Tag Info

New answers tagged

0

So deploying metasploit would be one option as you've mentioned however if you want a more Powershell route could look at using nishang which provides modules like powerpreter to help with pivoting on a network once you've compromised a single host.


0

The access security solution UserLock can prevent or limit concurrent logins on a Windows Server based network - this as part of a customized access control policy. It can be set by user, user group or OU and across all session types (workstation, terminal, IIS, VPN or Wi-Fi). There is no way in Windows native functionality to limit concurrent logins - i.e. ...


21

UPDATE Your device (W8901G) is in all likelihood VULNERABLE, to the very exploit described below, and more, and even more. I think that the steps suggested below may ameliorate your situation, but unless a firmware fix is available from TP-Link, you should consider replacing your router. The TP-Link search form did not supply any link (W8901G is ...


0

Every connection within your LAN must go through a router or switch. Some routers allow access control lists, which can block/allow connections to specific ports and services. Each host may also implement internal firewall rules to only broadcast a service to specific hosts, this however, means more management and operational overhead. Another option is to ...


1

These scammers often scare people by disguising harmless elements (such as event log entries, firewall rules, etc) into evidence of compromise and malware. For example they could tell you to execute some commands or find in advanced system properties what looks like a random number but is actually an reference to some system component common on all systems, ...


1

FYI, I just encountered a case where a credential (possibly corrupt, since it showed up under an entry named with only two, odd Unicode characters) appeared only in the rundll32.exe keymgr.dll,KRShowKeyMgr interface, and not in the Credential Manager interface found in the Windows 7 control panel. So it may be worth checking both interfaces for cached ...


0

Windows Firewall if is enabled blocks unsolicited connections to your computer. So any programs can connect to internet if user's actions make that happent but no connection can inbound whitout a previously demand. In conclusion: no IN without OUT and vice versa no OUT denies IN.


0

so I don't think this is going to be 100% possible. What you can do is limit your servers to a single RDP session : https://support.managed.com/kb/a1816/how-to-enable-disable-multiple-rdp-sessions-in-windows-2012.aspx What you won't be able to prevent (I don't think) is someone using a console session at the same time (so MSTSC /admin) and the equivelent ...


0

ProcessExplorer by SysInternals can help with this if you have access to the machine. You can even submit hashed process data to VirusTotal to give you an idea if it's a legitimate file/process or not. It also color codes data which I find very helpful. And you can quickly determine which files are signed. For a quick tutorial on how to get the most ...


1

It depends on how indepth the auditor wants to go or more correctly what is in scope for the audit. I would start with the standard port scan looking at standard windows services that are open. You will more than likely find non-standard services open and these are more than likely applications added on top of the OS (Vendor/3rd party apps). These are ripe ...


1

To get process inforomation programmatically (as you asked), it depends on the language you want to use but also on your processor version (32 or 64 bits). You can use Python's subprocess module: import subprocess cmd = 'WMIC PROCESS get Caption,Commandline,Processid' proc = subprocess.Popen(cmd, shell=True, stdout=subprocess.PIPE) for line in proc.stdout: ...


3

The list of common/legitimate processes will depend on the OS installed. Also, the list will depend on the software you have installed on your machine. In Windows, you can trytasklistIn Linux, you can try ps You can make a list of trusted applications(which you can do manually or lookup online). Then, after getting the list of running processes ...


1

Microsoft is able to remotely push code to your machine that will be installed and executed with the system's privileges the next time Windows Update runs (a practical example of this is the new "Get Windows 10" tray icon bullshit that continuously stays running in memory). So, while they definitely won't be doing this on a large scale (eventually someone ...


0

In short, you only have Microsoft's promise that they won't do that. If Microsoft were to log your activity inside programs for their own purposes, they would likely come under a lot of fire for doing so, both in terms of people being angry as well as possible legal action (especially from government agencies that use Windows). I wouldn't worry too much ...


1

Tor browser prevents somebody watching your Internet connection from learning what sites you visit. It prevents the sites you visit from learning your physical location, and it lets you access sites which are blocked. This statement is valid for Microsoft Windows OS. So to answer bluntly: No. EDIT: Following your comment: As by your machine ...


