All Questions

Filter by
Sorted by
Tagged with
0 votes
1 answer
6 views

How to perform analysis on a potentially malicious .torrent file?

I was recently sent a .torrent file from what I had thought was a trusted source, but when I opened it with qBittorrent, the computer automatically rebooted. I had already scanned the file with ...
user avatar
0 votes
0 answers
7 views

Should API keys, even for free services, be visible in a page's source?

I sometimes see API keys in page sources, such as the following: <span class="nf">init</span><span class="p">(</span><span class="nv">...
user avatar
0 votes
0 answers
17 views

A Continuous Flood of Kernel Warnings. Am I under attack?

I have a Linksys WRT1200AC with DD-WRT v3.0-r48865 std. It's connected to the Internet through the ISP's modem in bridge mode. My syslog reports continuously, many times per second stuff like this: ...
user avatar
1 vote
2 answers
29 views

Should deprecated versions of TLS not be used

I'm setting up an server, the default configurations allow for connections with deprecated TLS versions. Should I remove deprecated TLS versions from my server? What is the difference between a ...
user avatar
  • 225
0 votes
0 answers
21 views

French translation of technical words

While writing a memoir on Network Security I've encountered the following expressions: pervasive mechanism, trusted functionality, event detection and security labels. The online translation provided ...
user avatar
  • 101
0 votes
0 answers
10 views

What are some common vulnerabilities in APIs?

While doing web application security in startup companies, I am exposed to some backend APIs that integrate with the client web app, but testing APIs is a completely different procedure that I do not ...
user avatar
  • 1
0 votes
1 answer
36 views

What happens if both DoH and DoT are enabled?

If I have DNS over HTTPS and DNS over TLS activated simultaneously (router has DoT activated and smartphone browser has DoH activated, so I see on https://1.1.1.1/help DoH: yes and DoT: yes), which ...
user avatar
  • 71
0 votes
0 answers
7 views

Which browser add-ons prevent downloading of malware when clicking a malicious link? [closed]

Which browser add-ons prevent you from downloading malware when clicking a malicious/infected link? Both Firefox and Chrome.
user avatar
  • 101
0 votes
0 answers
18 views

Small file to trigger false positive when scanning with clamav 0.103 [closed]

I want to set up some scripts for running clamav scans but I want to test that they behave the way I expect them in case of a detection. I tried searching on the Internet but failed. What small non-...
user avatar
0 votes
0 answers
7 views

Change default classification label (Azure Information Protection) in Microsoft Office (Outlook, Word, Excel) by user

We have Azure Information Protection (AIP) configured for our organisation, we have 4 labels defined (public, internal, confidential, secret). The default label set for the organization is to "...
user avatar
0 votes
0 answers
28 views

Would removing a SIM disable the phone number and block text scams

I have a PAYG basic Nokia mobile, not a smartphone, and have noticed on my EE A/c there is a transaction for a Text Service with a charge of 15p, appearing every so often, which is nothing to do with ...
user avatar
  • 1
0 votes
0 answers
10 views

Can I store subject from a JWT from an external auth server in my DB?

We are retrieving external users using OpenID with the PKCE flow. We are using the JWT returned from the auth server to authenticate the user. If it is valid, we extract the subject field from the ...
user avatar
  • 101
0 votes
1 answer
39 views

Does user uploaded image file to HTML input form pose a risk?

I have a site where I need to get a logo from the user, they can click the input form and upload only .jpeg or .png files. After this the file will stay client side and be used to automatically create ...
user avatar
5 votes
5 answers
787 views

What cybersecurity jobs are mostly technical?

I am doing my bachelor's in computer science and I have the chance to take multiple cybersecurity courses. Of course, before taking these course, I did some research about jobs in the field of ...
user avatar
  • 53
1 vote
0 answers
25 views

x509 certificates are still exposed even with Encrypted Client hello?

Encrypted Client Hello hides Server Name Indication (SNI). However, looking at the TLS Handshake (https://tls12.ulfheim.net/). Wouldn't it be possible for a middle-man to inspect the TLS Handshake and ...
user avatar
  • 111
0 votes
0 answers
30 views

Protect laptop BIOS rootkit when attacker has physical access

My idea is that, what is the point of disk encryption or any other security measures if attacker uses BIOS rootkit when he has physical access to laptop. Until laptop is off it maybe protected against ...
user avatar
  • 207
0 votes
0 answers
12 views

Cannot get SQL injection to work in DVWA [closed]

I get a blank screen when I inject 1' on low security, for example. If I type in 1 then it displays users, but that's all that will work. I found instructions on gihub that mention to alter .htaccess ...
user avatar
0 votes
0 answers
10 views

Can I use ssh-rsa AAA...== cardno:000123456 to import my yubikey public key into open gpg?

