All Questions

0
votes
0answers
6 views

'referrer' in document Javascript for Back button [on hold]

I am using function below as Go back to last page but on certain machines 'referrer' in document is not recognized and page reloads itself as last page in history. function GoBackWithRefresh(event) ...
0
votes
0answers
8 views

List of libraries that got hacked in the past and passed undetected on code review?

I am working on an environment where there is the strong believe that open source libraries are unquestionably safe to use because of the public scrutiny and intensive code review (even if not formal)....
0
votes
0answers
11 views

How to make John the Ripper output example hashes for a given hash type?

Is it possible to make John the Ripper output example hashes for a given hash type given by the --format= option? This is possible using Hashcat, but currently I look in John the Ripper's source code ...
0
votes
0answers
12 views

CA issued certificates maps to the wrong user in AD

I'm doing certificate-based authentication using windows server 2012. I've set up the CA, NDES and now, when I request a certificate using the SCEP Challenge password, I'm able to receive the ...
0
votes
0answers
10 views

How is Indonesia blocking images in e2ee applications?

Indonesia's minister in communication and informatics supposedly blocked the sending of images and videos through social media from 22nd May until 25th May, in order to prevent hoaxes from spreading ...
0
votes
0answers
34 views

Malware propagation to new drives [on hold]

I am studying the tactics of new versions of malware, but I would like to how malware writers perform their spread to other drives. I found that once it is executed, it looks for network/fixed drives, ...
2
votes
1answer
50 views

Security implications of client TLS termination

I have a bunch of HTTP services/devices TLS unaware. I want to allow them to access WAN, but of course I do not want them to do it in plain HTTP. Updating them is unworkable due to legacy issues and ...
7
votes
1answer
1k views

Nuke it from orbit - surely can only mean bin and buy replacement?

If there are places on a laptop malicious programs can leave elements, hooks, back doors etc, in locations such as BIOS, device controllers, firmware etc - what confidence can one have in wiping the ...
2
votes
1answer
67 views

How do ISPs send their own pages when a user is trying to access a blocked site?

I know that some ISPs send block pages(like "This site has been blocked because ... ") over HTTP by sending a fake 301/302 redirect. I also know that instead of sending a block page, some ISPs simple ...
1
vote
0answers
37 views

Creating X509 certificate in C using post-quantum public key algorithm?

I'm trying to implement a self signed x509 certificate that uses a post-quantum (PQ) public key algorithm as the public key algorithm. I looked at the openssl library in c, and the way it's done using ...
1
vote
2answers
42 views

How can the Same Origin Policy protect the user in times of CORS headers?

How can the Same origin policy protect something if you can bypass it via Cross Origin Resource Sharing headers? And why are those assigned by the server which is tried to access and not by the user? ...
3
votes
1answer
50 views

Is it easy to hijack browser session if you have access to someone else computer

If someone has access to my computer , can they easily get my session id by going to the browsers developer tools and taking a photo of the session id with a phone, if the session id is passed in a ...
0
votes
0answers
23 views

FIDO2: will FIDO foundation MDS 1.0 metadata statements be migrated to MDS 2.0?

The FIDO foundation provides with metadata web service for UAF (MDS 1.0, https://mds.fidoalliance.org/) and a new web services for FIDO2 / WebAuthn metadata (MDS 2.0, see https://fidoalliance.org/...
0
votes
0answers
39 views

Execute internal penetration test without touching Active Directory

I'm part of a penetration testing team and part of my responsibilities for this quarter are organizing red team engagements for the rest of the year. This quarter, we've received buy-in from all org ...
2
votes
1answer
52 views

What mechanism does Firefox use to remember the in-session logins, after entering the Master Password?

After I have entered my Master Password, does Firefox decrypt all the logins and store them somewhere? Or does it store the Master Password itself? Is the in-session period (more) vulnerable to attack?...
1
vote
1answer
88 views

Can a Regex without characters [(+*{}? be dangerous?

I want to create some functionality for non dangerous regex. I want to accept only very few regex cases where it is safe to assume that they are not malicious (but still giving the user some ...
0
votes
0answers
33 views

Why are ASP.NET form authentication cookies deleted only on client side if client side can't be trusted?

