All Questions

0
votes
0answers
60 views

Cracking Zip File Password Encryption [duplicate]

Hey all I am currently taking a computer security course and while doing some research in cryptography I found that it was possible to crack the encryption of a password protected file in an encrypted ...
-5
votes
1answer
199 views

Monitor SSL traffic at home

There is an underage guest in my house for whom I will be legally responsible for the next few months and I'm concerned about some of his interactions online from some of the public postings I've seen ...
0
votes
0answers
56 views

Best architecture for a web app with highly sensitive data

I have to design a web app that contains medical information. Only the staff of the organization need to access the data in the office and on the go. A VPN is already in place. On premise server ...
1
vote
1answer
54 views

Cross platform OpenSSL aes encryption

I encrypted a file by using the following command from a stackoverflow answer: openssl enc -in file_name -aes-256-cbc -pass stdin -out file_name.aes; I can decrypt this file by running: openssl enc ...
-1
votes
0answers
26 views

i want to decrypt the msg but dont have key [duplicate]

"FGFNJ TYNYI FBMXM TQBJF JSQMI KLTDJ NYTYP WXJTW SJPWS EKOGB WAHUR BOAFG HBMOH VOUPI SUDPT HSGST FRCRS IHIAR BCHSA YUCOS WSTIF RDVZR SKRNC PKXJL FKYFG KENKG JVJFY RVNGF IVTVC RVVDV KBJNB JUVTF HIKPY ...
0
votes
0answers
43 views

Phoenix/Samsung BIOS/HDD security

I have a laptop bought in 2011. I want to protect its BIOS and HDD (data is already encrypted anyway). But I have seen these vulnerabilities: After 3 incorrect tries, I see "System Disabled" with ...
3
votes
1answer
96 views

Why OWASP considers TouchID as insecure?

As could be reviewed in 1 under Am I Vulnerable... section, OWASP page states that If the mobile app uses a feature like TouchID, it suffers from insecure authentication. The reasons for this are ...
0
votes
0answers
94 views

Have I Been Pwned Breached Email List by Domain Names

HIBP is a great service that I've been using for a long time. I had a question surrounding Domain Search feature on HIBP. I believe there has to be some form of verification from our end in order to ...
7
votes
1answer
156 views

What steps should I take to ensure there are no unpleasant surprises in a recently purchased home?

After buying a house from another party (i.e. not new construction) what steps should I take to ensure the previous residents have not left behind anything unpleasant for me? I'm not worrying about ...
0
votes
0answers
14 views

Windows registry subkey creation not generating logs (Windows event ID 4657) [migrated]

I am experiencing an issue where I am trying to audit a specific registry key via Windows Event ID 4657. TL; DR: I have tried to setup auditing on a registry key when a new subkey is created under it,...
1
vote
0answers
67 views

Buffer overflow return address with null byte, workaround

I'm practicing Buffer Overflows using Free Float FTP Server 1.0 on Windows 7 SP 1. I have done simple jmp esp examples on Windows XP, where system DLLs are without rebase or Address Space Layout ...
0
votes
0answers
41 views

Recover deleted Windows volumes

I have been given an HDD image. I believe the image was taken with dd. I have ingested the file using Autopsy and can see there are 4 volumes, like so Volume 1 - Unallocated. I believe NOT securely ...
0
votes
1answer
45 views

How to protect file integrity and history containing counters

I would like to create a solution that would sign the data and will have a increasing counter so I can track the number of signatures. One of the requirement is to have an increasing order of ...
1
vote
2answers
129 views

how easy a device can be hacked? [closed]

from when i was kid until today , i still have this idea that hacking is someone knows your ip address then he magically control your device and take a copy of your data. without even sending you a ...
0
votes
0answers
40 views

Is there any tool to identify steganography? [closed]

Stegdetect it is no longer developed, so what can I use? I would like to find a software that can identify stenography into files, any suggestions? [post only software taht works with "steghide"]
-1
votes
2answers
119 views

How to know if your work or home PC is being monitored or spied on?

