All Questions

From what I know about QES, they come on smart cards and USB tokens and are password protected. When a site asks you for a client certificate, you need to have it plugged in and enter the password ...

For work and other official matters, I am often forced to use websites and apps which clearly have some kind of cargo cult going on in their security department, given that they impose extremely ...

I would like to know what encryption does 1password use. From this 1password-security page, it says Your 1Password data is kept safe by AES-GCM-256 authenticated encryption. The data you entrust to ...

Is there an application to create an archive (e.g. 7z, zip, rar, etc) that can be accessed with multiple valid passwords? For example the password protected archive "example.7z" can be ...

I've seen some similar questions but maybe not exactly what I'm asking. Also I can't say that I've followed all the technical jargon in previous posts and am really after more of an intuitive ...

When performing a factory reset on Android devices, it is my understanding that the pointers to the data located in the SD card are simply erased while the data itself remains intact, waiting for ...

I'm creating a subscription-based desktop application, but there is no authentication on the platform as the "user" is the computer upon which the application is installed. This means no ...

I face a CSP header something like this - default-src https:; font-src https: data:; img-src https: data:; script-src https: 'unsafe-inline' 'unsafe-eval'; style-src https: 'unsafe-inline'; So is this ...

Mark Rober has a video named Glitterbomb Trap Catches Phone Scammer (who gets arrested) It includes call center scammers, mules, supervisors, and his attempt to locate the entire network of criminals. ...

Normally if I insert values to an HTML form's input field element via the JavaScript value property and would send the form, the form would be sent just fine, just as if I would fill in the data ...

Suppose a company wants to implement 2FA for it's users using phone number OTP system, but does not really want to store their phone numbers as it could get breached and phone numbers are considered ...

I am trying to detect the presence of a blind/stored XSS vulnerability of an input field. The vulnerability does not trigger on page 'A' where the payload is injected. It is likely due to the fact ...

I've looked extensively for a duplicate question, but I couldn't find anything that answers this question exactly. I have a SQL Server that will be used to store data for a multi-tenant application. ...

What are the security implications of managing your own server verses using a PaaS (i.e., Heroku, google cloud). I've been trying to find discussion of this topic strangely to no avail, so I thought I ...

I am looking for a kernel exploit for fun, to see $ become # in my terminal Unfortunately the ones I tried such as https://www.exploit-db.com/exploits/50135 did not work, Anyone has tried a kernel ...

I'm struggling to understand the diffrence between Pre-shared keys(PSK) and Pre-Placed Keys (PPK). From my understanding - pre placed keys are loaded onto a device and are ready to use without ...

I've been seeing a few false positives from our AV Carbon Black pertaining to wordpad (wordpad.exe) use. The alert I'd see is The application wordpad.exe injected code into another process. Upon doing ...

Let's suppose i lend my new macbook to a (dishonest) friend. This is a new fresh macbook, just unboxed. My friend does what ever he wants on this macbook. One month later, he gives me back the macbook....

I’m trying to find the correct forum for this question, so if not here, please suggest an alternative. I notice a number of web sites now log in users in two steps: one for the username/email address, ...

I'm trying to evaluate if a malicious npm dependency running in Electron's app renderer process (which has sensitive information) could send data from the webpage out to an attacker's server (or trick ...

I was practicing stack buffer exploitation on a well known application I was able to bypass canaries, ASLR and nx bit with techniques easily found on the internet However it has fortify-source enabled ...

Usually, when a file is deleted on your computer, it is simply unlinked. The file data is still stored on your disk, there's just nothing pointing to that spot in the memory, and the OS interprets ...

I'm participating to some bug bounty programs and I found some interest thinks in a javascript file. The problem is that the code is obfuscated. What do you do when you see this ? Do you skip it, or ...

I received a suspicious looking SMS today with a link. I checked out the page source code and came across this script between the <head> tags: <script async="" src="/cdn-cgi/...

Does the yum package manager in CentOS/RHEL-based systems require successful cryptographic authentication and integrity validation for all packages? I know that software downloaded with apt-get ...

