0
votes
2answers
20 views

Strength of key pair

I'm trying to find a basis for comparing key pair based authentication with password based authentication, and their relative resistance to guessing / brute force attacks. I appreciate that a user-...
0
votes
0answers
11 views

Allow ModSecurity to pass specific HTML tags?

I have a web-server running a Perl site, and I have a WAF (ModSecurity) running. The website has a form. When submitted the request contain HTML tags like so: <br+/> <div+style="border:none;...
1
vote
1answer
37 views

remove untrustworthy CAs from firefox

There are so many CAs in firefox, that are impossible to approve the reliability of all of them. How do I remove all CAs but the biggest ones like Lets Encrypt, Google Trust Services, GlobalSign and ...
12
votes
3answers
1k views

Can someone without the WiFi login and no physical access to a router still access it with the admin login?

If you have an router with default login and password for the admin page, can a potential hacker gain access to it without first connecting to the LAN via the WiFi login?
1
vote
1answer
30 views

How to protect a login page redirect

I have several web based applications that will redirect unauthenticated users to an ADFS sign-in page. ADFS will subsequently redirect users back to a web application once authenticated with a token. ...
1
vote
0answers
21 views

Rotor-Machine entropy and brute-force attack time

Information is encoded in English alphabets (there are 26 distinct alphabets and capitalization is ignored) and four rotors are used in a rotor-machine based cipher. The key is hardcoded on the rotor ...
8
votes
5answers
1k views

How does hackers make the victim access an XSS attack URL?

As I undertand it, the basic idea of XSS is to let the users browser execute some malicious code created by the hackers. Say, if a page has a vulnerability of loading arbitrary script when user access ...
0
votes
1answer
45 views

Do websites outside of the EU need to consider GDPR?

There are a lot of items in the GDPR that I am a fan of. Mandatory unsubscribe links are the best thing to happen to my inbox since I started using email. But there is one thing in particular I've ...
0
votes
0answers
32 views

Malware makes fake USB device

I am running windows 10 on a X1 carbon. I think I picked up a malware while I was visiting a website. Here are symptoms I had been observing: When I opened the web site, I saw that there is usb ...
1
vote
1answer
21 views

Why would TLSv1.0 TLS_ECDHE_RSA_WITH_AES_256_CBC_SHA still be used?

First, I may be asking a dumb question. I am trying to learn, so please, take it easy on me. Second, if this is not the right place for this question, or you can link me elsewhere, please tell me/ ...
0
votes
1answer
13 views

Spoofing ip webserver with Ettercap

I have an apache2 server with my test website running on my host machine, which is accessible by the victim. I am using Ettercap to perform an arp poisoning man-in-the-middle attack, and I need to ...
1
vote
2answers
34 views

Is my personal data at risk with global digital giant's services?

The global digital giant's services like facebook/gmail/twitter/etc are not following standard password policies (like the standard password policies used by most of the Enterprises/Corporate). For ...
0
votes
1answer
42 views

Should I have an SSH bastion?

I am using AWS. I need to connect with a local SSH client to Linux EC2/ECS instances. I also need to connect with a local PostgreSQL client to RDS instances. There are tutorials for creating SSH ...
-1
votes
1answer
37 views

OpenSSL On Linux and MacOSX have different outputs

I tried executing CLI OpenSSL on both MacOS (Sierra) and Linux (Debian) and noticed that the output of the code is different depending on the operating system. I read the version release and it doesn'...
1
vote
1answer
78 views

Can anyone using my wifi see what I'm browsing?

Can anyone using my wifi see what I'm browsing? I've already read questions and answers about this topic and everybody suggests to use VPN. I have two questions: is Tor safe for this issue? If I ...
0
votes
0answers
4 views

Restricting ssh and ftp access to unix server [migrated]

I know I can restrict ssh and ftp access to my unix server by using tools like ufw (uncomplicated firewall). What if I restrict ssh and ftp access to one IP address (my home IP) and then suddenly lose ...
0
votes
0answers
12 views

Running Hydra Over Tor

How is it possible to test a deepnet post form with hydra? or any other network login bruter... I'm just getting a 'socks5 error cannot connect'. I've set the HYDRA_PROXY variable to socks5://127.0.0....
0
votes
0answers
16 views

Setup own infrastructure for a ChipTAN generator

Smartcard readers can not just read bank cards, but also RSA smartcards. I wonder if it is possible to use a ChipTAN generator for other cards too. What is needed to set up a personal infrastructure ...
3
votes
1answer
35 views

Howto restore factory default state of a USB pen drive?

