All Questions

Filter by
Sorted by
Tagged with
0
votes
0answers
3 views

I need to change my kali Linux's default gateway [migrated]

i tried to change my kali linux's default gateway to 192.168.1.1 but when i tried i got this error: SIOCADDRT: Network is unreachable I tried the following command btw: route del default gw 192.168....
0
votes
0answers
20 views

How can you tell if an email is really from the address it claims it's from? [duplicate]

I am creating a basic website contact form. It requires entering a 'from' email address. I entered a dummy email address, which I do not control, yet the email is still sent, and, to the recipient, it ...
0
votes
0answers
22 views

is MITM attack possible when we verify only the jump host's fingerprint (host key)?

I am connecting to remote hosts via jump host where I verify only the jump host's host key, but turn off host key verification for the target hosts. the ssh command arguments look like this: -o ...
0
votes
0answers
24 views

Could events 1, 61 and 27 generated by the source [UniversalTelemetryClient] be a sign of a compromisedsystem? [closed]

Previously I was sent e-mail information from my ISP about pva.intowow malware that might of infected my system. This post is get information on a seemly correlated event pattern I've discovered on my ...
3
votes
4answers
420 views

Can hash of a hash be used to create cryptographically secure random data from strong random seed?

I was wondering if generation of sequential hashes from random seed can be considered "random enough" to be used in cryptographic operations? By sequential hashes I mean the following: First ...
0
votes
0answers
22 views

Any open source mutator support regex? [closed]

Is there any open source mutator supporting regex? for example, I want to generate data like below. input: "%d%d" output: 00, 12, 13, 46, 29, ... Previously I tried radamsa but I realized ...
0
votes
1answer
45 views

"Too Many Failed Attempts” message in Gmail, but I tried just once [closed]

After trying to log-in in my Gmail account with the right password, I received as expected an SMS to confirm that it's me. After correctly entering the G-<6 digits> code sent by Google, I get ...
0
votes
0answers
18 views

How does stack allocation work in this program? [closed]

I'm trying to write a blogpost on this challenge (it's pretty basic, it should teach you about buffer overflows and ret2libc attacks). The source code is the following: #include <stdlib.h> #...
0
votes
1answer
70 views

Can this be MITM attack?

a friend of mine wanted to install MongoDB Community when he encountered a problem. The .msi file downloaded from https://www.mongodb.com/try/download/community was rejected by Windows when he tried ...
1
vote
0answers
28 views

Shamir secret sharing, is security reduced by chunking a secret into smaller blocks?

When using Shamir's secret sharing algorithm one has to define the size for the finite field over which the secret is split. I came across a few implementations, like secrets.js-lit, and as far as I ...
0
votes
0answers
36 views

Is using HSM worth in this scenario?

Long story short, I've assigned with the task to find a way to improve security in an application, they are using java keystores to save and protect the keys. The application owner is worried that ...
1
vote
0answers
18 views

Is checking to see if any parameters contain “__proto___” an effective way to mitigate Prototype Pollution vulnerability?

let key = keys[j] === '' ? (currentParams as any).length : keys[j]; if (key === '__proto__') { throw new Error('Prototype pollution detected.'); } It at least defeats basic url-encoding,...
0
votes
1answer
24 views

Is there any standard or protocol of key exchange between multiple nodes?

A little context: I'm working in designing a system to sign and verify data sent between modules of a bigger system. Currently the system has two parts, a central application and a SDK inside modules ...
0
votes
0answers
25 views

Why does Windows not enable TPM 2.0 parameter encryption to protect against bus sniffing of Bitlocker key?

Comes from Bitlocker, does additional authentication at startup with TPM device provide any extra security? You can sniff the key right from the bus currently: As the decryption happens automatically,...
0
votes
0answers
25 views

Can a deleted veracrypt volume be recovered and decrypted?

If you were to delete a veracript volume, either yourself or as someone trying to break in, can that information be recovered from a memory stick? Also if the volume is recoverable, would the ...
0
votes
1answer
38 views

Man-in-the-Middle Mobile (e.g. Android) Application Tool

I'm trying to MITM an Android application but I cannot get it to work properly. Usually, I'm using Burp for those kind of attacks, which allows me to intercept and decrypt HTTPS traffic. (Assuming the ...
0
votes
0answers
25 views

Vault as an app configuration store

Is it common practice or are there pitfalls to using Vault by HashiCorp not only for storing secret parameters but for other app configuration key-values?
4
votes
3answers
2k views

Why not just use a small but odd number of hashing rounds?

