How to make use of a exploit that is not available in metasploit? I want to exploit a Microsoft IIS HTTPD 10.0 server open which is open in PORT 80. However there is no available exploits in Metasploit but there are few vulnerabilities in this site. Is it possible to make use of these vulnerabilities?

Is it possible to make use of these vulnerabilities?

Theoretically yes, As you mentioned the exploit doesn't exist in Metasploit framework, check if exploits exist on exploit-db site or POC for the CVE on GitHub. If the exploit/POC does not exist, study the CVE by figuring out what exactly leads to that weakness mention in CVE  and try to reproduce the vulnerability locally on the server. After you are done reproducing the vulnerability on the local server successfully, try it on the target server.


Is it possible to extract a certificate that an application uses to connect to an API server? There's an API server that only allows connections including specific SSL certificates. Talking about an Android application that has those certificates.

Using Fiddler without SSL decryption as a proxy between the app and the server, I can see the request being accepted by the server. Now how can I extract that certificate and use it to send requests to the API? Is it possible with Fiddler; or are other tools needed, like Wireshark?

I have tried Wireshark and exported Certificates, but using them with Fiddler still doesn't let me connect to the server.

Also, is this called SSL pinning from server side?

While you can extract the client and server certificates when sniffing a TLS connection (at least with TLS 1.2 and lower) you cannot extract the matching private keys. But you need these private keys to authenticate against the peer. These private keys are only at the endpoint, i.e. in the android phone in case of the client certificate you want to use.

  Also, is this called SSL pinning from server side?

No. Requesting and verifying a client certificate is called authentication with a client certificate, mutual authentication etc but not pinning.


Is it possible and does it make sense to sign an E-mail with PGP and S/MIME? After some research without any answer to my question, if it's possible and does it make sense to sign an E-mail with PGP and s/mime (?), I'm hoping to get an answer here.

I know that, PGP and S/MIME fulfil the same purpose. They create the signature with the same cryptographic utilities, but manifest a different format. The question about the differences of this two tools were already asked here: How does PGP differ from S/MIME?.

Far more clients are compatible with S/MIME out of the box. Is it possible to provide a PGP and a S/MIME signature per E-Mail, so I can satisfy PGP and S/MIME users?

You can sign with both PGP and S/MIME. Contrary to Oliver Schmidt's response, it is possible to create an external signature using PGP (you can sign any file with a PGP key, not just text - a executable (.exe) is not a good candidate for inline signatures). This is referred to as "PGP/MIME".

An external signature on a PGP file will be *.sig and S/MIME will typically be in the format of *.p7s for the PKCS#7 format. If you are using external signature it should not matter the order since you are not using both (as long as mail clients support it). Encapsulating them as suggested in another answer should technically work since the PGP user can ignore the S/MIME attachment.

The big issue on what to use will depend upon what your recipient is expecting and what their email client is capable of doing with (or what external tools they have). Some older clients may not support external PGP signature.


Is DNS secure when using DNS crypt? Is it the same security level like a VPN DNS wise when using Open DNS crypt servers plus DNS crypt proxy?

I installed both packages in Ubuntu and now unless I have the right IP entry in the network manager for the open DNS crypt servers, I get no connection to the Internet. So I guess this is what the open DNS proxy package does, all is getting filtered if not running through open DNS crypt.

Yes, DNSCrypt is in fact a point-to-point tunnel, so it's like encapsulating DNS queries in Elliptic Curve Cryptography provided by curve25519xsalsa20poly1305. See DNSCrypt Proxy TECHNOTES.

Regular DNS servers are not equipped to speak DNSCrypt but OpenDNS ones are. So when you change the DNS IP and use DNSCrypt then your dnscrypt-proxy would first try to exchange a DNSCrypt certificate before it accepts talking to that server. A regular DNS won't reply and you won't get a question/reply going. This explains why it doesn't work for other servers than OpenDNS.

However, there are different DNSCrypt providers. You might want to look for them because they vary. Some do not store logs, most of them are free of the shenanigans that OpenDNS does with non-existing domains, some offer malware filtering capability, etc.

List of alternative DNSCrypt servers: https://github.com/jedisct1/dnscrypt-proxy/blob/master/dnscrypt-resolvers.csv


is it possible to make a process hosted on svchost? A few days ago my little brother download a malicious file that turned out to be a Monero miner, the weird thing about it is that it runs as a windows service and hosted on svchost (the original one) when you kill it throws a BSOD, and if you try to "open file location" it says svchost in system32, and I repeat not a fake one. It closes Command Prompt, Process Hacker, and Task Manager when you open them and after I managed to open Process Hacker it showed "null" in the path field of the process I am talking about (I found it by the PID). I finally stopped by removing its schedule entry and the file associated with it, but I never found out how it was running under svchost or where the original file was. Does anyone have an idea on how this could be done?

Yes, it is possible to run malicious code on svchost or any other system process if you have sufficiently high privileges. Malicious code can use one of many injection techniques to modify a running process. This has the advantage of making it harder (or nearly impossible) to detect or remove without crashing the system. In your particular case, it seems likely that your brother was infected with WinstarNssmMiner. Rather than making a process running under svchost.exe, it spawns it as a benign privileged system process and then injects malicious code into it:

  It’s unclear what the WinstarNssmMiner infection path is, but once the malware executes on a targeted system it launches a system process called svchost.exe, a process that manages system services. Next, it injects malicious code into svchost.exe.

Does the BSOD message say a critical process had died? If so, this is likely caused by the process being intentionally marked as critical, so its termination will bring down the system:

  The svchost.exe process created for cryptomining has a process attribute of CriticalProcess, which means terminating the process crashes the system.

This malware is new and is actively spreading in the wild. You should update your antivirus definitions. Teach your brother to only download files from official, trusted sources, or configure your system to only run signed executables. These are files that contain an embedded digital signature that proves that it was signed by a reputable certificate authority trusted by Microsoft.


Can benign software modify Widnows DLL files? On Windows (XP, 7, 8, NT ...): can .dll files be modified (in any manner) by benign programs/software already installed/running on the computer ?

If the owner (user) of the process of the software has the ability to do so, then the software also can delete/replace/modify DLLs.


Is AES more secure than Rijndael? Which algorithm is generally considered to be more secure, and is AES-192/AES-256 still considered to be secure?

After reading this it's lead me to belive that the Rijndael algorithm would be a more secure choice, but is this actually true?

AES is a subset of Rijndael (FIPS-197). It's still being considered secure, if you continue reading to the bottom of the article:

  Even if the largest botnet ever discovered – the
  30-million-computer-strong BredoLab botnet – was given the task of
  attacking an AES-256 implementation, the sheer number of possible
  combinations would make the task virtually impossible.

The attack you suggested is called a biclique attack and is slightly faster than it would take to bruteforce an AES key. Considering that would still be a a few trillion years it's not really feasable.

Also this is the  official press release from the Katholieke Universiteit Leuven about the code being broken. (This is the university where both AES and the attack against it were made)


SELinux Privilege Escalation Metasploit Nexus 5 Android 5.0.1 LRX22C after Stagefright I am preparing a part of a security awareness day and one part of the "show" should be about mobile security.
I thought about showing the stagefright exploit.

So I started with getting a mobile phone beeing supported by the latest stagefright-module in the metasploit-framework (Nexus 5), downgraded it to a version with stagefright-vulnerability (Android 5.0.1 LRX22C) and started to exploit.

All works fine:

[*] 192.168.1.108    stagefright_mp4_tx3g_64bit - Target selected: Nexus 5 (hammerhead) with Android 5.0.1 (LRX22C)

[*] 192.168.1.108    stagefright_mp4_tx3g_64bit - Sending HTML to 192.168.1.108:56616...

[*] 192.168.1.108    stagefright_mp4_tx3g_64bit - Sending infoleak gzip'd MPEG4 (742 bytes) to 192.168.1.108:56616... (heap: 0x0, code: 0x0 from Browser)

[*] 192.168.1.108    stagefright_mp4_tx3g_64bit - Target selected: Nexus 5 (hammerhead) with Android 5.0.1 (LRX22C)

[*] 192.168.1.108    stagefright_mp4_tx3g_64bit - Sending HTML to 192.168.1.108:56616...

[*] 192.168.1.108    stagefright_mp4_tx3g_64bit - Sending infoleak gzip'd MPEG4 (742 bytes) to 192.168.1.108:56616... (heap: 0xb3a2e980, code: 0x0 from Browser)

[*] 192.168.1.108    stagefright_mp4_tx3g_64bit - Sending RCE gzip'd MPEG4 (102053 bytes) to 192.168.1.108:56616... (heap: 0xb3a2e980, code: 0xb64f1cb0 from Browser)

[*] 192.168.1.108    stagefright_mp4_tx3g_64bit - Sending RCE gzip'd MPEG4 (102048 bytes) to 192.168.1.108:58971... (heap: 0xb3a2e980, code: 0xb64f1cb0 from SF)

[*] Transmitting intermediate stager...(136 bytes)

[*] Sending stage (397164 bytes) to 192.168.1.108

[*] Meterpreter session 1 opened (192.168.1.106:4444 -> 192.168.1.108:44680) at 2017-02-19 05:19:51 -0500

Within this session, I am pretty help- and rightless.
My UID is 1013 - which I assume is the mediaserver's UID.
I do not have access to any interesting directory or file (No access - no effect with my show). Awe-struck, I noticed that this phone uses SELinux.
I decided to ask google on how to get more privileges and found this:
CVE-2015-3864 Metasploit Module from Mr. Drake aka jduck.

He used some specially crafted mettle to gain root access within this SELinux environment.
But I have to admit, that this is something I would need some advice/help with.
How do I build such merged payloads with mettle, pingpong and iovyroot?
Short: How do I get more privileges or maybe even root on this phone to show something that touches the audience?