I'm building a python script that analyzes a given C source code and performs vulnerability assessment (at least that's my intention). I would like to perform the checks base on Clang's AST. In order ...

We recently added a new Software Component Analysis tool (dependencytrack) to our infrastructure, which allows us to gain visibility on which dependencies are pulled by the code of our web apps. How ...

how do I get rid of a firewall. somebody was able to geuss my password and able to hack into my chrome and they created a firewall and now I cant really get to any of my important sites

Based on my research the best USB device can do is to trick the OS believing its device type A while it is device type B. However it can never auto install a custom driver or auto execute a program/...

What are possible attacks if am connecting to public WiFi using repeater, through Ethernet or /and if the router's firmware is hacked, supposing am running a Debian system ,blocking inbound ...

I just connected my iPhone to a brand new router and saw that 2 new MAC addresses appeared in connected devices. By disabling the "Private address" feature I could verify that both MAC ...

This is similar to Is this Google mail from gaia.bounces.google.com legit?, except a) I have nothing in my life related to the language used (Indonesian), b) these are different notifications (and ...

Is it possible that clicking a link would hack a device? For example: injecting a malicious code into the device directly from the link's host website connecting to the device remotely in a way ...

Various versions of Spectre, Meltdown, Foreshadow and ZombieLoad make it quite the jungle trip to navigate which CPUs are affected, how to mitigate them. Right now, my problem is that I need a new ...

I'm sending emails via the Ionos mail servers. I've got spf set up, but dmarc still fails. This seems related to: Why is DMARC failing when SPF and DKIM are passing? But I can't figure out how to fix ...

Is there any way to check if my email is on a blacklist or whitelist of some organization? Is there an option to check it without sending an email to that organization? Because of I don't want to send ...

When I run apt update on my kali terminal, I get this error - E: The repository 'https://http.kali.org/kali sana Release' does not have a Release file.

I am trying to find an XSS in website protected by Cloudflare. I use Burp to find which HTML tags allowed. Only the <script/> is tag disallowed. I tested multiple payloads to pass the WAF and ...

I decided to implement "forgotten password" functionality, without having to create a website just for that. The usual workflow that I've seen for any app is: User requests password reset ...

One can simply add exceptions to the Windows Defender by running this command in Powershell: Add-MpPreference -ExclusionPath <your_path> Why does Windows Defender not immediately flag programs ...

I have a client who does payroll and taxes and is looking for a web app to easily communicate and transfer tax related documents for clients. I would assume that the IRS or someone would have some ...

As per Bitwarden's FAQ If you don’t have your Recovery Code saved somewhere outside of your Vault, there is unfortunately no way for the team to recover the account or data therein. You’ll need to ...

On https://tls.ulfheim.net/ there is an example showing how to compute a signature in the section of " Server Key Exchange ". https://i.ibb.co/Y7fbkDw/1.jpg (This image shows the Server Key ...

When I used grabify I got numerous IP addresses. What does this mean and which IP address is the right address?

https://goteleport.com/blog/how-to-ssh-properly/ I'm following this guide on setting up SSH certificates, and it says to NOT put a passphrase on keys, or that it's "my choice" whether to do ...

I was learning to use wireshark when I noticed that opening a reddit url (reddit.com/r/privacy) sent a GET request for r/privacy over HTTP. Is this visible to the ISP or network sniffers? I was under ...

When thinking of encrypting a file (also how I implemented it in a program of mine), I think of getting the data of a file, encrypting it, and writing it back into the file (overwriting the file). But ...

Let's say I visited a malicious website and it downloaded malware that registered my phone to a C&C server And after realizing what happened I uninstalled the malware from my device Will my phone ...

I've read a lot of advice against storing your 2FA codes in your password manager and I don't understand why. Isn't a file on your computer something you have? There is the added benefit that you don'...

I am looking for some help on how to get the best out of sqlmap. I am practising on a web application that runs the following query when the login form is submitted: SELECT * FROM Users WHERE username ...