All Questions

So, I'm trying to exploit this program that has a buffer overflow vulnerability to get/return a secret behind a locked .txt (read_secret()). vulnerable.c //no edits here #include <stdlib.h> #...

I am trying to make a POST request, and after the request browser automatically sends a GET request. How to stop this GET request?. I can drop it using burp, but I need to drop every time I do POST. ...

I am trying to devise a way to find side-channels that reveal exact TLS library (and its version) running on the remote server by adopting similar approach to JavaScript Template Attacks However, if ...

I'm wondering how much I should trust our clients and their SSO implementations. We have an identity provider set up for @our-domain.com and most users of that domain have a lot of rights in our ...

OWASP is recommending x-permitted-cross-domain header. I gone through many websites and blogs and didn't get to know the difference between x-permitted-cross-domain and CORS. Since I have implemented ...

I'm currently thinking about writing a Firefox/Chrome and Python/PHP/JS plugin to accomplish the following: Assuming you are on a non-SSL secured site or you simply don't trust any CA like Let's ...

I am looking for any reliable, up-to-date sources (which may be RSS feeds, websites, or anything else OSINT-based) which contain password dumps and their relative links. I am looking particularly for ...

According to https://cve.mitre.org/cgi-bin/cvekey.cgi?keyword=jquery+1.12.4 and https://snyk.io/test/npm/jquery/1.12.4, I see that jQuery 1.12.4 has medium serevrity vulnerability. I checked on ...

I assume one uses one uses dhe on top? / instead of? some other key derivation function. But I am confused as to what that actually means in practice and what the considerations are.

Let's say you have a single sensitive document. You're traveling to somewhere high risk and are advised not to bring your data, but you also don't have safe storage at home. So you encrypt your ...

I know that "VM escape" is becoming a common issue now with malware testing. I'm just wondering if there's any way of verifying if the host system is clean from any infection after running a malware ...

I have been befrauded by an acquaintance of mine who borrowed large sums of money and provided contracts with his Turkish address and these contracts supposedly were sent by his lawyer in Turkey. But ...

How are you dealing with the OpenSSH vulnerabilities CVE-2019-6109, CVE-2019-6110 & CVE-2019-6111 on CentOS 6 in a PCI server? OpenSSH doesn't seem to have a fix for this yet, but it fails ...

I found this NPM package that looks like can be used to verify two factor authentication for websites, and also generating tokens for signing into other websites. In the README there is a section ...

This is message: 34f6e67627164757c6164796f6e63712026496e616c6970297f6570236f6d607c656475646024786963702471637b6e2

I have successfully discovered a vulnerability in the New York Times website. Is there any known way I can report this? I have not attacked it. But I found a bypass. What should I do?

I'm currently in the phase of integrating my web-site to OpenID Connect provided by KeyCloak. The web-site is not a single page application. However, different parts of the application are delivered ...

Anyone knows, can recommend, or is using a management deployment tool to updates desktop apps (Ex. Dropbox) on hundreds of Macs and Windows PCs in one shot? Can you share how you update apps in these ...

Suppose any two hash files that differ exactly in one bit from each other. How much the difference will I get in term of bits when hash value created? Assume MD5 or MD1 hash function.

Let's say I found a login-bypass/root-backdoor in a software my company uses that gives you root privileges within that software by simply entering a keyboard combination. I've reported this within ...

I would like to understand the advantages and disadvantages of load balancing outbound connections for anonymity. Scenario 1: My router (ip A) > VPN router (ip B) > VPN router (ip C) > web host ...

I want to deobfuscate malicious code where they are embedded in the URL. I have these URLs downloaded from here, where the URLs are embedded with malicious JavaScript. URL

Endgame AV on Virustotal detects files as just malicious (medium confidence) or malicious (high confidence). Are there any criteria publicly available for these detections? Are there clean guidelines ...

I have was asked this question: What are the basic things that need to be explained to every employee about a security policy? At what point in their employment? Why? (List at least 4 things). ...

I was running the following command hoping to run a dictionary with hashcat (worked with kali) on windows and use the GPU to see the speed differences. (WPA2 handshake converted .cap file) hashcat64....

