All Questions

Filter by
Sorted by
Tagged with
0
votes
0answers
6 views

How do Cloud-based services provide Qualified Electronic Signatures?

From what I know about QES, they come on smart cards and USB tokens and are password protected. When a site asks you for a client certificate, you need to have it plugged in and enter the password ...
2
votes
0answers
14 views

How can I, as an enduser, put pressure on corporations and discourage password strength theater?

For work and other official matters, I am often forced to use websites and apps which clearly have some kind of cargo cult going on in their security department, given that they impose extremely ...
0
votes
1answer
23 views

What algorithm does 1password use for encryption, AES-GCM-256 or AES-CBC-256?

I would like to know what encryption does 1password use. From this 1password-security page, it says Your 1Password data is kept safe by AES-GCM-256 authenticated encryption. The data you entrust to ...
0
votes
0answers
14 views

Application to archive a file with multiple passwords [duplicate]

Is there an application to create an archive (e.g. 7z, zip, rar, etc) that can be accessed with multiple valid passwords? For example the password protected archive "example.7z" can be ...
1
vote
2answers
85 views

Password security - use of random characters

I've seen some similar questions but maybe not exactly what I'm asking. Also I can't say that I've followed all the technical jargon in previous posts and am really after more of an intuitive ...
1
vote
1answer
29 views

Can SD cards on mobile phones and tablets truly be erased?

When performing a factory reset on Android devices, it is my understanding that the pointers to the data located in the SD card are simply erased while the data itself remains intact, waiting for ...
0
votes
1answer
26 views

Is there a secure way of handling online payments without user accounts and logging in?

I'm creating a subscription-based desktop application, but there is no authentication on the platform as the "user" is the computer upon which the application is installed. This means no ...
0
votes
1answer
22 views

Is this CSP implementation is secure?

I face a CSP header something like this - default-src https:; font-src https: data:; img-src https: data:; script-src https: 'unsafe-inline' 'unsafe-eval'; style-src https: 'unsafe-inline'; So is this ...
-1
votes
0answers
27 views

Does this kind of scam have a name? Exposed in Glitterbomb Trap Catches Phone Scammer video [closed]

Mark Rober has a video named Glitterbomb Trap Catches Phone Scammer (who gets arrested) It includes call center scammers, mules, supervisors, and his attempt to locate the entire network of criminals. ...
0
votes
0answers
31 views

Values inserted with the JavaScript "value" property are ineffective

Normally if I insert values to an HTML form's input field element via the JavaScript value property and would send the form, the form would be sent just fine, just as if I would fill in the data ...
0
votes
1answer
74 views

Effective ways to hash phone numbers?

Suppose a company wants to implement 2FA for it's users using phone number OTP system, but does not really want to store their phone numbers as it could get breached and phone numbers are considered ...
0
votes
1answer
24 views

Detecting XSS when Payload is only Triggered on Another Page

I am trying to detect the presence of a blind/stored XSS vulnerability of an input field. The vulnerability does not trigger on page 'A' where the payload is injected. It is likely due to the fact ...
0
votes
0answers
17 views

How should SQL Server users be managed for a multi-tenant application?

I've looked extensively for a duplicate question, but I couldn't find anything that answers this question exactly. I have a SQL Server that will be used to store data for a multi-tenant application. ...
0
votes
0answers
13 views

Security implications of PaaS vs a self managed server

What are the security implications of managing your own server verses using a PaaS (i.e., Heroku, google cloud). I've been trying to find discussion of this topic strangely to no avail, so I thought I ...
0
votes
0answers
40 views

Where can I find a working kernel exploit, to elevate privileges? [closed]

I am looking for a kernel exploit for fun, to see $ become # in my terminal Unfortunately the ones I tried such as https://www.exploit-db.com/exploits/50135 did not work, Anyone has tried a kernel ...
0
votes
1answer
24 views

What is the diffrence between Pre-Shared Keys and Pre-Placed Keys in cryptography?

I'm struggling to understand the diffrence between Pre-shared keys(PSK) and Pre-Placed Keys (PPK). From my understanding - pre placed keys are loaded onto a device and are ready to use without ...
0
votes
1answer
57 views

Can malicious binaries run from Program Files?