I know it's not allowed to monitor employees' PCs without a reason or permission, however some still do it. Is there any way to find out if a spy or monitoring program is installed or running? What ...
2
votes
1answer
81 views

Is it safe to let the user name an object key in JavaScript?

Recently I found a piece of code that takes input from the url. The input then get's saved into a javascript object: https://website.com/?foo=bar var x = {"foo": "bar"}; While the value doesn't ...
0
votes
0answers
71 views

How to defeat confirmation-of-a-file attack? [duplicate]

Suppose you want to upload some files to an online storage without the storage provider figuring out what you have uploaded. The obvious thing to do is of course to encrypt the files. However, we ...
0
votes
1answer
73 views

How do I operate a competitive CTF? [on hold]

I am forming a Cyber Security oriented club at my university, to prepare for an upcoming national CTF challenge between unis. We have so far been using resources such as PicoCTF and Vulnhub, but are ...
2
votes
1answer
48 views

What's the difference between SSH tunneling and login into the same SSH server and executing commands?

Consider these 2 scenarios. (1) Let's say I login into an SSH server named A normally using ssh [username] @ [IP address of A]. And now I connected to another server named B which is accepting ...
0
votes
1answer
71 views

Can a PC without VPN expose the public IP of another PC with VPN on the same local network?

Computer 1 is surfing the internet while using a VPN and at the same time accesses files on computer 2 (this computer does not have VPN) on the same local network. Since computer 2 does not have a VPN ...
0
votes
1answer
71 views

Detect Wi-Fi login attempts

How can I detect Wi-Fi login attempts? I was thinking to put an Wi-Fi interface in monitor mode and look for leaked SSIDs.
1
vote
0answers
46 views

Is there a way to get a forensic image of EC2 instance

I currently have an instance on AWS which was compromised and resulted in me losing control. I have shutdown the instance since then, but require a forensic image of the volume so that I can analyze ...
1
vote
0answers
76 views

How to crack encrypted Android SQLite DB?

I am testing an android app which has DB encrypted (AES-256), I extracted it from system files /data/data//databases, I have following doubts, How do we ensure that DB is encrypted properly and it is ...
37
votes
5answers
8k views

How do living politicians protect their readily obtainable signatures from misuse?

Many living politicians' signatures are found online or can handily be acquired (You can write them, and their letters will contain their signature). Thus do they use a different signature for ...
0
votes
0answers
25 views

Ipod classic + kokkia Bluetooth transmitter paired to earbuds

If I use an ipod classic 6th or 7th generation and the following transmitter: http://store.kokkia.com/...
0
votes
1answer
32 views

Is there a technical security standard for internet facing test environments?

We have a number of test environments that are permanently internet facing to accommodate external and automated testers with dynamic IP addresses. While we regularly check the servers for security ...
0
votes
1answer
41 views

Effectiveness of Euler's totient function and Carmichael's totient function in generating the public key in RSA encryption [on hold]

I'm a high school student taking IB and for my EE on Maths, I'm comparing the effectiveness of Euler's totient function and Carmichael's totient function in generating the public key in RSA encryption....
0
votes
1answer
55 views

Decrypting AES-128-CBC leads to first block being correct, the rest corrupt

I'm currently investigating a piece of software which encrypts it's files with AES-128-CBC. From disassembly it is truly known that the algorithm used is correct (log messages plus calls to the ...
0
votes
0answers
33 views

Bitfi Wallet Salt and phrase lost [on hold]

Just a quick question I purchased a bifi wallet gave it a salt and phrase. In March the wallet said updating and I have not been able to open my wallet. Bitfi response if you lose the salt and phrase ...
1
vote
1answer
72 views

Spam Russian Subdomains on my Website

I'm new to the forum, but I have the EXACT same problem that was addressed in a former thread on Stack Exchange here: https://webmasters.stackexchange.com/questions/103087/spam-russian-subdomain-in-my-...
-1
votes
0answers
43 views

Why is it possible to see running programs in memory dumps?