When it comes to hashing passwords, it is nowadays practice to do 100'000 or 200'000 iterations of SHA256/SHA512, or at least something in that ballpark. But my question is, why is it not safe enough ...
0
votes
0answers
23 views

Are those secure folders there by default? [closed]

A friend of mine suspect she has beeen hacked. She got called by a strange number, answered the phone, and then the call was immedeately ended. She sent me the following screenshot: My question is: ...
0
votes
0answers
9 views

AppCertDLLs does not work in GUI apps, why?

I was trying to automatically inject a dll to every process (including GUI) whenever it is started by a user . My DLL hooks DoDragDrop method of winapi and communicates with server to decide allow or ...
0
votes
1answer
37 views

Is there any way that I can redirect to other site when someone access to a particular site? [closed]

On my company's computer, someone play the internet game so I want to deny the site and redirect to another site. Or If someone access the game site redirect to other site right off on computer ...
-1
votes
0answers
42 views

American sources attacking Russia/China [closed]

It appears that cyber attacks are becoming more frequent and larger in scale - with the notorious Solar Winds and now Pegasus attack in recent memory. What most of these attacks have in common (or at ...
-1
votes
0answers
30 views

Working With Hydra Brute Force [closed]

This is the command I'm using: sudo hydra -l admin -p admin https://(myserver.com) https-post-form "/portal2/user:{"action":"login","username":"^USER^",&...
1
vote
1answer
112 views

What does Snowden mean by “majority of vulnerabilities … are introduced, for technical reasons …, at the exact time the code is written”?

In a recent Substack article ("The Insecurity Industry", 2021-07-26) Edward Snowden writes: The vast majority of vulnerabilities that are later discovered and exploited by the Insecurity ...
0
votes
0answers
27 views

Hydra with a 3-part username

I am using this code in hydra to bruteforce a password hydra 147.91.xxx.213 http-post-form "/ssasdkaduzsp/do:maticnaKnjiga=ee&brojUGodini=1021&godinaUpisa=20516&pass=^PASS^&action=...
9
votes
3answers
3k views

If we fixed SIM jacking would SMS then become a valid way to send an MFA token to?

And if not would like specific reasons why. I have this suspicion that, although an inferior method these days to MFA applications, believe that the security is adequate enough as most phone companies ...
1
vote
1answer
47 views

How does Sequoia allow unprivileged users to get root if it requires mounting a filesystem?

CVE-2021-33909 AKA "Sequoia" is a vulnerability against the filesystem code within the Linux kernel. According to the description of the vulnerability from Qualys Successful exploitation of ...
0
votes
0answers
46 views

Historical examples of breached TOTP secrets?

While reading about password breaches, it occurred to me; where are the TOTP shared secret breaches? Because TOTP relies on a shared secret (unlike say U2F) the server has a copy of the shared secret, ...
-1
votes
1answer
54 views

How can those “RFID signal blocker cards” work without any kind of battery or power of any kind? [closed]

https://www.netonnet.se/art/hem-hushall/bra-att-ha-hemma/safe-n-sound-antiskim-card/1011895.9253/ This card is apparently put in your wallet and protects your pay cards from skimming, by "sending ...
0
votes
0answers
12 views

Is it possible to disable login via password in ssh? [duplicate]

I had an idea to secure my system better when someone tries to ssh into my machine and that had to do with ssh keys. When logging in with ssh, you are prompted with a password that, if correct, gives ...
2
votes
2answers
54 views

Sharing files with others, encrypted on untrustworthy file storage (e.g. the cloud)

I want to work on a photo-sharing tool, where I can: store photos on untrustworthy disk space (like the cloud) share photo albums with friends and family update photo albums (rarely but happens) ...
0
votes
2answers
76 views

read etc/passwd using XSS

by trying the XSS room on THM, I try was trying to read the /etc/passwd using the following cmd: <iframe src="/etc/passwd"></iframe> However what I got is an error code as shown ...
0
votes
1answer
42 views

Can the ISP know which SSID I am logged in through? [closed]

