0
votes
0answers
3 views

sqlmap cannot find injection vulnerability

I create a page called register.php which will take 4 parameters user, pass, email, comments. And the pass is vulnerable to sql injeciton. I have tested the vulnerability manually by filling test', ...
0
votes
0answers
7 views

File Transfer on Lan or Internet Via Local Service Or System Account in windows

Since Local Service, Network Service And System Account are always logged on, Can these accounts be used in dail up connection or file transfer over Lan via other Service or Program? or is any ...
-1
votes
0answers
8 views

Software company possibly spying

recently I decided to check my network on task manager and have had some weird remote addresses from bandicam.com. I uninstalled it, deleted all registery keys of it and it still appears.
1
vote
0answers
10 views

Are Secure Desktop and separate process enough for hiding sensitive information in RAM?

In my program, I have an encrypted database on the file system with a password. It is decrypted in RAM, and the sensitive data get spread out too much in RAM for mistake to be auditable easily enough. ...
0
votes
1answer
13 views

Can I use a self-signed certificate in Tomcat for private APIs and a commercial certificate for public pages?

I distribute a Java desktop application that needs to communicate with some RESTful APIs served by embedded Tomcat within a Spring Boot webapp. I was planning on using a self-signed certificate for ...
0
votes
0answers
15 views

Are there any alternatives to EFS for transparently encrypting the contents of a folder in Windows?

EFS is not an option for me because I'm using Windows 7 Home Premium. Encrypting the entire drive with VeraCrypt or Bitlocker is not what I'm looking for because I am dual booting with Debian.
0
votes
1answer
49 views

What kind of backdoor can be made after hacking wi-fi? [on hold]

I'm interested to know if A hacks B's wifi password, what can A do to gain persistent access to the router even after B changes the wifi password? Secondly, how can we detect the backdoor and patch ...
1
vote
0answers
14 views

Is there an HSTS equivalent for DNSSec?

Is there any way to set a DNSSec-always policy similar to how HSTS commands Web Browsers to always use HTTPS? This would mitigate a DNSSec-strip attack (similar to SSLStrip)
4
votes
0answers
24 views

I just deployed DNSSec. Is there any benefit in DANE for a CA- issued Cert?

I just deployed DNSSec at https://val-id.com and https://getvalid.com Since DNSSec is a requirement of DANE, and I have a CA-based certificate, can I show my support for DANE-based deployments by ...
0
votes
0answers
27 views

SSL cipher suite usage statistics based on captured data [migrated]

Is there a reasonable method of building SSL cipher usage statistics based on captured packets? Let's say my web server supports a set of ciphers and I would like to find out how many clients ...
0
votes
0answers
15 views

How should I approach learning Verifiable Encryption?

I need to act as a proxy for certain types of encrypted data, and I want to make sure that my service isn't abused. To that end I need to verify the general structure of the data going through my ...
0
votes
0answers
7 views

upload received ssl data to distributed servers

I am doing the network traffic analysis for a live camera device from a Chinese company which allows to view the real time video from ios6 app. 172.17.200.2 is the IP of the ios device.And the ...
1
vote
1answer
20 views

Exploiting snmp private string [on hold]

Like many others I know about gathering info from snmp read only strings, and that with some tools we can grab the banner, but there is a private string, too, with READ WRITE authentication. Isn't ...
0
votes
1answer
22 views

VeraCrypt secure in public?

I have made a Veracrypt Containment that uses AES to encrypt everything inside. But my question is: can I securely put the containment file in public (everybody can access it) without anybody able to ...
1
vote
0answers
17 views

OpenPGP (RFC4880) - do you agree with my SimpleS2K (string-to-key) implementation?

Background: I'm writing a GPL Python OpenPGP to JSON parser which I'm testing on files generated with GPG 1.4.16. If given a passphrase, the parser will generate keys using the string-to-key methods ...
8
votes
3answers
386 views

External websites in logs

I have a website, let's call it www.good.com. I've been getting a lot of requests to www.good.com under completely different URLs than www.good.com. I suspect this traffic is also causing some site ...
0
votes
0answers
10 views

How to configure μTorrent for a VPN? [migrated]

I am using a VPN connection successfully for browsing but I have trouble when using it for torrents. I am sure that P2P is enabled by the VPN company so I must be missing some configuration. I know ...
10
votes
2answers
485 views

Why does rfc6797 say “An HSTS Host MUST NOT include the STS header field in HTTP responses over non-secure transport.”