0

When you connect to a site via SSL, the server serves the certificate for that site during the SSL session. In the issuer field of this certificate, the subject of the certificate that was used to sign the site's certificate (i.e. the next certificate up in the chain) is specified. That certificate may have been signed by another certificate, and so on and ...


3

What exactly is this checking? Where is Windows (or more specifically, the Crypto Shell Extension application) populating the information on this tab from? It is showing the trust path it constructed based on the certificates sent in the SSL handshake (ignoring any root certificates sent by the server), the cached intermediate certificates from other ...


0

I assume what you mean by "live forensics" would be what the infosec community usually refers as memory forensics, eg. taking your machine while it is active and unlocked and proceeding to dump all data from it. The solution to your problem would be twofold: First you need to have good physical security, so that attackers can't access your unlocked ...


9

There are security risk frameworks (STRIDE, DREAD and others) that you can apply to get a systematic approach to assessing risks and threats. TFS is a Microsoft solution that implements a sort of Git (from my experience, I don’t believe it’s a pure Git integration, but I may be wrong). They do offer valuable resources for security, so that’s worth checking ...


4

Technically, using SHA-256 won't make things really harder for the attacker. Unless you are the attacker. The concerns about SHA-1 are about collisions. SHA-1 is believed to be somewhat weak in that respect (generating a SHA-1 collision is still very expensive, to the point that it has not been done yet even once, but we have strong theoretical reasons to ...


1

My short answer: Changing from SHA1 to SHA256 for file signatures will barely increase your security, the only good reason would be to keep current with best practices. The concern with SHA-1 and the potential for collisions is that potential decryption may take place. This has to do with decrypting hashes after the fact: for example, passwords in a ...


0

If you are concerned about the security of SHA-1 then you must know that SHA-1's use on the Internet has been deprecated since 2011 and just to give you a hint: HTTPS sites whose certificate chains use SHA-1 and are valid past 1 January 2017 will no longer appear to be fully trustworthy in Chrome’s user interface. But there is no successful complete ...


2

The goal of a piece of malware is to stay on your system for as long as it can. To do this it takes a number of steps, and often just having user administrative privileges is not enough. Gaining execution is only one step. If the malware is lucky enough for the user to execute it it can not assume that it has admin rights. In which case, exploitation of a ...


1

Don't assume the user always has admin rights. That may be the case on home computers, but on corporate networks, the users may be non-privileged users. As to why a virus needs to expoloit a specific vulnerability: Many users aren't stupid enough to download a virus onto their machine and then run it. Even if they did, then UAC would pop up an obvious ...


0

I found the origin. Both Answers have given me the right indications to go on. With ProcessExplorer i picked the right svchost process (the same PID) and opened the TCP/IP tab, with wireshark i waited for the request, as it was sent, the TCP/IP tab from ProcessExplorer showed me the service wich was trying to establish a connection: BITS Service (Background ...


1

They r feasibly safe in the sense that in order to compute 2^160 hash computations which r technologically infeasible. And you don't need to worry of downloading an .iso of windows while u can create an .iso from install.esd files from some1's Genuine windows copy(if u r little bit paranoid).


0

you should change your hostname too btw this bash script can be useful (macchanger should be installed): echo "" echo "THIS SCRIPT WILL SET A RANDOM HOSTNAME AND" echo "RENEW YOUR I.P. WITH A RANDOM MAC ADDRESS" echo "" echo "" echo "TO ABORT PRESS: Ctrl+c" echo "" echo "PRESS ENTER TO CONTINUE: " read enter sleep 0.25 clear sleep 0.5 #Get Random String ...


5

You could sniff the network for traffic and change your network configuration to an active machine(i.e. MAC address): # ifconfig wlan0 down # ifconfig wlan0 hw ether DE:AD:66:55:12:34 <== sniffed MAC # ifconfig wlan0 up assuming wlan0 is your wireless network interface. On Windows you can do something like this. Now there should be two work stations ...


1

Go to sysinternals and install a trace tool. Record 20m of activity and locate that request. Then go back to the orign of that request.


