Tokk
  • Member for 7 years, 8 months
  • Last seen more than a month ago
Obfuscated php code found on the server
Accepted answer
11 votes

It is a very obfuscated way of doing this: eval(getenv(HTTP_X_UP_DEVCAP_IMMED_ALERT)); This alone won't do anything until someone views the page with the HTTP_X_UP_DEVCAP_IMMED_ALERT header set, ...

View answer
Someone help me decode this
Accepted answer
10 votes

According to the length of the text it could be one of the following hash formats: DomainCachedCredentials Haval128 MD2 MD4 MD5 NTLM But (because it is a hash, a one way function) you can't ...

View answer
What sensitive information can be leaked in a Vim's swap file?
Accepted answer
9 votes

The vim swap file contains the username of the author, the machine name of the computer where vim is running and some parts of the edited file. Personally I wouldn't care if someone could read my ...

View answer
Are there secure alternatives to single-use password reset links?
8 votes

I don't see the security of a single use password reset link like you describe it. Most single use links are only invalid if the password is changed, not if the page is loaded for the first time. An ...

View answer
Where are the user credentials stored when remember password is selected?
7 votes

Usaually the user's browser stores some cookies with a random string identifying the user on the server. More secure variants of this additionally check other parameters as the browser version, OS of ...

View answer
How secure is it to use an open-source software
Accepted answer
7 votes

Backdoors in open-source software where discovered, yes. Generally speaking open-source does not automatically mean the software is secure or free of bugs. Just remember Heartbleed in OpenSSL. One ...

View answer
How does the hacker manage to spoof a different IP address?
6 votes

It may be a Botnet with many different Computers in different countries. It has the advantage (for the hacker) that it is almost impossible to block for you (or your mail provider) because there is no ...

View answer
Wordpress site redirects to different site when using https. Have I been hacked?
Accepted answer
5 votes

As there are other sites on the same server as your website showing the same behaviour (like for example: http://annihilatethehero.com/ vs. https://annihilatethehero.com/) I assume you have your ...

View answer
Why not use symmetric encryption?
4 votes

First of all, encryption is made in a way that everyone can use it and only because of you don't need the advantages of private/public key methods doesn't mean it is like this for anyone else. Imagine ...

View answer
Ensuring security of web based games and contests
Accepted answer
4 votes

Encryption is not a good way to ban automated clients, because if a browser is able to decrypt the content of the contest, a good bod is able to to the same. But for the sake of completeness: A ...

View answer
Unexpected emails have been sent - do I need to wipe my Android?
Accepted answer
4 votes

You should not only focus on your cellphone, as there are other possibilities how this can happen. If a mail is sent from a pc it will also be shown in you GMail App, so this is no evidence that your ...

View answer
Securing commands
Accepted answer
3 votes

If someone manages to catch a request like this it may be possible to resend the request numerous times in your five second frame. Now the question is how to prevent this. There are more options, ...

View answer
How to share sensitive documents with unknown/untrusted parties?
3 votes

There is no way to be sure that the resipient won't retransmit your documents unsecured to others. You could use password secured PDF files, theoretically they sould be safe if you forbit to print ...

View answer
Can a mobile number ring if the person has not inserted their simcard into their phone?
3 votes

I don't think this is a security question. But anyway I think your person lied to you. Everyone knows the voice telling something like The person you have called is temporary not available. If a ...

View answer
My Lantern cloud server has a domain name that looks like typo-squatting, should I be worried?
Accepted answer
3 votes

There are two possibilities in my mind: Given the fact that you state that the apps font is very little, could it be that roundrobin.getiantern.org is in fact roundrobin.getiantem.org? Notice that ...

View answer
the dangers of internet forums - what is FUD, what is not
3 votes

I think you can safely live normally ;) The user in this forum propably just took a guess on your UserAgent. This is neither considered hacking nor does it do any damage on your pc. There is even a ...

View answer
Identify an unknown type of hash
Accepted answer
2 votes

This is not a hash. You always have a base64 encoded data (the one that ends with '==') and the hex value of the decoded data. I am not sure what type of data this is, but I am almost sure that it ...

View answer
Accepting other similar passwords when storing a salted, hashed password
2 votes

The answer to this question depends on two factors: the attack vector the implementation of allowing different passwords Websites should store passwords not in plain-text or any other form allowing ...

View answer
emailing a direct link to executable file blacklist risk
2 votes

From my personal experience it would be better do send a link to a webpage where the user has to download the software by cklicking on a download link/button. There are many spam/ malware filters for ...

View answer
Trying to get control of spam?
2 votes

I use a different mail for every service, like facebook@mydomain.com, google@mydomain.com etc. This way I can see who sells my data or gets hacked (poor adobe@mydomain.com; )). Also I don't have to ...

View answer
XSS echoed in pages html code but no pop up window
2 votes

With an XSS attack you normaly try to put JavaScript Code on a website. In your example a user tries to log in and on the next page there may be a warning like 'Username [input string] is not valid'....

View answer
Is it possible to track the email sent via BCC List using firewall or network security software?
Accepted answer
1 votes

This is a very broad question, depending on your setup. If you use SSL from your PC to your mailserver (wich is not administrated by the same guys) and your connection is secure, they can't see ...

View answer
File SHA256 checksum failed, but OK on reboot
1 votes

IMPORTANT: Everything following is only part of my assumptions about this incident. Without further details of it nobody can tell you exactly what happened. What browser are you using? I know that ...

View answer
Lock a website login to a certain computer
0 votes

As PiTheNumber said you can't just create or safe a file on the users drive. But you could let the user download your generated file so the user can open it with your desktop application after he ...

View answer
Why would Comodo SSL certs have two intermediate CAs (chain length 4)?
0 votes

One benefit could be that there are less customers per intermediate certs so if a cert is stolen, there are less people affected. Comodo has a very automated process in signing certs for customers so ...

View answer