0
votes
0answers
7 views

XSS Page Cannot be Displayed

When I try XSS on various websites, such as inserting " onmouseover="alert(1) in a search box, I either get a message saying You don't have permission to access this page or This page cannot be ...
0
votes
0answers
6 views

Simulation vs Formal Analysis of Authentication Protocols

I received a review for my journal paper in which we proposed WOOlim or nspk kind of authentication protocols. We proved the strength of our protocol with rigorous formal methods using CSP and rank ...
-2
votes
0answers
12 views

MITM Protection

This company claims to have solved the MITM attack: ...
0
votes
0answers
5 views

InitializeSecurityContext takes 45 seconds to come out

For a Expired certificate sent by the server, the InitializeSecurityContext functions takes more than 45 seconds to come out with SEC_E_CERT_EXPIRED. Is there any configuration to avoid this much ...
0
votes
1answer
6 views

How can I check the integrity of a file with GPG?

I plan on running several servers with bitcoind and other things. How can I do file check with GPG key? I did the following: first I downloaded the file I want to check over a secure connection: ...
0
votes
0answers
8 views

Recover encryption key from Windows

Ok, So last night my Windows 10 Laptop crashed and was stuck in a repair boot loop and after troubleshooting and restarting and so on, the best course of action was to reset my PC. So as I was in ...
0
votes
1answer
22 views

Strange symbols in Firefox address bar with https

Why are there dash marks through the https portion of this address? Is this a feature that's supposed to further accentuate that this is unsecured https? I just thought it was a graphical glitch ...
0
votes
0answers
10 views

AES256 nopadding vs PKCS7Padding

I was looking over AES Crypt's Java lib which seems like a secure AES encryption software and I noticed that they are using nopadding. Can somebody explain to me what the benefit of using nopadding as ...
-2
votes
1answer
29 views

Is it possible for a school to see what you're doing when connected to their WiFi?

Let's say I connect to my schools WiFi, and I log into Facebook. Could they see my login information, my messages and what not? I know they could see what applications you are using, but I'm still not ...
0
votes
0answers
24 views

Decrypting binary code from a base64 string

So, this online discussion function use decoded account names in every post, along with that they call "logging data", an example of this can be: Loggin data: 10878 Encoded account info: ...
2
votes
1answer
43 views

Fear regarding session tokens

I have read recently that sessions work as follows: Your credentials are checked. A token is generated and stored on server side, eg UUID, and this token is given to the client where it is stored ...
1
vote
0answers
10 views

Are deleted offline calendar events in Android actually deleted?

When an Android app deletes a calendar event in a local (offline / non-synced) calendar, does Android's Calendar Storage (com.android.providers.calendar) actually delete the event or does it just flag ...
0
votes
2answers
43 views

Setting up a secure VM and protecting host network

I'm an intern doing research on different honeypots, and I'm planning to test a few on a VM. However, I'm on a company network and would like to have my VM as secure as possible. I've read that VMs ...
-2
votes
0answers
18 views

“DNS not found” when connecting to a public wi-fi spot [on hold]

Trying to connect to a public free wifi spot (eg. in Starbucks) on my os x and on my Win10 laptops, after I click "connect" on the appropriate wifi network name, the "connected" icon appears, which is ...
0
votes
0answers
15 views

Virtualbox wipe drive on exit

In Virtualbox, is there a way to wipe the virtual drive of a Guest OS upon exiting/shutting down that OS? If not, is there any other way to reaching that goal without doing it manually?
15
votes
1answer
1k views

Does Microsoft's “Password Ban” list insecurely store user passwords?

Supposedly, Microsoft is banning common passwords, and their list will dynamically update: Microsoft says it is dynamically banning common passwords from Microsoft Account and Azure AD system. ...
5
votes
0answers
32 views

SSL Certificate MITM Attack for Expired Domains

Let's say I have a domain name, like mysupercoolproduct.com. I buy a 2 year SSL certificate for it, and then I am negligent and the domain gets snatched up by someone else. I still have a valid SSL ...
2
votes
4answers
48 views

Is it beneficial to run the browser from a different user account for personal devices?