More precise Question:
How do I customize mettle payload to include PingPong-root and Iovy-root exploits?
(Any other cusomization of payloads for gaining root access is welcome, too ;) )

Use Dirtycow kernel vulnerability. I guess with the downgrade you did, the kernel is vulnerable to it.

You can use it on android kernels too: Dirty Cow Android PoC.

A video example about it: https://www.youtube.com/watch?v=4xdMteqm994

Once inside the device, you can download via wget or however the exploit and compile it to gain root. Check your kernel to see if vulnerable, I guess it is.


Is it more secure to encrypt separate customers' data with separate keys? If I am storing multiple customers' data in cloud-based file storage such as an AWS S3 bucket, and I use an encryption service such as AWS KMS to achieve encryption at rest, does it add any extra security for me to store each customer's data in a separate bucket and use a separate encryption key for each customer?

Or is it just as secure to encrypt all customer data with the same encryption key (provided the key is rotated regularly of course)?

One argument in favour of separate keys: assume at some point in the future your app has some sort of SQLInjection or Server-side request forgery (SSRF) vulnerability that lets a user logged in as CustomerA bypass the usual access control rules and fetch data belonging to CustomerB.

If all customers use the same key, then your application layer server will happily decrypt and serve it back through your UI. However if each customer has their own key, then your server will try to decrypt CustomerB's data with CustomerA's key and throw a decryption error. That would be a win for defense in depth.

While in general, using per-customer encryption keys doesn't do a lot (esp. if you store all the keys in the same place), there are some specific cases where it could save your butt.


Putting the Biba-LaPadula Mandatory Access Control Methods to Practise? Text books on database systems always refer to the two Mandatory Access Control models; Biba for the Integrity objective and Bell-LaPadula for the Secrecy or Confidentiality objective.

Text books tend to recommend that a combination of these methods be used to meet these security objectives of a DBS - but they often only touch the surface.

Marcin states that, the 'strong *-property', disallowing reading or writing from any other level but your own, is an idea introduced to battle the problem inherent to Biba-LaPadula: no state.

He also goes on to say that the Biba-LaPadulla is really only taught to security students as the first and simplest security model, it's really a toy, an educational construct.

So then, to what extent does the security methodology here apply to DBAs, how might they put it to practise, and just what is the consensus on handling Mandatory Access Control in a DBS?

I tend not to pay much attention to textbooks that recommend Bell-Lapadula or Biba multi-level security.  Those schemes are impractical for most real-world settings.  They make some beautiful theory, but they have not worked out well for general-purpose computing in practice.

Bell-Lapadula and Biba models have several major problems.  Here are two of them:

They get in the way of useful work. The combination of Bell-Lapadula and Biba is the worst; it prohibits writing up or down, and prohibits reading up or down.  Thus, it basically corresponds to creating multiple databases, segregating your data, and prohibiting any application from accessing more than one database.  That's horribly unrealistic and rules out its use in most real systems.
They don't provide the security they claim.  In practice, such systems always have covert channels that can be used to subvert the security "guarantees" that are supposed to be provided by a multi-level security system.

See the chapter on Multilevel Security in Ross Anderson's Security Engineering book for a lot more discussion on these practical problems, and some hard-earned experience.  Ross has put this chapter from the first edition of the book online, so you can check it out.  If you find it useful, buy the latest copy of his book; the second edition adds a lot of useful information, and the book is simply brilliant, perhaps the most insightful book on computer security I've ever read.

Bottom line: Bell-Lapadula and Biba aren't very practical, so you can safely ignore them for most settings.


Why is 3DES not used to store passwords? I'm sure its obvious, but I was wondering, what is the primary reason 3DES encryption is not used for storing passwords in the database?

My understanding is that 3DES is a strong encryption?
So I can only think that the reason it is not used is because its encrypted not hashed, so that if the system was compromised the hacker could find the key used to encrypt and use it to decrypt?

The other reason being in privacy of information, even the database owner should not have the ability to see the users passwords, as they are often the same password used everywhere.

Is there any other reasons why it isn't used? Is it easier to brute then SHA?

NOTE: I am not using 3DES, but my company previously did. It was just a question out of curiousity.

Site owners should not have the ability to instantly see every single user's password (and possible every password they've ever used on your site) - many users share passwords, and you don't need to get into their bank account.

Nor do you need to be accused of getting into their bank account based on having their password.

Should an attacker get your database password list somehow, the only thing they need them is your encryption key to get 100% of all passwords, nearly instantly, regardless of password strength - "12345" and "abDPZJg2$f3e4^po6aB]s67Kbfd;:vIr4}52Fqa\~Rep`,>ioNuJ" will be found in the same time (and at the same time, for practical purposes).  With properly hashed passwords, "12345" remains worthless.  However, with even the weakest cryptographic hashing algorithm, that long, random password will be an incredible challenge.

Even if an attacker does get your database password list but not your encryption key, you'll be on major security sites who tell you that your methodology is a giant disaster, just like Adobe when they leaked over a hundred million 3DES encrypted passwords.

Don't encrypt passwords.  Hash them, using a password hashing function like PBKDF2, BCrypt, or SCrypt with a random 8-16 byte salt and as high an interation count or cost/work factor as you can afford during expected peak times.  Wee How to securely hash passwords? for more detail.


How to make TLS_RSA_WITH_3DES_EDE_CBC_SHA strong First off I have NO idea what ciphers are and my knowledge is very basic in security!

With that said, from this tutorial I have established a secure SSL site and I have a ran a test on my domain and although the rating is A+ but I noticed that TLS_RSA_WITH_3DES_EDE_CBC_SHA (0xa) is WEAK I don't think this is an important issue but since everything is perfect it looks good if I strongify this cipher too.

would anybody kindly help me fix this weak cipher?

If following that guide you used this line in your nginx configuration:

ssl_ciphers 'ECDHE-RSA-AES128-GCM-SHA256:ECDHE-ECDSA-AES128-GCM-SHA256:ECDHE-RSA-AES256-GCM-SHA384:ECDHE-ECDSA-AES256-GCM-SHA384:DHE-RSA-AES128-GCM-SHA256:DHE-DSS-AES128-GCM-SHA256:kEDH+AESGCM:ECDHE-RSA-AES128-SHA256:ECDHE-ECDSA-AES128-SHA256:ECDHE-RSA-AES128-SHA:ECDHE-ECDSA-AES128-SHA:ECDHE-RSA-AES256-SHA384:ECDHE-ECDSA-AES256-SHA384:ECDHE-RSA-AES256-SHA:ECDHE-ECDSA-AES256-SHA:DHE-RSA-AES128-SHA256:DHE-RSA-AES128-SHA:DHE-DSS-AES128-SHA256:DHE-RSA-AES256-SHA256:DHE-DSS-AES256-SHA:DHE-RSA-AES256-SHA:AES128-GCM-SHA256:AES256-GCM-SHA384:AES128-SHA256:AES256-SHA256:AES128-SHA:AES256-SHA:AES:CAMELLIA:DES-CBC3-SHA:!aNULL:!eNULL:!EXPORT:!DES:!RC4:!MD5:!PSK:!aECDH:!EDH-DSS-DES-CBC3-SHA:!EDH-RSA-DES-CBC3-SHA:!KRB5-DES-CBC3-SHA';

You should replace that line with

ssl_ciphers '-ALL:EECDH+aRSA+AESGCM:EDH+aRSA+AESGCM:EECDH+aRSA+AES:EDH+aRSA+AES';

then restart nginx and try the Qualys test again (click on clear cache on the Qualys test page if necessary). You can compare the results for the simulated connections by different browsers and search engines to see that nothing changed except you lost the ability of Internet Explorer on Windows XP to connect. That is not a loss, it's completely insecure.

In the future, when you upgrade from Ubuntu 14.04 to a server OS that ships with a version of openssl that supports ChaCha20Poly1305, you'll wany to adjust the ssl_ciphers. This can be as soon as when Ubuntu 18.04 is released a year from now. You'll definitely need to adjust when you switch to Ed25519 certificates, which will take a few years (RSA 2048 certificates will probably be supported for a very long time, and Ed25519 will not become available for at least a year, but eventually everyone will upgrade).


Making a bitcoin-like secure mail protocol, how to tackle public keys? I'm making a new mail protocol (probably already exists, but I've learnt a lot of things about security and privacy on the way).

Here's the summary(much simpler if you know bitcoin's inner workings):

Every user has a list of public and private keys.
Every mail is in a file that every node has a copy of.
users can send messages using the following protocol:

message = encrypt("Your message here", receiver.publicKey);
signature = sign(message, sender.privateKey);
proofOfWork = hashcashAlg(message); see: hashcash

When sending a new mail, you send your public key, receiver's public key, message, signature and proofOfWork to all nodes known to you. Every node then sends that mail on to all nodes they know.

Now I've got this problem: public keys (currently RSA) are extremely long. When you would want to send a mail to someone, you would need to know their public key.

Are there any asymmetric encryption algorithms that use smaller public keys? Or some way I can put the long RSA key through a RIPEMD160 and it still being usable?

Now I've got this problem: public keys (currently RSA) are extremely long. When you would want to send a mail to someone, you would need to know their public key.
Are there any asymmetric encryption algorithms that use smaller public keys? Or some way I can put the long RSA key through a RIPEMD160 and it still being usable?

This is a known problem with conventional public key crypto systems, e.g. RSA and DH and among other things one reason why Elliptic Curve Cryptography (ECC) is so appealing. Usual key sizes range from something between 160 to 512 bit, while providing the same level of security.
Another potential way to solve the problem is a scheme similar to the one implemented in DNSSEC. Here you have two key pairs, which are different in length. The shorter one has to be replaced more often (once per month or so), but is the one that actually is doing all of the signatures. Personally I don't like this approach very much, but it was specifically designed in this way to make signatures shorter.


Would allowing the user to login via a set of IPs with face recognition be a secure enough alternative? I'm trying to figure out how face recognition would be considered a valid and secure enough option of logging into an account.