The proper way to secure erase a SSD is to issue the SECURITY ERASE UNIT command. Then the SSD controller should send a BLOCK ERASE command to all physical blocks. One caveat: the SSD has to be ...
0
votes
2answers
60 views

Protecting a web app from unwanted vulnerability scanners

I have a web application and I keep getting unwarranted offers from "security experts" and the results I get are pretty convincing. Somehow, they send me a report of PHP files running and ways on how ...
0
votes
2answers
56 views

Risk of infecting the host OS if the guest OS is out of date

I'd like to know how much the risk changes if I don't update the software on the guest OS in a VM (applications and the guest operating system itself), compared to the risk in case it's all kept up-to-...
0
votes
0answers
26 views

Confused over unlink() macro for malloc

I am trying to understand the basic unlinc() exploit on the heap. (Yes, I know its been patched for years now.) I think I understand conceptually what is happening. The chunk that is being un-linked ...
1
vote
1answer
70 views

Slow Hashing Without a Salt?

I'm trying to design a security scheme that involves a shared secret but isn't a traditional account password situation. The server would store a set of "keys", each of which has a blob of data ...
1
vote
1answer
62 views

How to calculate our application security debt?

Application security debt has some similarities to technical debt but there are few differences that we need to think about when deciding if our security debt load has gotten too high and needs to be ...
0
votes
0answers
35 views

Do security breach victims have any meaningful recourse?

OPM Breach Anthem Health Care Equifax The list goes on... If we define meaningful as non-monetary compensation (e.g. services) to protect victims from further victimization stemming from loss of ...
0
votes
1answer
47 views

What is the best way to know current attack for a server machine? [on hold]

I'm hosting centos 7 servers which are exposed to the risk of malicious attacks. I have to protect the machines from the attacks. What is the best way to know how to protect attacks from system ...
0
votes
0answers
17 views

How to prevent Oracle TNS protocol sending data in plaintext?

I am doing a security audit and discovered an Oracle Server pulling data from an ODS server in plaintext. I am able to sniff the traffic from one of the internal servers. Essentially, the Oracle ...
0
votes
0answers
20 views

What oauth grant type should I use after social sign in

I have an application which has its own oauth microservice to issue access tokens. The flow runs as below: User enters username and password to register, which makes api call to user-microservice ...
1
vote
1answer
26 views

Mobile application authentication using UUID

I write back-end code for mobile applications. I am needing to write the code for authentication and the simplest yet secure solution I can think of is: When user signs in, device sends username and ...
0
votes
0answers
63 views

How many unique MD5 hash values are there really? [duplicate]

The hashed value created by the MD5 hashing algorithm contains 32 chars, each of which contains 1 of 16 possible values. Simple math demonstrates that this could result in 16^32 number of ...
0
votes
1answer
71 views

Mobile call encryption

Is the signals of a mobile phone-call encrypted between the phone and the mobile-tower or only between the towers? And is it possible for a non-authority individual to eavesdrop on your conversation ...
2
votes
3answers
111 views

What is probability of a user picking a published password?

Say I have a large list (10 million) of published accounts and associated passwords. Assume this is a representative sample of population of account passwords. From this sample I can generate a ...
0
votes
0answers
11 views

Postgres on Ubuntu Server 16.04 - automatically backups [migrated]

I have Ubuntu Server 16.04 and PostgreSql database. How to organize automatically backups? Is this better idea to move my database to AWS RDS instead having database on my server?
0
votes
0answers
18 views

GDB cannot access memory of the c library routine

I have been trying to access the c library routine within memory but somehow, I'm restricted from reading the address at <main+84> could someone tell me what is the problem? here is my GDB ...
5
votes
3answers
87 views

Doesn't persisting previous passwords pose a vulnerability?

