Tag Info

New answers tagged

1

If you are using SSL why would you send a salt at all? All you need to is allow the user the send username and password and you can calculate H(message + salt) server side. There is no point of sending the salt to the user. Just make sure you use a proper hashing algorithm like PBKDF2, bcrypt or scrypt. Also if you have broken SSL it would not matter if you ...


1

Given the problems we've seen with SSL recently (both CA-side issues and implementation bugs), I agree that having another layer of security protecting the password is a good idea. The best option I know of is the Secure Remote Password protocol (wikipedia, Stanford, crypto.SE) -- ideally, combined with a slow hash function like scrypt or PBKDF2. Using SRP, ...


0

Since you're building an API from scratch, you could implement a hashing function where a SHA256 (or whatever) hash is put on the username and password matrix and submitted. In this way, only the hash is sent over the wire. This isn't an end-all-be-all solution, but it's just another layer.


1

If you believe in layers, then add some layers. For instance, run your SSL within another SSL, and arrange for the two SSL layers to use distinct algorithms (e.g. the outer SSL works on AES encryption and an ephemeral Diffie-Hellman key exchange, while the inner SSL uses RC4 encryption and RSA-based key exchange). This is undoubtly layered, and, as far as ...


2

The encryption isn't your problem as most C# encryption examples will do the right thing with the CryptoStream class. But after quick look at the CodeProject article that you linked, I can say with certainty that you had better not use the code as presented. I will list the problems in the order they appear in the code. private void EncryptFile(string ...


0

Personally, I have better trust in MSDN articles over anything else. That being said, I would start with Cryptographic Services, then Walkthrough: Creating a Cryptographic Application, which explains the process pretty well.


1

If this form is hackable, others are likely to be also. Getting the content of the database is problematic, but bypassing normal user authentication, altering other users accounts, or just plain trashing the database are all on the table. I doubt your client would want you to try these things on their live database.


1

How can I obtain the database's content using the SQL injection technique? Whether or not you can do this will depend greatly on how the information is used after it is pulled from the database. For example, if the information pulled from the database is only used to see if you have valid credentials, but never displays any of the database content that ...


6

You should ensure that you have the right skill set before offering to perform work for a client. This means that you looking at the website will be worthwhile and you won't give the client a false sense of security. This will be better for you as you will know how to take the correct steps to perform a test legally and won't get sued by the client if you ...


1

I have not used these technologies before but what I can tell you is if you decrypt the password in your SQL query then anyone on your network can sniff and get the passwords as plain text. If I understand correctly, your C# will get the decrypted passwords? If so I would recommend you have something such as in your C# application: C# generate a random ...


1

You can do this a few different ways. First, if your exploit is an EXE-dropping exploit (like psexec), you can set the EXE::Custom advanced option. Otherwise you can use one of the payloads that allows you to upload (windows/upexec/*) or download (windows/download_exec) a custom executable.


3

There are several weird things in your setup: ECB mode does not use any IV. You should not specify an IV when using ECB mode. Or, rather, you should not use ECB, which is weak (generally speaking). AES processes binary input, produces binary output, and uses a binary key. There is no character string whatsoever in AES; thus, any notion of encoding like ...



Top 50 recent answers are included