All Questions

Filter by
Sorted by
Tagged with
0
votes
1answer
14 views

Certificates Do Nothing

Please correct me if I'm mistaken, but I've reached the conclusion that CA-signed certificates in the current Internet Public Key Infrastructure do not add any more security compared to servers ...
0
votes
1answer
32 views

Router firewall ICMP risks and threats?

I have found out, that my Router firewall has never blocked ICMP traffic. There is a lot of opinions online regarding ICMP, and whether it should be disabled or limited. So far I have found out, that ...
0
votes
0answers
17 views

Enable or Disable CORS for Domains and API

I currently have two domains that I use for my app: Ex: backend-app.example.com and api.example.com In both domains the access-control-allow-origin header is *. This configuration is this way because ...
0
votes
1answer
19 views

Unclear security impact of a Reflected XSS vulnerability

What is the security impact of a Reflected XSS vulnerability on a state website involved in financial relations? There are no user profiles on this page and it serves as an information board and a ...
0
votes
0answers
18 views

How does Anti-CSRF token get delivered?

I was reading an article describing how CSRF works. The article did a pretty good job but it started to talk about how to protect against CSRF and one of the methods that the article has mentioned is ...
0
votes
0answers
19 views

Escaping out of a select query to run a statement that modifies data in the database

Lets say you use SELECT * FROM ($query) sub where you can swap $query to any query you wish. Is there a way to escape this select and run a command that modifies data in the database?
2
votes
3answers
233 views

Can a cloned page have HTTPS certificates?

Imagine that a hacker is cloning Twitter or Facebook. The attacker uses his own website, but it is going to be HTTP, right? So can he have the certificates that ensure that his website is "secure&...
0
votes
1answer
34 views

Link test differs from link location in plaintext view is not visible in Thunderbird

Today I noticed something strange. I got an email containing a link that links to another site than the text says. In (Simple) HTML, the review is visible when hovering over the link. However, in ...
2
votes
0answers
58 views

AWS credentials seem terribly insecure. Why?

In my ~/.aws/credentials I have the following: [default] aws_access_key_id = <something> aws_secret_access_key = <something-else> This file has permissions 0600 but doesn't ...
1
vote
0answers
32 views

Android System Update Spyware Can Steal Your Photos, Money, Record Calls and Track You Too. What to do if this happens? [closed]

I came across this website and suddenly I got worried. What worries me is apart from the system update threat mentioned I have been visiting so many sites, clicked on pop-ups, downloaded apps from ...
1
vote
0answers
22 views

How to choose specific file names in php code? [migrated]

$_FILES['userfile']['type'] == "image/gif" There is a problem to choose not only image.gif but whatever name is, such as *.gif . And, if it is possible, can you share some regex expressions ...
0
votes
0answers
24 views

can disconnect all phone contact to computer via cmos script? [closed]

I have a computer from which I have removed the wi-fi card, antenna, all software/firmware to wi-fi and Bluetooth. My info is that CMOS can be used to hack a computer via telephone. Is there any way ...
0
votes
0answers
13 views

Transparent Voting and Advance Secret Code [migrated]

In the book "Introduction to the Theory of Computation", Michael Sipser writes The field of cryptography, as this area is known, now extends well beyond secret codes for private ...
0
votes
0answers
37 views

What are the chances that my private photos are accessed remotely using malicious software? [closed]

Recently I had installed two apps from third party websites to my android smartphone and now I am going paranoid about what if the apps contained malicious codes and my private photos are accessed ...
0
votes
0answers
38 views

How do you execute a base64 payload [closed]

How do you execute a payload with a base64 format in a webpage I tried to host it on a local server so that when a victim gets redirected to the link the payload gets executed Generating a payload ...
0
votes
1answer
37 views

Is this scenario of static ECDH public key exchange right?

