All Questions

1
vote
0answers
4 views

How does TPM and BitLocker work together?

When a computer has a TPM module, BitLocker doesn't seem to require a password, which makes me really uncomfortable. Where's the key coming from? What's preventing someone from grabbing the key by ...
-1
votes
0answers
4 views

Need help regarding Cyber Security project on Intrusion Analysis and File Integrity Monitoring

I want help in making a project that is Intrusion Analysis and File Integrity Monitoring I don't know where to begin or what to do as I am new in this cyber security field as I am a student. At ...
0
votes
1answer
16 views

Encapsulating DNSSec into Dot or DoH

I read a few articles on how DNSSec works (here and here). The DNSSec request are not encrypted, and I wanted to know if it's possible to encapsulate it into a DoH or a DoT request?
0
votes
0answers
10 views

Whether cross cookie sharing between the android apps is potential threat to privacy?

Recently I wanted to buy the particular product from an online website and was just searching that product during my leisure time. after some time suddenly I saw the ad of that product on Instagram ...
-2
votes
0answers
9 views

Proof-of-authority vs Proof-of-space vs Proof-of-stake vs Proof-of-work

What is advantage of using one against the other. What are the differences Proof-of-authority Proof-of-space Proof-of-stake Proof-of-work
0
votes
0answers
8 views

does vBulletin and similar discussion forum CMS store previous email address and password hash in database?

I am in the process of De-Googling myself and use complex passwords. I change my registered Gmail to an alternative mail provider I change my password to a complex one I use mostly vbulletin and ...
3
votes
2answers
36 views

Android Security - Giving Google Your Phone Number

While setting up my Android account on my phone, I am asked If you like, you can add this phone's number to your account .... ..for example you number will be used to: Reset your password ...
0
votes
2answers
29 views

Logged into same network of residence, owner knows my Mac address.. what can they see?

Logged into same network of residence, owner knows my Mac address.. what can they see? They are techy and know my Mac address for my phone and PC. Can they see text message to and from me? My email? ...
0
votes
0answers
16 views

Traceroute / mtr show only 2 hops [on hold]

traceroute to google.com (216.58.209.174), 30 hops max, 60 byte packets 1 192.168.0.1 0.941 ms 1.270 ms 1.575 ms 2 216.58.209.174 18.725 ms 19.184 ms 19.826 ms traceroute to yahoo.com (98....
0
votes
0answers
10 views

do we need VPN for SaaS cloud applications?

If we need to connect to the corporate network from home, we need to have the VPN connection. However, what if for accessing SaaS applications like Google Doc, Salesforce, etc, do we need still need ...
-1
votes
0answers
21 views

is the “unknown” in the path of this email, the source of the delay and does it occur prior to leaving Docusign?

Created at: 6/6/2016, 1:05:58 PM PDT ( Delivered after -13 sec ) SPF: pass DKIM: pass DMARC: pass # Delay From * To * Protocol Time received 0 ...
-1
votes
1answer
33 views

Online traffic monitoring by ISP for safety purposes

I have a question regarding approach to online security and protection against viruses, malware and phishing by one of the biggest European ISP. Below you will find my understanding of the topic. Is ...
0
votes
0answers
5 views

Can you tell who approved an email to go out from a distro in Exchange online?

We have some distros that require moderator's approval if the sender is not on the allowed sender's list. So the email land's in all the moderator's inboxes and one of them clicks a button to allow ...
-1
votes
0answers
10 views

OpenVPN can't establish connection on Ubuntu 18.4

My OpenVPN credentials work on Windows 10 but I am having difficulty connecting from Ubuntu 18.4. It is simply reporting that the connection failed on Ubuntu. The config files, cert and key are all ...
0
votes
1answer
49 views

What is the importance of fuzzing?

