Casey
  • Member for 11 years, 2 months
  • Last seen more than 2 years ago
How to harden SSH on CentOS 6.5
11 votes

I am not completely sure, but you may want to look at the protocol setting in sshd_config. From http://wiki.centos.org/HowTos/Network/SecuringSSH # Protocol 2,1 Protocol 2 Change Protocol 1 to ...

View answer
Should a site have SSL if it doesn't have a login form?
8 votes

I'm a fan of SSL everywhere. You may not be transmitting anything that might be sensitive now, but you never know if that might change. In my opinion, there really isn't any good reason NOT to use ...

View answer
Is UUID v4 cryptographically safe for passwords?
Accepted answer
7 votes

UUID4 does not rely on the machine's MAC address, from the documentation: If all you want is a unique ID, you should probably call uuid1() or uuid4(). Note that uuid1() may compromise privacy since ...

View answer
Should I trust URL based on file extension like this: http://example.com/image.jpg
4 votes

I don't think you can really trust any URL just by looking at it (taking URLs in general). You could use a service like Virus Total to scan it https://www.virustotal.com/en/#url That is still not ...

View answer
Problems with l0phtcrack
2 votes

I haven't used l0phtcrack in a long time, but I would suggest trying out John the Ripper. I would also recommend grabbing one of the community enhanced version, for windows, here is a direct link ...

View answer
Convenient cross-platform help on checking secure hashes like SHA-256
2 votes

I actually created a small python wrapper around the python hashlib api for this exact purpose. I needed to be able to check and compute hashes between nix, mac and windows, particularly sha256. ...

View answer
Which languages are better for attacks against websites?
2 votes

It depends on what you are trying to do and what you are comfortable with. Any modern language has what you need to carry out attacks against web sites. High level dynamic languages (e.g. python, ...

View answer
Should I use a cryptograpically secure random number generator when I generate IDs?
1 votes

I would definitely recommend using a cryptographically secure random number generator wherever possible regardless of what the data is. The upsides outweigh the downsides. Also, you never know what ...

View answer
Server-side man-in-the-middle/eavesdropping: attacks between two servers using unencrypted HTTP
1 votes

As an attacker, if there is a vulnerability that would allow me to gain access to Server A (always assume an attacker can gain root access if they can get a restricted shell on the server), then I ...

View answer
What security resources should a white-hat *developer* follow these days?
1 votes

I would highly recommend SpaceRogue's HNN Cast http://www.hackernews.com It is a weekly video cast that rounds up the top stories from the previous week as well as mentioning new security related ...

View answer