0
votes
0answers
3 views

Ping Input box on web server vulnerable to piped commands?

Scenario is this. I have logged into a web server as admin through the Login page in browser. it has displayed me with a home page of sorts that has an input box with a button next to it saying ...
0
votes
0answers
10 views

Clarification about logging

Firstly, I apologize for asking this kind of noob question. But, for some time, I've got so much confusion about computer message logging. As the article on Wikipedia said, Syslog is a standard for ...
0
votes
0answers
15 views

Understanding Digital Signature

I have just learned Digital Signature and am trying to ensure that I have got my understanding of Digital Signature on the correct track. Assume Alice wants to send a message (M) to Bob where the ...
0
votes
1answer
12 views

IP Address when access website on Remote Computer

Can you please advise me on this, All the web sites visited on remote computer, can that be traced? I have a office computer say COMP1 and Home Computer COMP2. If i access any websites on COMP2 ...
0
votes
0answers
16 views

How do I set up SSL on my NearlyFreeSpeech site via StartSSL?

When it comes to infosec and managing a website, I know next to nothing. What I do know is that I'd like to set up SSL on my personal website, which is hosted on NearlyFreeSpeech. My primary ...
-3
votes
3answers
35 views

Why doesn't Google Safe Browsing block the IP addresses of malicious websites?

If you visit a blocked domain name like www.thelotbet.cn from Google Chrome, Opera or Firefox, you will get a warning from Google Safe Browsing that this is a malicious website. But if you visit the ...
1
vote
3answers
34 views

Can any website secured using TLS can be impersonated using a rogue certificate issued by a rogue CA?

Any website secured using TLS can be impersonated using a rogue certificate issued by a rogue CA. This is irrespective of which CA issued the website’s true certificate and of any property of that ...
2
votes
1answer
20 views

What is the difference between a “Thumbprint Algorithm” “Signature Algorithm” and “Signature Hash Algorithm” for a certificates?

I'm a bit confused on the differences between Signature Algorithm, Signature Hash Algorithm, and Thumbprint Algorithm that are present in SSL/TLS certificates. Can someone please elaborate?
1
vote
2answers
29 views

What's the benefit of hybrid cryptosystem vs asymmetric for small data blocks?

It's a common belief hybrid cryptosystems are better than asymmetric only. Is that allways like that? What's the benefit of using symmetric and asymmetric encryption for small data blocks (< 100 ...
1
vote
0answers
9 views

is there a risk in increasing esmtp header line length against rfc5822 - asa/pix question

Have a question towards the 998 bytes limitation on the esmtp header line length. We have noticed the asa is dropping emails coming from various external mail servers with the header line length ...
0
votes
1answer
81 views

TeamViewer: I'm worried the user who used my PC stole some data

How can I be sure that the user yesterday connected to my PC with TeamViewer downloaded some data with the file transfer? Does the file transfer shows a notification to say that he is downloading ...
0
votes
0answers
7 views

return list of sites with similar unique IDs (e.g. Adwords)

I have been using http://sameid.net/ to discover sites which have the same unique ID as a page in question for a number of affiliate and advertising networks. However, I am wondering if there is a ...
4
votes
4answers
159 views

How does a one liner to create passwords in linux look like?

How do you create a readable password using bash with one line? What if i'm looking for 128 bits of entropy?
0
votes
2answers
34 views

Nmap scan list of domains and provide boolean if up/down

I have a newline separated list of domains that I would like to perform an arbitrary nmap scan on (e.g. aggressive, syn) and I would like to output a boolean that indicates whether or not any ports ...
7
votes
2answers
347 views

Why is TLS_FALLBACK_SCSV secure against a MITM attack?

It is recommended, to mitigate POODLE, if SSLv3 cannot be disabled entirely, to make use of TLS_FALLBACK_SCSV, a signaling cipher suite value that indicates that fallback has occurred. The draft ...
3
votes
2answers
56 views

How do I encrypt external drive with Password which is compatible with both Linux and Windows?