I made a private key and sent to my yubikey. However, I lost the public key file corresponding to it, but I have the ssh-rsa AAA...== cardno:000123456 thing. How can I import this public key to my ...
user avatar
  • 121
0 votes
1 answer
21 views

Recommendations on PKI roles as per ETSI EN 319 401 - V2.3.1

I want to configure roles (least privilege) on my CA instance (EJBCA) and I'm trying to find what are the best practices to do this. I've tried to read the ETSI EN 319 401 - V2.3.1 standard and try to ...
user avatar
  • 83
0 votes
0 answers
10 views

Nessus Scan failed: 5.2 Ensure 'file_priv' Is Not Set to 'Y' for Non-Administrative Users

Taking a look at the failure Description: The File_priv privilege found in the mysql.user table is used to allow or disallow a user from reading and writing files on the server host. Any user with the ...
user avatar
-1 votes
2 answers
89 views

What’s the most secure way to obtain & use a computer [closed]

What’s the most secure way to obtain (purchase) & then use a computer/device? I.e. even if I pay cash for a Mac at Apple. Right when I put in my Ethernet cable wouldn’t Apple see my IP address and ...
user avatar
0 votes
0 answers
31 views

Is it possible to assess the integrity of an SSD's firmware using SMART results or drive details?

I recently bought a used SanDisk SSD and I am curious to know if there is any way to assess the integrity of its firmware using information such as SMART or drive details. In addition to SMART ...
user avatar
  • 1
0 votes
0 answers
11 views

Microsoft Sentinel API for search a query

Is there any API in MS Sentinel to search a query, Workspace | where something == "something2" | where this "that" I tried using msticpy, any alternative that can be done using a ...
user avatar
0 votes
0 answers
28 views

I can't find the rule of CSRF in OWASP ModSecurity CRS version 3.3.2

I want to use OWASP ModSecurity Core Rule Set (CRS) version 3.3.2 to protect against CSRF to APIs, but I can't find any rule about it in the rule file of CRS version 3.3.2 from Github. Is the rule of ...
user avatar
  • 1
-1 votes
0 answers
44 views

Encryption database on app that runs on client side

I'm having a discussion at work and I want to know the opinion of the community and know if I'm wrong or not. We have a product that runs on client computers (on-premises) and it uses a local database ...
user avatar
  • 1
22 votes
3 answers
5k views

Can I prove that I did not receive an email?

A company are saying they sent an email to me. I have gone through all of my inbox, junk, and deleted files and the email still doesn’t exist. They have asked me to prove the email never got to me by ...
user avatar
  • 221
0 votes
0 answers
17 views

GnuPG: How can I clean signatures from my encryption subkey?

Similar to Is it wise to remove redundant self-signatures from my PGP key? - I noticed that after a couple of years, and multiple key manipulation (I use keyoxide.org so my UIDs have multiple ...
user avatar
0 votes
0 answers
19 views

Can Proxy replace VPN? [duplicate]

I was reading about proxy vs VPN, to summaries that one could say that VPN is similar to proxy with the addition of encryption for better security. So I have a question, wouldn't it be better to use ...
user avatar
  • 1
1 vote
0 answers
16 views

Penetration testing framework for Windows Desktop applications

Is there a burpsuite-like framework for Windows Desktop applications? I.e. I'm looking for something that would allow me to intercept user-input data sent to my application for manipulation to test ...
user avatar
0 votes
1 answer
58 views

Crack JWT HA256 with hashcat

Is it possible to crack JWT with HA-256 algorithm with hashcat on a normal PC? hashcat password.txt -m 16500 -a3 How can I calculate how much time it will take? JWT first section for example ...
user avatar
0 votes
0 answers
8 views

PGP certify key redundancy

The whole issue is caused by my usage openpgp cards I have 3 cards where I am using one as a Master card with Certify key on it and the second one as a daily runner. The third card was meant to be ...
user avatar
  • 101
0 votes
1 answer
78 views

Who Leaked My Data? [closed]

I am trying play with _IntelligenceX and SNUSBase. So fun. I see documents that list me. But do not show who leaked or where did leak come from. Is such a source exist to look at my Twitter handle or ...
user avatar
-1 votes
0 answers
54 views

What is code review? [closed]

What is the official definition of code review or source code review? Does it only mean that another developer reads the code after changes done by another developer? or it can be done by an automated ...
user avatar
0 votes
2 answers
92 views

Are country IP address blocks officially standardised and can they be reliably used for access control?