I’ve heard a lot about fuzzing website parameters with programs like OWASP-zap but what is the importance of it? A simple active scan finds vulnerabilities in a website such as XSS. So why do we need ...
0
votes
1answer
46 views

DNS Poisoning? Unable to access a specific website

Below are the DNS servers that I have been using for many years: 84.200.69.80 DNS Watch (Hostname: resolver1.ihgip.net ISP: Accelerated IT Services GmbH) 91.239.100.100 Uncensored DNS (IP: 130.225....
0
votes
1answer
40 views

OpenVPN via TCP or UDP

I read a question here about this topic but actually I am not super sure whether I understood it correctly. Unfortunately, because of my low reputation I can't comment there, so I decided to ask here ...
0
votes
2answers
64 views

Is it better to rate limit API requests based on UserId or IP address for authenticated users?

I'm thinking of rate limiting anonymous requests based on IP, but for users with a valid authentication token, I can't decide if it's better to log and rate limit requests based on their UserId or IP ...
0
votes
0answers
13 views

Could an intermittent or “resuming” connection be caught as a TCP port scan attempt?

I'm learning how to properly configure iptables to fend off TCP port scans on a hosted Linux-based VPS -- I'm not particularly interested in blocking this kind of attack, but rather in understanding ...
0
votes
2answers
40 views

How to monitor password protected web page

I want to use a website monitor to check that a web page is working but the web page requires that the user is authenticated. Is there a crafty way of achieving this that doesn't require storing an ...
0
votes
1answer
26 views

AWS Load Balancer Response Header Apache Server Disclosure

I have a node.js environment deployed using AWS Elastic Beanstalk on an Apache server. I have run a PCI scan on the environment and I'm getting 2 failures: Apache ServerTokens Information Disclosure ...
1
vote
2answers
40 views

Bypassing file upload restrictions on php server

I am conducting a penetration test on a website and am trying to prove that php code can be executed with the file upload. The website allows for file uploads but it checks for: 1: Filetype 2: ...
0
votes
2answers
53 views

How can pentest reports contribute to structural solutions for vulnerabilities?

When you do a pentest what is your recommendation to the client on how to handle/interpret the report? What I frequently see is that identified issues - especially issues related to self developed ...
-1
votes
0answers
29 views

Blackberry have the authentication system of picture and digits combination

Has per security concern, I personally used this feature on blackberry. I felt more secured while unlocking the phone ,even someone watching you while unlocking they can't get the pattern or ...
-5
votes
0answers
39 views

How I can hack android with java image [on hold]

I code with java How i can hack android with java image like put java code into image and execute in phone target
0
votes
2answers
52 views

Web App or Web Services testing?

I am trying to clear up a doubt on security testing. If the web app (GUI, functional UIs, user roles, et all), makes use of rest web services to take actions, I believe both the web app AND the web ...
19
votes
2answers
6k views

Does this mean Target's twitter was successfully attacked?

I was just surprised to see this suspicious promoted tweet, asking me to send Bitcoins I added the hand-drawn red lines so I am not responsible for propagating the apparent scam. Clicking on the ...
3
votes
2answers
84 views

How to choose between password derivation or encryption?

Suppose you use a password manager having all possible features of modern password managers: encryption with a key derived from your master password, auto-filling, cloud or local storage, browser ...
0
votes
0answers
58 views

Capturing HTTP Traffic Through Proxy Sever

While performing the security assessment on an Android application(UAT Environment), I'm unable to capture the HTTP traffic through proxy server(Burp Suite/OWASP Zap). There is no point of ...
0
votes
0answers
22 views

Can anyone suggest about Application [Research] of Elliptic Curve Cryptography [on hold]

I am trying to do my undergrad thesis in my univeristy and want to do it on Elliptic curve cryptography. Can anyone suggest me where to apply ECC.
0
votes
1answer
56 views

Tampering of temporary and intermediate files

It just came to my mind that few years ago many iOS applications where infected by XcodeGhost (notably WeChat). This made me think about few possible scenarios: Malicious code injected in object ...
1
vote
1answer
65 views

Is information still being sent from a discarded tab in my browser?

