0
votes
0answers
15 views

Network Management

I was after a little bit of advice regarding Network Management. Users will enter the network and hit a remote desktop server. On from this, they will pass through firewalls to the core switch. When ...
0
votes
0answers
14 views

Can data be tampered with after expert clones a drive?

Intro It might be more related to law than security. 3 computers where sealed and taken form a person's apartment. Investigators invited him to unseal the pc's, they were intact and they started the ...
1
vote
0answers
25 views

A sneaky way of disabling Microsoft Security Essentials?

For a long time I've been dismissing and ignoring this popup, which is easy since it only appears at boot (or logon) which is once every few months: But recently I became suspicious after a crash ...
0
votes
0answers
29 views

Does Microsoft Edge (Spartan) share Cookies, Cache, Passwords, or TLS Certificates with Internet Explorer?

Windows 10 was released with a new browser called Microsoft Edge. Interestingly, Internet Explorer is also installed on the same default install. Given that Chrome and Firefox tend to separate their ...
6
votes
2answers
159 views

Input Sanitization vs Output Sanitization

In the bits that I've searched about this, I've seen a few people declare as word-of-god that you should only sanitize outputs and not inputs. Why? Would it not be safer to cover both ends?
0
votes
0answers
12 views

How to handle the aftermath of a possible firewall compromise? [on hold]

Today while I was away at work, my router and one of my Windows boxes both spontaneously rebooted, at roughly the same time. After this, the firewall failed to start DHCP and Apache services on ...
1
vote
2answers
26 views

LAMP MailServer without SSL… so what's the problem?

I want to set up a MailServer on Ubuntu for my website, and access the email from my POP3 client without enabling SSL encryption (I suppose the SSL is used to encrypt the password?). My questions ...
0
votes
3answers
34 views

Password help with coding! [duplicate]

So, I'm terrible with any sort of coding, and I need help with passwords. I've forgotten the combination of password it put in for an email - I know the password, just not which letter was capitalized ...
-2
votes
0answers
35 views

How can i get my algorithm corrected? it seems it should be simple [on hold]

Im trying to make a really decent compression method. This is sort of getting throttled though by my lack in college level mathematics and algorithms. Can someone help me with this code? Its really ...
1
vote
0answers
6 views

Is it possible to low level format an Virtual Machine? [migrated]

I just came to wonder, if you can low level format the disk of an Virtual Machine, maybe you guys can help me with that?
1
vote
1answer
19 views

Source code scanning - PCI Requirement - Service Provider

I've been doing a lot of research regarding the requirements for source code scanning but haven't found anything conclusive when it comes to my question below. So I need some guidance from PCI Experts ...
2
votes
1answer
15 views

Setting up a wildcard certificate, question about generating CSR?

I have registered a new domain for a project. The hosting is actually done by a vendor. I have set the nameservers according to the vendors specs. Now they are requiring the cert in PFX format. ...
10
votes
5answers
672 views

Practice your security skills

Do you know of any good free platform in which we can practice mechanisms such as XSS, SQL injection, low level, reverse engineering and other hacking skills online? For example, I really liked Smash ...
19
votes
2answers
2k views

My friend revealed both private and public keys for his server. How serious is this?

A friend of mine managed to expose both id_rsa and id_rsa.pub file from his server via apache. I mentioned to him that this is serious security issue but he brushed this off like it was no big deal. ...
4
votes
1answer
238 views

How to store passwords in database so that they can be retrieved?

I'm developing a password manager web app. It's just for fun: I'm not exposing anybody's passwords. My idea was to use hashing+salting, and that's what I did for the master password. But then I ...
3
votes
2answers
28 views

Stealing OAuth2 Tokens from IoT Devices

As I am delving into different forms of session authentication and persistence, I started to question how tokens are stored and the risk of a token being compromised. The scenario I have in mind is as ...
0
votes
1answer
21 views

When do system access policies start to become source of security incidents? [on hold]

Consider the assumption we are dealing with systems handling secret information which is crucial for an organization's existence. I would like to know what is a good balance between security ...
15
votes
3answers
1k views

Could malware move during a scan to avoid detection?