On Linux, when launching the browser does it help security if I don't run it from my main user (not root, but still has my personal information in it) as follows: su FirefoxUserName -c 'firefox' ...
0
votes
0answers
25 views

Make my SSH I treat like VPN more anonymous

I have a VPS (although I could easily upgrade to a dedicated server) which I use as a "poor man's VPN" by tunneling through it. My aim is to improve this server so anyone attempting to track me has ...
0
votes
0answers
32 views

Decryption with two-way authentication

We have a Customer who wants his sensitive user-data stored with an encryption. These are the basic requirements: Sensible user-data is stored in a database using encryption A remote-attacker who ...
4
votes
1answer
46 views

TLS/SSL Certificate - Key usage and encryption

So I'm looking at google.com's SSL certificate and do not understand a few things: I totally get that it ensures the identity of Google's webserver, but don't understand how it proves anything ...
-4
votes
0answers
39 views

Explain this jQuery in simple terms [on hold]

What does this line of code mean? jQuery("#HiddenReferral").val(jQuery(location).attr('href'));
1
vote
0answers
13 views

Does NSURLConnection on iOS support HSTS?

I have an app for iOS that uses NSURLConnection to retrieve things from a server. Will enabling HTTP Strict Transport Security (HSTS) on the server have any impact on the app? Will it refuse to ...
6
votes
2answers
1k views

How does HSTS stop MitM attacks?

I know that until a few years ago, someone could set up a fake wireless AP, and use something like SSLStrip to lure the victims into connecting to insecure versions of the major websites, such as ...
-1
votes
0answers
14 views

How do I setup openssl s_server to support ECDH-RSA-AES256-SHA cipher?

I need help to make a certificate/key and command line to execute the server.
1
vote
1answer
25 views

Does HSTS inlcudeSubDomains directive include subdomains on all levels?

I asked this question on Stack Overflow, but thought its more relevant here. Regarding the HSTS includeSubDomains directive. Does this include every subdomain underneath e.g. example.com. So ...
2
votes
1answer
32 views

Why is data quality important for privacy?

"Outdated personal data" is number 8 on the OWASP Top 10 Privacy Risks, and also the OECD Privacy Principles mention that data should be kept up to date: Personal data should be relevant to the ...
0
votes
1answer
17 views

How can I determine the common cryptographic suites I need to enable on my browser for common websites?

How do I determine the common cryptographic suites I need to enable on my browsers (I use IE11, Firefox/Nightly 49, Chrome 51) running on Windows for common websites, for eg, www.google.com, ...
2
votes
1answer
29 views

How to manage employee OpenPGP keys?

I am trying to create a secured policy for storing and maintaining keys between users of my company. I am rather new to OpenPGP and thus need some advice. Currently, the idea is: Generate a master ...
19
votes
4answers
2k views

Should I trust a website which uses a HTTPS certificate using SHA-1

I am on a website where I need to pay for something. This website has the following warning in the top left: This site uses a weak security configuration (SHA-1 signatures) so your connection ...
0
votes
0answers
48 views

Is there a ransomware variant that checks for file's magic numbers to encrypt?

Is there a known ransomware-variant (Cryptolocker, Cryptowall etc.) that before encrypting the files checks for their magic numbers? Lets say that there's a Word file, that had its file extension ...
1
vote
1answer
29 views

DOM based XSS: jQuery(“#HiddenReferral”).val(jQuery(location).attr('href'));

DOM based XSS has been reported by Burp Suite and showed this query as vulnerable: The application may be vulnerable to DOM-based cross-site scripting. Data is read from location and passed to ...
2
votes
0answers
16 views

Yubikey with gpg2

I recently purchased a Yubikey 4, which is working great for U2F and a static password, but I'd like to use the PGP Smartcard functionality as well, so I connected the Yubikey to my computer and ...
1
vote
1answer
28 views

Having malicious code stored in your DB

Let's say that there is a website which has an input field from which the input is saved to a database and then displayed somewhere else on the website. Is it safe to only sanitize/escape the ...
1
vote
0answers
52 views

Is it possible to trick a person into going to a website, and running JavaScript, without them knowing? (no iframes)

My website is W. If you make a GET request to my website, it gives you JavaScript, and if you execute the JS, then you do some action (if you are logged in and have a session cookie). Can someone ...
0
votes
2answers
49 views

Is cellphone based (tethered) Wi-Fi hot-spot hackable?

