All Questions

Given one or two sequential Math.random outputs generated with Internet Explorer's linear congruential generator, is it possible to find the seed used in the LCG and find subsequent outputs? Here is ...

I must give certain employees access to a report which contains email addresses. I would like to redact or partially mask these email addresses, but I am having trouble finding official guidance on ...

the logs are formatted like this.. there is also two brackets around each **: 03/16-08:30:05.350000 ** [1:491:8] INFO FTP Bad login ** [Classification: Potentially Bad Traffic] [Priority: 2] {TCP} ...

Is Chrome on iOS more secure than Chrome on Windows. Since Apple (or Google) restricts extensions, doesn't that make it more secure?

Is it possible for my G Suite admin to monitor me if: -I am off their network. -I am in Incognito mode -I am signed in with my G Suite account to iOS Chrome No, I’m not on a VPN. Just my normal home ...

the context is this introduction in an HP whitepaper. I'm inquiring about "platform-ownership" within the Secure-Boot environment. I'm looking for a simplified summary of platform-ownership. Much of ...

There was a tool that gives probable files headers in whole file(like lzma, crc header, aes etc). I can't remeber name ( not binwalk and trid).

So I am in a situation where I need to prove that I am not hacking or monitoring someone elses computer on a home network. The setup is fairly standard. 2 win 10 computers(one home edition and and one ...

I am trying to figure out the best way to do this. I have done some searching and all I have found is about storing API keys in a back end, nothing like my use-case where there is no back end. ...

Are there any non-obvious mitigations for the big DMA-attack revealed last year and demonstrated in this video by F-Secure? We know that Microsoft has published some material pertaining to DMA-...

My Ubuntu 18 system did an upgrade to Firefox 68 (presumably from 67.x). I have a simple XSRF demo that I use for class --- the demo is extremely simple: I have a login program that sets a sessionid ...

I noticed this NSEC3 record seems to contradict my understanding, and I wondered if it was me or the record that is wrong. The short version, puppies.supplies hashes between myhome.supplies and ...

I'm not experienced with encryption at all, so please bear with me. My use case: I'm working on a membership management web application to be used by a small organisation. When someone becomes a ...

Suppose I sign up for website.com with username "John" and password "Secret". Currently the webbrowser supplies website.com with my real plain text password, and we must trust them to salt and hash ...

I'm trying to interpret this video demonstration by F-Secure of the big cold-boot attack discovered last year. What is happening at the 50-second mark? Why does he insert the USB boot-device before ...

So first of all I'm extremely new to the world of programming, etc. The professor from our Ethical hacking class gave us a seemingly simple task of getting the registration date, expiration date, ...

I am learning about file upload vulnerabilities using DVWA. After cranking the website's security level to High, the website checks both the post request's content type & file extension, so in ...

I am trying to clone/write copies of an NFC card. I am using an ACR122U-A9 receiver and running nfc-tools on a kali linux VM. The card I am trying to clone is identified as a Mifare Classic 1k tag ...

I've been reading up on XXE Injection, and so far every example I've seen has involved a webserver voluntarily loading xml external entities (as below). <?php libxml_disable_entity_loader (false);...

I am trying to help a friend who has a Mac Notebook with a firefox browser, and a gmail account for her emails. She has been in the hospital since the end of March and requested I bring her Mac from ...

All things considered, this question could possibly be a non-issue or simply too stupid a idea to consider for an attacker when other more viable options are available. Suppose you want to use a ...

I am a commerce stream student with some knowledge on computing. I can create and develop games and applications, and I know to use Operating Systems properly like a sceipt kiddie. Till now I know ...

Let's say I want to allow to the customer's of my website to upload PDF documents. What would be more safe to do: Convert the PDF to image using a library and store it in my file server as an image? ...

I was wandering if, a deeplink inside an email that auto-authentication even though the session is expired, it is GDPR compliant. For instance if I send to an user an email subscription with links to ...

I know we can read QR codes using the phone camera. Are there ways to analyze short video bit stream using the camera?

