All Questions

i tried to change my kali linux's default gateway to 192.168.1.1 but when i tried i got this error: SIOCADDRT: Network is unreachable I tried the following command btw: route del default gw 192.168....

I am creating a basic website contact form. It requires entering a 'from' email address. I entered a dummy email address, which I do not control, yet the email is still sent, and, to the recipient, it ...

I am connecting to remote hosts via jump host where I verify only the jump host's host key, but turn off host key verification for the target hosts. the ssh command arguments look like this: -o ...

Previously I was sent e-mail information from my ISP about pva.intowow malware that might of infected my system. This post is get information on a seemly correlated event pattern I've discovered on my ...

I was wondering if generation of sequential hashes from random seed can be considered "random enough" to be used in cryptographic operations? By sequential hashes I mean the following: First ...

Is there any open source mutator supporting regex? for example, I want to generate data like below. input: "%d%d" output: 00, 12, 13, 46, 29, ... Previously I tried radamsa but I realized ...

After trying to log-in in my Gmail account with the right password, I received as expected an SMS to confirm that it's me. After correctly entering the G-<6 digits> code sent by Google, I get ...

I'm trying to write a blogpost on this challenge (it's pretty basic, it should teach you about buffer overflows and ret2libc attacks). The source code is the following: #include <stdlib.h> #...

a friend of mine wanted to install MongoDB Community when he encountered a problem. The .msi file downloaded from https://www.mongodb.com/try/download/community was rejected by Windows when he tried ...

When using Shamir's secret sharing algorithm one has to define the size for the finite field over which the secret is split. I came across a few implementations, like secrets.js-lit, and as far as I ...

Long story short, I've assigned with the task to find a way to improve security in an application, they are using java keystores to save and protect the keys. The application owner is worried that ...

let key = keys[j] === '' ? (currentParams as any).length : keys[j]; if (key === '__proto__') { throw new Error('Prototype pollution detected.'); } It at least defeats basic url-encoding,...

A little context: I'm working in designing a system to sign and verify data sent between modules of a bigger system. Currently the system has two parts, a central application and a SDK inside modules ...

Comes from Bitlocker, does additional authentication at startup with TPM device provide any extra security? You can sniff the key right from the bus currently: As the decryption happens automatically,...

If you were to delete a veracript volume, either yourself or as someone trying to break in, can that information be recovered from a memory stick? Also if the volume is recoverable, would the ...

I'm trying to MITM an Android application but I cannot get it to work properly. Usually, I'm using Burp for those kind of attacks, which allows me to intercept and decrypt HTTPS traffic. (Assuming the ...

Is it common practice or are there pitfalls to using Vault by HashiCorp not only for storing secret parameters but for other app configuration key-values?

When it comes to hashing passwords, it is nowadays practice to do 100'000 or 200'000 iterations of SHA256/SHA512, or at least something in that ballpark. But my question is, why is it not safe enough ...

A friend of mine suspect she has beeen hacked. She got called by a strange number, answered the phone, and then the call was immedeately ended. She sent me the following screenshot: My question is: ...

I was trying to automatically inject a dll to every process (including GUI) whenever it is started by a user . My DLL hooks DoDragDrop method of winapi and communicates with server to decide allow or ...

On my company's computer, someone play the internet game so I want to deny the site and redirect to another site. Or If someone access the game site redirect to other site right off on computer ...

It appears that cyber attacks are becoming more frequent and larger in scale - with the notorious Solar Winds and now Pegasus attack in recent memory. What most of these attacks have in common (or at ...

This is the command I'm using: sudo hydra -l admin -p admin https://(myserver.com) https-post-form "/portal2/user:{"action":"login","username":"^USER^",&...

In a recent Substack article ("The Insecurity Industry", 2021-07-26) Edward Snowden writes: The vast majority of vulnerabilities that are later discovered and exploited by the Insecurity ...

I am using this code in hydra to bruteforce a password hydra 147.91.xxx.213 http-post-form "/ssasdkaduzsp/do:maticnaKnjiga=ee&brojUGodini=1021&godinaUpisa=20516&pass=^PASS^&action=...