I think every AV-Scanner is using some predictable recursive scan to search files for malware. Couldn't malware easily detect a scan and just move to an already checked location, determined by knowing ...
3
votes
2answers
46 views

Can you access Google Drive documents if you have the absolute path to the file?

I have been digging into Google Drive while I am trying to investigate a proper way to protect files on a site. In my experience if a user has the URL to a file they can access it without any ...
-7
votes
0answers
33 views

Should Free and Open Source Software and Hardware be Legally Manadated to Protect Users' Digital Rights? [on hold]

In light of the advent of the Purism Librem 15, and the Novena laptops, is it time to consider legally mandating the manufacture of Free and Open Source Hardware and Software, in order to uphold ...
-4
votes
1answer
23 views

Exploit php array and string using url variable [on hold]

I get this php error after requesting /main/located?location=usa&time=' on my site. array(0) { } string(8) "||| LOCATION I tried several methods to inject something, but all failed.. What do ...
4
votes
2answers
151 views

How to ensure that a person whose identity has been verified from an I.D. is the author of their exam answers?

Background We are designing a computer based test system where the examinees use their own computers to write their answers. The examinees' computers are booted to a custom Linux OS from USB drives ...
2
votes
0answers
11 views

SNORT sfportscan alert format

How can I modify the output alert from sfportscan ? Ex : output alert_csv: /var/log/snort/portscan.log timestamp,src,dst,dstport,msg OBS: I can set output for default alert file with this method ?
-3
votes
3answers
54 views

What security problems are there with enabling directory listing on my webserver? [duplicate]

I want to to ensure that every file on my webserver is secured. The problems I am having right now: If you go to my website, and enter a url like mywebsite.com/img/ if there is no index page in ...
4
votes
4answers
81 views

Famous XSS attacks over JavaScript [on hold]

I'm about to graduate in "Computer Science", and I'm writing thesis about the Javascript vulnerabilities. In particular, I'm analyzing the JS vulnerabilities that allow XSS attacks. I would like to ...
1
vote
0answers
30 views

Port Scanning - States definition

I am currently reading the "NMAP Network Scanning" book by Gordon Fyodor Lyon. On page 77 there is a description on how NMAP categorizes the ports based on host's responses (or not). What would help ...
0
votes
1answer
32 views

Centralized local hosted web based password manager

In our company we have more than 100 employers and everyone use several online applications daily. To access all of this sites they need a password which was now stored very insecurely. so I'm ...
3
votes
1answer
50 views

Adding SSL to existing applications

We need to strengthen the network communication between our systems, a mix of Windows, Linux and Embedded devices, written in C++ and C#. What we want to achieve is to prevent interception of our ...
0
votes
0answers
21 views

Get java code to check AP isolation is enabled? [on hold]

I am building a chat application in Java socket programming to communicate locally like IP messenger. When AP isolation is enabled I get only my IP and gateway.gateway. That's why I can't chat to ...
14
votes
3answers
1k views

Security Implications of Neglecting the Extra Byte for NULL Termination in C/C++ Arrays

Please Consider: English is my second language. On the Security Now! podcast episode 518 (HORNET: A Fix for TOR?), at the 27:51 mark Steve Gibson quotes an example of vulnerable code in C/C++: ...
2
votes
0answers
25 views

OpenVPN redirect-gateway def1 bypass-dhcp not working on 3G [on hold]

Edit I followed @begueradj advice in comments and posted the question on ServerFault : http://serverfault.com/questions/709340/openvpn-redirect-gateway-not-working-on-3g-cellular Original Question ...
5
votes
2answers
108 views

Connected cars: Skills needed for a security specialist [on hold]

Connected cars are being mass produced by many car manufactures such as Audi, GM, Honda and Hyundai (Founding members of the Open Automotive Alliance). Recently I have read a scaring article about ...
5
votes
3answers
98 views

What to do when iPhone is successfully phished

My girlfriend watched "some" pages on her iPhone and facebook.you-won.com page appeared. She didn't know how to get rid of that JavaScript alert, so she clicked OK. After that she closed the page, and ...
2
votes
2answers
49 views

Website Visited by Unresolved Ip

My Website is flooded with unknown visiters Awstats says that my website getting thousands of hits in few seconds. I am using robots.txt and .htaccess, but the problem stays there. Please help me ...
21
votes
3answers
3k views

How can people send me spam emails from the future?

