All Questions
65,370
questions
0
votes
1
answer
6
views
How to perform analysis on a potentially malicious .torrent file?
I was recently sent a .torrent file from what I had thought was a trusted source, but when I opened it with qBittorrent, the computer automatically rebooted. I had already scanned the file with ...
0
votes
0
answers
7
views
Should API keys, even for free services, be visible in a page's source?
I sometimes see API keys in page sources, such as the following:
<span class="nf">init</span><span class="p">(</span><span class="nv">...
0
votes
0
answers
17
views
A Continuous Flood of Kernel Warnings. Am I under attack?
I have a Linksys WRT1200AC with DD-WRT v3.0-r48865 std. It's connected to the Internet through the ISP's modem in bridge mode.
My syslog reports continuously, many times per second stuff like this:
...
- 1
1
vote
2
answers
29
views
Should deprecated versions of TLS not be used
I'm setting up an server, the default configurations allow for connections with deprecated TLS versions. Should I remove deprecated TLS versions from my server? What is the difference between a ...
- 225
0
votes
0
answers
21
views
French translation of technical words
While writing a memoir on Network Security I've encountered the following expressions: pervasive mechanism, trusted functionality, event detection and security labels.
The online translation provided ...
- 101
0
votes
0
answers
10
views
What are some common vulnerabilities in APIs?
While doing web application security in startup companies, I am exposed to some backend APIs that integrate with the client web app, but testing APIs is a completely different procedure that I do not ...
- 1
0
votes
1
answer
36
views
What happens if both DoH and DoT are enabled?
If I have DNS over HTTPS and DNS over TLS activated simultaneously (router has DoT activated and smartphone browser has DoH activated, so I see on https://1.1.1.1/help DoH: yes and DoT: yes), which ...
- 71
0
votes
0
answers
7
views
Which browser add-ons prevent downloading of malware when clicking a malicious link? [closed]
Which browser add-ons prevent you from downloading malware when clicking a malicious/infected link? Both Firefox and Chrome.
- 101
0
votes
0
answers
18
views
Small file to trigger false positive when scanning with clamav 0.103 [closed]
I want to set up some scripts for running clamav scans but I want to test that they behave the way I expect them in case of a detection.
I tried searching on the Internet but failed. What small non-...
0
votes
0
answers
7
views
Change default classification label (Azure Information Protection) in Microsoft Office (Outlook, Word, Excel) by user
We have Azure Information Protection (AIP) configured for our organisation, we have 4 labels defined (public, internal, confidential, secret). The default label set for the organization is to "...
- 1
0
votes
0
answers
28
views
Would removing a SIM disable the phone number and block text scams
I have a PAYG basic Nokia mobile, not a smartphone, and have noticed on my EE A/c there is a transaction for a Text Service with a charge of 15p, appearing every so often, which is nothing to do with ...
- 1
0
votes
0
answers
10
views
Can I store subject from a JWT from an external auth server in my DB?
We are retrieving external users using OpenID with the PKCE flow. We are using the JWT returned from the auth server to authenticate the user. If it is valid, we extract the subject field from the ...
- 101
0
votes
1
answer
39
views
Does user uploaded image file to HTML input form pose a risk?
I have a site where I need to get a logo from the user, they can click the input form and upload only .jpeg or .png files. After this the file will stay client side and be used to automatically create ...
5
votes
5
answers
787
views
What cybersecurity jobs are mostly technical?
I am doing my bachelor's in computer science and I have the chance to take multiple cybersecurity courses. Of course, before taking these course, I did some research about jobs in the field of ...
- 53
1
vote
0
answers
25
views
x509 certificates are still exposed even with Encrypted Client hello?
Encrypted Client Hello hides Server Name Indication (SNI). However, looking at the TLS Handshake (https://tls12.ulfheim.net/). Wouldn't it be possible for a middle-man to inspect the TLS Handshake and ...
- 111
0
votes
0
answers
30
views
Protect laptop BIOS rootkit when attacker has physical access
My idea is that, what is the point of disk encryption or any other security measures if attacker uses BIOS rootkit when he has physical access to laptop. Until laptop is off it maybe protected against ...
- 207
0
votes
0
answers
12
views
Cannot get SQL injection to work in DVWA [closed]
I get a blank screen when I inject 1' on low security, for example. If I type in 1 then it displays users, but that's all that will work.
I found instructions on gihub that mention to alter .htaccess ...
