User k1DBLITZ

1255 votes

3 answers

666k views

How does SSL/TLS work?

Polynomial

132k

asked Sep 28, 2012 at 7:51

293 votes

11 answers

462k views

"Diffie-Hellman Key Exchange" in plain English

cryptography key-exchange diffie-hellman asymmetric

user15119

asked Nov 24, 2013 at 1:10

165 votes

3 answers

84k views

What are rainbow tables and how are they used?

cryptography hash attacks attack-prevention rainbow-table

AviD♦

72.1k

asked Nov 16, 2010 at 7:26

121 votes

8 answers

9k views

Is it acceptable that a skilled professional pentester deletes or modifies sensitive data in production unintentionally during a pentest?

penetration-test legal

kinunt

2,759

asked Jul 17, 2013 at 19:08

87 votes

4 answers

81k views

SSL Certificate framework 101: How does the browser actually verify the validity of a given server certificate?

tls certificates certificate-authority digital-signature

SecurityNoob

981

asked Apr 22, 2014 at 21:07

69 votes

6 answers

22k views

What's the difference between using HSTS and doing a 301 redirection?

tls http hsts

Franzech Domâs

975

asked Jul 5, 2016 at 22:12

27 votes

1 answer

3k views

What questions should be asked when joining a new security team? [closed]

vulnerability-scanners logging patching operations

bobmagoo

434

asked Nov 19, 2014 at 20:30

26 votes

1 answer

3k views

Why does Firefox not trust this US government SSL certificate?

tls certificates web-browser

DeepSpace101

2,143

asked Feb 28, 2014 at 20:42

23 votes

2 answers

49k views

Cross site scripting when the greater than and less than signs are escaped?

xss sql-injection injection

Bob John

343

asked Feb 17, 2015 at 4:57

18 votes

1 answer

47k views

Force a specific SSL cipher

tls penetration-test

Sonny Ordell

3,476

asked Nov 28, 2013 at 21:38

15 votes

2 answers

25k views

Why does Google prefer ECDHE-RSA-AES128-GCM-SHA256?

google cipher-selection

Ludwig Behm

296

asked Mar 16, 2016 at 14:34

13 votes

3 answers

2k views

How much information about the reason for an unsuccessful login should a web application give?

web-application passwords authentication design-flaw

vandalizmo

511

asked Mar 11, 2013 at 9:05

12 votes

2 answers

538 views

Why do browsers allow public websites to attack intranet sites?

web-browser attack-prevention csrf

D.W.

98.4k

asked Apr 7, 2013 at 7:29

11 votes

5 answers

8k views

Insecure Cookies Because of Load Balancer

tls cookies

Bradford

367

asked Mar 14, 2011 at 15:29

9 votes

2 answers

4k views

CTF competitions/challenges that are Windows based?

windows exploit virtualization professional-education

NULLZ

11.4k

asked Nov 5, 2014 at 14:48

8 votes

5 answers

5k views

What security requirements are a defacto standard in the Financial Industry?

compliance legal

makerofthings7

50.1k

asked Nov 22, 2010 at 16:35

8 votes

2 answers

24k views

Private key to PEM

tls certificates openssl wireshark decryption

blaz11

81

asked Sep 21, 2015 at 21:19

7 votes

2 answers

21k views

Can running a browser in Windows Compatibility Mode be a security issue?

windows chrome

Telestia

173

asked May 28, 2014 at 16:13

7 votes

2 answers

1k views

Gamification of IT security - any applications yet?

corporate-policy user-education gaming

J_rgen

187

asked Jul 10, 2013 at 9:42

6 votes

3 answers

2k views

Why use Keepass, etc. if all your passwords are in one place?

passwords

Colonel Thirty Two

163

asked May 23, 2014 at 23:44

6 votes

2 answers

2k views

Information Transfer Between Browsers and Tabs

web-browser vulnerability sandbox

user58446

513

asked Dec 3, 2014 at 1:03

5 votes

2 answers

1k views

Why are CSRF tokens used so often?

web-application csrf

Paul Draper

958

asked Dec 8, 2014 at 8:51

5 votes

2 answers

3k views

Retention periods for web logs

webserver pci-dss logging hipaa regulation

Leptonator

117

asked Mar 1, 2014 at 17:38

4 votes

1 answer

456 views

How much protection is really offered by TLS_FALLBACK_SCSV?

tls web-browser

mcgyver5

6,807

asked Jul 24, 2015 at 21:41

3 votes

2 answers

12k views

Any network related security benefits using RODC (Read Only DC) in DMZ?

windows active-directory dmz

Dog eat cat world

5,739

asked Jun 30, 2014 at 13:09

2 votes

1 answer

879 views

What is the difference between claims and capabilities in access control?

access-control capabilities

Sámal Rasmussen

231

asked Jun 10, 2015 at 9:46

2 votes

1 answer

2k views

Using "Security Compliance Manager" to audit a Windows system

windows audit hardening

M.S. Dousti

1,514

asked Jan 12, 2015 at 10:23

1 vote

0 answers

722 views

Passing the hash with metasploit and psexec not working - why? [closed]

hash metasploit ntlm

Shane Dobson

11

asked Dec 11, 2014 at 20:27

Stack Exchange Network

current community

your communities

more stack exchange communities

28 Bookmarks

How does SSL/TLS work?

"Diffie-Hellman Key Exchange" in plain English

What are rainbow tables and how are they used?

Is it acceptable that a skilled professional pentester deletes or modifies sensitive data in production unintentionally during a pentest?

SSL Certificate framework 101: How does the browser actually verify the validity of a given server certificate?

What's the difference between using HSTS and doing a 301 redirection?

What questions should be asked when joining a new security team? [closed]

Why does Firefox not trust this US government SSL certificate?

Cross site scripting when the greater than and less than signs are escaped?

Force a specific SSL cipher

Why does Google prefer ECDHE-RSA-AES128-GCM-SHA256?

How much information about the reason for an unsuccessful login should a web application give?

Why do browsers allow public websites to attack intranet sites?

Insecure Cookies Because of Load Balancer

CTF competitions/challenges that are Windows based?

What security requirements are a defacto standard in the Financial Industry?

Private key to PEM

Can running a browser in Windows Compatibility Mode be a security issue?

Gamification of IT security - any applications yet?

Why use Keepass, etc. if all your passwords are in one place?

Information Transfer Between Browsers and Tabs

Why are CSRF tokens used so often?

Retention periods for web logs

How much protection is really offered by TLS_FALLBACK_SCSV?

Any network related security benefits using RODC (Read Only DC) in DMZ?

What is the difference between claims and capabilities in access control?

Using "Security Compliance Manager" to audit a Windows system

Passing the hash with metasploit and psexec not working - why? [closed]