3

It seems that "gvt1.com" its owned by Google (whois shows:) Registrant Name: DNS Admin Registrant Organization: Google Inc. Registrant Street: 1600 Amphitheatre Parkway Registrant City: Mountain View Registrant State/Province: CA Registrant Postal Code: 94043 Registrant Country: US Registrant Phone: +1.6506234000 Registrant Phone Ext: Registrant Fax: ...


4

For a malicious attacker who tries to alter an ISO file while keeping its hash value identical to the hash value of the "genuine" file, the problem is known as a second preimage attack. No such attack is known for SHA-1 right now; if somebody wanted to compute such a second preimage, he would have to pay a cost of about 2160 hash function computations, which ...


-1

Say I'm a normal Internet user [...] what are the chances that I will get hacked or malware find a way into my PC? 100%


2

If you are careful as you say, the chances will be lower, but not 0. Trusted websites can also contain malicious flash content. The games on Facebook are made by third parties and that means that you can never be sure if the game has some malicious code. Adds can also contain malicious flash. Another problem is, if a website has an XSS vulnerability, an ...


0

I wrote a tool (in C# and powershell using reflection) that walks thread stacks and reports where the function calls are loading from using GetMappedFile. Shows where all functions are executing from (i.e. which dll and where on disk) if the MappedFile property is blank, most likely reflectively loaded ;) https://github.com/secabstraction/PowerWalker


1

Alasjo already provided a good answer, but I think some additional information could help you grasp the difficulties you have and how to address them. In you question you suggested encryption. Just encrypting the uploaded data cannot be enough to secure them. Since encrypted data is useless without a mean to decrypt them, your application would have to ...


0

I'm assuming that You know how RPC works. Metasploit allows enumeration of DCE-RPC services(DCOM objects) using methods listed by you and other than that is hidden. Endpoint mapper provides you the list DCOM objects or services registered with Endpoint Mapper. Why Endpoint Mapper is because of it supports dynamic bindiings to the services. The list of ...


0

I think Docker would be a possible solution for this. I am not an expert on Docker. So this is a concept idea solution. I am thinking that you could create a few containers for the database and fig up. So say you build 3 containers (1-master, 1-internal and 1-webapp) with containing the same database in each. Then you could get them to be scanned before ...


2

There are numerous questions with answers on this site as well as Owasp guidelines that cover the risks of allowing file uploads and how to store files properly. You may want to check the legislation that applies to your application and take necessary action to store files accordingly (encryption, access rights, data integrity, logging). As for your idea ...


4

There are a few possible scenarios, even after assuming Man in the Middle is not happening. Missing patches: If your system is missing a patch that allows RCE, that is an easy win. There are plenty of remote exploits that exist, and new ones every so often. Mitigation: Patch your system! Are you on a domain? You didn't mention Windows 7 Home or ...


2

When I hear this question, my first response is don't. If you are at all concerned about your personal network and your personal data, don't expose any part of it directly to the internet by hosting services. If you feel you must, here are some steps: Host the website on an entirely separate machine with nothing else on it Put that machine on a DMZ (most ...


1

Security is a process, where new software bugs are discovered from time to time. Sometimes by good people, and sometimes by bad people. Software bugs can be discovered in both user software, like Excel, but also in OS network stack. Windows 7 is based on rather well tested code, in which hundreds of remote vulnerabilities were found and patched during last ...


3

Microsoft is hoping to incorporate SSH: http://blogs.msdn.com/b/powershell/archive/2015/06/03/looking-forward-microsoft-support-for-secure-shell-ssh.aspx However, that has been attempted before and then fell by the wayside. As for your question, there is no standard or overriding reason why a user might enable SSH but disable SFTP, but there can always ...


0

SFTP and other SSH solutions are not standard on Windows mainly because they are not standardized and properly documented in RFCs. Microsoft provides the bare minimum if any facilities to enable SSH. That said I had no issues using it with ported Penix utilities compiled with Cygwin. Just don't expect it to make it's way into official development framework ...


8

Because SFTP runs over the same protocol as SSH, there is no valid technical reason to refuse to enable SFTP. That said, there may be company policies that prevent this. There is a big difference between an SSH connection to issue commands, and an SFTP to transfer files. A company might accept the risk of allowing an approved account to access another ...



Top 50 recent answers are included