If, for example, I am in a building containing 150 offices. They are all serviced by the same ISP. Each floor has a router servicing 30 offices each. I log on through Thompson Construction wifi ...
0
votes
0answers
27 views

i need a help for john warnings [closed]

I'm writing C:\Users\asus\Desktop\john180j1w\run>john.exe The-Witcher-3.zip hash.txt and john gives me these : Warning: invalid UTF-8 seen reading The-Witcher-3.zip Warning: detected hash type ...
0
votes
2answers
43 views

Sending password in separate email [duplicate]

I've noticed some services will send a username in one email with a note saying the password will come in a different email. Is there any point to this? It seems that if someone can get that email ...
0
votes
0answers
29 views

Windows directory that is only accessible by SYSTEM user

I am developing a .NET Windows Service using C# that needs to download an executable file and run it. I need the Windows Service to run with SYSTEM privileges in order to allow it to install software ...
2
votes
1answer
68 views

How does validating the PGP signature of a downloaded executable against the publisher's public key show that the binary has not been tampered with?

Websites that host downloadable executables often provide measures to confirm the integrity of the data that is available to download. Such measures include: Hosting the website under HTTPS; ...
0
votes
0answers
45 views

Bruteforce files with base64 encoded names [closed]

There are a bunch of files in a directory on a website. The file names are like this: [base64 encoded 8 character part]-[static part].mp4 Examples: https://example.com/videos/neCvxy4d-ZwJ6E9cx.mp4 ...
0
votes
0answers
27 views

Can someone see my contact list because of Truecaller? [closed]

I read somewhere that Truecaller had its database open. Is it still open to the public, or can someone with enough time get access to it and see who I have on my contact list?
-2
votes
0answers
52 views

Compliance 1984 [closed]

Ok, this is not so much of a question as it is a post; sharing what some of you may find absurd, indeed is is! With all the recent policy updates and the insane algorithm enforced stringent compliance ...
0
votes
0answers
11 views

Identify hash pattern inside a string [duplicate]

I believe that this question was answered already, though I couldn't find it. I have several strings that include hash. Each string has hash and some random (or not) add-on. How can I identify the ...
0
votes
1answer
57 views

User login encryption - Is SSL enough? [closed]

We recently had a security engineer review our platform and they told us we need to encrypt the data when it's sent to the server. However we're already sending the data with a SSL certificate. Which ...
1
vote
2answers
125 views

What is Malware Family: pva.intowow

I've gotten an e-mail from my ISP saying that one of my devices might be infected with malware. In the e-mail they have provided me with some information about the malware but I'm having trouble ...
0
votes
0answers
87 views

Is an owned domain + self hosted email the closest to owning one's online identity? Are there better alternatives?

Most online accounts identify users using email/phone & password; but since most all email/phone is handled by another service (e.g. Gmail), one's online identity only exists so long as these ...
0
votes
0answers
49 views

Is there a fullproof way to safely erase SSD data, without physically destroying it?

During my search for an answer to this question I found that TRIM may not be reliable(https://blog.elcomsoft.com/2019/01/life-after-trim-using-factory-access-mode-for-imaging-ssd-drives/)as well as ...
0
votes
0answers
20 views

How do I get my hotmail.fr address back? [closed]

I just changed my hotmail address to an outlook domain one. I removed the old address. How can I set it back to hotmail.fr if the only option showed for domain is outlook.com
0
votes
0answers
12 views

How to architect cross-device sign-in

Taking Microsoft Authenticator for Microsoft accounts and WhatsApp Web as examples: Both allow one device to request authentication, and another one to receive the authentication success. How are ...
0
votes
0answers
25 views

share text in the form of a letter? [closed]

There used to be a site that you could paste a snippet of text (bitcoin address/private key etc;) that you wanted to share privately & press 'encrypt' & it would generate a realistic looking ...
1
vote
1answer
38 views

Can I use part of PBKDF2 output as an IV (nonce)?

SHA-256 generates a 32-byte hash, Is it a safe practice to use the first 16 as an iv (nonce) and the second 16 as a key ? What other things I should consider when using PBKDF2 in a scenario like this ?...
0
votes
3answers
66 views

Should I have another domain name for my company internal tools

My company has a domain name that we use to serve our customers, say company.com for the main website, app.company.com for the web application and api.company.com. These are all public domains that ...

15 30 50 per page
1
2 3 4 5
1261