The way how I see this works is as followed, the user logs into their account via password and enables logging into this account from the current IP address via face recognition. There is no option to provide an IP address. You must enable it for each one. Once the user logs out and wants to login again they can use face recognition which will look into the database for faces that match the user's IP address and on a match will automatically log a user in without the need to provide a username or a password.

Can this be considered a secure enough option to login and what are the risks?

Consider the scenario where a co-worker obtains a photo of someone's portrait, and prints it out. They then use the same network (and thus public IP) to log in, holding that printout up to the webcam. They are then logged in, because the face recognition recognises the face, and the IP is the same.

Face recognition involves "something you are," to which the additional security factors are "something you know" (password, etc.) and "something you have" (token, etc.) Face recognition in combination with something that falls under either of the latter two would be more secure, though you have to weigh up its cost-benefit ratio and whether "something you have" is still compromisable, depending on the situation.


API Method Parameter Enumeration via Web Browser I am obligated by contract to prevent enumeration of an API method's parameters but cannot achieve it.

When I send a blank request to the API server in a web browser, the server responds with the exact parameters that that API method requires. This makes an attacker's job much easier because they know exactly what data to send to that API method.

For example, if I enter
https://www.example.com/api/jsonpostgw.aspx?m=MethodName
into a web browser, I get back a response, similar to the following, containing the exact parameters used by that method:

{"initObj": {"Locale":
   {"LocaleLanguage":"","LocaleCountry":"","LocaleDevice":"","LocaleUserState":"PossibleValue1 || PossibleValue2"},
   ”Another Parameter":""”,"AnotherParameter”:”PossibleValue1 || PossibleValue2"},
   "username": "", "password": ""}

This information tells the attacker exactly what data to send to the API method making attacking it much easier.

What I need to do is prevent the server from responding with this information when a blank request is sent.

Of course, these parameters are always sent via POST, not GET like when I send the URL in the web browser. So, one work around is to prevent GET requests.

How can I prevent these responses from the server without relying on this work around?

You are going about security the wrong way!

Attempting to secure something by hiding information about it is called security by obscurity. It is considered bad practice and should not be used. The general philosophy is that it is hard to keep things like an API secret. A determined attacker will backwards engineer the client application, watch the network traffic, probe the server, etc... to discover the signature of an API.

Instead, implement an API that is secure even in the face of being publicly known. Rely on secrets (such as passwords and authentication keys) and other access control mechanisms to secure your API's security. OWASP is a good place to start reading about security.


Use Splunk to run Nmap scan from remote host to potential attacker When receiving internal attacks, I'd like to utilize Splunk alerts to trigger an Nmap scan against that attacking host from a remote machine; one other than the Splunk server.

Is there any API or script that would provide this functionality (Splunk alert, get source address, automatically send the address to a remote host to run Nmap (-A) scan against attacker)?

The idea here would be to automatically get additional information on internal hosts that are potentially malicious/compromised. Then, a potential add-on would be to send the scan results back to Splunk for correlation.

This questions is rather opinion based and not really about security.. so until this gets flagged I'll answer how I might go about accomplishing this as effortlessly as possible.

For what it's worth!

set Splunk alert to invoke script (docs here)
script (above) could be a simple shell script that takes in the necessary info that you need for the Nmap scan as a payload in a POST request to the server via cURL
setup simple API for server to accept data via something like json-server (docs here)
configure cron on server to run every N seconds to check db.json (json-server data storage) for new data and if found, run Nmap scan
potentially store Nmap scan results within db.json so that Splunk machine can, by way of another script, query data and action accordingly

This is by no means perfect but might at least be able to provide you with an early route to start in hacking together a quick prototype for what you are looking to accomplish. Ideally, you would want to set up a more robust and tested API but, again, the above can suffice as a working POC.

This is a tutorial for quickly standing something like this up with JWT authentication.


Why does host's antivirus detect guest's malware? I'm analyzing some malicious files on a VM and I'm noticing that every time I open a file, the host's antivirus detects it.

Why does this happen? Is the malicious content escaping to the host?

What I'd guess is happening is: When the guest OS reads an infected file, the hypervisor reads part for of the virtual disk file, the host anti-virus intercepts this read, scans it for viruses, and detects the virus in the guest.

As a workaround I would configure your host AV to ignore the virtual disk files.


Privilege escalation in Linux 2.6.32 I am in an audit and I need to show the client that privileges can be scaled but I have tried in various ways and I could not. The Kernel version is 2.6.32-754.3.5.el6.x86_64.

I have already tried using DirtyCOW, but the problem is that I always get "sh: denied permissions". And in fact, gcc also has root only permissions.

I'm a user without privileges.

I'll go out on a limb and guess that any directory your user has permission to write to is mounted as noexec, which means that you will not be able to directly execute anything. To run a shell script despite this, you can always do bash script.sh if doing ./script.sh fails with a permission denied error. You should try looking for any directory you can write to which you can also execute from. If none exist, then even having gcc would not help you, since you could not execute the code it generates.

In order to exploit DirtyCow, you need to invoke a number of system calls. This cannot be done from within a shell script. You either need to use a sufficiently sophisticated scripting language such as Python and re-write the exploit in it, or you need to compromise a binary that you have the rights to run and make it run shellcode to perform the attack. If you aren't able to do that, I suggest you practice binary exploitation and shellcode development first to learn how, or this will be quite hard.


Using composed, yet unsent email drafts to communicate If an individual creates an email account with false personal information, then shares the email address and password with another person or persons, could they use saves drafts of emails to communicate securely?

Since most websites and email servers would record ip addresses of those who logged in, you would have to trick it into thinking you are each logging in from the same ip even if across the world.

What also matters is how the email server handles saved drafts of emails. If you change a draft or delete it does the server preserve the drafts if they are never sent?

I would think that since no email is sent to another email address that it would be less noticeable if two people or more logged into the same email account and used drafts to communicate. There is also the possibility of attaching files to the draft as well.

It's not a good idea. Also, that trick is older and more popular than you might think.
As with any security-through-obscurity pattern, it only works if the adversaries aren't aware of it. But since saving emails as drafts instead of sending them has been popular among criminals, terrorists and even found its way into pop culture, that technique rather attracts attention and certainly doesn't add security.
E.g., one popular case was the Petraeus and Broadwell affair:

The CIA director and his biographer had a shared Gmail account and wrote some of their personal missives as draft emails, which were left in a draft folder or an electronic, "dropbox".
[...]
Al Qaeda terrorists began using the technique years ago. It allowed them to exchange information without sending traceable emails. An account would be opened by one conspirator and a draft email written and saved. The account could then be opened by a co-conspirator with access anywhere in the world, who could read the draft email and delete it.
The process meant the information had never been sent in the form of an email, making the electronic trail weaker. The technique has since been copied by teenagers in many countries to avoid having their emails monitored by their parents.

(Source)

If you change a draft or delete it does the server preserve the drafts if they are never sent?

There is no way of knowing if deleted drafts are preserved, so better assume they are kept. Also, getting behind this trick might be as easy as searching the provider's database for email accounts that produce high amounts of drafts but rarely actually send emails.
Instead, encrypt your emails. There are plenty of cryptographically secure technologies, free providers and VPN services to do so anonymously and securely.


Should a user be able to reset his password if his email address has not been verified yet? Please consider a scenario where a user signs up for a web application with his email and password. After registration the user is sent a confirmation email which requires a login/session to confirm the email address. To reset his password the user has to confirm a reset password mail which is sent to his stored email address.

This is not to be confused with this similar question as the other question deals with a temporary account access which is not given here: Should you be able to reset a password without verifying the email address first? In other words: My question is not regarding an email address change but the initial sign up process.

Is there any security issue if the user is able to reset his password if his email address has not been confirmed yet?

Scenario #1 Alice mistypes her email address

By accident the confirmation email is sent to Eve.
Eve receives the confirmation request but is not able to confirm her email address.
However, Eve is able to reset her password.
Finally Eve is able to confirm her email address and obtain full control of Alice's account.

Result: The login/session requirement for email confirmation is bypassed. Thus, I think this is a bad idea. However, if a password reset is not available without a verified email address than the following could happen:

Scenario #2 Alice forgets her password and has not confirmed her email address yet

Alice signs up with her own email address and password.
Alice loses her session and forgets her password.
Alice is not able to login (wrong password) and not able to verify her email (login/session required). Nor is she able to reset her password (email not verified).
Alice lost control of her account (forever).

So, as you can see scenario #1 produces a risk that is more or less bad (probably not too bad if no other information is collected on sign up). However, scenario #2 gives a good reason to accept that risk and enable the reset without a confirmed email address. Can the risk be accepted or am I missing something?

The correct sign up procedure is as follow:

Alices signs up with a new password and an email address (x@y)
the account is created as blocked until email address validation
Alices tries to login and only gets a message saying she must activates her account with the mails sent at the address x@y
if the validation does not occur in the expected time (between 4 and 24 hours) the account is destroyed - prevents Alice to forget to validate her mail address
Alices validates from the mail and is asked for the password. If she cannot give the correct password after three attempts the account is destroyed - prevents Eves to use Alice's account if she received the validation mail

The real problematic case (already seen in real world) is:

Alice signs up with a correct mail account from her ISP and validates it
later Alice changes ISP, uses a new email account but forget to declare it in its account
even later Alice forgets its password. Plonk! She is definitely locked out of its account

I cannot imagine a way to mitigate that problem


Are there security issues in not supporting TOTP 2FA for 1Password? 1Password sort of supports 2FA. We have a master password and an additional secret. But why don't they support TOTP for 2FA?

I just want to make really sure that unless I approve, no other devices can access my 1Password account.

Say someone put a trojan keylogger on my computer. I don't know if I can ever detect the presence of this on my current computer.

Say I open 1Password in my computer. It asks for master password that I type and I insert the key. Now, since one of my computers is compromised, the hacker knows my master password and my secret key that is not regularly changed. Isn't that dangerous?

