To safely store a passwords, it is better to store them hashed using a hashing function designed to be slow like bcrypt. The goal is to trump brute force attacks. Are there any ciphers slow enough to prevent brute force attacks? I am especially interested about SSH private key storage. Would a b...

Yes, it's possible to trust companies. You do it all the time. If you use Windows, you're trusting Microsoft very heavily. Same goes for Apple if you use any of their products. When you use HTTPS you're trusting a whole raft of Certificate Authorities, most of whom you've never heard of before. ...

I just setup a test bed and i disabled information_schema from being accessed (a weak waf) and i've been trying to extract the table list from the database by using convert to spit out a conversion error with the contained information. To extract the version we use the syntax: +and+1=convert(int,...

I have a setuid program which is listing a file this way: #include <stdlib.h> #include <stdio.h> int main(void) { system("ls /challenge/binary/binary1/.passwd"); return 0; } What I need is to get the program to disclose the content of the file instead of simply listing its nam...

We have a hacker occasionally attempting to hack a site, and so far unsuccessful, but I would like a way to determine if the site has been compromised (i.e., files edited). The type of attacks are LFI and attempting to inject iFrames in some source files. What can I install on my Debian server to...