I wanted to encrypt my external drive with password, which is compatible in both Linux and Windows. Truecrypt is an option. But the development of it is stopped few months back. I came across ...
0
votes
0answers
30 views

In buffer overflow exploit, 0x20 (space character) not appearing in memory and is replaced by null

The situation: I'm currently working on shellcode (I modified the assembly code from Project Shellcode) that runs "cmd.exe /c calc.exe". The shellcode itself works fine. However, when I use the ...
-1
votes
1answer
30 views

Making 2 yubikeys generate the same password

Is their a way you can make two yubikeys generate the exact same password at the exact same time? (identical copy) I am wanting to purchase two of them so I am able to store a backup yubikey in a ...
19
votes
3answers
2k views

Is there anything preventing the NSA from becoming a root CA?

There are now tons of Certification Authorities (CAs) that are trusted by default in major OS's, many of which are unrecognizable without online lookup or reference. While there have been attempts ...
0
votes
1answer
47 views

XSS - Bypass this RegExp

How could this anti-xss regexp be bypassed: /<(?:\w+)\W+?[\w]/ I am working on it but I can't find a way. Just to be sure that I have understood it correctly, this regexp search for a pattern ...
1
vote
1answer
20 views

Using OAuth 2.0 without token storage

I am building a system for a product which requires Authentication and Authorization. Naturally I have chosen using OAuth 2.0 as it is a commonly used protocol and has proven to be useful. I am ...
-1
votes
3answers
61 views

what are the best security certifications for beginners with no experience in IT [on hold]

I want to make a career change from administration to IT but I have absolutely no experience and no certifications in IT. I am interested in information security and networking. So what certifications ...
-1
votes
0answers
13 views

How do I set up SSL in wampserver [migrated]

When transmitting sensitive data over the Internet its exposed to malicious users or links therefore ssl or ssh is adopted. I have wampserver in my local machine and would love help on how to set up ...
0
votes
3answers
48 views

How SplashData knows about Worst Passwords used by users annually

It is known that every reputable website stores their user passwords into their database after implementing some hashing algorithm on it, and even they don't know what the actual password of the user ...
1
vote
1answer
33 views

Can the following function be somehow exploited/used for malicious behaviour?

I am using a main Site Engine class which is constructing most of my pages. I'm using this language function to change language website for all of my pages in the start of the Site Engine class: ...
1
vote
0answers
27 views

Hidden TrueCrypt Container containing the Tor Browser Bundle

I'm considering using a hidden TrueCrypt container to keep a Tor browser bundle copy which could save bookmarks. In this case, would the TBB leave traces on the OS it started with? E.g. I use my ...
-1
votes
0answers
26 views

Facebook connecting without relations [on hold]

Not too long ago, I looked up a person I know, but share NO relation with whatsoever (person X) on Facebook, only using X's first name. Note that I only talked to X through a not too known web-chat ...
-2
votes
1answer
50 views

Given remote access to a virtual machine, how much damage could someone do to the host computer? [on hold]

Assume that it's a fresh virtual machine, with no one logged on to a service like Google or Facebook, but still connected to the internet. I'd also like to know if it's affected by the type of RD ...
7
votes
2answers
638 views

Should I change phone number and e-mail address after PayPal fraud?

I have been the victim of PayPal fraud. I hadn't used PayPal in a year and then within 9 days there were three unauthorized transactions on my account for a total of 150 Canadian dollars and 290 ...
13
votes
1answer
954 views

Why do exploit kits use droppers?

I've been looking into the structure of the online criminal underground, which consists of exploit kits, droppers, and malware payloads. What is the function of the dropper in this pipeline? Why ...
0
votes
1answer
22 views

extracting JSESSIONID from document.cookie

I was trying cookie stealing on a java and spring based web application. Normally, a cookie can be obtained through <script>alert(document.cookie)</script>, but in the above code, cookie ...
1
vote
0answers
40 views

Mobile, WebServices and SSL

So I just started dipping my feet into Security and SSL. I looked at various videos to try and understand how the magic happens and I have the general idea now. But most deal with it taking the ...
2
votes
0answers
21 views

cisco asa syn flood detection and response not working

I have a Cisco ASA 5510 (ASA Version 8.3(2)) that has been getting a syn flood attack on it (or more accurately through it - targeting a host behind it) a couple of times a day for the past few days. ...
1
vote
1answer
74 views

Is there any practical attack on port knocking method?