LastPass implements 2FA, it supports plenty. Why doesn't 1Password? I know their engineers are active on this site and provide answers occasionally. So that's why I am asking. I've heard 1Password is security all the way, so I thought they must have "security" reason why they choose to implement things this way.

So to start with, your question is based on a false premise, namely that you can protect your 1Password account using 2FA (Two-factor Authentication) from the 1Password website.

You can use any TOTP compliant app or a Yubikey device.

1Password can itself be used to generate TOTP codes but it ABSOLUTELY SHOULD NOT be used to generate TOTP codes for itself (for reasons which should be obvious!)

Enabling 2FA with 1Password requires a 1Password membership.

Source: https://support.1password.com/two-factor-authentication/


Multi-boot with full hard drive encryption and pre-boot authentication How would I set up a multiboot system which supports  full hard drive encryption and pre-boot authentication.

I have a system with Ubuntu, Windows 7, Windows XP, and I would like to install Red Hat. I use grub 2 boot loader. What software would support this set up, for full drive encryption with pre-boot authentication? There is TrueCrypt for Windows pre-boot authentication, but will it play nice with grub 2? What other disk encryption software could I use for Linux side?

Before you read all this, remember that this technique is at least 5 years old -- it's probably much easier by now (see the other answers). (But it sure was fun to figure this all out.)

I did this a few years ago with Fedora 10 and Windows Vista to demonstrate how all the intricacies fit together. It was a bit involved (mostly because Windows Vista doesn't "play well with others" and doesn't like being installed second), but in the end I found a method that suited me. Your case is more complex because you have 3 existing OS'es and you want to add another onto your drive.

Because I've never attempted this on the magnitude of 4 operating systems, I'll leave most of it up to you (the actual re-partitioning and such) and will try to take the general security principles from my experience and apply them to your situation. Also note that in my case, I started from scratch on a drive I had erased. This was more an experiment than an expert exposé... so take a few things with a grain of "salt" (no pun intended) and don't hold me responsible. :)

Remember, these are just my notes. You will have to adjust them for your situation. So here we go:

Problems overcome by the method described here

My notebook’s hard disk could only contain 4 primary partitions.
Primary partitions are the only ones that OSes can be installed to (Windows, anyway).
Primary partitions are the only partitions the system can boot from
Each extended partition counts as a primary partition.
6 or 7 partitions may be needed.
TrueCrypt can’t encrypt an entire drive that has multiple partitions, OSes, and various file systems when it only runs on one
TrueCrypt doesn’t play well with Grub or any non-Windows boot loader.
Windows likes to be installed first and only on a partition flagged as “bootable” (or, if no partitions are flagged “bootable” at all)

Benefits in the end

After the initial boot loader prompt, mounting various encrypted partitions could be automated with scripts. (<3 Truecrypt)
Files can be shared between encrypted operating systems (with password).
Each and every partition is encrypted, even swap file.

How the boot loaders work together

We install and use Windows’ default boot loader to the MBR. This is what the computer will boot to first.
We install GRUB (Fedora’s boot loader), but not to the MBR. This will merely be available for us to boot to later.
We install TrueCrypt which takes over the Windows boot loader. TrueCrypt’s boot loader goes into the MBR. On boot, the user will authenticate with TrueCrypt then be taken to the Windows boot loader where the option Vista or Linux (actually GRUB) becomes available.
In the end, my boot process looked like this:

Diagram of full-disk encrypted dual-boot process (yellow boxes are encrypted partitions; padlocks are another layer of security)

Possible adjustments for your situation

I didn't use Truecrypt on the Linux side except to mount the Windows partitions. I'm not sure how to mount native Linux-encrypted partitions from Windows, so my setup was rather one-way. You might consider using Truecrypt to encrypt at least your Linux /home directory and let native Linux encryption protect the /swap partition, for example. This might allow Truecrypt on the Windows side to mount your Linux files.
Re-partition your hard drive in-place, or add another drive for Red Hat. The folks over at SuperUser probably know more about this.
Figure out how you're going to partition your hard drive ahead of time... you don't need as many partitions as I used.

Requirements

A computer with at least one hard disk you are willing to wipe clean (Back up your data first, of course...)
Installation discs of the OSes you wish to install
Gparted LiveCD or LiveUSB
TrueCrypt
EasyBCD to modify the Windows boot loader (There's a free version...)

Instructions

Back up your data. You are going to wipe the hard disk totally clean and reformat it very soon.

Reformat the entire drive. To do this, I use Gparted LiveCD. If you don’t want to use Gparted, Fedora 10’s installer comes with a partition editor. But, it’s a bit trickier. You’ll have to partially complete the Fedora setup in order to get to it, apply the changes to the disk, then exit setup because Fedora shouldn’t be installed first. (Windows Vista’s partition editor is NOT powerful enough. You cannot use it for this.) I strongly encourage the use of a Gparted LiveCD or LiveUSB.

I thought about how to split up my drive and after a while, I came up with this:

Partition layout for dual booting Fedora 10 and Windows Vista with TrueCrypt

I wish I had sized them differently in hindsight, but you can do it however you want. Each padlock indicates an encrypted partition. The yellow padlocks with “TC” are encrypted with TrueCrypt in Windows. The blue ones are encrypted by Fedora. As you can see, each and every partition - except, of course, the /boot partition - is encrypted. Partitions labeled in red are for Windows. Black is for Linux.

Okay, so this is a setup that works for me. Basically, you’ll want these things:

A primary boot partition to put Grub (the boot loader Fedora can install for you) - I recommend about 50 to 100 megabytes. Do not flag this as “bootable” when partitioning - Windows will complain.
An extended partition to hold all the “data” or “miscellaneous” partitions. This will hold your Fedora /home directory (basically the “My Documents” folder of Linux), Windows backup partition (optional), and your Linux swap file (highly recommended). The swap file should be at least as large as your RAM’s capacity.
A primary partition for Windows Vista to be installed to.
A primary partition for Fedora 10 to be installed to.

Partition your drive as such and be sure to format with the appropriate file systems. You can use the table above as reference.

Write down the sizes of your partitions (in order) and their filesystem. You'll need this during the OS installs.

Start installing Windows Vista. You’ll be forced to do a custom installation. Choose the primary NTFS partition you reserved for the Windows install. Don’t forget to load hard disk drivers - especially on laptops. If your Windows install hangs around 70%, then you need to install the SATA drivers for your laptop. Once drivers are loaded and you select the right partition, install Windows.

After Windows installs, boot into it normally and finish setup. Don’t spend too much time customizing things yet. Once it is running, shut down and insert the Fedora 10 DVD. Boot to that and install Fedora. However, take note of the following:

Be sure you choose to do a custom layout for your partitioning. Fedora will want to wipe things and create its preferred partition layout by default. Don’t let it do this. Make sure you go straight to the part where you can view and modify your current partition information.
Don’t format the NTFS partitions. Windows is on one of them.
Be sure to set the mount point for the small partition (100 MB?) to be /boot. -Check “Format as” and select “ext3.” You cannot encrypt this partition.
Set the mount point for the partition for your /home directory to… you guessed it: /home. Check “Format as ” and select “ext3″ then choose the “Encrypt” option.
Set the mount point for the partition for your swap file as /swap. Linux will have to format it and you should, of course, select “Encrypt.”
Set the mount point for the partition for your main Fedora install to be “/”. Check “Format as” and select “ext3″ then choose the “Encrypt” option.

Before continuing, ensure that neither of the NTFS partitions have a check mark next to them. If they do, they will be formatted and you’ll have to start over. Continue. Fedora will warn you it will delete all the data on the modified partitions. That’s okay. You may have to set your passwords now as well. Go ahead and do that.

Soon it will ask you about the boot loader. Tread carefully here. Do not write the GRUB boot loader to the MBR. When it says “Install the boot loader on/dev/sda1″ (the “sda1″ may be different) - keep the box checked but click “Change Device” and choose “first sector of boot partition” instead.

After that step, you should be home free. Finish up the install and reboot the computer. It will boot straight into Windows.

Once Windows loads, download and install EasyBCD. You’ll want it to easily modify the Windows boot loader. Add an entry to the boot loader: click “Add/Remove Entries” - choose the “Linux” tab, select “GRUB” from the dropdown, and name it something intelligent. Choose the partition that contains GRUB, not Fedora. Leave the checkbox unchecked.

Add the entry then try rebooting. You should now be able to boot into either Fedora or Windows! Boot into Windows again and encrypt it, as follows:

Install TrueCrypt and create a new volume. Choose “Encrypt the system partition or entire system drive.” From this point, you’ll have to choose the proper options. Read them carefully! I don’t remember the exact sequence, but you need to specify “Multi-boot” at some point. At the end it will ask whether Windows has its boot loader in the MBR or if a different boot loader is used (like GRUB). Remember: we're using the Windows’ boot loader (we want Truecrypt to "overtake" it).

Once you’ve finished the volume creation wizard, you’ll be asked to “Test” the system. It will restart for you. It should boot into the TrueCrypt boot loader where you’ll type your password. After that, it should load the Windows boot loader where you can boot into either Linux or Windows.

From here, finish encrypting the Windows system partition, then remember to encrypt any other NTFS partitions you made for Windows.

When you’re done, try booting into Linux. It should go to the GRUB boot menu where you can select Fedora or change your mind and go back to Windows. As Fedora boots, you’ll be asked for your password as it mounts the encrypted partitions.

Tl; dr (Too long; didn't read)

It took me a few tries to get it right with two OSes, and employed the use of software like EasyBCD, Truecrypt, and Gparted, but I was successful in the end... for 2 OSes. Good luck with 4. The key is to plan effectively. Size and format your partitions properly, then install operating systems in the correct order. (Usually Windows goes first.)

PS. Hm, For a simpler solution, though not quite what you asked for: have you considered running 3 of the 4 operating systems in virtual machines? You can encrypt the host machine, thus protecting the other 3 at the same time. (And if you're worried about losing the VHD files, remember you can fully encrypt the guest OSes, too.)