I'm thinking about the way to build encryption mechanism for 'peer-2-peer' communication. This is a mechanism I had a thought of: Alice wants to communicate with Bob First of all, Alice and Bob must ...
0
votes
0answers
23 views

x509 validation check service

I would like to check validity of x509 certificates of my clients. I would like to trust the certificates what big companies trust. For example I would like to trust what Microsoft Edge, Chrome ...
0
votes
0answers
32 views

I think someone hacked into the Android of my friend but not sure [closed]

i have a friend whos'e daughter downloaded a lot of "games" from the play store since then the phone acts strange. Phone Contacts automatically disappered. He uses is phone for work, and ...
1
vote
1answer
78 views

Is saving a dark web page locally and reloading it in another browser a security risk?

Say I have Tor running and am browsing the dark web with the Tor browser. If I were to save a local copy of a web page and render it into another browser, like Chrome (with JS enabled), would I then ...
0
votes
0answers
23 views

Someone is apparently spoofing my email [closed]

Timeline of relevant events as far as I can tell: Someone I don't know sends me direct messages on Discord offering close collaboration on a project we were both members of. I didn't decline. That ...
1
vote
0answers
31 views

Decrypt RSA encrypted value generated from .net in Android [migrated]

I have gone through many posts here but did not find the right solution. I want to decrypt a value encrypted in c# .net from Android. I have successfully decrypted in .net platform using the following ...
0
votes
3answers
44 views

Is it secure to put a mysqldumped file online?

I made a database table of emoji country codes. I exported the data via mysqldump into a file called countries.sql. I want to share it because it was a hassle finding anything like this, so I want to ...
0
votes
0answers
24 views

Best secure approach with Basic Auth

Due to several customer reasons our product needs to support Basic Auth as primary authentication mechanism with client's service account. We are using Bcrypt to store customer's password in our DB, ...
1
vote
1answer
59 views

Can someone intercept my messenger calls

I want to know whether or not facebook messenger calls can be intercepted and listened to by hackers. I would also like to know if my exact location can be found by hackers through them knowing my ...
0
votes
0answers
31 views

Accidentally entering .onion link without any protection, am I at risk? [closed]

This just happens recently while I browsing a subreddit, there was supposedly a comment pointing to an image I'd like to see, but upon clicking it I got redirected to what it seemed to be .onion link, ...
0
votes
1answer
35 views

On Gmail I received an Incoming TLS Encrypted Message. Will my reply be encrypted by default to different email provider?

If I receive an incoming TLS encrypted message from another email provider like outlook/hotmail, will my reply in transit from gmail to outlook/hotmail be encrypted by default as well?
0
votes
0answers
37 views

How to get Future Keys (Session Key) from IPEK for decryption data?

I'm new to DUKPT, so I'm not entirely clear about DUKPT and HSM. Right now, I'm trying to decrypt data (PAN number) from terminal. So far, when I receive KSN and encrypted data, I understand that I ...
0
votes
0answers
37 views

Uploading php webshell using Burp Intruder

I am using Burp Intruder to upload a webshell to different directories. These 400 responses tell me the requests are bad. I should be getting mostly 403 responses or maybe if I'm lucky the goal ...
-1
votes
0answers
56 views

how can i decode this encryption [AOp//W4d2BF57veRpbIbZA==]? [closed]

the encryption: AOp//W4d2BF57veRpbIbZA== it looks like base64 but it's not all I know is the plaintext 01006069622e thanks beforehand!
1
vote
1answer
30 views

Dyanamic class load for server side application

Is there a problem to use reflection (specifically class.forName) in server side application? My main thread about this is someone to inject a code dumping memory in JVM and adding commands in ...
0
votes
3answers
73 views

How can multiple receivers decrypt message with public key

If i encrypt a message with private key put the public key on server and send message to 2 enteties, how can the second one encrypt the message when the first one has the public key ?
-1
votes
0answers
45 views

penetration testing For My WP site [closed]

I have a website made in wp and i want to hack it. I have got to know that it uses 7 plugins(and from internet i got to know that most of the websites of wp are hacked using plugin vulnebilities) , ...
2
votes
1answer
77 views

Security risks of OAuth vs a password manager

Of the following two approaches, which is "more secure", under which circumstances, and why? In other words, please compare the security risks of these two approaches: Log in to an OAuth ...
0
votes
1answer
66 views

Can anyone identify the IMSI number from a locked SIM card?

