All Questions

2
votes
3answers
102 views

Encryption Key vs. One-Time Pad Brute Force

How does an attacker know when they've cracked a traditional encryption key? Wikipedia describes the one-time pad: A 140 character one-time-pad-encoded string subjected to a brute-force attack ...
2
votes
1answer
22 views

What attack vectors does AWS SSE-S3 help mitigate?

Reading into the various SSE options on S3, I'm can't understand the following: What exactly does the SSE-S3 (fully-managed, transparent at-rest encryption) protect you against? I can only think of ...
0
votes
0answers
25 views

No test for echainiv(authenc(hmac(sha256),cbc(aes))) (echainiv(authenc(hmac(sha256-generic),cbc-aes-aesni))) [closed]

I found this message in my log file while trying to setup a tunnel between a home agent and a mobile node. Could this be a reason of the failure of the tunnel or it can be ignored ? I am using the ...
1
vote
2answers
45 views

Is there any methodology to detect smart deauthentication attack?

I'm a project student in IIT-Hyderabad. I have been working in Wifi security domain for my M.Tech. In particular, I chose de-authentication attack. Whenever I sent De-Auth frames continuously to APs ...
2
votes
0answers
39 views

String Format Exploit x64 compiled with -Wformat-security -D_FORTIFY_SOURCE=2 on

I found a daemon running as uid 0 that has a string format vulnerability. It is compiled with -Wformat-security and -D_FORTIFY_SOURCE=2 on. I'm trying to write an exploit for it, but what I get is: ...
0
votes
3answers
97 views

Security concerns on hosting server

Few years back I hosted my website on godaddy but I was not that tech savy so they (customer care people) assisted me on hosting the website on their shared hosting server. Since then I am on a ...
71
votes
8answers
14k views

Is displaying remaining password retry count a security risk?

Some websites display a remaining password retry count when I input wrong passwords more than twice. For example, displaying that there are 3 retries remaining until locking out my account. Is this ...
2
votes
0answers
15 views

AWS SSM Agent protection

Our company is moving to the AWS cloud recently, and AWS relies a lot on the SSM agent, it is also opensource. ( https://github.com/aws/amazon-ssm-agent ) From my understanding, this agent is not ...
1
vote
2answers
93 views

Can you wipe a USB flash drive so securely that it's impossible to recover deleted files through forensic analysis? [duplicate]

Internal SSD can be wiped with TRIM, but USB sticks are external SSD. They're apparently difficult to wipe securely enough to make forensic analysis of the device impossible. This question has been ...
0
votes
0answers
36 views

Can OpenVAS do a scan on a scanner device?

I know OpenVAS can scan printers with just tweaking some scan configuration. I try to scan a scanner device but I only get one result which is OS Detection Consolidation and Reporting. I have an ...
2
votes
1answer
93 views

Why did Stuxnet have command and control servers?

I am currently reading Countdown to Zero Day which, amongst other things, describes Stuxnet in lay terms. It states that Stuxnet could report to two command and control servers. Most basic ...
0
votes
1answer
60 views

How does Google Authenticator interact with apps on an iPhone?

I am clear on how Google Authenticator works when logging on to a website and I am clear on that. However, these days everyone is using apps for everything. The Twitter app, the Facebook app, the ...
-2
votes
0answers
28 views

Cel im longer distance [closed]

Is title celler, one images in very sometimes save me. Did know a text one How rest connect a passowrd. some things peaceful.
0
votes
1answer
22 views

How are these transaction fingerprints colored?

For those unfamiliar, blockchains have two main types of data structures propagated in their networks: blocks and transactions. Each block and transaction has a hash, just like key fingerprints. The ...
3
votes
1answer
80 views

How should I share the key of the AES algorithm in each client?