Is this considered directory traversal? So I'm currently testing a site that has a url like this

example.com/dir1/dir2?nextPage=/someOtherDir/someHTMLfile.html

I found that I can do to get to the home page

example.com/dir1/dir2?nextPage=../../

or I can read files like the CSS for another page

example.com/dir1/dir2?nextPage=../../dir3/dir4/css/main.css

NOTE: The company's policy states that a researcher can only go to the minimal amount of testing required to prove that a vulnerability, so I don't want to try accessing the passwd file or any other sensitive file that isn't already public. I also tried example.com/dir1/dir2?nextPage=google.com but it seems to check if the URL is local so that doesn't work. Would what I found be considered directory traversal?

It looks like a directory traversal. To prove whether it is really exploitable I would try to open something more interesting like a script file which is not public available. Otherwise you can't be sure that an attacker can really do something interesting. In my opinion that would be in line with minimal testing. Maybe there is a filter which allows only opening .html and .css files.


SSL decryption/visibility on the host Can host app see traffic before network encryption? E.g. can a host-based VPN app see cleartext traffic (http to https) to make any traffic routing decisions? Considering the TCP/IP model, all operate at the Application layer.

SSL is handled inside the applications (like browsers) themselves by using libraries like SChannel, Secure Transport, OpenSSL, NSS etc. This means only encrypted traffic enters or leaves the applications. Anybody wanting to get access to the plain traffic without being an active man in the middle would need to inject itself into the  process of the running original application or would need to modify the application binary or similar.

I'm not aware of any VPN which would do this and it is also not needed for any routing decisions. Routing is done at the level of the IP addresses (Layer 3) and not at the application level.


How do I revoke the certificate and generate a CRL? I created a self-signed CA certificate, and then created a client certificate using this tutorial here. I am just trying to revoke the client certificate:

openssl ca -keyfile rootCA.key -cert rootCA.crt  -revoke ../oldCert/old.pem superseded

When I try, I get this error:

Using configuration from /etc/ssl/openssl.cnf
unable to load certificate
140187823251392:error:0906D06C:PEM routines:PEM_read_bio:no start line:crypto/pem/pem_lib.c:691:Expecting: TRUSTED CERTIFICATE

I've tried pretty much everything there is on the internet, but it just results in the same error. How do I revoke the certificate and generate a CRL?

Your title is misleading; you are using the default config file, just fine, as shown in your first line of output.

  How do I revoke the certificate and generate a CRL?

These are two separate steps with OpenSSL.

First use openssl ca -revoke $certfile much as you did, but if you want to specify a reason (you don't need to) you must use a flag like -crl_reason superseded not just superseded. This step only updates the 'database' (a simple text file normally named index.txt although it can be configured otherwise). If the CA key and cert files are specified in the config file, which they normally should be, you don't need to specify them on the command line. (This operation doesn't really need them but does access them; see Why does OpenSSL need the private key to revoke a certificate? )

Anytime after the 'database' is updated, use openssl ca -gencrl [options] to actually generate a CRL from the current (updated) contents. The CRL period (in days, hours, or seconds) must be specified on the command line or in the config file; the upstream default config sets it to 30 days, but I don't know what packaging or other modification you are using. Other options may be added as per the man page. This operation does need the CA key and cert, because the CRL is signed with that key and marked for verification with that cert.

This 'database' scheme is identified, rather briefly, in the first text paragraph of the man page for ca(1ssl?) on a Unixy system with OpenSSL or on the web:

  The ca command is a minimal CA application. It can be used to sign certificate requests in a variety of forms and generate CRLs it also maintains a text database of issued certificates and their status.

The 'text database' is the index.txt file (normally) and 'status [of issued certs]' is whether, when and why they were revoked. Whether is indicated by the first tabdelimited field being V for valid or R for revoked; the other information is in the third field and should be pretty obvious.


Where can I get untrusted certificates? Where can I find certificates signed by a CA which are invalid? I need them to test a program I'm writing - I want to check if it will correctly mark invalid certificates.

I found this site: https://badssl.com/ but I can't find any way to download the invalid site certificate.

I'm interested mainly in expired and revoked certificates.
And (I'm not sure if it is important) I'm looking for certificates for signing things, not for web certificates (but AFAIK they're same).

BadSSL is open-source. You can find some of the certificates in their GitHub repository.

On Chrome, you can also export the certificate used for a tab.

Click on "Not Secure", then click on "invalid" under "Certificate".
See the details tab, then click "export" to save the certificate.


Wireshark HTTP continuations (Hydra HTTP version) I am trying to use Hydra to brute force a HTTP POST form page, however the page is returning a HTTP Continuation I'm not sure what that is.

This is being caused by the HTTP/1.0 at the top of the request. I'm not sure how to change it to HTTP/1.1 which would fix the issue.

Also, is there a way to change the order of HTTP headers? And is there an alternative to Hydra that actually has good support for this?

EDIT: Sorry, I didn't give enough information. I'm using wireshark to track the requests that Hydra is sending. It it is showing a sequence of packets like this

src            dst            prot   info
my computer    login server   HTTP   POST /login
login server   my computer    HTTP   Continuation

And if I examine the response, it contains only the lower half of the HTML document in the response. However, using Burpsuite to send the requests, I can somehow see the whole HTML document in the response.

I have tried enabling and disabling Allow subdissector to reassemble TCP streams, which doesn't change anything.

This is really confusing. Does anybody know what's going on??

Hydra's HTTP Form module only uses HTTP/1.0 as can be seen in the source.  You could probably modify the source to send HTTP/1.1, though I can't guarantee its implementation is otherwise conforming.  I've never seen a server which absolutely refuses to speak HTTP/1.0, and many tools use it by default, like wget.

The Continuation you see in Wireshark is because the full HTTP response is not contained in that packet.  There should be a previous packet (if you captured it) that has the beginning of the HTTP response.

If you need a tool to test an application for HTTP passwords and need to speak HTTP/1.1, I believe ncrack supports that.


Is it possible to redirect https to http in modern browsers? What if I was an evil proxy operator who wanted to modify response content, but did not care if the victim sees http://? What happens if the browser requests https://example.com, but example.com has never had a valid SSL certificate? Will the browser automatically redirect to the http:// version? If so then an evil proxy operator should be able to simulate that response, right?

What happens if the browser requests https://example.com, but example.com has never had a valid SSL certificate? Will the browser automatically redirect to the http:// version?

No. Modern browsers don't downgrade to plain HTTP autonomously. If a certificate is invalid, the user will simply see a certificate warning (and eventually an option to add an exception).

  If so then an evil proxy operator should be able to simulate that response, right?

If browsers did redirect to plain HTTP when seeing an invalid certificate, a MITM could silently downgrade any new secure connection by modifying the transmitted certificate details. That would be a major security problem. That's why, as long as you use HTTPS right from the beginning, a MITM can't redirect you anywhere.

Rather, what an attacker can do is try to intercept a plain HTTP response before the connection is upgraded to HTTPS. E.g., if you type in mybank.com, your browser doesn't know if the site provides HTTPS yet and tries http://mybank.com first. Even if this HTTP site immediately responds with a redirect to https://mybank.com, a MITM could already intercept the response and remove the redirect to keep you on plain HTTP. (The HTTP Strict Transport Security (HSTS) feature prevents this exact attack by instructing your browser to always visit the site over HTTPS and reject all attempts to use plain HTTP.)


Why does Keybase sign hashes of previous proofs? I (think) I understand roughly how Keybase works to establish verifiable connections between a user on Keybase and a set of other identities (e.g. Twitter, GitHub, etc.). One of the steps to accomplish this to sign and publicly post a proof of this connection on each connected account. Part of that proof consists of "the hash of his previous signature" (which I assume means hash of the previous proof).

What is the purpose of this element of the Keybase architecture: what does signing hashes of previous proofs achieve?

I see there are great comments already, but let me condense them and add the missing pieces:

Why hashing the previous proof into the current proof?

As already indicated by ISMSDEV, keybase is essentially building an append-only data structure, an immutable log. The idea is that by incorporating the previous proof, you not only sign the current statement but reassure your knowledge of the previous one, as well.

Why is such a chain a good thing?

Append-only data structures have some nice properties: The sequence is fixed and this is easy to prove and verify. Assume you have a chain like this:
A -> B
Where A is the first proof and B is a proof that incorporates the hash of A. If you now want to later add a proof X that "happened" between A and B, you can embed the hash of A to make it a successor. However, the forked chain now looks something like this:
X <- A -> B
If you would really want X to be part of the chain, you would need to create a new B' that incorporates the hash of X instead the one of A. This would look like this:
A->X->B'
Now the nice thing is that this will render the existing proof of B (the signature) wrong, since the signed content changed. Hence, people can detect this, because the head is now B' instead of B.
To make this more clear, if you have a long chain, such as:
A-> B -> ... -> Z, then you can verify no element of the whole chain ever changed by remembering only the current head of the chain. If at ANY point in the chain something is changed, all elements following would need to be recreated and the top element('s hash). So for a service that continuously publishes the chain and hence the head signature, you only need to remember this one and as soon as the chain changes (probably new elements were appended), you just need to verify everything from the head you already had and after that, remember the new one.
If you are interested in more details, Keybase explains some more details of their approach here.

About committing to the Bitcoin Blockchain...

Ok so what I explained above already holds without Bitcoin. But why now also push to the Bitcoin chain? Essentially, Bitcoin users/clients are continuously checking and verifying the Bitcoin chain to be an append-only log, a public, timestamped ledger. This gives us a public, sealed log of events that is secured by a large, global community. Now people started to exploit this by committing data, such as hashes, to the Blockchain in order to securely and irrevocably timestamp their data. The important part here is that in contrast to a sig chain that you as a service owner publish yourself, you cannot rewrite history. For you as a Keybase user, this means the following: If, at any point in time, the head hash available through the Keybase service and the one hashes into the Bitcoin Blockchain at that time diverge, you now something is fishy. The Keybase people call this "Be Honest or Get Caught". You cannot achieve this by posting to a web page only since it can change any time. The Bitcoin Blockchain however is (almost*) unchangeable.