ASP.NET documentation says: FormsAuthentication.SignOut() Removes the forms-authentication ticket from the browser Why is the cookie not invalidated at the server as well? It would be easy ...
1
vote
0answers
20 views

mod_security flush persistence

I run a website with a resource & time consuming URL, say ~20 seconds per request. In the last few days this URL is being targeted by some kind of DoS attack, and I'm trying to use mod_security so ...
-1
votes
0answers
32 views

Can source ip be spoofed when making directory bursting? [on hold]

I am solving pentest box and so my purpose is only for educational. I want to make directory bursting using source ip from a list of ips. Since the server drops packets from an ip if that ip makes ...
0
votes
0answers
32 views

Brand new 8th gen core i7 laptop using 2.9/7.9 GB RAM idling on desktop [on hold]

Brand new 8th gen core i7 laptop using 2.9/7.9 GB RAM while idling on desktop. Machine running Windows 10 and nothing running that Windows hasn’t arranged in the background. I happen to fear a ...
0
votes
0answers
29 views

Hydra -M option issues [on hold]

I receive following warning and Hydra stop without trying all ip address in the target list (More than 1000 IPs ) specified in -M options. [WARNING] More tasks defined per server than allowed for ...
0
votes
0answers
25 views

What is an .nrml file extension? [on hold]

I signed up at what I thought was a legit website and the confirmation email said I should verify by clicking a link like this: http://justdropped.com/next.cgi?file=verify.nrml Which I thought was ...
2
votes
0answers
36 views

OAuth2: what to return when revoking a token which is not the client's? RFC7009

In RFC7009 - section 2.1, it is stated that: The authorization server first validates the client credentials (in case of a confidential client) and then verifies whether the token was ...
1
vote
0answers
40 views

What unique device fingerprinting information can an iOS 12 app collect?

As a follow-on to these questions: What unique fingerprinting information can an iOS7 app collect? What unique device fingerprinting information can an iOS8 app collect? What unique device ...
0
votes
1answer
83 views

Am I making my One-Time Passcode less secure?

I am using some "magic link" one-time passcodes for automatically logging users in for a specific purpose on our website. My plan is to generate a hash based on the datetime, users specific "ID" and ...
0
votes
0answers
33 views

Checking the reverse IP address to find all DNS records

In the context of Vulnerability Assessment, what is the purpose of checking the reverse IP address of an end-point to find all DNS records of ‘A’ type associated with the IP? I've come across this ...
1
vote
1answer
71 views

MAC Spoofing - Keep victim out

I have successfully done a MAC Spoofing Attack on my open (ad-hoc) network using the macchanger tool (OS: Kali linux). I would like to know what are the common techniques to keep the connection alive ...
0
votes
0answers
51 views

What does this opcode in my exploit code mean?

I'm trying to develop an already existing exploit for Windows XP. All DLL's are protected by ASRL, so I used an address in ultraiso.exe, but all addresses start with NULL-bytes. So far, I followed ...
0
votes
1answer
46 views

Storing server-side secret key in environment variable - is a concern?

Is it a security concern to store server-side key in plaintext in environment variables? And specifically with PHP, would I be safe by not calling phpinfo() or other kind of dumper?
1
vote
0answers
40 views

Why is autofs insecure?

I am hardening CentOS/RHEL 7.6. The hardening documents recommend disabling the automounter, "unless it is necessary." Why is autofs such a problem? One of the benefits of networking is a shared file ...
0
votes
0answers
25 views

x86 shellcode leads to segmentation fault

I want to execute execve("/bin/dash", &"/bin/dash", NULL) on Ubuntu 64 bit with the following 32 bit shellcode: global _start _start: xor eax, eax ; set eax = 0 to push a null without using ...
0
votes
0answers
52 views

what to do to make yourself a good bot? [on hold]

We are working on providing credentials on behalf of users to many of the secure sites (anti-bot-prevention-tech/reCaptcha) who don't entertain any kind of bots from technical perspective. Some of ...
1
vote
1answer
78 views

I clicked a link in an email message. What should I do now?

I got a message that looked like an ad from Microsoft. At the end, there was a message saying "You can simply WIPE Out your email from Mailing List click here". I clicked. I got to a page this ...
3
votes
1answer
81 views

When to use which rootkit?