When we have Wi-Fi router and and somebody is connected to it, they can access its settings by visiting 192.168.1.1 or some other address. If password for router access is weak then router can be ...
-3
votes
0answers
65 views

Why does this registry key keep getting recreated even if I delete it?

When I open my registry editor I see this: C:\Windows\system32\WindowsPowerShell\v1.0\powershell.exe -noprofile -windowstyle hidden -executionpolicy bypass iex ...
1
vote
0answers
9 views

Error Running command shell :TimeoutError Operation Time out

I am Testing a Payload linux/x86/meterpreter/reverse_tcp in my Test Linux network to Exploit, I got a Meterpreter Session by Metasploit using it, I tried several commands like getuid, cat and all ...
0
votes
3answers
85 views

Disadvantages of using same key for encryption and decryption in symmetric cipher?

In a symmetric cipher, the same key is used for encryption and decryption. What are some disadvantages of using the same key?
0
votes
1answer
29 views

XSS to overcome HTML entities

In a search box (<input value=" *insert search term here* "...>), when I input " onmouseover="alert(1), the double quotes are converted to their entities, so it's not possible to break out of ...
1
vote
0answers
14 views

SSH certfificates generated on server user-creation + login scheme secure?

I'm sketching on a way to harden and automate server login using ssh-keygen with certificates where certificates, valid for e.g. 1 week, are generated on a trusted server and can be used to both ...
0
votes
0answers
11 views

Testing framework that can run external tools [on hold]

Can you recommend a testing framework that can run external tools like msf, sipvicious, nmap or similar tools and collect the results?
0
votes
1answer
32 views

Deploy intranet application with SSL certificate

My company has an intranet application build on the WAMP stack - Windows / Apache / MySQL / PHP. This application is installed on a server at each customer's site, and is accessed via LAN IP address. ...
1
vote
1answer
46 views

Security of a desktop application's source code

How easy is it to get the source code from a desktop application? Are there any protections in place to stop someone from viewing an application's code?
4
votes
0answers
8 views

How do virtual trusted platform modules protect data?

From what I've read so far, vTPMs are able to securely store data on disk images. The disk images are encrypted and its keys are stored by the vTPM Manager. vTPM Manager also securely stores data on a ...
5
votes
0answers
17 views

Why do browsers or operating systems not have default DNSSEC validation?

Many resolvers (including TLDs and Root TLDs) support DNSSEC, also Google's OpenDNS servers support it. Yet it isn't checked on the client side by default. Why is this?
0
votes
0answers
18 views

How to use MANA Toolkit for MitM attack?

I have recently developed interest about Wireless hacking, and I can perform simple dictionary type attacks, and etc. But, now I want to get the user's FB or Google credentials, and I want to perform ...
-2
votes
0answers
16 views

How can I get rid of ogafdr.dll malware?

Every time my Windows 7 PC starts, Avast reports the following malicious process: C:\Program Files\cbe0a0d456caf9f5ffc42818634b4af9\d82a24b74d9073b29e5c73bb798c5253.exe The file reported by Avast ...
0
votes
1answer
16 views

Use externally generated CA cert to sign CSR's in OpenSSL

I wondering if it is at all possible to use an externally generated root CA ( and by external I mean an internal root CA that was created using another tool) and use it with OpenSSL to sign a CSR? ...
0
votes
1answer
53 views

Questions regarding AES 256

i have googled and searched quite alot but most things just state the same things but not answering my questions so hopefully you guys can help me out abit Story: i am looking at creating an ...

15 30 50 per page