Clang on OSX doesn't support OpenMP by default, so I could not compile JtR with OpenMP support without another Clang installation. However, after looking at the below option, I wonder what the ...

I am in the process of setting up an api which will have the subdomain "api.", I have been advised to change this to something "less obvious" to avoid automated attacks against it. I can't find any ...

A developer running Docker for Windows needs to enable the option "Expose daemon on tcp://localhost:2375 without TLS" in Docker setting > General tab. There is a warning: Exposing daemon on TCP ...

In a website when "Forgot Email" page opens it gives a textbox for email input but when in that text box some scripts or inputs like: ' OR '1'='1 is filled only a simple 'tick' sign comes in the send ...

I'm trying to parse nvd databases from nvd vulnerabilities feeds https://nvd.nist.gov/vuln/data-feeds#JSON_FEED I see many entries, where vendor product information is not filled in (cve->affects->...

Most of my questions were answered in this post ASLR bypass with info leak However, I just want to know the process of getting the memory address from the information leak to then using it in the ...

this is pretty odd but I want to change my school test marks. Yeah, it is unethical but I just want to do just on my tablet and not on schools website. I would just show some good marks to my Indian ...

I have a machine with a process that signs code for users running 24/7 (encrypting the key is not possible), which will be protected as well as possible. Is there a way to set things up such that I ...

Webroot marks valid file as [Trojan.Dropper.Gen] We develop and deploy a Windows Desktop Software Application, but this gets repeatedly marked as [Trojan.Dropper.Gen] The antivirus software webroot ...

I am trying to run a VBS script which calls a macro and won't run unless I click "Trust Access to the VBA object model" in Microsoft Office Trust Center. I forget where I read it but I thought I read ...

I put a reverse shell on a machine in my lab enviornment and it seems to just hang after there is a connection in netcat - I'm not sure why this is. I've tried different ports but no luck. See ...

Bear in mind it looks like Apple Push Notification Service is a gateway for pushing viruses and malware to users devices, if I am not mistaken, just look here: https://www.virustotal.com/gui/ip-...

I have built a REST API, where users login, with extra permissions in some cases (or restricted to certain areas of the site; or even admin privileges). What I've built: JWT authorization (added to ...

Does anyone have any recommendations for enterprise password management solutions? The main requirement is that it must be hosted and managed on premises by us.

Consider a web application that: uses HTTP Basic Auth over HTTPS, and therefore needs to validate a password (an API Key) on every request and needs to handle a substantial load has very few distinct ...

I am looking for, but not finding, a published protocol that does something similar to TLS 1.3 mutual authentication, but simplified by using assumptions to reduce the chattiness of TLS. If we assume ...

I'm adding Client Certificate Authentication to my application - what is the correct way to handle an invalid certificate, untrusted certificate or an un-mapped user ID?

I am installing a pivpn, on my raspberry pi, at my home network and it asks me for the DNS provider for my VPN Clients. I am concerned about the privacy of the DNS. What can I do to ensure the maximum ...

suppose I have the following code that will display an image. The name of the image is supplied by the user as follows: https://example.com/image.php?image=cat.jpg My image.php file contains $...

I am trying to perform an HTML injection on my buggy web app (bWAPP). So far I made it on low and medium level but I am really struggling with high-security mode. Can you give me some tips?

I am testing a website that has "Forgot my password" functionality. If user clicks that, his email address will be displayed as a hyperlink. If that is clicked, an email to reset password will be ...

Can a self-root certificate (implemented via mobile configuration) spy on me without a VPN or proxy on iOS?

Is it possible to inject SQL statements with fmt.Sprintf instead of Db.qwery with the ? and not %s parameter? I know it's a bad habit to use it but I wonder if it's possible or not. Example : query :...

I'm just starting to learn execve command, so I'm sure this is a very easy mistake, but I've stuck on this for hours, so any help or hints would really be appreciated, my code is as follows: section ...

I feel like my phone is being monitored/tapped as it keeps glitching out and other abnormal symptoms. How can I check/remove these unwanted programs?