I was wondering, how can I bypass the port knocking method. Is there any public vulnerability or method for attacking port knocking services? For example: I know an SSH port is behind a port ...
0
votes
0answers
11 views

logging of data traffic to follow cyber law [migrated]

I have connected my ubuntu 14.04 computer to a "mirrored" port on my firewall, so that I can see all traffic on the network. I use this today to see who uses our bandwidth with NTOPNG. but since I ...
0
votes
1answer
83 views

Identify an unknown type of hash [on hold]

I've come across an unknown type of hash value which looks like this: AAAAAATOM2KIII+kbR/Dqw3TLTw4PHsGPZft2c+b93rImFIuAQ== The corresponding hex string is: ...
-4
votes
1answer
26 views

Question regarding Oauth and https [on hold]

Whats the difference between Oauth protocol and https protocol?
0
votes
0answers
18 views

Establish IPSEC Tunnel between two Ubuntu 12.04 PCs over LAN [migrated]

I have two ubuntu 12.04 32 Bit PCs between which I want IPSec Tunnel to be setup. I have setup ipsec in both systems and ipsec verify runs fine on both. Since I have no prior experience of openswan, I ...
5
votes
1answer
1k views

How do I stop attack on my email id from hackers?

We have an email id, info@<ourdomain>.com This email id is being hacked frequently and mails are sent from this email id, Following is the example of one such email. From: ...
-4
votes
1answer
53 views

Is there any way to hack the password of my neighbour WPA-PSK and WEP connection [on hold]

Is there any way to hack the password of my neighbour WPA-PSK and WEP connection of WI-FI without using a keylogger. I tried a lots of softwares and efforts but unsuccessful. Can any one suggest. I ...
-1
votes
0answers
25 views

are companies in singapore required to comply with PCI? [on hold]

How long can CC info be kept by the company? Can only keep the last 4 digits of CC info with name of card owner?
1
vote
2answers
48 views

SSL Certificate Trust Model

I have been looking at the SSL Certificate Trust Model, and there is something that does not make sense. If I am correct, the trust model makes it that if there is a chain of certificates with a ...
0
votes
1answer
34 views

Can the aproximated date on which a given Encryption Algorithm will become prone to brute force be predicted?

I have a very elementary understanding about encryption so this question may have false assumptions, Lets take an encryption algorithm that is impractical to break through bruteforce with today's ...
1
vote
1answer
62 views

How long can a pkcs#8 passphrase be?

A program is using a private key to read messages. To improve security, besides randomness, I'm trying to create the longest passphrase that makes sense. How long should it be? After which amount of ...
2
votes
2answers
59 views

Protecting against GCHQ port scans: How does TCP stealth work?

Today I read the first time about a draft of TCP Stealth which should serve as a protection against GCHQ and NSA vulnerability scanning(Source: https://en.wikipedia.org/wiki/TCP_Stealth): The ...
-5
votes
1answer
37 views

Requirment for encryption algorithem to be secure/safe [on hold]

When we call encryption algorithem safe/secure? I can list following: is not possible to find key from cipher text is not possible to find plain text from cipher text Resistant to brute-force ...
-1
votes
1answer
44 views

Can I used the command line to disable settings in Yosemite that have made my Mac visible?

Recent changes to my machine as the result of an upgrade to Yosemite (OS X 10.10) have made my machine visible on Bluetooth and Bonjour, where it was not visible before. Is there a command line way ...
0
votes
0answers
15 views

IIS 8.5 TLS 1.2 not working [migrated]

I have Windows 8.1 with IIS 8.5 and have run the script from http://www.hass.de/content/setup-your-iis-ssl-perfect-forward-secrecy-and-tls-12 to enable TLS 1.2, but Qualys SSLLabs says my server ...
0
votes
1answer
29 views

Encrypted NAS where only clients know the (decryption) key

Is there an implementation of a file-sharing network protocol where the server has no idea what data is being stored, but can serve the encrypted files to clients that will decrypt them on-the-fly (if ...
1
vote
0answers
26 views

Read SSL Certs with user process

I am running my own server, on which I have different services (Nginx etc.). All these (internet) services are / should be secured with SSL (offcialy signed). The key files / certificates are located ...

15 30 50 per page