All Questions

I'm trying to find a basis for comparing key pair based authentication with password based authentication, and their relative resistance to guessing / brute force attacks. I appreciate that a user-...

I have a web-server running a Perl site, and I have a WAF (ModSecurity) running. The website has a form. When submitted the request contain HTML tags like so: <br+/> <div+style="border:none;...

There are so many CAs in firefox, that are impossible to approve the reliability of all of them. How do I remove all CAs but the biggest ones like Lets Encrypt, Google Trust Services, GlobalSign and ...

If you have an router with default login and password for the admin page, can a potential hacker gain access to it without first connecting to the LAN via the WiFi login?

I have several web based applications that will redirect unauthenticated users to an ADFS sign-in page. ADFS will subsequently redirect users back to a web application once authenticated with a token. ...

Information is encoded in English alphabets (there are 26 distinct alphabets and capitalization is ignored) and four rotors are used in a rotor-machine based cipher. The key is hardcoded on the rotor ...

As I undertand it, the basic idea of XSS is to let the users browser execute some malicious code created by the hackers. Say, if a page has a vulnerability of loading arbitrary script when user access ...

There are a lot of items in the GDPR that I am a fan of. Mandatory unsubscribe links are the best thing to happen to my inbox since I started using email. But there is one thing in particular I've ...

I am running windows 10 on a X1 carbon. I think I picked up a malware while I was visiting a website. Here are symptoms I had been observing: When I opened the web site, I saw that there is usb ...

First, I may be asking a dumb question. I am trying to learn, so please, take it easy on me. Second, if this is not the right place for this question, or you can link me elsewhere, please tell me/ ...

I have an apache2 server with my test website running on my host machine, which is accessible by the victim. I am using Ettercap to perform an arp poisoning man-in-the-middle attack, and I need to ...

The global digital giant's services like facebook/gmail/twitter/etc are not following standard password policies (like the standard password policies used by most of the Enterprises/Corporate). For ...

I am using AWS. I need to connect with a local SSH client to Linux EC2/ECS instances. I also need to connect with a local PostgreSQL client to RDS instances. There are tutorials for creating SSH ...

I tried executing CLI OpenSSL on both MacOS (Sierra) and Linux (Debian) and noticed that the output of the code is different depending on the operating system. I read the version release and it doesn'...

Can anyone using my wifi see what I'm browsing? I've already read questions and answers about this topic and everybody suggests to use VPN. I have two questions: is Tor safe for this issue? If I ...

I know I can restrict ssh and ftp access to my unix server by using tools like ufw (uncomplicated firewall). What if I restrict ssh and ftp access to one IP address (my home IP) and then suddenly lose ...

How is it possible to test a deepnet post form with hydra? or any other network login bruter... I'm just getting a 'socks5 error cannot connect'. I've set the HYDRA_PROXY variable to socks5://127.0.0....

Smartcard readers can not just read bank cards, but also RSA smartcards. I wonder if it is possible to use a ChipTAN generator for other cards too. What is needed to set up a personal infrastructure ...

The proper way to secure erase a SSD is to issue the SECURITY ERASE UNIT command. Then the SSD controller should send a BLOCK ERASE command to all physical blocks. One caveat: the SSD has to be ...

I have a web application and I keep getting unwarranted offers from "security experts" and the results I get are pretty convincing. Somehow, they send me a report of PHP files running and ways on how ...

I'd like to know how much the risk changes if I don't update the software on the guest OS in a VM (applications and the guest operating system itself), compared to the risk in case it's all kept up-to-...

I am trying to understand the basic unlinc() exploit on the heap. (Yes, I know its been patched for years now.) I think I understand conceptually what is happening. The chunk that is being un-linked ...

I'm trying to design a security scheme that involves a shared secret but isn't a traditional account password situation. The server would store a set of "keys", each of which has a blob of data ...

Application security debt has some similarities to technical debt but there are few differences that we need to think about when deciding if our security debt load has gotten too high and needs to be ...

OPM Breach Anthem Health Care Equifax The list goes on... If we define meaningful as non-monetary compensation (e.g. services) to protect victims from further victimization stemming from loss of ...