And if not would like specific reasons why. I have this suspicion that, although an inferior method these days to MFA applications, believe that the security is adequate enough as most phone companies ...

CVE-2021-33909 AKA "Sequoia" is a vulnerability against the filesystem code within the Linux kernel. According to the description of the vulnerability from Qualys Successful exploitation of ...

While reading about password breaches, it occurred to me; where are the TOTP shared secret breaches? Because TOTP relies on a shared secret (unlike say U2F) the server has a copy of the shared secret, ...

https://www.netonnet.se/art/hem-hushall/bra-att-ha-hemma/safe-n-sound-antiskim-card/1011895.9253/ This card is apparently put in your wallet and protects your pay cards from skimming, by "sending ...

I had an idea to secure my system better when someone tries to ssh into my machine and that had to do with ssh keys. When logging in with ssh, you are prompted with a password that, if correct, gives ...

I want to work on a photo-sharing tool, where I can: store photos on untrustworthy disk space (like the cloud) share photo albums with friends and family update photo albums (rarely but happens) ...

by trying the XSS room on THM, I try was trying to read the /etc/passwd using the following cmd: <iframe src="/etc/passwd"></iframe> However what I got is an error code as shown ...

If, for example, I am in a building containing 150 offices. They are all serviced by the same ISP. Each floor has a router servicing 30 offices each. I log on through Thompson Construction wifi ...

I'm writing C:\Users\asus\Desktop\john180j1w\run>john.exe The-Witcher-3.zip hash.txt and john gives me these : Warning: invalid UTF-8 seen reading The-Witcher-3.zip Warning: detected hash type ...

I've noticed some services will send a username in one email with a note saying the password will come in a different email. Is there any point to this? It seems that if someone can get that email ...

I am developing a .NET Windows Service using C# that needs to download an executable file and run it. I need the Windows Service to run with SYSTEM privileges in order to allow it to install software ...

Websites that host downloadable executables often provide measures to confirm the integrity of the data that is available to download. Such measures include: Hosting the website under HTTPS; ...

There are a bunch of files in a directory on a website. The file names are like this: [base64 encoded 8 character part]-[static part].mp4 Examples: https://example.com/videos/neCvxy4d-ZwJ6E9cx.mp4 ...

I read somewhere that Truecaller had its database open. Is it still open to the public, or can someone with enough time get access to it and see who I have on my contact list?

Ok, this is not so much of a question as it is a post; sharing what some of you may find absurd, indeed is is! With all the recent policy updates and the insane algorithm enforced stringent compliance ...

I believe that this question was answered already, though I couldn't find it. I have several strings that include hash. Each string has hash and some random (or not) add-on. How can I identify the ...

We recently had a security engineer review our platform and they told us we need to encrypt the data when it's sent to the server. However we're already sending the data with a SSL certificate. Which ...

I've gotten an e-mail from my ISP saying that one of my devices might be infected with malware. In the e-mail they have provided me with some information about the malware but I'm having trouble ...

Most online accounts identify users using email/phone & password; but since most all email/phone is handled by another service (e.g. Gmail), one's online identity only exists so long as these ...

During my search for an answer to this question I found that TRIM may not be reliable(https://blog.elcomsoft.com/2019/01/life-after-trim-using-factory-access-mode-for-imaging-ssd-drives/)as well as ...

I just changed my hotmail address to an outlook domain one. I removed the old address. How can I set it back to hotmail.fr if the only option showed for domain is outlook.com

Taking Microsoft Authenticator for Microsoft accounts and WhatsApp Web as examples: Both allow one device to request authentication, and another one to receive the authentication success. How are ...

There used to be a site that you could paste a snippet of text (bitcoin address/private key etc;) that you wanted to share privately & press 'encrypt' & it would generate a realistic looking ...

SHA-256 generates a 32-byte hash, Is it a safe practice to use the first 16 as an iv (nonce) and the second 16 as a key ? What other things I should consider when using PBKDF2 in a scenario like this ?...

My company has a domain name that we use to serve our customers, say company.com for the main website, app.company.com for the web application and api.company.com. These are all public domains that ...