Is this an exploit of the email system of some sort? I receive a great deal of spam every day, and my accounts in Yahoo and Gmail sometimes show me spam emails from the future. Yes, the future. ...
3
votes
1answer
102 views

Would the Stagefright vulnerability existing in Android be able to run on other phones?

I saw a question about Android's "Stagefright" vulnerability, and I got to thinking: other OS'es pre-process MMS messages to make it easier to view. iOS does it and shows a preview. Even BREW OS (the ...
2
votes
0answers
13 views

Is XSP suitable for Internet facing, production hosts? (either self hosted, as an Apache plugin, or FastCGI)

XSP is portable version of ASP.NET that allows for operation on OSX, Linux, and Windows. It's an alternative to IIS, and hosts its own web server, or can plug into existing web servers such as ...
3
votes
2answers
61 views

Where in a TLS connection can I get the signature of the content sent by the server?

I want to be able to prove that a given content returned by a HTTPS server was in fact served. I have looked over the whole TLS protocol and I found I can use ServerKeyExchange to get the server's ...
6
votes
1answer
45 views

VirtualBox: Ubuntu With or Without Virtual Hard Drive

I've been working on a setup using VirtualBox that uses the Whonix Gateway as a Tor middlebox and I am planning on using Ubuntu for the workstation. I don't plan on storing any information on the ...
1
vote
1answer
46 views

Use RSA Encryption With ASP.NET

My goal is to implement asymmetric encryption in an ASP.NET website to secure user-entered Social Security Numbers. I want to encrypt the SSNs with a public key, and only display a masked version, to ...
1
vote
0answers
54 views

Distribution of a public key with a dotnet client application?

I have a pretty good understanding of X509 cryptography etc, from my career in the smart card industry. So I know that the card scheme (e.g. Visa, MasterCard) is the highest level of trust - they sign ...
0
votes
2answers
97 views

Safety of Encryption Keys

I'm trying to figure out the best way to encrypt passwords for a forums site I'm working on. I've decided I'm going to use an encryption such as blowfish. From my understanding, you have a key, and ...
1
vote
1answer
96 views

What security practices should I keep in mind during development? [on hold]

I am beginning to develop apps for Android and iOS that make API calls to a PHP web application that I will be developing. Users will be required to sign up with a username, password, and (optional) ...
0
votes
1answer
16 views

hping3 - Ignoring not responding ports

Is there a way to ignore the not responding ports in the scan report? james@ahoi:~$ sudo hping3 -q --scan 1-1000 -S 192.168.0.1 Scanning 192.168.0.1 (192.168.0.1), port 1-1000 1000 ports to scan, use ...
1
vote
2answers
42 views

Conflict between cipher-suite and certificate

When capturing my SSL session (using Chrome) I have noticed that the server chose TLS_ECDHE_ECDSA_WITH_AES_128_GCM_SHA256 (0xc02b) as the cipher-suite and the certificate signedcertificate signature ...
3
votes
0answers
50 views

How to really treat security between peers in WebRTC

Recently I've been implementing WebRTC in my project and would like to add security and privacy to the couple. I then decided to search on and found something if it is really necessary to impose ...
0
votes
0answers
18 views

Export detailed reports from Rips Vulnerability Scanner 0.55

I am using RIPS 0.55 to scan for static source code vulnerabilities. Currently when running it at the directory level it just gives the category and the list of files. Is there a way to extract ...
0
votes
0answers
17 views

Does OAUth 2 allow authentication without UI (to an account with hard coded credentials)? [migrated]

Note: this question is not about authenticating to an account after receiving a valid access token. This is about the first leg in the authentication process that would obtain the valid access token. ...
-4
votes
0answers
42 views

XSS filter evasion when “less than” followed by an English character is filtered [on hold]

In a recent penetration test, I encountered an XSS filter that allows <,> to pass without encoding, but blocks <a, for example. The filter allows < <_ <, <ש, but DOESN'T allow ...
3
votes
3answers
42 views

What is the precise difference between a signature based vs behavior based antivirus?

I do not understand very well the difference between signature based vs behavior based antiviruses. Please clarify the distinction between the two.

15 30 50 per page