(*) Of course, Bitcoin is not perfect as well, but the probability or attacks that achieve large-scale history rewriting are tiny (see 51% attack).

So what's the bit picture

The big picture is that companies like Keybase put a lot of effort into building crypto software that reduces the amount of trust you have to put into the creators/service owners to a minimum. Beside establishing transparency through open sourcing code, publishing the sig chains, hashes etc allows customers to even use the service if they do not trust it. The idea is that you as a service provider cannot cheat your customer.

Ok so that was a long answer, but I hope it will clear things up. I just felt that there is some context that needs to be mentioned when talking about such things.


How to filter outgoing traffic? There are a lot of programs that check incoming traffic for viruses and other malicious software.

This is yesterday.

Nowadays security means to prevent insider to send information OUT.

Are there any programs that listen to all outgoing traffic and analyse whether it is valuable (containing passwords, keystrokes, voice recorded, geolocation trackings etc) or not?

I don't know what you're aiming for with your question but filtering outgoing traffic through computer software suffers from the same deficiencies like virus scanners and the like. You need a pattern matching software that is able to distinguish what is good and what is bad. If malware records keystrokes, passwords, whatever, it is sufficient to encrypt it and every filter will let it pass because the risk to break business processes by stopping legitimate traffic is too big.
So there is no "yesterday" and "today", all this stuff can be easily tricked with average knowledge available for free on the internet.


Are Facebook chat messages encrypted? I was wondering if chat messages on Facebook are sent plain text, or whether
they are encrypted in some way. The address bar in browser looks like this

  https://www.facebook.com

(notice the https), but are the AJAX requests used by chat also sent over https?

And since my understanding of https is a bit shoddy, what would using https for chat actually mean in terms of encryption? Would there be encryption for incoming messages, outgoing messages, or both (or neither)?

Basically what I'm curious is, can a middle man (a router for example) read any of the messages on Facebook chat?

I took a peek with Wireshark and I couldn't see any plain text message. Everything Facebook related was going through TLS/SSL. It appears that, at least in my case, everything was encrypted. I would, however, appreciate if someone more knowledgeable could confirm this.

I took a peek with Wireshark and I couldn't see any plain text message. Everything Facebook related was going through TLS/SSL. It appears that, at least in my case, everything was encrypted. I would, however, appreciate if someone more knowledgeable could confirm this.

That would be exactly what I would do to test whether my browser is sending plaintext messages from some webapp.  Yet, since you are on a page that is connected over HTTPS the AJAX call must be made through HTTPS thanks to the same origin policy.  There is an old (but still actual) question on SO about it.
If you look at the comments on that question you will also see a reference to the CORS spec which argues the following about Cross Site Resource Sharing:

user agents are allowed to terminate the algorithm and not make a request. This could be done because e.g.:
...

https to http is not allowed.

Now, this part of your question is another story:

And since my understanding of https is a bit shoddy, what would using https for chat actually mean in terms of encryption? Would there be encryption for incoming messages, outgoing messages, or both (or neither)?

For the encryption part I'll simply refer you to the relevant SO question.
For the "shoddy" part you probably mean the (quite) famous sslstrip attack by Moxie Marlinspike.  It is a MITM which fakes to your browser who it is actually talking to, it is an attack that requires the attacker to have control of the network you are on.  HSTS is being widely implemented these days (facebook uses it) therefore sslstip is becoming less of an issue.  And we also have a reference question for sslstrip.
References:

HTTP Ajax Request via HTTPS Page
Cross-Origin Resource Sharing
How does HTTPS provide security?
How does SSLstrip work?


How dangerous is leaking knowledge about existence of objects which the user is not allowed to access? It is my understanding that good security design does not reveal information about data which the user is not allowed to access. This includes information about the existence of said data, i.e. if a user is not allowed to access entities of a certain type, they should also not be able to figure out whether an entity of that type with a certain ID exists.

A project I am currently working on does not support this consistently. For example a request to /edit/record/52 will return an HTTP 404 error if the record with ID 52 does not exist and an HTTP 403 error if it does exist.

I'm unsure how much of a problem this is in terms of security. With this information alone, attackers can probably not do anything. My worry is that this enables attackers to aggregate information about data in the system (as we have several endpoints for different entities exhibiting this same behavior) which could then be used to attack the system. Admittedly, I do not have an attack scenario using this information laid out in my head, but I'm afraid this leakage might at least facilitate attacks. Unfortunately, changing this would require a bit of refactoring of our security architecture, which is why we didn't do it right away.

Is this a common attack vector? Should I be worried and fix this wherever possible? Or is leakage of information about existence of objects acceptable? Could you provide examples of well-known or high-profile attacks where leakage of seemingly insignificant data led to the compromise of a system?

Your assessment of the risk is correct: leaking this data could facilitate an attack by helping the attacker collect information. So even if there is no direct risk, it could speed up the information gathering phase of an attack.

If you have any concern, the usual solution is to sanitise your responses as needed - you could replace those 403's with 404's for example. But if, as you have mentioned, this is high effort - it's worth weighing up whether the slight leakage risk needs remediation.


Is it secure to create a Bitcoin address from a private key generated by Rand() instead of cryptographic elliptic curve I am writing a C++ application  that creates a Bitcoin address. I am having a hard time installing openssl for windows and making it work for visual studio.

So, I am asking myself, if I create a private key, let's say a hex string of 64 chars, by simply executing rand() multiple times, and then create a Bitcoin public address from that, would it be secure?

And if I add more randomness by requesting the user to move the mouse randomly and gathering data as random seeds?

Using the mouse is a good choice to generate entropy, but there are better methods for generating good random numbers.

For generating a single bitcoin address for personal use, the random generator is likely good enough, but is much much much weaker than a properly random key.

If this is for any kind of system that will be generating many addresses (and therefore be a reasonably attractive target for baddies) it is very much not secure enough.

For any given OS/hardware/programming language combination, quite a bit can be deduced about the state of the random generator, especially if people can make multiple addresses, so that they can gather data. From there its a hop skip and a jump to be predicting other peoples addresses/keys. This becomes an even much worse problem if this is deployed as any kind of shared service in the cloud where the same instance of a generator may be making keys for many users

Use of a real crypographic psudeorandom generator is like 2-3 extra lines of code, and very worth the effort.


What are those nul bytes doing in Certificate Subject CN? While doing some research with SSL certificates, I found some weird certificates containing nul bytes in their Subject field. One example is www.refah - bank.ir (did the Iranian government fake this CA? It looks very similar to a Spanish CA except for location...).

Another example is mcafee.com which looks more trustworthy to me. They have two different IP addresses for mcafee.com and www.mcafee.com, the certificate also differs. What surprised me was that such a company uses certificates containing nul bytes in their Subject field:

Data:
    Version: 3 (0x2)
    Serial Number:
        c8:e6:3c:67:a8:7f:38:ba:c9:ab:06:ef:4e:68:67:0d
Signature Algorithm: sha1WithRSAEncryption
    Issuer: O=Network Associates, OU=NAI Certificate Services, CN=NAI SSL CA v1
    Validity
        Not Before: Aug 26 20:36:38 2008 GMT
        Not After : Apr 26 09:28:50 2019 GMT
    Subject: C=US, ST=Texas, L=Plano, O=McAfee, Inc, OU=IIS-Plano, CN=\x00*\x00.\x00m\x00c\x00a\x00f\x00e\x00e\x00.\x00c\x00o\x00m

Opening mcafee.com correctly rejected the certificate as the wildcard does not match against this. Out of curiosity, I edited my host file and made foo.mcafee.com (and www.) point to the IP address 161.69.13.40 (mcafee.com).
I would expect such a certificate to be rejected, but Firefox and Chromium both accept this certificate.

I found another website that has nul bytes in the CN and is still "trusted": https://www.digiturk.com.tr

What is happening here?

This is a badly encoded Common Name. The Common Name, like many elements of a Distinguished Name, can be encoded in several ways, including UTF8String (that's UTF-8) and BMPString. The latter is more or less the same as UTF-16, with two bytes per character (except surrogates, which I won't talk about here). Apparently, someone encoded *.mcafee.com in big-endian UTF-16, but it was decoded as if it was UTF-8 (or ASCII), leading to the spurious null bytes. It was probably improperly tagged in the certificate.


Black box testing javascript MVC web applications I want to test a web application that has been built using the backbone.js framework.

Currently I have used a few tools for crawling and testing without any luck. When crawling the website they can only find the MVC js files, and not the dynamically build pages.
What I ideally need is a tool that is able to parse the javascript in order to build the pages, and test them from there.

Are there any tools available that focus on AJAX intensive web applications?

I have found out that there are a few solutions to this issue. First is to use Burpsuite to index the website. It will function as a proxy and will register all calls made to the website, while you are browsing the website through your web-browser.
This proxy technique can be also applied to other pentesting tools, if supported.

The next step would be to write your own interface to these calls and use the pentest tool from there.


How can one create one's own anti-virus scan server at home? I suppose that every one used a service such as virustotal.com, anubis.iseclab.org, or any other service that could provide the same objective to scan same files.

So my question is how can I make the same thing at home, for my personal use since you can't install more than one anti-virus on your os?

This can be done using techniques like:

Docker
virtual Machines
Jails
Clusters (out of scope for home use)

The trick here is to NOT use a single user environment like Windows. but use a environment where you could safely test any file without risk of infection. So you need a READ-ONLY Environment (full OS, not just the location being tested) which makes using a *NIX ideal.


Secure private key storage In light of BadUSB,
storing private keys on a USB flash drive is not the best way.
What about writing private keys to a CD?