I'm hosting centos 7 servers which are exposed to the risk of malicious attacks. I have to protect the machines from the attacks. What is the best way to know how to protect attacks from system ...

I am doing a security audit and discovered an Oracle Server pulling data from an ODS server in plaintext. I am able to sniff the traffic from one of the internal servers. Essentially, the Oracle ...

I have an application which has its own oauth microservice to issue access tokens. The flow runs as below: User enters username and password to register, which makes api call to user-microservice ...

I write back-end code for mobile applications. I am needing to write the code for authentication and the simplest yet secure solution I can think of is: When user signs in, device sends username and ...

The hashed value created by the MD5 hashing algorithm contains 32 chars, each of which contains 1 of 16 possible values. Simple math demonstrates that this could result in 16^32 number of ...

Is the signals of a mobile phone-call encrypted between the phone and the mobile-tower or only between the towers? And is it possible for a non-authority individual to eavesdrop on your conversation ...

Say I have a large list (10 million) of published accounts and associated passwords. Assume this is a representative sample of population of account passwords. From this sample I can generate a ...

I have Ubuntu Server 16.04 and PostgreSql database. How to organize automatically backups? Is this better idea to move my database to AWS RDS instead having database on my server?

I have been trying to access the c library routine within memory but somehow, I'm restricted from reading the address at <main+84> could someone tell me what is the problem? here is my GDB ...

Recently I attempted to log in to Facebook, but I'd forgotten that I'd changed my password. Facebook bounced me back to the login screen and advised me that I'd attempted to enter an old password. ...

I'm practicing buffer overflow for a class and I have a piece of code that I borrowed from an open source system. Unfortunately, I'll not be able to reveal that code. My system information: nikel$ ...

I'm having some trouble using hydra to crack my website login. Below is my command. hydra -L userdummy.txt -P passdummy.txt -vV 104.20.113.15 https-post-form "/website.com/sign-in:email=^USER^&...

My ISP (JCOM) says that McAfee is the only security software that will work with them. Is that true? The system is running Windows 7 Home Premium Japanese Version. The McAfee system is provided by ...

I know it's recommended to use a VPN with a hotel WiFi but if I'm in a hurry and don't have time to setup my own VPN server would an SSH tunnel (invoked with ssh -D) work just as well to secure my web ...

Basically i watch movies that could contain threats, is there a safe way to open these, as firejail does have access to certain white listed files. https://firejail.wordpress.com/ There are ways to ...

I am learning about CompTIA Security+ and there it was mentioned that proxy firewalls are of two types; application layer and circuit layer. But there was only a basic explanation of proxy firewall. ...

I do have password that has been encrypted with Bcrypt and the salt . Is it possible if I want to decrypt the password into normal text ?

I want to run many snippets of untrusted and unknown code on an Ubuntu machine hosted on Digital Ocean. For safety reasons, I would like to record and block any external calls made by any of the code ...

Ignoring that there are far better and more standard approaches to providing authentication and integrity guarantees, what (if any) weaknesses would a system as outlined below that relies on AES (AES/...

I purchased a MacBook Pro 13 inch early 2015 about three years ago. Unfortunately, some snow melted and drained a lot of the keyboard. Since the power button is in embedded in the keyboard, it is not ...

When I download files I am unsure of from the web I typically download them into Sandboxie to be safe. If I open a downloaded file within the sandbox (a pdf of a book for example) and I open to find ...

My antivirus noted gcp.gvt2.com certificate is expired today, gvt2.com alegently used by google analytics. It might to do with Google distrust of Symantec https://security.googleblog.com/2018/03/...

I’m looking for advice as to self learning material etc. I’m in Washington State and am close to getting my low voltage electrical license. I work on/troubleshoot/build out IDFs Meg’s etc and do all ...

If a hard disk drive that contains malware, is connected to a hardware write blocker, that works on the lowest level, can this malware copy itself ,spread on the hardware write blocker or even on the ...

I would like to begin by clarifying, my question does not relate to TapJacking attacks on Android and to my knowledge filterTouchesWhenObscured will not help in my case. Here is the scenario: I work ...