All Questions

We are a merchant who processes over 2m transactions a year. However, we have outsourced all the payment functions to compliant 3td providers. Understand that PCI is about people, process and ...

I use a program that confused me while typing the password. It acts like this when I type the password ABC: I type: A Display: *** I type: B Display: ***** I type: C Display: ** I can think of the ...

Bruce Schneier Writes Down Passwords. So Can You ... But how should people deal with all of this in the real world, or on line? "Relax," he says emphatically. Surprisingly for a security ...

Recently I coincidentally have discovered that an api endpoint of an insurance company is sending a StackTrace of a JSON parser as response to a http POST message with bad formatted JSON in the ...

I am trying to see if there are use cases where a mutually authenticated TLS is preferred over a one way authentication. Usually the authentication of the client/user is done over the TLS tunnel. ...

Is there anyway to log the plaintext passwords of accounts that authenticate against a domain controller? I know most of the Mimikatz attacks and they all recover credentials from memory, but they're ...

A common way to prevent replay attacks when logging in is for the server to present a challenge (chall) and request a response in the form hash(chall+secret) where the secret is already known by the ...

Is there anything we can put in place such to verify that if the sender's name = "John Doe" and the domain is not company.org (or legitimate verified SPF sender), then the message is marked as spam or ...

With Collection #1 yet another large data set of email addresses and passwords was found out there. I happens that one of my frequently used email addresses shows up as 'pwned' when checked against ...

I used macchanger with these commands: sudo ifconfig eth0 down sudo macchanger -r eth0 sudo ifconfig eth0 up I am using it with virtualbox on a local network, I've never had issue with that before, ...

I'm trying to get response from some live links running Nessus server. nmap --script nessus-detection.nse -p8834,8890 <target> Starting Nmap 7.70 ( https://nmap.org ) at 2019-01-22 06:45 PST ...

We have generated an internal root Certificate Authority for our organization and added X509v3 Name Constraints for our domain (example.com) We issued a number of certificates for servers under that ...

I ask this question in reverse engineering site of SE but they suggested me to ask in this site. I have a MTP3 pcap file that when I open in Wireshark shows Frame1 Ethernet IPV4 MTP2 MTP3 SCCP TCAP ...

What are the basic ways of ensuring that API calls (retrieving data) are secure? I have searched around and all I can find are ways to secure REST API itself.How do I ensure the data being retrieved ...

I would like to know if making a pdf 'searchable' somehow make it less secure?

I intend to deploy some embedded software on Raspberry Pi devices. All will have WiFi capability, but not all will have internet access. I want to occasionally be able to update the firmware in all, ...

I am working on SP initiated saml sso and it is completely new to me. I have gone through lots of articles and videos(wikipedia, centrify chalktalk, medium posts) but i am not able to understand some ...

I've setup arch using dm-crypt / luks, with a passphrase and a key, lost on of them will fail to login. But I feel I need more secure of passphrase, how to setup dm-crypt / luks that has one-time ...

I have a ivs and a hccap file. Is there any way to get a hccapx file from them? It can include 2 steps e.g. ivs to cap file and then cap to hccapx. Unfortunately hashcat is not accepting hccap file ...

I have a CA generate a cert and private key for my server. My server, however, does not have a domain name and its IP is dynamic and never static therefore validation of the host name must be ignored ...

I have recently been interested in data mining and I stumbled apon a forum that provides information on extraction of data using the AES Key to decrypt .pak files for Unreal Engine games. My ...

I am an Information security analyst, looking for creative, non traditional, and unapproved ways to query/evaluate DBMS applications that includes SQL Server and PostgreSQL. Goal here is to protect ...

I have a theoretical question. If you went on a website which provides real time chat service, and only login information it requires is a username of your choice, and the website adress was https, ...

I am trying to figure out a macOS hash 10.8+ and I happen to know that it uses A-Z, a-z, 0-9, is 6-8 characters, and almost certainly random. Currently, it spits out an error regarding hash length ...