My doubt would be the following: How should each client know the encryption key? Using the AES algorithm. (or the best way): Save it in a file encrypted by password? Save it in a DB? Send it over ...
1
vote
1answer
58 views

How to convert this .NET cryptography code to openssl command?

how to sign the message with the private key of the signer using openssl command line tool to get the same result as the code below? using System.Security.Cryptography.Pkcs; using System.Security....
0
votes
0answers
49 views

Where to start in security if I'm coming from physics? [closed]

I guess I have a few questions really. Is this even plausible? Should I look into other fields before getting into cyber security? I know basically nothing about information technology, but I am ...
2
votes
2answers
48 views

Private key DES password

If I have a SSL private key that is encrypted with a DES password, and I have to share with another admin a NODES copy of the private key, can the other admin determine what my DES password is?
0
votes
1answer
64 views

badBIOS reflashing

This is not a has-badBIOS-pwn3d-me post, so don't worry about any paranoid rants. Having read a thorough analysis/debunking of the alleged evilware, I certainly understand that the technology badBIOS ...
0
votes
0answers
45 views

Why am I getting a Mal/HTMLGen-A flag [closed]

Here is the results of the Sitelock XSS scan through their Sophos scan. I installed Sophos home and the shopitus.com gets red flagged. Please see below: Sitelock through their Sophos XSS scan URL: ...
0
votes
0answers
25 views

Unkown encryption type? [duplicate]

200 character long string ...
0
votes
0answers
679 views

In re Experian Data Breach Litigation postcard [closed]

I've received a postcard with an "Experian data breach claim form" and an "Important message from the court" attached. Could anyone explain to me what this is for and what I should do with it? They ...
0
votes
0answers
10 views

Can't install wine on Kali Linux 4.18.10 [migrated]

I can't install wine. I type apt-get install wine32 And I have this error Reading package lists... Done Building dependency tree Reading state information... Done Package wine32 is not available, ...
-3
votes
1answer
103 views

How long would it take to brute force a URL path that's 5 characters long

example.com/[a-zA-Z0-9] the code can be any mix of numbers + uppercase/lowercase letters and it's 5 characters. How long would it take to brute force or is there an easier/faster way to do it?
0
votes
1answer
31 views

How to automate OWASP ZAP Fuzzing

Is there any way I can automate fuzzing in zap. I know how to do it manually. But is there any way to create test suite and execute?
1
vote
2answers
68 views

Does Digital Certificate affect privacy of the user?

As I know the user use the digital certificate to identify himself for the others. Can a Digital Certificate to be use as unique identifier for the user to trace and profile user activities?
1
vote
1answer
65 views

How can CSRF POST happen?

I realise this is a newbie question but when it comes to this im clearly that. On a browser, assuming one received a cookie from site A. Then a different site B makes a call to site A through it's ...
0
votes
2answers
37 views

RSA signature security with short keys

RSA keys with the size of 1024 aren’t considered to be safe anymore. Does this also apply if you use this key for signing only? Can a signature be faked easily with a short key length?
0
votes
0answers
44 views

Certificate for Windows IoT Core Retail Image [closed]

I am working on a Windows 10 IoT Core application and I need to build a custom retail image of Windows 10 IoT Core. I was following the docs of building retail image for Windows 10 IoT Core here(https:...
0
votes
0answers
42 views

Secure https communication between two applications on same system

I have two applications running on the same computer. These applications need to communicate with each other. One application acts like a server and the other like a client. Client <-> Server ...
1
vote
0answers
41 views

How can user send malware code via input=file

After the file is uploaded via input=file it is converted to b64 standard. But what is the exact path the file is going through and where in javascript code we can catch that uploaded file. And if I ...
0
votes
1answer
86 views

SQL injection that bypasses website's firewall that filters table by its prefix

There is a website I am assessing for security breaches. It has Joomla 1.5.x with MySQL 5.5.24 and PHP 5.3.2. I am doing a penetration test, that exploits SQL injection. The thing is that WAF filters ...
0
votes
2answers
33 views

AWS serverless architecture compliance with PCI DSS 11.3 penetration testing segmentation

I am wondering how to comply with PCI DSS requirements (11.3) to test segmentation controls using penetration testing in AWS serverless architecture. We are using components such as AWS Lambda, AWS ...
0
votes
0answers
31 views

Cheap(er) HSM FIPS 140-2 [closed]

I'm currently building a project including electronic signature that requires the eIDAS certification. Currently, the eIDAS certification requires an HSM with the FIPS 140-2 Level 3 norm. But these ...
0
votes
1answer
40 views

How do JavaScript (and mobile) APIs keep user data clean?