I've been seeing a few false positives from our AV Carbon Black pertaining to wordpad (wordpad.exe) use. The alert I'd see is The application wordpad.exe injected code into another process. Upon doing ...
0
votes
0answers
11 views

Mac os x installation partition integrity

Let's suppose i lend my new macbook to a (dishonest) friend. This is a new fresh macbook, just unboxed. My friend does what ever he wants on this macbook. One month later, he gives me back the macbook....
2
votes
0answers
29 views

Is two-stage logging in more secure? [duplicate]

I’m trying to find the correct forum for this question, so if not here, please suggest an alternative. I notice a number of web sites now log in users in two steps: one for the username/email address, ...
0
votes
0answers
16 views

Can malicious code running in isolated Electron's renderer process send data to attacker's server?

I'm trying to evaluate if a malicious npm dependency running in Electron's app renderer process (which has sensitive information) could send data from the webpage out to an attacker's server (or trick ...
1
vote
0answers
37 views

What can you do against fortify-source (stack overflow)?

I was practicing stack buffer exploitation on a well known application I was able to bypass canaries, ASLR and nx bit with techniques easily found on the internet However it has fortify-source enabled ...
0
votes
2answers
42 views

What happens to apps, files, objects in a VM if it gets deleted

Usually, when a file is deleted on your computer, it is simply unlinked. The file data is still stored on your disk, there's just nothing pointing to that spot in the memory, and the OS interprets ...
0
votes
0answers
47 views

As an attacker, what do you do when you see an obfuscated js? [closed]

I'm participating to some bug bounty programs and I found some interest thinks in a javascript file. The problem is that the code is obfuscated. What do you do when you see this ? Do you skip it, or ...
0
votes
0answers
40 views

Decoding suspicious Javascript

I received a suspicious looking SMS today with a link. I checked out the page source code and came across this script between the <head> tags: <script async="" src="/cdn-cgi/...
2
votes
1answer
26 views

Does yum enforce cryptographic authentication and integrity validation by default for all packages? (CentOS, RHEL)

Does the yum package manager in CentOS/RHEL-based systems require successful cryptographic authentication and integrity validation for all packages? I know that software downloaded with apt-get ...
0
votes
0answers
16 views

Retrieve identifiers in Clang Cindex (Python) [closed]

I'm building a python script that analyzes a given C source code and performs vulnerability assessment (at least that's my intention). I would like to perform the checks base on Clang's AST. In order ...
-1
votes
1answer
45 views

How to take advantage of a new security tool (SCA) added to company?

We recently added a new Software Component Analysis tool (dependencytrack) to our infrastructure, which allows us to gain visibility on which dependencies are pulled by the code of our web apps. How ...
-2
votes
0answers
52 views

how to get rid of a chrome firewall [closed]

how do I get rid of a firewall. somebody was able to geuss my password and able to hack into my chrome and they created a firewall and now I cant really get to any of my important sites
0
votes
0answers
50 views

How does USB device run exe program when plugged in

Based on my research the best USB device can do is to trick the OS believing its device type A while it is device type B. However it can never auto install a custom driver or auto execute a program/...
0
votes
0answers
29 views

What are possible attacks if am connecting to public WiFi using repeater, through Ethernet or /and if the router's firmware is hacked

What are possible attacks if am connecting to public WiFi using repeater, through Ethernet or /and if the router's firmware is hacked, supposing am running a Debian system ,blocking inbound ...
0
votes
0answers
10 views

iPhone private MAC address not working? 2 MAC addresses appear in my router [migrated]

I just connected my iPhone to a brand new router and saw that 2 new MAC addresses appeared in connected devices. By disabling the "Private address" feature I could verify that both MAC ...
3
votes
0answers
43 views

Disturbing/suspicious Google notifications about account recovery and password change

This is similar to Is this Google mail from gaia.bounces.google.com legit?, except a) I have nothing in my life related to the language used (Indonesian), b) these are different notifications (and ...
0
votes
0answers
22 views

What ways a website could hack a device? [duplicate]

Is it possible that clicking a link would hack a device? For example: injecting a malicious code into the device directly from the link's host website connecting to the device remotely in a way ...
2
votes
0answers
67 views

How to select a CPU to buy for the best security?