Following the tutorial described in this link, I was able to extract pictures in memory dumps with volatility and GIMP. But I don't understand why it is possible to see other running programs in some ...
0
votes
0answers
25 views

ettercap packet modification

I am trying to figure out how to write a plugin in ettercap which modifies the payload of a packet. I have a vm with a simply python socket server and a simply python client on the ettercap machine. ...
1
vote
1answer
90 views

Should I report this Google API key disclosure issue or not?

I have been asked to perform a pentest on a website from a company. I was analyzing the javascript files they were using, and I found a link pointing to: https://www.googleapis.com/customsearch/v1/...
0
votes
0answers
6 views

Dangerous MySQL functions [migrated]

It is well-known that the SQL function SLEEP() can be used to attack web applications, e.g. as described here. The sleep function cannot be disabled since it is compiled into the MySQL code and does ...
-1
votes
1answer
50 views

Subdomain scanner without brute-force attack? [duplicate]

It is possible to scan subdomains of network without brute-force attack? If yes, how it works? I tried to scan the network with some penetrating tools and it returned to me subdomain which doesn't ...
3
votes
1answer
320 views

Ports Showing Closed/Filtered in Nmap Scans

hopefully this isn't a stupid question.. I am running some nmap scans and I get a list of ports that show closed. Why would they even show in the scan report? Can these be exploited further with other ...
0
votes
0answers
37 views

Disable Bluetooth but let user re-enable it? [migrated]

Is is possible to disable Bluetooth by default (with a GPO), but give local users the rights to re-enable it? I'm talking about a scenario with domain joined Windows 10 laptops and users without admin ...
3
votes
1answer
74 views

How to filter ciphers based on ssl certificate?

I have many ssl certificates. On one of the certificates I run the command openssl x509 -in cert.pem -text -noout it shows: Signature Algorithm: ecdsa-with-SHA256 Public Key Algorithm: id-...
0
votes
0answers
38 views

How can a Web Server be fingerprinted? [duplicate]

How can a Web Server such as nginx or Apache be fingerprinted, if only functional HTTP Headers are sent and error pages are replaced by custom ones?
-2
votes
1answer
179 views

Can wifi admin watch my FaceTime stream?

Can wifi admin see what I am doing on FaceTime? I don't mean can they see I am using FaceTime, but can they intercept the actual audio or video?
-1
votes
0answers
44 views

Windows 10 claims a driver is not signed. Which one is meant? [migrated]

Windows 10 pops regularly a warning about the installation of the unsigned driver and asks whether it really should install it. Since I didn't install any new hardware immediately before I can't find ...
1
vote
1answer
55 views

Is it safe to deploy software without memory protections such as DEP/ASLR?

Several software packages on our SOE Windows machines come with DEP and ASLR memory protections off by default. More troubling is that these applications run as SYSTEM and load their own drivers. ...
-1
votes
0answers
25 views

How ITSM service management helps to become successful? [closed]

How does amazon is using ITSM and become successful and how did they upgrade it from existing service?
0
votes
1answer
56 views

Authentication handshake between two independent apps

I need help on a solution for below scenario from a security perspective. Scenario: There are two independent web applications App1 and App2. User will log in to App1 by performing authentication ...
0
votes
0answers
97 views

Which is more secure? Whatsapp or Line? [closed]

Remark: I am not a computer science person. I only read resources from the Internet and try to understand by myself (so they may be far from reality). I knew a Taiwanese friend recently and I am ...
-2
votes
2answers
135 views
0
votes
0answers
90 views

Encrypt L2 traffic between two buildings via network cable [closed]

For a secure network, I have the requirement to encrypt the network traffic between two locations (within a building, connected via one ethernet cable) so that man-in-the-middle attacks are not ...
0
votes
0answers
38 views

Best tool to check list of subdomains for possible takeover? [closed]

What is the best way to check a massive list of subdomains for possible takeover?
-3
votes
0answers
62 views

What is the difference between rooted and unrooted Android devices in regards to Anti-Virus software?

What is the difference between rooted and unrooted Android devices in regards to Anti-Virus software? I looked at the scan log of an Anti-Virus software and saw that directories such as /data/data ...

15 30 50 per page