What I am worried about is whenever I plug my private key storage device into the machine, it opens up the possibility that any rogue process may take over and steal the keys.

I have a private key used to encrypt all my other passwords and keys. This way I have a single key to worry about protecting. but it also opens up a single point of failure.

How can I securely store this key?

I was thinking that a QR code printed on paper may be a great way to password protect a private key.
But then that leads to how to securely decode the QR code and decrypt the private key.

You want to investigate a Hardware Security Module. This offloads the keys (and the crypto processing) to a hardened device from which the keys cannot be extracted.

The best known ones are from Thales and Safenet, and they offer versions that are local PCI boards, locally attached (via USB) and network-attached.

If you only have one or two keys, you can also use a USB token, which is a small, low-end HSM in a form-factor similar to a thumb-drive. Another alternative is a smart-card or CAC, which is the chip from a token in a PVC card that is the same size as a drivers license or passport card, or like a very chubby credit card.

In any of these cases, you would install a driver and engine (both are software constructs) to access the device. From here, you would not have access to the key, and would instead access it via the PKCS#11 API interface or the Windows CryptoAPI, which would wrap the request to have the encryption/decryption on your behalf in hardware.

I would also recommend to have three of these devices, of the same type. When you gen and import the keys, do it on all of them, and then test-encrypt the same string with each and compare the output. If it does not match, beware. The first one is for online use. The second is for near-line backup (if it were pocket-sized, in your safe or in your secretary's locking filecabinet) . The last one is your DR/BC copy, and that should stay with your lawyer, with written instructions about when and to whom it can be released. Put simply, over a long enough time, these devices can fail, but are statistically unlikely to all fail together.


Website login using database credentials Is it secure to login to a website by using database usernames, for each user? Is it a bad practice? What can be the issues?

The idea is to create the users and permissions at database level.

EDIT: Any user accessing through my website would have INSERT, DELETE, UPDATE an SELECT permissions in specific tables.

At code level I would block any login to specific users with higher permission levels (like admin).

Only my company staff will be accessing my website. So, there will be no account management through the website, nor creation of new users. I would do it locally.

EDIT2: I will be using PostgreSQL, and my users should be able to access the site over the internet (not the database).

One of the reasons I ask this is because I saw a similar comercial desktop application, which does just that: you login inside the application, with a database username. I know that type of software is intended to be run inside a local network, but can easily be configured to work outside.

Edit: I made a lot of assumptions in this answer that were not necessarily true. I just found out that the DB in question is Postgres. My answer is more tailored towards SQL Server, which until version 2016 did not have Row-Level Security. I'll leave my answer here for information purposes.

What you are suggesting is certainly not best practice, for many reasons. That doesn't mean you can't do it, but you must be willing to concede all of these points if you don't:

With your model, any user can access the database directly without using the website at all. (Edit: this is assuming you are in a local intranet and your users can access the DB directly using another tool outside of the website).

Because of this:

Any user can add/edit/view/delete information for all users, not just their own information. (Note: this is not necessarily true if your DB supports Row-Level Security, and if you use it.)
If any one user's credentials are compromised, all of the data is potentially at risk. (Note: this is not necessarily true if your DB supports Row-Level Security, and if you use it.)
A user accessing the DB directly could incidentally run queries that do something they didn't intend. They can also unknowingly lock up the DB and make it unusable for others.

There are other reasons to not do it, but let's talk about the "norm" instead. Typically you manage your users from the website, and then give the website access to the DB with a single user that has the minimum set of permissions needed. If you ever suspect the DB password has been compromised, you can simply change that one password, and then let the website know about the new password (usually in an encrypted file of some sort that is not web accessible). This also makes it easier to provide different levels of permissions to different users, simply by controlling their access in the website code. You can also get much more granular, for example, you could allow certain users to only update a particular column of a particular table, if you wanted to.

Fortunately, there are many free out-of-the-box solutions that manage users and roles on virtually every popular web platform. I can't really think of good reason to venture away from the norm for connecting to a database via a website.

Edit: even though it may be the case that Postgres best practices differ from my suggestions in this answer, I still am not convinced that providing direct access to the DB is better than my suggestions. Without knowing more about Postgres, I would still prefer this model. But that could simply be because this is what I'm used to.


Why do some certificates specifically identify a corporation and most don't? Looking at a handful of websites that allow for/require HTTPS, I realized that the certificate for a few of them specifically identifies the owning corporation, but some (most) don't.

What's the difference between a certificate that identifies a corporation and one that doesn't? Shouldn't they pretty much all identify the owner of the site?

Certificates that identify the owner of the site are Extended Validation certificates. They require certificate authorities to check the owner identity, and are as such more expensive than certificates that don't.

A normal certificate only ensures that the website you are talking to is indeed the domain you tried to contact.


How do I extract data from response in Burp Suite Intruder? Already gone through How to perform custom response grep/extract in Burp Intruder?, but this does not solve my problem.

While performing attack using Intruder I have used grep extract and obtained values in separate columns.

What I want to achieve is extract that data in a separate text file with each row in new line.

I know that burp supports saving whole response to a file, after which I can search using regex. But I have hundreds of response and it's time consuming.

According to the official documentation you can choose which columns you want to save to the file.

  Results table - This is used to save the results table as a text file. You can choose to save all rows, or only selected rows. You can also select which columns to include, and the column delimiter. This function is useful for exporting the results into a spreadsheet for further analysis, or for saving a single column (such as data mined using the extract grep function) to be used as an input file for subsequent attacks or other tools.

So you should click "Save"->"Results Table" to save the currently visible results table.

To adjust the columns that are visible in the results table (and the ones that will be saved), click "Columns" in the menu and make sure only the columns that you want to export are selected.

Follow the steps:

Step 1:

Step 2:

Step 3: Save in desired format by clicking on save.


Can I be hacked just by watching a stream from a youtube channel that is being hacked? A few days ago I joined a stream on a youtube channel that I later discovered was being hacked.
That got me thinking. Is it possible to have been infected with some type of virus just by accessing the stream (By this I mean that I didn't click on links or add. I just opened the stream on the youtube page)?

Yes, it is feasible.
Do an internet search for something like "video decoder vulnerabilities h265". Plenty of vulnerabilities have been found and patched over the years.
The video stream is compressed with a video-specialised scheme. Different schemes are called codecs. Software code is used to decode the steam and therefore there is scope for errors and exploitation.
If someone uploads a video to YouTube that has a malicious payload, it would need to be unmodified by YouTube. They do reencode uploaded video, but perhaps not all the time: if the video substream is supported, they might send that out to viewers as is (even if a different container format is used). So this reencoding barrier may be the most difficult to overcome. But if a hacker was able to hack YouTube and directly deploy the malicious payloads that would be streamed, then that would suffice. Furthermore, of the reencoder is known, one could upload a payload that they know will be reencoder to their target malicious payload by YouTube.


Are CCE's used anymore? Obviously CVE's are used extensively for referring to specific vulnerabilities. However, I don't see CCE's referenced very much in regards to configurations. I understand that configuration settings are pretty static, but the CCE page hasn't been updated since 2013. Having said that:

Are CCE's still used at all?
Has NIST abandoned this initiative as it hasn't been touched since 2013?
Are there similar initiatives out there?

Configuration settings maybe static but new platforms are introduced time and again and you'll need configuration settings specific to those. Sadly CCEs aren't expanding at the same pace as CVEs.

  1) Are CCE's still used at all?

Yes, the CIS benchmarks still use CCEs for reference. Several government and related organizations depend on CIS benchmarks for their configuration monitoring so I would say that CCEs are still used.

  2) Has NIST abandoned this initiative as it hasn't been touched since 2013?

As you can see on this website there was some activity that happened regarding CCEs. But generation of new CCEids hasn't happened in a while.

  3) Are there similar initiatives out there?

If you are looking for something specific in the Configuration enumeration then I am not aware of but there are several different configuration standards in the market which you can look at. Speaking of enumeration systems, CVE (Common Vulnerability Enumeration), CPE(Common Platform Enumeration) etc come to my mind.


How many places should TLS be encrypted/unecrypted for web traffic? Related, but not the same question as Should SSL be terminated at a load balancer?.

Our web stack looks like:

Web Server - IIS
Load Balancer - NetScalar
Firewall - Palo Alto
CDN/WAF - Akamai
End client

What is the best practice for ensuring security while having the minimal number of TLS encrypts/decrypts?

If your data is sensitive (more than regular personal data), you may want to use TLS all the way to the web server and decrypt in as few places as possible (ideally not at all). Especially CDN which you do not control should not be allowed to decrypt the data.

That being said, IMHO for most kinds of data, encrypting up to your firewall should be enough, as your local network should be protected. If it is not (you don't have adequate physicals defenses, like cameras, alarms, locks...), you may want to get some. Also all the equipment and networking (3,2,1) should be preferably in one locked room, where only few highly trusted employees have access, as physical access is often as dangerous as root privileges.

You still need to encrypt client to CDN and CDN to firewall (your building), but if your CDN is reputable, you can let it decrypt the data.


How to prevent directory traversal when joining paths in node.js? I have a node.js webapp in which I need to concatenate two paths in a safe way. The first one (leftmost) is a constant, and the second one (rightmost) is relative to the first one and comes from untrusted user input. The resulting path should be something that is below the first path. So the situation is this:

path1 = "public/html";                // Hardcoded path.
path2 = req.query.path;               // Untrusted user input.
result = safePathJoin(path1, path2);  // Result can be e.g. public/html/index.htm,
                                      // but never private/config.xml

What I need is the function safePathJoin() that is safe against directory traversal attacks. My first naive approach is this:

safePathJoin = function(path1, path2) {
    path1 = path.normalize(path1);
    var result = path.join(path1, path2);
    return result.startsWith(path1) ? result : undefined;
}

Is this good enough? Is there a standard way to do this? Any suggestions?