Recently I attempted to log in to Facebook, but I'd forgotten that I'd changed my password. Facebook bounced me back to the login screen and advised me that I'd attempted to enter an old password. ...
0
votes
0answers
27 views

Injected shellcode corrupted after leave instruction

I'm practicing buffer overflow for a class and I have a piece of code that I borrowed from an open source system. Unfortunately, I'll not be able to reveal that code. My system information: nikel$ ...
0
votes
0answers
34 views

THC-Hydra Issue-Giving false positive passwords

I'm having some trouble using hydra to crack my website login. Below is my command. hydra -L userdummy.txt -P passdummy.txt -vV 104.20.113.15 https-post-form "/website.com/sign-in:email=^USER^&...
1
vote
2answers
86 views

Can an ISP limit what security software (firewall) that will work?

My ISP (JCOM) says that McAfee is the only security software that will work with them. Is that true? The system is running Windows 7 Home Premium Japanese Version. The McAfee system is provided by ...
1
vote
1answer
55 views

VPN vs SSH tunnelling for hotel wifi

I know it's recommended to use a VPN with a hotel WiFi but if I'm in a hurry and don't have time to setup my own VPN server would an SSH tunnel (invoked with ssh -D) work just as well to secure my web ...
0
votes
0answers
14 views

How to open infected files safely with Firejail

Basically i watch movies that could contain threats, is there a safe way to open these, as firejail does have access to certain white listed files. https://firejail.wordpress.com/ There are ways to ...
-2
votes
1answer
23 views

How do proxy firewalls work on circuit and application layer? [on hold]

I am learning about CompTIA Security+ and there it was mentioned that proxy firewalls are of two types; application layer and circuit layer. But there was only a basic explanation of proxy firewall. ...
-3
votes
1answer
50 views

Is it possible to decrypt Bcrypt encryption? [duplicate]

I do have password that has been encrypted with Bcrypt and the salt . Is it possible if I want to decrypt the password into normal text ?
0
votes
1answer
26 views

Block external http calls

I want to run many snippets of untrusted and unknown code on an Ubuntu machine hosted on Digital Ocean. For safety reasons, I would like to record and block any external calls made by any of the code ...
0
votes
1answer
35 views

Using AES encryption to generate MAC (and provide authentication/integrity)

Ignoring that there are far better and more standard approaches to providing authentication and integrity guarantees, what (if any) weaknesses would a system as outlined below that relies on AES (AES/...
0
votes
0answers
39 views

Removing data from a solid state drive?

I purchased a MacBook Pro 13 inch early 2015 about three years ago. Unfortunately, some snow melted and drained a lot of the keyboard. Since the power button is in embedded in the keyboard, it is not ...
1
vote
2answers
38 views

Can a file that has been opened and read still contain a virus?

When I download files I am unsure of from the web I typically download them into Sandboxie to be safe. If I open a downloaded file within the sandbox (a pdf of a book for example) and I open to find ...
0
votes
1answer
117 views

Google certificate gcp.gvt2.com untrusted / expired?

My antivirus noted gcp.gvt2.com certificate is expired today, gvt2.com alegently used by google analytics. It might to do with Google distrust of Symantec https://security.googleblog.com/2018/03/...
0
votes
1answer
33 views

Looking to combine a AAS in cyber security with a 06 (low voltage electrical) [on hold]

I’m looking for advice as to self learning material etc. I’m in Washington State and am close to getting my low voltage electrical license. I work on/troubleshoot/build out IDFs Meg’s etc and do all ...
0
votes
1answer
52 views

security leak in working with hardware write blockers?

If a hard disk drive that contains malware, is connected to a hardware write blocker, that works on the lowest level, can this malware copy itself ,spread on the hardware write blocker or even on the ...
0
votes
0answers
11 views

Mitigations for Android Invisible Overlay Views

I would like to begin by clarifying, my question does not relate to TapJacking attacks on Android and to my knowledge filterTouchesWhenObscured will not help in my case. Here is the scenario: I work ...

15 30 50 per page