Tag Info

Hot answers tagged

32

Probably not. In order to respond to HTTP requests, the operating system must be able to run a TCP/IP stack, process packets, and complete a TCP handshake, all requiring the system to utilize or spawn threads in memory, call libraries, etc. Therefore, the system would still be susceptible to protocol attacks it may not be patched for (TCP sequence ...


13

Do you have experience with CLI (command line interface), like Windows command prompt? If so, why not get a Raspberry Pi? The Pi is going to be smaller, faster, and more efficient than your old laptop. You can get a Pi for ~$50. Then you download (or get pre-installed SD card with ) their NOOBS software and install Raspbian OS, which is a Debian fork, ...


8

I also am questioning how this machine can run Win98 (which wasn't exactly an efficient OS in its day), but it cannot run Linux. How about taking a Linux Live CD (bootable "frozen" OS), editing the ISO to include the web pages you want to serve, removing local storage (pull out the hard drive), then boot off of the Linux Live CD and reboot daily? Even if ...


5

In simple terms: Your browser starts to connect to an HTTPS website, asking to use a strong cipher. The attacker intercepts this request and replaces it with one asking to use weak "export-grade" encryption. The server gets this modified request and responds to your browser with an export-grade encryption key. Your browser doesn't notice the key it got is ...


3

No, it's not secure. You're vulnerable to: Cold boot attacks (freeze memory and extract the contents, get BitLocker encryption keys and all your other sensitive data) DMA attacks via FireWire, CardBus, ExpressCard, Thunderbolt, etc. Installation of a physical keylogger (many laptop keyboards can be easily removed) or backdoor hardware. In general, if an ...


2

This is simply a bad idea unless you just want to try it for fun. Anyone who suggests it could be done is making too many assumptions. There isn't enough information to make a call. Probably the main issues include Win98 is old, is no longer patched and is likely vulnerable to many existing penetration techniques which were not even thought of back ...


2

It is perfectly possible to have the same public key in several distinct certificates. Mathematically, the public and private key are linked (in RSA parlance, they use the same modulus) and there is nothing that you can do for or against it. It just is. Technically, a given machine may store certificates and private keys in some dedicated structures, and a ...


2

For Windows operating systems, Microsoft has multiple KB Articles and other references to address SSL/TLS configuration. Microsoft KB Article 245030, How to restrict the use of certain cryptographic algorithms and protocols in Schannel.dll has practically everything you'll need to know. Currently, the KB Article covers operating systems ranging from NT 4 up ...


2

In the end, it's not the OS that's the issue, but the application and the service running it. If your firewall is locked down tight, if the computer is physically secured, and the ONLY thing you are doing to serving a static page, then it comes down to the web server and what "else" the static page could do. It CAN be done, but the web server you choose to ...


2

This is possible to an extent, on Windows, using the Windows Data Protection API; more specifically the CryptProtectData function. This function allows you to encrypt data against a user profile or machine, so that only that entity may recover the data. Your setup would look something like this: A dedicated service user is configured for the application. ...


2

Get rid of that old box! It's too much hassle. Buy a Raspberry Pi B+. It's fast for your needs, cheap to buy, and within five to ten months it will earn the investment back by saving electricity. That old box maybe uses up to $10 a month for electricity, the RPi maybe $1.


2

You can not generate your own EV certificates and especially you can not generate self-signed EV certificates. Only some CA's are able to generate these and these CA's are specifically marked in the SSL stacks of the browser or operating systems. If you want to create EV by yourself you would have to change the SSL stack used by the browser to accept the ...


1

Depends on what you mean spoof and what you mean IP. If you want to be a specific IP4 or IP6 it may not be possible. Such as you pretending to come from Google's IP. But if you just want to test various IPs against a security firewall that's different. You can generally find VPN like hidemyass.com to use their IP. Some are anonymous, others not so much. ...


1

How can I spoof source ip address while making a ping request from windows command prompt? If you just want to change your local network address (e.g., change from 192.168.1.69 to 192.168.1.70) then you can set a different static IP address in the Windows "Network and Sharing Center". The exact steps depend on what version of Windows you are using, ...


1

You could send the mails in standard S/MIME format, which would allow recipients to use a plugin for their mail client of choice to read the encrypted parts without too much hassle. I know for a fact that there are Tunderbird plugins, and I'm pretty sure Outlook has native support for S/MIME. You can create these mails with the openssl command line tool: ...


1

This is mainly an addition to armani's answer. As Win98 has not been maintained for years, you cannot expect the OS TCP/IP stack to be exempt of bugs. But you certainly can find a recent (decent) OS accepting to run on an old computer. NanoBSD for example declares that it can be customized to low requirements : it is possible to cut the system down, so it ...


1

In addition to Polynomial's answer it's worth noting that the network interfaces will still be up and active and any access through that route (shares, remote management services etc.) may permit access to stored data regardless of screen locking. Either remote network sessions, or someone plugging in a device to your network ports could provide a surprising ...


1

Considering that a modern computer (or even a smartphone) can compute circles around a 15 year old laptop one would need to ask "why?", esp. as the old hardware is expected to fail more-or-less anytime. If this is a "because I can" project, then have at it and good luck. If you simply want your own webserver, it is very easy to set one up on your current ...


1

How about KolibriOS and write your own web-server? Or Tinfoil Hat Linux and maintain it? (shouldn't take too long, just upgrade everything to the latest versions and hack around with dependencies until you get it to compile) Most importantly before I can provide other suggestions, what are you hardware specifications; and personal skill level?


1

"I can't find any documentation on how key derivation works. There are some mentions of PBKDF2, but that's about it. " DiskCryptor is very visibly derivated from Truecrypt and shares some of its old style constants. It uses SHA-512 with 1000 iterations as key derivation algorithm according to ...


1

windows is a close source OS so, your work is hard. you need learn basically about windows Architecture and you need learn Assembly with c/c++ language for attack. specially Assembly. also about this sentence : i used book about nmap, Metasploit, exploit writing etc..., but they contained too much information about too many OS's this tools ...


1

A 'mail scanner' is not necessary with most modern webmail providers. Most modern webmail providers will scan your email and remove any malware. In addition if the user has a standard Antivirus installed it should catch anything else (download links, etc) when the file is downloaded and created. You can test this by sending your user a EICAR test file: ...


1

I ran out of space on my previous answer, but think this is valid and useful information: Revocation The next few sections discuss CRL and certificates, but before you get too far I want to draw your attention to an issue that may affect production and PKI operations: If you think your PKI will revoke twice the same certificate with Microsoft's PKI ...



Only top voted, non community-wiki answers of a minimum length are eligible