Related to security concerns specific to the Microsoft Windows operating system itself. For security of applications that happen to be running on Windows, please use [appsec]. For the X Window System, please use [x11].

learn more… | top users | synonyms

0
votes
0answers
19 views

rdp connection with netcat pivoting

I want to connection from local computer to another local computer. I have 3 machine. for example A: 192.168.1.50 -> in local windows machine B: 50.3.52.110 -> linux server C: 192.168.5.25 -&...
-1
votes
0answers
47 views

Windows 8 hacking

Can a Windows 8 machine can be hacked, by only knowing the IP address of the victim, without having first penetrated the Wifi? Say I disable the Wifi altogether and start my computer fresh..is it ...
1
vote
0answers
18 views

Is it safe to paste secure notes into Notepad if you clear your clipboard? [duplicate]

Password manager software such as LastPass and Keepass often offer some form of a secure note feature, which allows the user to encrypt data with their master password. However, their GUIs may not be ...
0
votes
4answers
153 views

How to block all porn websites from firewall?

I want to block all porn websites and similar contents in my Windows 7 PC using Windows firewall. Till now I can block it by inserting sites one by one. Is there any category defined for such sites or ...
-1
votes
0answers
34 views

Alternatives to Windows Internals [on hold]

The shiny new book on Windows 10 internals is coming on December 29. Until this date, what other (official) source(s) can I use/research to deepen my knowledge in Windows domain? Keep in mind that not ...
4
votes
1answer
142 views

Why is it a security issue to load Notepad++ plugins from %APPDATA% folder?

I have used the Notepad++ installer several times. However, it caught my eye that in one of the installer windows there is an option of: Allow plugins to be loaded from %APPDATA%." Below it there ...
0
votes
0answers
52 views

Windows API call sequence monitoring

I need to monitor an API call sequence created by a process running on Microsoft Windows, to analyze malware behavior. I know we can do user mode or kernel mode monitoring. I have tried some tools ...
2
votes
1answer
253 views

How did someone find my Windows username?

I recently (and stupidly) created a Windows SBS 2011 user whose password was the username. Multiple unauthorized people across the Internet used RDP to log in as that user. How did they find the ...
-6
votes
0answers
76 views

How can I identify a person accessing my computer? [on hold]

Activity on my computer last night when I was not home: Log Name: Security Source: Microsoft-Windows-Security-Auditing Date: 7/16/2016 11:27:59 PM Event ID: 4672 Task ...
3
votes
2answers
124 views

Why does DISA STIG recommend “Deny access to this computer from the network” for Domain Admins?

For Windows systems, the U.S. DISA STIGs recommend enabling the Deny access to this computer from the network for the Domain Admins and Enterprise Admins groups: https://www.stigviewer.com/stig/...
1
vote
1answer
88 views

Is there a way to prevent changing the MAC address on a Windows machine?

Is it possible to stop someone from changing the MAC address of a Windows machine using GPOs?
3
votes
2answers
185 views

Does typing something in Notepad but not saving it leave any trace?

Sometimes, if I'm having trouble typing a long password, I'll open up Notepad, type it in their (so I can make sure what I'm typing is correct), and the copy+paste it into the form, and then close the ...
3
votes
0answers
37 views

Can I use my computer while BitLocker is encrypting the system drive? [migrated]

I am thinking of encrypting my Windows 10 laptop with BitLocker (although I am curious about the answer for other versions too). If I start the process I imagine it will take a while since I have lots ...
0
votes
1answer
66 views

Can't remove suspicious bridge connection

I'm currently fixing the computer of a family member who just fell for the "I'm from Microsoft and let me take control of your computer please" phone scam. The computer is an old Core 2 Duo running on ...
-1
votes
3answers
61 views

Why is netapi obsolete [closed]

Why is the ms08_067_netapi exploit obsolete? Are there alternatives to this exploit that can help me inject payloads to more recent version of windows?
12
votes
3answers
655 views

Can Microsoft access all private data if a user installs Windows 10?