I have a sim card that has a strong password. Above the SIM card, I have erased the IMSI number. Can anyone (police or government or any other) with a SIM extractor identify who belongs to this SIM ...
4
votes
2answers
451 views

Sending OTP before authentication / password verification

One of my old, rarely used computers had still an old password for my pyszne.pl / takeaway.com account stored in my browser's password manager. I tried to log into my account from that computer and ...
0
votes
0answers
31 views

SQL Column encryption can be part of Data at Rest?

I have a SQL database and I have enabled the Always Encrypted feature. Can I claim that Data at Rest is fulfilled? or do I have to secure the backup files using certificates to claim that our database ...
0
votes
0answers
34 views

API request sent out under HTTPS becoming to HTTP on our firewall end [closed]

We have set up one api request, and we set our firewall only allow the api with HTTPS pass. When our visitor visits my app, they can see the traffic out from their firewall is under HTTPS, but when it ...
0
votes
0answers
28 views

AWS WAFv2 Custom Rules

I have to implement AWS WAFv2 on my CloudFront applications, I have been looking into the AWS managed/free rulesets, I want to understand what kind of custom rulesets should I implement or are ...
0
votes
0answers
55 views

Dynamic port forwarding without sudo or SSH

I have compromised box A and another target server. I don't have SSH on A and want to do port forwarding with escalating to root. I can't install or run services without root, and only have nc and ...
1
vote
1answer
68 views

Can Google authenticator be used to link all my accounts together?

For example, if I add two accounts from different non-Google services, can Google (or maybe those services) because of that link them both together with my gmail account?
9
votes
5answers
5k views

Why would one need to encode an MD5 hash string? Is it unsafe to display unencoded?

I was reading this article which talks about a design to shorten URLs, and in the design section, it says that the given URL can be hashed using a hashing algorithm such as MD5, and then be encoded ...
1
vote
0answers
42 views

How do you execute payloads with javascript? [closed]

Is it possible to execute payloads with javascript in the browser According to this question you can execute base64 code index.html <html> <script> var encoded = "base64 payload goes ...
0
votes
0answers
41 views

Is there a legal or regulatory requirement to encrypt data in flight WITHIN our mainframe network? (sysplex to sysplex via Connect direct?) [closed]

Is there a legal or regulatory requirement to encrypt data in flight WITHIN our mainframe network? (sysplex to sysplex via Connect direct?)
0
votes
1answer
31 views

Meterpreter: How to invoke commands in a loop for each new connection

I want to execute commands like screenshot on a regular interval (e.g. each 5min) for each incoming connection to Meterpreter using the reverse_tcp payload until the connection gets closed by the ...
0
votes
0answers
8 views

Find a string for which hash() starts with 0000 [migrated]

I've got a task from my professor and unfortunately I'm really confused. The task: Find a string D1 for which hash(D1) contains 4 first bytes equal 0. So it should look like "0000....." As I ...
1
vote
2answers
62 views

Will making HTTP cookies unique to a given website make cookies aligned with the strictest privacy guidelines?

As far as I know, the only privacy problem with cookies is that in general, the owners of website Y could read what a visitor has searched for or had done in website X. Will making HTTP cookies unique ...
-1
votes
1answer
48 views

AngularJS login view send data in the url

Is the default behaviour that all the views are accessible from public? like example.com/angular-app/views/login.html? Also if I compile the form at /views/login.html and send it the browser send a ...
0
votes
1answer
48 views

Can Cisco Umbrella be Used Along with Google Classroom?

We are creating an Information Assurance and Security Plan for a public school. The Plan will include Google Classroom because the school doesn’t have an online learning platform. The problem is our ...
0
votes
0answers
30 views

GPG not recognizing YubiKey 5 NFC on Windows 10

I am trying to setup a YubiKey 5 NFC with GPG on Windows 10 to ultimately use it to sign git-commits. This is a new topic for me and I ran into some issues that got me stuck now. I ran into this error:...
0
votes
0answers
53 views

Was my Gmail account hacked? [closed]

Received an email from google on my gmail account it said critical security alert someone knows your password. It was legit from google. I received this email in december 2020, I changed my password ...

15 30 50 per page
1
2 3 4 5
1247