0
votes
0
answers
10
views
Can I use ssh-rsa AAA...== cardno:000123456 to import my yubikey public key into open gpg?
I made a private key and sent to my yubikey. However, I lost the public key file corresponding to it, but I have the
ssh-rsa AAA...== cardno:000123456
thing. How can I import this public key to my ...
- 121
0
votes
1
answer
21
views
Recommendations on PKI roles as per ETSI EN 319 401 - V2.3.1
I want to configure roles (least privilege) on my CA instance (EJBCA) and I'm trying to find what are the best practices to do this.
I've tried to read the ETSI EN 319 401 - V2.3.1 standard and try to ...
- 83
0
votes
0
answers
10
views
Nessus Scan failed: 5.2 Ensure 'file_priv' Is Not Set to 'Y' for Non-Administrative Users
Taking a look at the failure
Description:
The File_priv privilege found in the mysql.user table is used to allow or disallow a user from reading and writing files on the server host. Any user with the ...
- 111
-1
votes
2
answers
89
views
What’s the most secure way to obtain & use a computer [closed]
What’s the most secure way to obtain (purchase) & then use a computer/device?
I.e. even if I pay cash for a Mac at Apple. Right when I put in my Ethernet cable wouldn’t Apple see my IP address and ...
- 533
0
votes
0
answers
31
views
Is it possible to assess the integrity of an SSD's firmware using SMART results or drive details?
I recently bought a used SanDisk SSD and I am curious to know if there is any way to assess the integrity of its firmware using information such as SMART or drive details.
In addition to SMART ...
- 1
0
votes
0
answers
11
views
Microsoft Sentinel API for search a query
Is there any API in MS Sentinel to search a query,
Workspace
| where something == "something2"
| where this "that"
I tried using msticpy, any alternative that can be done using a ...
- 1
0
votes
0
answers
28
views
I can't find the rule of CSRF in OWASP ModSecurity CRS version 3.3.2
I want to use OWASP ModSecurity Core Rule Set (CRS) version 3.3.2 to protect against CSRF to APIs, but I can't find any rule about it in the rule file of CRS version 3.3.2 from Github.
Is the rule of ...
- 1
-1
votes
0
answers
44
views
Encryption database on app that runs on client side
I'm having a discussion at work and I want to know the opinion of the community and know if I'm wrong or not.
We have a product that runs on client computers (on-premises) and it uses a local database ...
- 1
22
votes
3
answers
5k
views
Can I prove that I did not receive an email?
A company are saying they sent an email to me. I have gone through all of my inbox, junk, and deleted files and the email still doesn’t exist. They have asked me to prove the email never got to me by ...
- 221
0
votes
0
answers
17
views
GnuPG: How can I clean signatures from my encryption subkey?
Similar to Is it wise to remove redundant self-signatures from my PGP key? - I noticed that after a couple of years, and multiple key manipulation (I use keyoxide.org so my UIDs have multiple ...
- 101
0
votes
0
answers
19
views
Can Proxy replace VPN? [duplicate]
I was reading about proxy vs VPN, to summaries that one could say that VPN is similar to proxy with the addition of encryption for better security.
So I have a question, wouldn't it be better to use ...
- 1
1
vote
0
answers
16
views
Penetration testing framework for Windows Desktop applications
Is there a burpsuite-like framework for Windows Desktop applications? I.e. I'm looking for something that would allow me to intercept user-input data sent to my application for manipulation to test ...
- 11
0
votes
1
answer
58
views
Crack JWT HA256 with hashcat
Is it possible to crack JWT with HA-256 algorithm with hashcat on a normal PC?
hashcat password.txt -m 16500 -a3
How can I calculate how much time it will take?
JWT first section for example ...
0
votes
0
answers
8
views
PGP certify key redundancy
The whole issue is caused by my usage openpgp cards I have 3 cards where I am using one as a Master card with Certify key on it and the second one as a daily runner. The third card was meant to be ...
- 101
0
votes
1
answer
78
views
Who Leaked My Data? [closed]
I am trying play with _IntelligenceX and SNUSBase. So fun. I see documents that list me. But do not show who leaked or where did leak come from. Is such a source exist to look at my Twitter handle or ...
-1
votes
0
answers
54
views
What is code review? [closed]
What is the official definition of code review or source code review?
Does it only mean that another developer reads the code after changes done by another developer?
or it can be done by an automated ...