I was setting up firewalld on an enterprise server and came across their concept of firewall zones. I figured I can easily use them and their source property to restrict access to SSH to only the ...
user avatar
0 votes
0 answers
21 views

Is lateral movement and horizontal privilege escalation the same thing?

Is lateral movement and horizontal privilege escalation the same thing, what would be the key difference to these two ?
user avatar
1 vote
1 answer
41 views

What are the security best practices to implement offline login of android apps?

My client has an android application requirement. The users of the application are workers who might have to work at places where internet connectivity is unavailable. So an offline login feature is ...
user avatar
2 votes
0 answers
26 views

Normative reference for a web application disclosing existing values of integration secrets to users

In a web-based SaaS product, one of the configuration pages allows users to set credentials for system-wide integrations with other products. These include usernames, passwords, and API secrets. The ...
user avatar
  • 121
0 votes
1 answer
29 views

Is key renegotiation necessary with a larger cipher in OpenVPN?

OpenVPN allows the use of their 'reneg-sec' option to renegotiate keys for the data channel at a specified interval. This helped protect against exploits like Sweet32 with 64 bit block ciphers a while ...
user avatar
  • 99
0 votes
0 answers
20 views

Any studies on the hardware costs of server-side password hashing? [closed]

I am researching the state of the art in password security on the web and the general consensus seems to be that server-side hashing with a slow hashing algorithm (Argon2id, bcrypt, scrypt etc) is the ...
user avatar
0 votes
1 answer
46 views

How to setup internet connection in a way vpn logs would think I'm logging from different country

I have a company laptop which uses a Cisco VPN to log in to the company network in order for me to work. How do I configure internet I'm using at home in a way where Cisco VPN logs, or another log ...
user avatar
  • 1
1 vote
2 answers
64 views

How to non-intrusively monitor my team's MacBooks secure configuration?

I'm managing a small remote team. We care about security and I want to be sure that our MacBooks comply with at least basic security standards, such as CIS benchmark. These are the ways I see I could ...
user avatar
2 votes
1 answer
41 views

Why does HIBP use k-anonymity when checking passwords? [duplicate]

Maybe I'm misunderstanding the purpose of k-anonymity, but I don't see the why HIBP uses it when checking user passwords. This website, which explains HIBP's implementation of it, says, "The ...
user avatar
  • 21
0 votes
0 answers
14 views

OpenId Connect and proper usage of nonce

I understand that a nonce is used to prevent replay attacks. I have been going through documentations, specs, posts and blog posts and I am a little confused. Consider the following attack scenario. ...
user avatar
  • 43
0 votes
0 answers
15 views

Storing strings in a Database that are only visible to their owner who stored them when they were logged in

In my application, logged-in users create some strings, and those strings are stored in the Postgres database. But, because they are in plaintext, their values are visible to me, as I have access to ...
user avatar
1 vote
2 answers
43 views

When renewing a TLS certificate (no change to CSR nor private key), will the modulus remain the same?

Here is the scenario, just wanted confirmation that I am understanding it correctly. I have a TLS certificate that will expire soon; Upon renewal, I paid the CA, and they reissued me with a new public ...
user avatar
  • 307
1 vote
0 answers
61 views

Protection against JPEG compression bombs

There is a well-known threat named compression bombs. Such image formats as PNG and JPEG use compression methods, and therefore and threory PNG/JPEG images might be a comperssion-bomb. I've found an ...
user avatar
1 vote
1 answer
70 views

Databases for compromised passwords that browsers use

I am looking into databases of compromised passwords in order to ensure that passwords on a system I am responsible for are not already compromised. To have complete peace of mind, I prefer to get ...
user avatar
  • 331
0 votes
0 answers
6 views

AES CBC: When to use new IV [migrated]

I am trying to figure out when to use a new IV for an AES-CBC communication and whether my approach is safe. Here is a quote from Thomas Pornin from a similar question: So, to sum up: you must choose ...
user avatar
  • 151
-1 votes
0 answers
9 views

Is it possible to enforce CSS1 in browsers? [migrated]

I was recently surprised to learn that CSS2+ is Turing complete, and hence it is potentially dangerous, from the information security standpoint, to open websites containing CSS. That being said, if a ...
user avatar
22 votes
9 answers
6k views

Redirect to login page if authorization required -- security flaw?

Suppose we have a site that has public and private areas. The private areas require login. For example "www.site.com/about" is publicly accessible. But "www.site.com/message_inbox"...
user avatar

15 30 50 per page
1
2 3 4 5
1308