Stack Exchange Network

Stack Exchange network consists of 175 Q&A communities including Stack Overflow, the largest, most trusted online community for developers to learn, share their knowledge, and build their careers.

Visit Stack Exchange

Unanswered Questions

4,145 questions with no upvoted or accepted answers
15
votes
0answers
2k views

Github account hacked and repo wiped - Github Response

UPDATE: Ok looks like the source has been found. https://en.internetwache.org/dont-publicly-expose-git-or-how-we-downloaded-your-websites-sourcecode-an-analysis-of-alexas-1m-28-07-2015/ Silly me! :...
12
votes
0answers
2k views

DMA attacks despite IOMMU isolation

If you're already familiar with PCI behavior and Linux's handling of DMA buffers, skip to the third section for my actual question. Otherwise read on for a small summary of how PCI devices perform ...
11
votes
0answers
609 views

OpenSSL EVP aes_256_cbc Initialization Vector Size

I'm looking at the crypto library examples (programmed in c) provided for OpenSSL EVP on OpenSSL Wiki. Their example for a 128 bit Initialization Vector is as follows: /* A 128 bit IV */ ...
11
votes
1answer
544 views

Fully transparent proxy

By default mitmproxy will use its own local IP address for its server-side connections. What I want instead is mitmproxy to use the client’s IP address for server-side connections. The following ...
9
votes
2answers
218 views

risk from USB-C port on locked laptop

If an attacker has access to the USB-C port on my laptop which is in powered on but at the lock screen, what is the risk that they are able to carry out an evil maid attack? Say I'm in the room but ...
9
votes
1answer
1k views

Openid connect nonce replay attack

The openid connect specification adds a nonce parameter to the authorize endpoint, which must be echoed back as a claim in the id_token. It claims that the purpose of this parameter is to prevent ...
9
votes
1answer
382 views

Pin required for accessing (smartcard) Card Authentication Slot

So let me set the stage: I have created an Intermediate Signing Certificate by way of the Yubico walkthrough: https://developers.yubico.com/PIV/Guides/Certificate_authority.html I made a couple ...
9
votes
2answers
2k views

dnsspoof not spoofing (requests and forwards real DNS packet)

I was trying to use dnsspoof but it did not work as expected. These are the steps I followed: Set IP forward in kernel to 1 arpspoof -i eth0 -t 192.168.1.39 -r 192.168.1.1 and arpspoof -i eth0 -t 192....
9
votes
3answers
6k views

SQL Injection Escaping Challenge Security Shepherd

I am using Security Shepherd as a training tool and I am now in challenge SQL Injection Escaping Challenge. The challenge is as it can be seen below: When I makae a query just like the one above (...
9
votes
2answers
3k views

importing OpenVAS xml in metasploit

I am practising in my lab with some metasploitable machines, and I just realised that the vulns declared by OpenVAS 6.01 in the scan report aren’t imported in Metasploit 4.11.5 by the db_import report-...
8
votes
1answer
209 views

Security implications of download attribute

The download attribute in an a element tells the browser to force the download of a file that otherwise would be interpreted by the browser. This is very convenient, since often users want to download ...
8
votes
0answers
377 views

Is there any merit to the RFC 3414 (SNMPv3 User Security Model) password-to-key method?

RFC 3414 (published 2002) specifies a method of generating keys based on password in its Appendix, which essentially takes any "passphrase", and keeps on repeating it until there is a 1MB string, at ...
7
votes
1answer
240 views

Protection against Android Reverse Engineering

I have been particularly trying to find the most effective measures to protect an apk from Reverse engineering and abusive use. While continuing my research I came across various top rated apps and ...
7
votes
1answer
339 views

What exactly is encrypted by “full disk encryption” on Android 5?

This page says "user data" gets encrypted. But that implies it's only a certain part of the full disk? Like "/data" or something? Can I copy a file from a PC to the internal storage to any place and ...
7
votes
0answers
307 views

Can SRP be implemented using libsodium

I am using libsodium for cryptography and I want to use SRP for key exchange. The wikipedia page lists a python example, but I am not sure if and how I could convert this to libsodium function calls. ...

15 30 50 per page