I was connected to my workplace wifi via my personal phone for 10 minutes. I did not open anything strange that could get me into trouble. I was doing some work. However, when I finished looking up ...
0
votes
1answer
65 views

Recognise tool by which file was encrypted [duplicate]

I have file with extension *.encrypted. Can you give me some advice how to recognise by witch tool was this file encrypted? It´s not encrypted by some ransomware but by some encrypt tool. When I open ...
0
votes
0answers
14 views

Using Referer/Origin request header to prevent CSRF [duplicate]

I'm testing a web application checking the Origin or Referer request header as a CSRF prevention mechanism. I could not find a way to bypass these checks and they seem to be implemented reasonably ...
-3
votes
0answers
40 views

Failed to start OpenVPN [on hold]

After I've installed OpenVPN; I faced with below errors. Would you, please, support me about ? systemctl status openvpn@server.service openvpn@server.service - OpenVPN Robust And Highly Flexible ...
-5
votes
0answers
27 views

Diagram illustration of an IDS [on hold]

This is a scenario based question. A large corporation has hired you to develop an IDS infrastructure for their network. The organization has five subnets: Marketing, Research, Development, Sales and ...
1
vote
1answer
32 views

Lastpass - Can I use my old master password to decrypt local data?

I am a user of Lastpass and I have some concern about the storage of local data. According to my knowledge about Lastpass, there is an encrypted local vault stored in my devices with the Lastpass app ...
-5
votes
0answers
44 views

I'm trying to Decrypt the following Encryption - B-893bc61697fae28215bf8e5ecab3a81e [on hold]

I'm trying to Decrypt the following Encryption - B-893bc61697fae28215bf8e5ecab3a81e I do not have much knowledge of Encryption, Decryption etc. But all i do know is, i can't find anything on this, i ...
1
vote
2answers
38 views

Effects of new random Session token for each HTTP Request

On successful authentcation, a web application issues a session cookie that is a constant length string of apparently random hex characters. ...
0
votes
0answers
4 views

In which Scenarios an Authentication can itself trigger EAP Failure message

I was looking at a sample PCAP from 1 of configured CISCO catalyst switch configured for EAP-TLS authentication. In few snippets there were 2 EAP request and EAP response followed by EAP failure ...
-2
votes
0answers
24 views

porque tengo este error al querer entrar por la aplicacion [on hold]

![al querer conectarme desde la aplicacion me salio este error, yo estuve ejecutando unos comandos como dm-boot y dm-verity ppr problemas de seguridad en mi correo, quizas por eso me sale ese error? ] ...
1
vote
0answers
23 views

Provide email author origin integrity

If i receive an email, how does my computer verify the author origin integrity using the digital certificates? Does it use any specific protocol for this?
3
votes
3answers
121 views

How is a pepper used with salted passwords?

How is a pepper (a large constant number) used after a password has been salted with a salt by a hashing function such as bcrypt? From Sybex CISSP Official Study Guide, 8th Edition (2018): Adding ...
1
vote
0answers
30 views

How does my computer actually validate a certificate? [duplicate]

Let's say I receive an email from my friend, X. The email is attached with the digital certifciate of X. Suppose this digital certificate is issued by a company called DS, and my computer does not ...
0
votes
0answers
50 views

Hacked website Database [on hold]

I just got an email from a hacker that says Hello Dear Support Admin I hacked your site and copy entire data to my laptop. If you send me 1(one) BitCoin : 1.You have your data. 2.You have my help ...
-3
votes
0answers
40 views

Is that setup safe enough? [on hold]

First of all I changed my macadress and hostname. After that I connected to my neighbor's WiFi. Then I used a double-vpn connection and cleaned my computer up, connected with rdp and activated socks5 ...
-4
votes
0answers
43 views

Encrypted file - I need decrypt it [on hold]

I have this file and my school task is to decrypt this file. Can anybody help me how?
0
votes
1answer
50 views

Shipment tracking displaying delivery information publicly - Is this dangerous?

Background: Many shipping companies (like DHL, UPS, national postal services, etc) will allow the recipient of a package to track their package online, and will often display the address that the ...
0
votes
0answers
45 views

John the Ripper quits before cracking hash

I have a single raw-md5 hash that I want to crack. I've put it in a proper text file without a trailing linespace. I also want to use a wordlist for this. However, john exits before actually trying to ...
0
votes
0answers
13 views

comprehensive knowledge about attacks on near field communication [on hold]

Where can I learn about attack and security implementations of NFC chips? Specifically Mifare Desfire EV1. Google didn't give me much on it. I want a comprehensive study.

15 30 50 per page