Why does the RFC prohibit the server from sending HSTS to the client over HTTP? I can see that if a HTTP client responds to that unsecure HTTP response it might cause that site to be inaccessible ...
1
vote
0answers
16 views

nslookup shows wrong data [migrated]

I am currently an administrator and have about 150 windows systems running. The previous administrator turned out be be a real nightmare for me before he left. The network assignes some windows ...
2
votes
0answers
27 views

Find the installer of a Rootkit and reason for attack on a Linux OS? [duplicate]

My Linux Jenkins server was compromised and a Rootkit was installed. I know this since a running process tells me the path Jenkins job is running and it includes a URL with path pointing to a Python ...
0
votes
1answer
26 views

CSRF on GWT apps : bypassing the Same-Origin policy

At work we suspect a GWT app (that is not in production yet) we own to be vulnerable to CSRF. We have to look at it from a black-box point of view before a third-party security audit will be ...
2
votes
1answer
53 views

Why does WPA2 need a 4 way handshake?

If client and AP both have the Pairwise Master Key (PMK) available, why do we need a 4 way handshake again to derive some other key (PTK)? Why can't we use PMK for further security process?
1
vote
1answer
59 views

Wordpress blog hacked?

There is a Wordpress blog running on Wordpress 4.0. Anyone having the company webmail can signup to the blog using their Google+ account and submit blog posts. Once posted they will be sent to some ...
0
votes
0answers
21 views

How to remove Cryptowall Locker Virus [duplicate]

I have been getting issues with this Cryptowall Locker Virus, is there any permanent solutions to remove this virus from my pc. I have taken help from ...
0
votes
0answers
19 views

What is the most effective way to block IP address in Application Layer? [migrated]

I understand that most Routers/Firewalls are able to block IP tables in the network level. IPtables for instance is quite effective. However, I want an application layer IP block.I have an HAproxy ...
15
votes
7answers
2k views

Can 'cracked' product keys harm the user in any way?

If a user download commercial software through the official, corresponding website, but use a product key which you did not legitimately purchase (e.g. websites that offer a list of product keys for ...
0
votes
0answers
24 views

TLSV1 and TLSV1.2 coexist issue in wireshark

I analysed an live camero's net traffic and found that the client uses both TLS1.0 and TLS1.2 in the handshakings while the server only uses TLS1.0. How can the handshaking uses both TLSV1.0 and ...
1
vote
0answers
20 views

PowerShell / Windows - Security best practices for enabling Windows Remote Management

As the title indicates, I'm looking for industry best practices for enabling Windows Remote Management on a mix of Windows Servers (from 2000, 2003, 2008/R2 and 2012) to allow PowerShell to execute ...
-1
votes
0answers
23 views

Should Information Security staff have Local Admin and Domain Admin Privileges [on hold]

Please provide some insight into the reasons as to why Information Security staff should have local admin privileges or Domain Admin privileges. Appreciate your feedback on this.
0
votes
0answers
16 views

What is the best way to manipulate the browser fingerprint? [migrated]

The test here worries me: http://panopticlick.eff.org/ and I'd like to know if there is a good way to manipulate the browser fingerprint?
3
votes
1answer
41 views

How is JWT implemented?

I'm using django-rest-framework-jwt in one of my APIs. As you might know, the concept is simple: you send username and password and you get a token back. The token is not stored anywhere on the ...
2
votes
2answers
57 views

What are ways I can analyze malware in an infected machine, not just clean it?

I often run into infected devices in my environment and would like to learn more about the specific infections that have gotten in. What are the best tools and techniques I could use to do this? I ...
1
vote
1answer
55 views

Snort report - 1000+ alerts in 1 minute from port 5060

I woke up this morning and could see over 1000+ of these alerts. They came in the time space 23:34 - 23:35. Can anybody tell me what that was about and should I be worried for an eventual DDoS ...
1
vote
4answers
84 views

How can I stop this remote attack?