According to this Forbes article by Gordon Kelly, a condition of using Microsoft's Windows 10 operating system is to agree to the following: [Microsoft] will access, disclose and preserve personal ...
0
votes
2answers
81 views

How to use standalone meterpreter exe with a USB key connected to an unlocked victim session

When I need to make a POC about why it is dangerous to let the session unlocked, I used to put a mimikatz on an USB key and get the logon credentials in clear text. But sometimes the client has no ...
2
votes
1answer
60 views

Use local admin or domain admin to raise privileges on a machine for administrative purposes?

By now I would hope that, unless there were extenuating circumstances, all users (including administrative users) use a low-level account for their daily activities and raise their permissions to ...
0
votes
0answers
6 views

Using Windows installers created in SCCM on a custom boot menu [migrated]

I'm wanting to place several Windows Installers on an external HD and have a custom boot menu on it so one of those builds can be selected. Each of these are Windows 7 builds which have been created ...
0
votes
1answer
82 views

How does Antivirus sandbox work?

Supposing we have a malicious .EXE which deletes (using DEL command with cmd) a sensitive system file. First, common antivirus will analysis the file with signature detection. Secondly, it will be ...
-1
votes
2answers
127 views

Trouble with Metasploit framework (kali linux) [ms08_067_netapi]

I'm new to kali linux and just penetration testing in general. I'm having a bit of trouble with the metasploit framework in getting into my own pc. I've used this tutorial and I get an error that says ...
2
votes
2answers
124 views

Is Qubes OS more secure than running a set of activity related VMs?

I'd like to skip the argument about Linux being more secure than Windows, and purely focus on the security boundaries between Host OS and VMs. Is Qubes OS theoretically more secure than say - Windows ...
5
votes
3answers
91 views

Can I test my own network?

I'm currently trying to enter the field of information security and I was just wondering if there was anything barring me from testing my own network for security vulnerabilities? I only have a couple ...
6
votes
0answers
59 views

Can I use disk encryption and track my device at the same time, in case it's stolen or lost? [duplicate]

I would like to encrypt a single user profile but have been told EFS isn't the solution. I have a laptop that I leave in my bag and use for work and private purposes. I want to secure data in case my ...
1
vote
1answer
35 views

Unable to PSEXEC into machine with admin hash

I'm doing a penetration test at the moment, and I am trying to PSEXEC into a machine for which I have the local administrator hash. I am attempting this with metasploit and metasploits psexec module. ...
0
votes
0answers
93 views

Possible to detect Metasploit trojan installation on Windows 10?

I'm concerned my Win 10 installation may be infected with one of Metasploit's trojan variants. How could I go about confirming or disproving this suspicion? Are there ways to detect Metasploit hacks?
0
votes
3answers
126 views

How secure is Windows 10 account control?

I have a Microsoft account in my machine (Admin). I set a guest account (Standard) for a friend so he can play games. Is there any way he could access my files/folders info? I mean, get data, view ...
4
votes
2answers
89 views

How attaching to a process with a debugger can compromise system's security?

Visual Studio shows a warning, trying to attach to a different user's process: Searching for an explanation, I've found the MSDN article, claiming that: An untrusted process that contains ...
3
votes
2answers
160 views

Ransom32: How does it work?

Ransom32 seems to be a new ransomware written (partly) in JavaScript. As I understand it, it doesn't affect a user through a browser / by visiting a website, but by downloading some .rar file which ...
0
votes
1answer
99 views

Can I detect when a file is copied on Windows?

Can I detect when a file is copied on Windows? Will it create an event in the Windows log? Or can I not? I know you can detect when a file is created due to the file pointers and stuff, but can you ...
2
votes
1answer
63 views

What is the definition for different access attributes in object access auditing?

Though there is documentation available about configuring Object Access auditing, there is no place where I have found any documents explaining the different attributes in Object Access Auditing. Can ...
3
votes
0answers
66 views

security of libgcrypt when cross-compiling for windows?