I've developed a Chrome extension that I plan to publish to the Chrome Web Store. On the server side, I've implemented OAuth 2 (using access tokens and refresh tokens) with support for generation of ...

I'm looking for someone like NSSLabs, Synack, Tevora, but obviously not these companies.

I was loading my embedded resources into an Application variable but I received this error! I changed my strategy and put them in a class level variable but I have this error again! I changed my ...

I have zipdetails to get the info of a zip file and I found out payload there.Can u guyz tell me what is this payload ??

I have a client that would like to use one-time passwords (via SMS or Email) for their app, and their requirements spec does not include traditional password-based authentication. I haven't seen this ...

How to calculate WPA2 handshake offline if I have the Mac address and the password thanks

Recently, I have been reading a lot of my ubuntu log files (in /var/log/auth.log), and I can see that some IP addresses are actually trying to 'brute-force' their ways into my VM using SSH by testing ...

This is a term I ran across in a blog post by Troy Hunt (which was linked from an answer on this site): I heard a perfect example of this just the other day when speaking to a security bod in a ...

I recently got a Galaxy Watch and to get acquainted with developing apps for it I'm writing a simple two factor authenticator to generate TOTP codes from entered secrets using the Google Authenticator ...

I have made a vulnerable SQLi website ( to teach students ). I am able to dump the database but I am not able to run os commands or upload os-shell. I want to show them how to use --os-shell option ...

I am currently trying to get the OWASP ZAP scanners working on a peculiar website. When authenticated on this website, each GET request needs a "token" (most likely a anti-CSRF token) as a parameter. ...

I have a webserver hosting an application that is accessible to the Internet but only has DNS records on my corporate DNS server. We have a few contractors accessing this site from outside the ...

Reading OWASP encrypted tokens pattern they describe the flow as follow: After successful authentication, the server generates a unique token comprised of the user's ID, a timestamp value and a ...

I was reading some material about the defense mechanisms used to protect against CSRF attacks. I think I've a question about the one based on a secure token. As far as I know, a web application ...

When setting up Smart card authentication you publish that Intermediate/Sub CA to the NTAuthCertificates object in Active Directory and certificates from that CA will now be OK for certificate ...

I'm trying to solve what appears to be a chicken-and-egg problem. When a machine appears on my network, how do I know that it is whom it asserts to be? Suppose, for instance, the host has an ...

I'd like to proxy an Android application with Burp Suite. The application uses certificate pinning via OkHttp3. I solved this by modifying the source code, now the application accepts the certificates ...

Following is a CSP policy, for example derived sample response headers. The implementation below allows white-listed domains only in "script-src" directive but the 'unsafe-inline' and 'unsafe-eval' ...

Are web sites that do Password Strength/Entropy tests like for example http://rumkin.com/tools/password/passchk.php http://www.passwordmeter.com/ https://howsecureismypassword.net/ http://www....

I encountered this error on Google Chrome on my Windows 10. I solved it by installing the certificate and now it is working fine. I wonder, how do I know the certificate I have is legit? That is, ...

1) Is it a good security practice to have a separate TLS certificate for each sub-domain? 2) Is wildcard certificate (i.e. one certificate for many/every sub-domains) a bad practice?

I want to develop my final year project on automation tool in Python for Android testing both SCA & DCA. But don't know where or how to start. Can someone help? CLI application will work for me. ...

Math.random() produces a double value (IEEE 754 binary64) in the range [0.0, 1.0). How many digits (or bits) of entropy does the return value of random() contain? If it simplifies things, I'm okay ...

My school gave everyone Macs that were sealed in the box and everything. From what I’ve seen so far, the root certificate hasn’t been tampered with. Can they see my https web history? Can laptops have ...

The idea of 2 factor authentication is that if you can prove that you have both a password and a device, you are trusted to be who you say you are. My question is, why does the service still ask you ...

I recently saw a post asking why something that appeared to be a random string of characters was a bad password. One of the answers was that it already exists on a website so you can Google it by just ...