Throughout the RMF documents, one finds the phrase, a) "implemented correctly, b) operating as intended, and c) producing the desired outcome" with respect to meeting security requirements or control ...

I had applied for CVE ID at https://cveform.mitre.org/. I did followed their guidelines, and did exactly as their instructions said (didn't add PGP key as it seems optional). It's been 2 month since ...

I'm in the process of selecting a product for data masking sensitive information in our DB so that developers won't see restricted information while testing production data. I came across some ...

One of our applications uses SQL Server for the back end, and that application requires a 4 digit numerical PIN for employees to be created that works with a key (more or less). The system itself ...

We have a java web application running in tomcat which is hosted in AWS. The operating system used in the server is Centos. Today it become inaccessible for more than 10 minutes. When we got access, ...

Using standard RedHat documentation... https://access.redhat.com/documentation/en-US/Red_Hat_Enterprise_Linux/7/html/Security_Guide/sec-Using_Network-Bound_Disk_Encryption.html Created enrypted ...

aireplay-ng deauthentication does not work for me. Despite everything goes well before, when I enter command aireplay-ng --deauth 2000 ... it only sends a few packets (like 3-4), but sometimes more, ...

Is there any cipher suites supported in one TLS version and not supported in the other? If yes, then is there any documentation that talks about the cipher suites supported in each TLS or SSL versions?...

I'm wondering if there's any repository with leaked penetration testing reports? I found some samples but I'm not confident they are taken from real life cases. Does any one know where can I find ...

I'm using an installation of Ubuntu server on disk, with some extra packages installed and configuration carried out, on disk as a kind of base image for repeatedly creating other systems. I clone ...

I need to implement DNS spoofing attack usign VMs. My host network is connected to a Wireless network. I created one Kali Linux machine (the attacker machine) and another Win10 machine (the victim ...

If I download archived data from a possibly untrusted source at which point am I at possible risk of harming my system: Initially downloading and saving the archived data (still packed) Unpacking the ...

I build a https website and use IIS, I setup SSL settings with Client Certificate to Required, and when I visit the website on browser (chrome), it pops up a client certificate dialog and let me ...

I am a beginner with information security and everything about SSL just goes over my head. Currently I'm trying to get an IoT device(ESP32) to connect to an MQTT broker, broker.losant.com:8883 in ...

This question relates to an answer on Skeptics.SE. Read the comment where somebody wrote "Even if you forward someone the email you received, we can't be sure you didn't fake it." Is this statement ...

I came across a strange webpage crawled by google. A miscellany of text from different websites appears alongside images in a chaotic sequence. The search box at the top returns a different set of ...

I'm of the opinion that HTTPS is sufficient for securing passwords from would-be MITM (man-in-the-middle) attacks, but I'm curious to know if there's anything else I should be doing. During signup, ...

Does it matter if X-Content-Type-Options header is not set to no-sniff in the response if the attacker cannot upload/include files in the application?

I am a low-level system administrator for a new college Learning Management System, or LMS. (An LMS is the platform used by professors to post their syllabi, lecture notes, assignments, grades, ...

So, I have a piece of linux malware that communicates with a C2C server that is no longer active. I have reverse-engineered the malware and figured the commands that it expects. It uses IRC for its ...

Suppose you have vulnerable library, vuln-lib.jar, that you then import into your source code but never actually use: #My imports import com.vuln.lib.* #My code .. And you go onto to deploy this ...

I have been looking at PDO attributes, specifically at resources (some are linked at the end of this post) saying that emulated query preparation is less secure than using real prepared statements, ...

I'm pretty new to the certificate renewal process, so bear with me if this is a stupid/easy question I'm asking. I have a jks store that had a certificate expire under the alias aliasA. Another ...

In iOS apps, Apple goes to a lot of trouble to keep applications from creating a stable identifier for a specific device. For example, in iOS >= 5 they no longer allow apps to get the hardware-tied ...

I got hold of a prepaid credit card if I buy amazon gift cards with it will I be tracked? if so how can i avoid that? Thanks