Looking at libgcrypt, specifically secmem.c it seems that it does not account for windows-specific memory handling (e.g. VirtualLock) and in fact there is a very troubling comment: #elif defined (...
3
votes
0answers
37 views

Host process for windows services network activity between other computer on same network

Wondering if this is normal? I have two PCs hooked up to a router and when the other one powers up and I check my firewall I see that there's some sporadic network activity going on (mainly upload/...
1
vote
1answer
49 views

Shared folders in Windows to/from unsecured PC on the same network

I have a Windows 10 desktop computer which is my main device. It's password-protected and I'm not concerned about it being physically accessed by bad actors. I have a Windows 7 laptop with a fresh OS ...
-3
votes
1answer
91 views

checking if malware altered system files in windows

a friend called me today because he opened an attachment of an email. It was a double zipped exe file - and malware: I started to analyze the file: first with virustotal - then with radare2 and the ...
3
votes
4answers
317 views

Is a computer more vulnerable if wireless is left on when booting?

Normally I switch off wireless on my laptop before I shut it down but I forgot to do this last night. So this morning, after I booted up the laptop, I saw the wireless notification on the bottom right ...
3
votes
1answer
47 views

Possible security measures to put into place before allowing screen sharing

I have someone who is having their non profit small company receive a financial audit. They are prepared for it but the financial auditors have asked to also do part of it remotely and would like to ...
3
votes
1answer
52 views

Application Whitelisting Approaches/Options on non-Enterprise Windows PCs

For a while now I've been kicking around the idea of implementing application whitelisting on a few sets of machines (owned by 2-3 different consulting clients) I administer that seem suitable for it. ...
3
votes
2answers
125 views

Comparison and difference between CAs

While doing some Google searches, I learnt that there are a lot of different Certification Authorities like the Windows role named "Active Directory Certificate Services", the OpenSSL library or the ...
0
votes
1answer
59 views

Is it safe to use this online tool to generate my Windows Answer File?

I found a Tool to generate an unattended Windows Answer File for Windows Installation but I'm not sure if it is safe to use. It asks for the default password to setup a local admin user and the ...
0
votes
1answer
54 views

How to connect to Windows RDP and delegate authentication to a (reverse) proxy?

Looking for the following setup: Client connects to Windows RDP server through proxy server. The client is in public network hence can't send username/password for logon. The proxy server in between ...
8
votes
1answer
185 views

Does Logging out of Windows make my computer much safer than only locking?

I recently saw the following security tip on my company's intranet: When you are done using a computer, always Log Off, Restart, or Shut Down. If you only lock your computer, your account ...
3
votes
2answers
271 views

Detecting when a screenshot is taken by a software (spyware) in Windows [closed]

Most trojaning, spyware and keylogger tools have the ability to take screenshots. Is there a way to detect if an app or software is taking a screenshot in Windows? Maybe a Windows API call or dll? ...
3
votes
3answers
212 views

Is Bitlocker trustworthy?

My question isn't about whether or not the encryption on Bitlocker works, but whether or not there has been any security audits about potential backdoors Microsoft may have installed. I don't have a ...
0
votes
0answers
47 views

How to extract the hash from SMB

I have a running PC which I need to test against.It is running Windows with SMB enabled. When capturing using Wireshark while connecting with an incorrect password I see packets being sent to / from ...
1
vote
1answer
79 views

Creating a system to try new software out

I am using Windows 10 and I like it. I would like to experiment without doing harm to my main system that I work with. Experimenting means, downloading software from doubtful sources, executing ...
0
votes
2answers
169 views

C# .Net most secure way to store RSA Key Pair in Windows

At the moment I am looking into the most secure way to store a private RSA key on Windows. Making it as much usable for the end user as possible, while keeping the security to its highest. As this ...
-7
votes
1answer
66 views

bind(merge) exe with jpg [closed]

i have an exe file and a jpg file, i want to bind them into one executable(exe) file, in the way that when user double click on that executable: first image will shown to him then the exe file will ...
1
vote
0answers
62 views

Bypass UAC without meterpreter session?

I have a research project about "Malvertising". I try to show an attack by using metasploit and I am using a Flash Plugin to hack the victim (exploit/multi/browser/adobe_flash_hacking_team_uaf) This ...
1
vote
1answer
63 views

SHA-256 Timestamp not recognized in windows 7 when dual signed

I wanted to dual sign my exe so that the XP and Vista users can use the software. But when i dual sign the exe with SHA1 and SHA256 timestamps, In windows7 only 1 timestamp is shown. To dual sign I ...