Someone appears to be logging into my machine remotely, I am running Avast anti virus with Comodo Firewall both report no attacks.I only noticed this because on my router security logs I see the ...
1
vote
0answers
27 views

What Firefox settings should be changed from factory defaults to ensure privacy vis-à-vis Mozilla?

Besides turning off everything in Edit/Preferences/Advanced/Data Choices and browser.newtabpage.directory.ping browser.newtabpage.directory.source browser.safebrowsing... ...
1
vote
0answers
18 views

How do nested vpns through VM work?

Let's say I have 2 different VPN services (vpn1 and vpn2) both using OpenVPN and a Linux host running a guest VM. Now let's suppose I connect from the Linux host to vpn1. Then I connect from the ...
2
votes
0answers
21 views

Is it necessary to purchase an OID for ADCS? [migrated]

I am interested in utilizing ADCS to generate trusted certificates for internal web applications. However, from my readings it appears that I need to purchase an OID, which looks pretty expensive. Is ...
2
votes
1answer
36 views

On the fly encryption for unencrypted cloud services?

Today Amazon announced their Cloud Drive with unlimited storage for only 60$/yr. Microsoft did the same with Office 365 a while ago. I don't really want to entrust either service with my dearest ...
0
votes
0answers
33 views

Calling a HTTPS web service [on hold]

Background I have a Java application, one part of it is to call a HTTPS web service regarding payment (offered by a company called PayPoint). The application is sitting on a IBM Websphere server. ...
-1
votes
1answer
41 views

AES or Serpent-Twofish-AES [on hold]

I want to encrypt my private stuff like credit cards, money, RSA private keys (and so on) but I don't know if I should use AES-256 only or in combo like Serpent-Twofish-AES (I am using Veracrypt). ...
0
votes
1answer
61 views

Website being probed from the Ukraine

I have a landing page setup for my business located at www.jdmxchange.com and have been getting some strange error logs from ELMAH. I apparently have users (or bots) in the Ukraine probing the hell ...
3
votes
3answers
70 views

Image steganography and tracking

We are running an online-press media-library. On this site many brands are uploading images and track press users download and views per image. But some brand now want to add unique code in image so ...
0
votes
1answer
47 views

Does VPN remote port forwarding compromise the anonymity of the VPN user?

An anonymous VPN service will typically assign the same public IP address to many VPN users. This procedure ensures that a connection cannot be traced back to the VPN subscriber: behind the veil of ...
0
votes
1answer
45 views

Unexpected/unwanted/unknown participant joined WebRTC session

While running the simpleWebRTC example Step8 of the WebRTC codelab tutorial on my local computer 192.168.2.101 (in my own home private network), when someone (that I don't know) joined in (video + ...
2
votes
1answer
52 views

Asymmetric / end to end encryption for web messaging app

Background I'm trying to design a secure and sustainable web app for messaging. The purpose is to learn how to create secure web application. The application is suppose to be written in Javascript ...
1
vote
0answers
14 views

JKS - Keystore protection and configuration file

It appears that Java Keystore is often used by web server using a configuration file, with the password opening the JKS written in it and also the password protecting the specific entry. How could ...
-1
votes
0answers
19 views

Effects of Upgrading OpenSSL library? [on hold]

we are having a Redhat linux server network proxy server [Apache http] with openssl version standing on [jae@myserver~]$ openssl version OpenSSL 0.9.8e-fips-rhel5 01 Jul 2008 I am planning to ...
0
votes
0answers
24 views

Buffer overflow lab problem [migrated]

Since our security course doesn't have a lab, i'm trying to solve the Seed project's lab . http://www.cis.syr.edu/~wedu/seed/Labs_12.04/Software/Buffer_Overflow/Buffer_Overflow.pdf But there seems ...
1
vote
0answers
21 views

How to design a right VPN connection for an organisation (Interconnected MPLS link or Individual FW)

Thanks in advance for your advice We have to implement VPN connection for nearly 7 countries Option 1 : As we have private MPLS link to all 7 countries. It is been outsourced Third party. They ...
0
votes
0answers
47 views

DOS attacks on 802.11 access points

I want to carry out resource exhaustion attacks on access points which would lead to DOS condition of the access point. I would like to exhaust the client association table,by imitating a large ...

15 30 50 per page