dll When this kind of URL is navigated to, is the code in the DLL executed ...

15 30 50 per page