Let's say we're running Google Analytics, and we're tracking user specific data (or displaying contents based on that data, such as most recently viewed pages) -- we add a pixel, and then we pass the ...
1
vote
1answer
32 views

Is the CN field on an SSL cert a secure form of authentication?

I'm using TLS client authentication for a machine-to-machine connection. In addition to ensuring the client has a valid cert, I'd like to have access control to ensure the request is originating from ...
1
vote
1answer
58 views

ISP's defence methods against IPv6 Spoofing

I read about there being methods applied by ISP's to defend networks against IPv4 spoofing, but not too much about IPv6 spoofing. I'm wondering if someone has some knowledge if ISP's apply techniques ...
0
votes
2answers
67 views

Why is the SSL message red?

The site Phonel.ir uses a SSL certificate. Why is the Error message in red? Is there a problem with the SSL certification? I sometimes use a proxy. Can that be the reason?
0
votes
0answers
24 views

How to decrypt an openssl_encrypt() encrypted value using MySQL query? [closed]

If I am using the following php script to encrypt a field in my database: <?php require_once('../api.php'); $newApi = new api(); $conn = $newApi->connection(); //$key previously generated ...
0
votes
0answers
23 views

What am I missing in port forwarding? [migrated]

I am trying to forward a specific port on my router with listening to that port number, but when I run canyouseeme tool, it shows the connection is refused. I made the inbound rule, no firewall no ...
0
votes
2answers
200 views

What do we do when passwords are not secure anymore? [closed]

During an intense shower thought train. I began to think about a hypothetical world where passwords were no longer a safe way of protecting systems. Edit: W̶h̶e̶t̶h̶e̶r̶ ̶c̶o̶m̶p̶u̶t̶e̶r̶s̶ ...
-2
votes
0answers
16 views

Can anyone please suggest any drupal contrib modules or suggest any custom hooks to implement the below password policies in drupal 8 [closed]

Can anyone please suggest any drupal contrib modules or suggest any custom hooks to implement the below password policies in drupal 8 1.Apply a password dictionary and/or other checks to prevent ...
2
votes
0answers
31 views

Is Privileged Access Management secured without regular Patch Update?

It is well know Privileged Access Management (PAM) is a solution that helps organizations restrict privileged access within an existing Active Directory environment. Many big company use it to address ...
0
votes
1answer
21 views

Classification of countermeasures for family of vulnerabilities

I would like to know if anyone of you has already read about some models that would classify a set of possible countermeasures against a family of vulnerabilities. What I mean by a 'family of ...
2
votes
2answers
80 views

Does accessing a personally owned Tor node (that only you ever visit) over the Tor network break anonymity?

Does accessing a personally owned Tor node (that only you ever visit) over the Tor network break anonymity? I read from a long guide by Whonix on how to properly use Tor that I shouldn't ever access ...
2
votes
1answer
81 views

Asymmetric public-key cryptography: can either key be used to encrypt or decrypt?

Key exchange describes a public key encrypting plaintext and the private key decrypting, while in digital signatures the reverse is true where the private key is used to encrypt a hash that the ...
0
votes
2answers
50 views

How pincodes used as an authentication mechanism?

I'm designing a login system for my mobile app where users only need to provide a pincode to authenticate into the app after they sign-up. I'm more wondering how the backend would work in such a ...
3
votes
2answers
91 views

Proprietary RF Protocol Security

I've just been reading this article on proprietary RF protocols vs Bluetooth and it seems to be suggesting that the security through obscurity gained through a proprietary protocol is advantageous ...
0
votes
0answers
53 views

Watchbog cryptomining. Who can get some more info about it? [closed]

This is a comment on a previous post A process called ./watchbog is mining crypto currency in our server. How do I stop it? It happened to me in a RHEL 6 system and wanted to share my info in case ...
3
votes
2answers
101 views

Should I inform the previous email account that it is no longer the main email address of my user?

I'm building a website where you can register with an email account. In your account private section you can find a form where you can change the email address to use when logging in. I wanted this ...

15 30 50 per page