Here's is one approach I've used in this situation:

path.normalize() handles all . and .., so you can be sure that if either one is present, it will be at the front of the path.
Remove any ../../ from the front of your path.

So:

var safeSuffix = path.normalize(unsafeSuffix).replace(/^(\.\.(\/|\\|$))+/, '');
var safeJoin = path.join(basePath, safeSuffix);

About your approach: checking the prefix seems like a pretty good idea to me.  There are a couple of problems I see with your implementation:

You've checked for a prefix without a trailing slash: ../html-other will resolve to public/html-other, which I guess is not what you want.
You would run into trouble on Windows systems, where .normalize() would convert / to \, meaning no paths would work.

When I've done prefix-checking (for slightly different situations), here's what I ended up with:

function checkPrefix(prefix, candidate) {
    // .resolve() removes trailing slashes
    var absPrefix = path.resolve(prefix) + path.sep;
    var absCandidate = path.resolve(candidate) + path.sep;
    return absCandidate.substring(0, absPrefix.length) === absPrefix;
}

(Yes, I added path.sep to both, so that the prefix dir itself passes the test.)


OAuth 2 vs OpenID Connect to secure API I am developing a Web API which will back several applications: a website, a companion mobile application(s) and possibly several third-party applications. Every application is expected to get an access token from auth server and then feed it to the API, user will enter their credentials either on auth server web interface (for third-party applications) or directly in the website or app (for "trusted" applications). The client apps themselves are not expected to require user identity.

I've started implementing it via OAuth 2, and it matches my use cases exactly. But later I found several discussions in the 'net that sent me thinking whether my scenario really requires OpenID Connect, and now, after a few thousands of words read I still cannot grok which one is better for my case.

(For example, GitHub, which roughly matches my use cases, uses OAuth 2)

I'd like to hear some guidelines on how does one choose whether one's API requires OAuth 2 or OpenID Connect.

Update

What confuses me is the following: there is a valid point in not using OAuth for authentication. But consider this case (assume that there's a simple business rule: each user can see only their own documents):

app goes to auth server for token
user authorizes the app, so the token is granted
app goes to api with the token for data
api returns documents for user that authorized the token (so somehow the token can be traced back to user)

Is this an authentication scenario or authorization scenario?

PS. I am aware of this question, but the best answer there doesn't address my doubts.

From what you have explained it seems that OAuth 2.0 would better suit your needs. OpenID Connect was developed to add secure authentication to OAuth 2.0. Large providers i.e. Google, Facebook, Yahoo, etc began using OAuth 2.0 as a way to authenticate users with "login with" services so users could use their credentials to authenticate to a variety of third-party services. Standard OAuth 2.0 cannot securely satisfy this requirement because of deficiencies within the protocol. OpenID Connect solves these deficiencies and allows providers to securely use OAuth 2.0 as an authentication framework. OAuth 2.0 was originally developed as an authorization framework which allows a user to grant a third party service access to their data stored on the provider. The scenario you described seems like exactly what OAuth 2.0 was developed to do. If you do not plan to offer a "login with" mechanism use OAuth 2.0.

If a user will have their own credentials for the third-party services and not use your providers credentials to log into the service, you won't need OpenID Connect.

This was the most useful resource I found. It's a blog post by one of the designers of OpenID Connect that addresses Facebook's different uses for OAuth 2.0.


Fully encrypted social network theory I have this idea about building a social network that stores all its data encrypted. The idea is that a member's data is stored on multiple 'base servers' (of the member's choice). Each member has 3 datasets and 3 encryptionkeys.

keyP for his own private data and settings
keyF for his profile (posts, photos, friendlist), he gives this key to all his friends
keyA for his public info (name, city, etc.), also given to friends. Friends can share this one with their friends (this allows people to find friends of friends)

A friendlist would contain the ID, serverlocation and keyA of all your friends.

Members can switch baseservers whenever they want to. When they do, their encrypted data will be completely removed from the server. When a baseserver is added the encrypted data will be copied to the new server and that location will be sent to all friends so they know where to find him. If a member wants to 'remove himself' from the only server he has left there should be some extra confirmation.

I've added a rough sequencediagram to give a visual impression what it could look like.

Question:
Do you think this concept is realizable without big performance issues and do you think the security can be maintained?

Update: maybe "Social network" is not really a proper name for it, I want it to be a platform with a security-first mentality and try to outsmart even NSA-like organizations from decrypting the data (which would require to be very careful with the keys instead of sharing it with all your friends).

A first generic comment is that when you give a key to a friend, there is no way you can prevent that "friend" from sending the same key to other people, or blabbering about your semi-private information. In that sense, encryption cannot make a useful distinction between "keyF" and "keyA". In a security setting, there are only two categories of information: that which you do not tell to anybody, and that which you tell to at least one person. Since it would be quite pointless to upload the former on any server, we could say that there is, in a social network, only one kind of information, meant to be shared. And you cannot really control how far some data is shared.

This is not new. Propagation of secrets through gossip is a well-known phenomenon and is probably as old as language itself.

However you may try to work in a setup where friends are "trusted", i.e. they will keep secrets (I strongly doubt this scenario is practical if the set of friends includes more than three people, but hey, one can always hope). In that case, you may indeed share data by revealing to these select few the key which encrypted the data. This then calls for a second important comment: you cannot enforce forgetfulness.

This means that if you want to "remove" a friend, then you cannot make him "forget" the key which was previously shared. The only method is to create a new key, share it with your remaining friends, and thereafter encrypt your data with the new key only. This implies that removing people from your set of friends implies distribution overheads proportional to the number of remaining friends. This may cause scalability issues.

It is somewhat unclear what you are trying to protect against. Server operators ? Search engines ? Your friends ? Maybe traffic analysis (i.e. reconstruction of the friendship graph) ? This should be defined with great precision. Appropriateness of any algorithm of protocol can be analysed only if we know what kind of security property we want to achieve.

I still urge you to consider the generic comments above. They can be summed up as: data propagation is hard to control. It makes things simpler to think about social networks as repositories for public data: everything you write on such a network may become public or close enough.


How is typing "name at example dot com" safer than "name@example.com"? Say I want to type my email address in a forum...say, hank.chief123@gmail.com. Obviously, that's a bad idea since spam bots will likely find it. So, I would just "cleverly" type hank dot chief one two three at gmail dot com or something similar.

However, wouldn't most of the spammers know this trick, and design their bots to look for at replacing @, and dot replacing .?

My question is, How much more safe is using at and dot, and do many spam bots already try to detect those?

The problem for the bot creator is trying to parse all the text to identify what is an obfuscated email. It's obvious to a human by reading the context, but a script is not going to have contextual awareness. However, the regex to parse a proper email address syntax is well-known.

Try to program a bot to identify hank dot chief one two three at gmail dot com in your post (without knowing the email to look for). There is not a lot there for a script to use to figure out an email.

Sure, a script could look for at [\c] dot com, but getting the name right will be quite a chore.

Some bots will be able to programmatically identify the context based on the form used, but that requires that the forum have an identifiable format to be able to say that "the text in this area is likely an email".


How to MiTM insert an iframe using burp or another tool? So, I am trying to obtain a cookie without the secure flag enabled over HTTPS.
After reading about it, I came across an answer:

You visit https://secure.example.com/ which drops a cookie on
your browser.
You then visit http://www.msn.com/ however a MITM inserts:

MiTM sniffs your cookie from the request on the iframe

I am currently trying to duplicate the above steps.

Using a proxy tool like Burp, I am able to obtain the cookies and all header information.
I am wondering, how do I insert an iframe with a HTTP website as a request?

Am I using the wrong tool?

You can do this using the Proxy tool (tab) of Burp. Just be sure that you added the host (msn.com in this case) to the Scope and check the "Intercept server responses..." check box on the Options tab (under Proxy).

This way all the server responses will be displayed on the Intercept tab where you can place arbitrary content in them.

You can also use the automatic Match and Replace feature under Proxy/Options.

http://portswigger.net/burp/help/proxy.html


Strategy for encryption before cloud storage Apologies if this has been asked before.

I am looking to encrypt documents before storing in the cloud.

There will be a separate metadata storage, which could be either internal or cloud hosted.

My strategy would be to generate a new symmetric key for each document (or batch of documents if key generation is expensive), and then to encrypt the key used with another 'global' key (symmetric or asymmetric) and recording this encrypted key within the metadata storage.

The documents are safe so long as the global key is not compromised, but it could make key management easier since changing the global key means reencrypting the key used in metadata only, rather than having to reencrypt the cloud hosted document.

Does this sound a sensible strategy, or is there a better one you could recommend?

First, it's no problem to use a different symmetric key for each document, generation is easy as you just have to generate a 16-64 byte random string, a matter of a millisecond (mostly).

As threats I guess you consider your cloud hoster and anyone who can get their hands on the documents.

The approach you propose should work.
The document needs to be encrypted and authenticated using an AEAD mode like AES-GCM.
You add a header (which may be stored on the metadata storage, no matter where), which is authenticated and encrypted (using an AEAD mode like AES-GCM) using your master-key.

Scenario 1: You do this for personal access.
You can store the metadata locally or on the cloud, it won't make a difference.
You should use password-based key derivation to derive the master key from your password. The master-key will be symmetric and be used to encrypt+authenticate/decrypt+verify the file-header.

Scenario 2: You do this for a company, or a larger group of people.
You should go with cloud-hosting the meta-data so everyone has access if needed.
You store the header encrypted as described above.
You give everyone a copy of the master-key, so they can encrypt it using their very own password (again using authenticaed encryption + PBKDF)


How get data from password protected rar file? I want retrieve  documents from a password protected rar file? I know brute force and dictionary method. Is there any other method to get data?

The current version of RAR uses 128bit AES, which is very secure. A brute force attack will be useless; and while there are some known attacks on AES, none of them are of any practical use. The specific implementation of AES they use is well respected.

That leaves:

Guessing the password
Dictionary attack
Social engineering the password
Rubber Hose cryptography