Various versions of Spectre, Meltdown, Foreshadow and ZombieLoad make it quite the jungle trip to navigate which CPUs are affected, how to mitigate them. Right now, my problem is that I need a new ...
5
votes
2answers
522 views

How to fix DMARC alignment failure

I'm sending emails via the Ionos mail servers. I've got spf set up, but dmarc still fails. This seems related to: Why is DMARC failing when SPF and DKIM are passing? But I can't figure out how to fix ...
0
votes
0answers
23 views

checking if my email is in blacklist or whitelist of an organization [closed]

Is there any way to check if my email is on a blacklist or whitelist of some organization? Is there an option to check it without sending an email to that organization? Because of I don't want to send ...
0
votes
0answers
7 views

Problem updating Kali linux [migrated]

When I run apt update on my kali terminal, I get this error - E: The repository 'https://http.kali.org/kali sana Release' does not have a Release file.
0
votes
1answer
46 views

Bypass WAF to perform XSS?

I am trying to find an XSS in website protected by Cloudflare. I use Burp to find which HTML tags allowed. Only the <script/> is tag disallowed. I tested multiple payloads to pass the WAF and ...
4
votes
0answers
38 views

Security of in-app Forgot Password workflow in Xamarin (Mobile App) without using a website

I decided to implement "forgotten password" functionality, without having to create a website just for that. The usual workflow that I've seen for any app is: User requests password reset ...
3
votes
0answers
50 views

Why doesn't Defender get suspicious if a program adds exceptions to the Defender?

One can simply add exceptions to the Windows Defender by running this command in Powershell: Add-MpPreference -ExclusionPath <your_path> Why does Windows Defender not immediately flag programs ...
3
votes
1answer
36 views

Security requirements for small tax software business

I have a client who does payroll and taxes and is looking for a web app to easily communicate and transfer tax related documents for clients. I would assume that the IRS or someone would have some ...
2
votes
1answer
28 views

(How) can loosing 2FA render encrypted data inaccessible?

As per Bitwarden's FAQ If you don’t have your Recovery Code saved somewhere outside of your Vault, there is unfortunately no way for the team to recover the account or data therein. You’ll need to ...
0
votes
0answers
17 views

Compute a signature with private key in Server Key Exchange

On https://tls.ulfheim.net/ there is an example showing how to compute a signature in the section of " Server Key Exchange ". https://i.ibb.co/Y7fbkDw/1.jpg (This image shows the Server Key ...
-1
votes
0answers
18 views

Differentiating between multiple grabify IP addresses [closed]

When I used grabify I got numerous IP addresses. What does this mean and which IP address is the right address?
2
votes
1answer
31 views

Is there a security benefit to giving an SSH key a passphrase when using certificates?

https://goteleport.com/blog/how-to-ssh-properly/ I'm following this guide on setting up SSH certificates, and it says to NOT put a passphrase on keys, or that it's "my choice" whether to do ...
0
votes
1answer
56 views

Do websites send full URL over HTTP instead of HTTPS if there's an HTTPS connection?

I was learning to use wireshark when I noticed that opening a reddit url (reddit.com/r/privacy) sent a GET request for r/privacy over HTTP. Is this visible to the ISP or network sniffers? I was under ...
0
votes
0answers
48 views

Encrypting file = Overwriting file?

When thinking of encrypting a file (also how I implemented it in a program of mine), I think of getting the data of a file, encrypting it, and writing it back into the file (overwriting the file). But ...
0
votes
1answer
39 views

How can I prevent a C&C server from accessing my device?

Let's say I visited a malicious website and it downloaded malware that registered my phone to a C&C server And after realizing what happened I uninstalled the malware from my device Will my phone ...
0
votes
0answers
59 views

Can a file on your computer be the "something you have"?

I've read a lot of advice against storing your 2FA codes in your password manager and I don't understand why. Isn't a file on your computer something you have? There is the added benefit that you don'...
0
votes
0answers
22 views

How to utilise sqlmap's blind enumeration when you already know the SQL injection query

I am looking for some help on how to get the best out of sqlmap. I am practising on a web application that runs the following query when the login form is submitted: SELECT * FROM Users WHERE username ...

15 30 50 per page
1
2 3 4 5
1282