Tag Info

New answers tagged

4

A good compromise between user experience and security would be to have IP-based captchas that trigger after a few failed logins from a particular IP, regardless of username. This approach isn't vulnerable to DoS attacks against a single user by bruteforcing his account until the backoff time reaches several hours/days and prevents the legitimate owner of ...


15

A relatively user-friendly way of mitigating brute-force attacks is delaying the minimum time between attempts. The first time your user enters wrong credentials, you let him wait 1 second before he can try again. The second time, you let him wait 2 seconds. The 3rd time, you make him wait 4 seconds. 4th time, 8 seconds, and so on. You also base this on the ...


2

I think you're responsibilities is to verify on on-going basis if your company is adhering to the ISO27001. So basically your third point describes what you will be doing: reviews. Basically you are an auditor, which indeed means you are NOT part of the IT department, but the audit department. This is to ensure independence and objectiveness as no-one of ...


2

You should look into CTF problems. For instance I know picoCTF has a ton of binary exploitation problems, web exploitation challenges, crypto problems, etc. It's a high school competition (which actually ended just yesterday), but anyone can create an account and access the problems. The problems will remain online indefinitely.


0

In my experience the above problem occurs when you are broadcasting the deauth packets with your attacking machine's MAC and not with your router's MAC. So to solve it you should change the attacker WiFi interface's MAC address to the same as your router's MAC. (This is so because you can't change the MAC of mon0 after it has been created.) So do this: ...


2

It's looking at channel -1, try running aircrack with the following option: --ignore-negative-one or --ig as it said in the error you posted: 13:50:47 Waiting for beacon frame (BSSID: ACCESS_POINT_MAC) on channel -1 13:50:47 Couldn't determine current channel for mon0, you should either force the operation with --ignore-negative-one or apply a ...


2

Pipes are "half duplex" connections: data only flows through them in one direction (from the left-hand program to the right-hand program). If you're using pipes to connect your shell to the network, you need two of them: one to handle input, and one to handle output. Network connections, such as are provided by the /dev/tcp pseudo-filesystem in your second ...


0

Technically yes, there is a very minor data leakage vulnerability here. In your example: "aaaaaafooNfooaaaaaaa".replaceAll("foo([A-Z])foo", "user_input") if user_input contained $1 and the value of the above was output and the input string aaaaaafooNfooaaaaaaa was not user controlled, the user would be able to find out what the original "secret" string ...


1

TL;DR I expect it to be a non-issue provided both the disk and the BIOS manufacturers know their stuff. Otherwise there's a very slight possibility of it being an issue after all. The disk encryption password scenario depends on the BIOS. If the BIOS supports the caching feature, then it can cache the password between warm boots, and re-supply it to the ...



Top 50 recent answers are included