0
votes
2
answers
92
views
Are country IP address blocks officially standardised and can they be reliably used for access control?
I was setting up firewalld on an enterprise server and came across their concept of firewall zones. I figured I can easily use them and their source property to restrict access to SSH to only the ...
- 184
0
votes
0
answers
21
views
Is lateral movement and horizontal privilege escalation the same thing?
Is lateral movement and horizontal privilege escalation the same thing, what would be the key difference to these two ?
1
vote
1
answer
41
views
What are the security best practices to implement offline login of android apps?
My client has an android application requirement. The users of the application are workers who might have to work at places where internet connectivity is unavailable. So an offline login feature is ...
- 1,380
2
votes
0
answers
26
views
Normative reference for a web application disclosing existing values of integration secrets to users
In a web-based SaaS product, one of the configuration pages allows users to set credentials for system-wide integrations with other products. These include usernames, passwords, and API secrets.
The ...
- 121
0
votes
1
answer
29
views
Is key renegotiation necessary with a larger cipher in OpenVPN?
OpenVPN allows the use of their 'reneg-sec' option to renegotiate keys for the data channel at a specified interval. This helped protect against exploits like Sweet32 with 64 bit block ciphers a while ...
- 99
0
votes
0
answers
20
views
Any studies on the hardware costs of server-side password hashing? [closed]
I am researching the state of the art in password security on the web and the general consensus seems to be that server-side hashing with a slow hashing algorithm (Argon2id, bcrypt, scrypt etc) is the ...
0
votes
1
answer
46
views
How to setup internet connection in a way vpn logs would think I'm logging from different country
I have a company laptop which uses a Cisco VPN to log in to the company network in order for me to work.
How do I configure internet I'm using at home in a way where Cisco VPN logs, or another log ...
- 1
1
vote
2
answers
64
views
How to non-intrusively monitor my team's MacBooks secure configuration?
I'm managing a small remote team. We care about security and I want to be sure that our MacBooks comply with at least basic security standards, such as CIS benchmark.
These are the ways I see I could ...
2
votes
1
answer
41
views
Why does HIBP use k-anonymity when checking passwords? [duplicate]
Maybe I'm misunderstanding the purpose of k-anonymity, but I don't see the why HIBP uses it when checking user passwords.
This website, which explains HIBP's implementation of it, says, "The ...
- 21
0
votes
0
answers
14
views
OpenId Connect and proper usage of nonce
I understand that a nonce is used to prevent replay attacks. I have been going through documentations, specs, posts and blog posts and I am a little confused.
Consider the following attack scenario.
...
- 43
0
votes
0
answers
15
views
Storing strings in a Database that are only visible to their owner who stored them when they were logged in
In my application, logged-in users create some strings, and those strings are stored in the Postgres database.
But, because they are in plaintext, their values are visible to me, as I have access to ...
- 101
1
vote
2
answers
43
views
When renewing a TLS certificate (no change to CSR nor private key), will the modulus remain the same?
Here is the scenario, just wanted confirmation that I am understanding it correctly.
I have a TLS certificate that will expire soon;
Upon renewal, I paid the CA, and they reissued me with a new public ...
- 307
1
vote
0
answers
61
views
Protection against JPEG compression bombs
There is a well-known threat named compression bombs. Such image formats as PNG and JPEG use compression methods, and therefore and threory PNG/JPEG images might be a comperssion-bomb.
I've found an ...
- 23
1
vote
1
answer
70
views
Databases for compromised passwords that browsers use
I am looking into databases of compromised passwords in order to ensure that passwords on a system I am responsible for are not already compromised.
To have complete peace of mind, I prefer to get ...
- 331
0
votes
0
answers
6
views
AES CBC: When to use new IV [migrated]
I am trying to figure out when to use a new IV for an AES-CBC communication and whether my approach is safe.
Here is a quote from Thomas Pornin from a similar question:
So, to sum up: you must choose ...
- 151
-1
votes
0
answers
9
views
Is it possible to enforce CSS1 in browsers? [migrated]
I was recently surprised to learn that CSS2+ is Turing complete, and hence it is potentially dangerous, from the information security standpoint, to open websites containing CSS. That being said, if a ...
- 99
22
votes
9
answers
6k
views
Redirect to login page if authorization required -- security flaw?
Suppose we have a site that has public and private areas. The private areas require login.
For example "www.site.com/about" is publicly accessible. But "www.site.com/message_inbox"...
- 291