I am new to information security and is currently studying about rootkits. According to my understanding so far: a kernel-space rootkits runs in ring0 and use techniques such as syscalls a user-...
0
votes
0answers
50 views

Generating a valid payload for RichFaces 3.X

I am currently running on a virtual machine JBoss 5.1.0GA + RichFaces 3.X + photoalbum demo which makes me vulnerable (only accessible from my LAN) to CVE-2018-14667. I have tested the payload ...
1
vote
1answer
45 views

Why is not checking the origin of postMessage insecure?

Typically, within the onmessage handler, you would have something like this: window.onmessage = function(e) { if (e.origin != "www.example.com") return; //Do stuff }; The check for e....
0
votes
0answers
42 views

MIC vs PTK, what's the difference?

What is the difference between a MIC and a PTK and how applications like Aircrack-ng and Pyrit are concerned about? note I'm only concerned with WPA2-PSK From my research, a PTK is the pairwise ...
3
votes
0answers
64 views

How does “Fides” from the German Bundesdruckerei work?

I'm no security or cryptographic expert, just an interested computer scientist - so this question may be at the wrong place, or contain wrong assumptions. Nevertheless: The German Bundesdruckerei ...
0
votes
1answer
115 views

Hiring an AppSec Engineer - What to look for?

I am in the process of trying to hire an AppSec Engineer to review our source code manually and have only been able to find those using appscan tools for secure code reviews. Is there something in ...
-2
votes
0answers
44 views

URL injection in email content

I am testing a billing website in which I am able to enter an arbitrary URL in the name and address fields. There is no input validation. The bill or invoice email sent to the user has the entered URL ...
-2
votes
0answers
55 views

SQL database encryption [on hold]

What solution/technology can I use to encrypt all source code on a SQL database in a single file to prevent unauthorized access to sensitive keys whilst still making it accessible by all applications ...
1
vote
1answer
40 views

If only SP (or IDP) uses Shibboleth in its SAML implementation, can the systems still communicate?

I was reading about Shibboleth's metadata -- https://wiki.shibboleth.net/confluence/display/CONCEPT/Metadata#Metadata-Use(andnon-use)ofMetadata , and how it's used to identify IDPs and service ...
3
votes
2answers
57 views

Is OCSP Request Signing Necessary?

We can directly request OCSP Server for certificate status. Then why is there an option to sign the request? Is it to identify incoming requests or something?
-1
votes
0answers
37 views

VPN suggestion for small office [on hold]

What would be cheapest, reliable, 2-way authenticate type, manageable with non-techie, VPN service for a small team of around seven which works in over all continents? Any suggestions please. Thanks,...
2
votes
1answer
113 views

Reliable signs a Windows laptop has been booted for first time [duplicate]

Are there any ways to reliably determine that a Windows laptop has been booted for the first time? I do no trust the system log, and so am hoping there may be certain files or other data (or an ...
0
votes
2answers
96 views

How do we create more secure software when we already work with source code auditing tools like GitLab?

I’m interested to know how CIA, NSA and FBI secure their software when they’re developing a software. My company builds software and products based on c# .NET framework with rest API that communicates ...
0
votes
0answers
38 views

Un-setup (but presumably fully working) Windows, susceptible to malware? [on hold]

If a usb stick with a malware program were inserted into a computer prior to the Windows 10 “installation” process/ setup (I assume a fully working os image is already on the hard disk and running, ...
1
vote
1answer
91 views

Honeypot for Linux user

Let's consider the following scenario: You have a web -facing server, which runs software e.g. apache2 on separate Linux user www-data. An attacker finds a vulnerability and gets a remote shell on ...
0
votes
0answers
34 views

WordPress Suspicious:PHP Help [on hold]

I've tried to download a local copy of our website to play about with some minor front-end tweaks and my anti-virus flagged and prevented the download. I used a plugin to scan WordPress and it ...
1
vote
1answer
61 views

What is advantage of passing request / response data via cookies instead of regular query parameters?

I have a specification where its required to pass all the data in the requests to the server using cookies (instead of body or query parameters) and accept all data from the server using cookies (...

15 30 50 per page