All Questions

Filter by
Sorted by
Tagged with
0
votes
0answers
3 views

Find seed used in Linear Congruential Generator given a list of outputs

Given one or two sequential Math.random outputs generated with Internet Explorer's linear congruential generator, is it possible to find the seed used in the LCG and find subsequent outputs? Here is ...
0
votes
0answers
6 views

Documentation for GDPR best practices for partially masking email addresses

I must give certain employees access to a report which contains email addresses. I would like to redact or partially mask these email addresses, but I am having trouble finding official guidance on ...
0
votes
0answers
10 views

Extracting Information from PCAP

the logs are formatted like this.. there is also two brackets around each **: 03/16-08:30:05.350000 ** [1:491:8] INFO FTP Bad login ** [Classification: Potentially Bad Traffic] [Priority: 2] {TCP} ...
-1
votes
0answers
18 views

Is Chrome on iOS more secure than Chrome on Windows?

Is Chrome on iOS more secure than Chrome on Windows. Since Apple (or Google) restricts extensions, doesn't that make it more secure?
-2
votes
0answers
22 views

Is it possible for my G Suite admin to monitor me off their network?

Is it possible for my G Suite admin to monitor me if: -I am off their network. -I am in Incognito mode -I am signed in with my G Suite account to iOS Chrome No, I’m not on a VPN. Just my normal home ...
0
votes
0answers
24 views

Should I Pursue Platform-Ownership?

the context is this introduction in an HP whitepaper. I'm inquiring about "platform-ownership" within the Secure-Boot environment. I'm looking for a simplified summary of platform-ownership. Much of ...
0
votes
0answers
23 views

Looking for tool for searching in file magic numbers [on hold]

There was a tool that gives probable files headers in whole file(like lzma, crc header, aes etc). I can't remeber name ( not binwalk and trid).
0
votes
0answers
30 views

what are the ways that computers on a shared home network communicate with each other that are not hacking, or any kind of intentional monitoring [on hold]

So I am in a situation where I need to prove that I am not hacking or monitoring someone elses computer on a home network. The setup is fairly standard. 2 win 10 computers(one home edition and and one ...
0
votes
1answer
18 views

Having web client do requests with User's 3rd party API key?

I am trying to figure out the best way to do this. I have done some searching and all I have found is about storing API keys in a back end, nothing like my use-case where there is no back end. ...
0
votes
0answers
20 views

Non-obvious Mitigations for This DMA-Attack Demonstrated by F-Secure

Are there any non-obvious mitigations for the big DMA-attack revealed last year and demonstrated in this video by F-Secure? We know that Microsoft has published some material pertaining to DMA-...
0
votes
1answer
38 views

Firefox 68 — any changes affecting CSRF capabilities?

My Ubuntu 18 system did an upgrade to Firefox 68 (presumably from 67.x). I have a simple XSRF demo that I use for class --- the demo is extremely simple: I have a login program that sets a sessionid ...
0
votes
0answers
20 views

NSEC3 record disavows too many records?

I noticed this NSEC3 record seems to contradict my understanding, and I wondered if it was me or the record that is wrong. The short version, puppies.supplies hashes between myhome.supplies and ...
3
votes
2answers
65 views

Using AES to securely store sensitive pictures

I'm not experienced with encryption at all, so please bear with me. My use case: I'm working on a membership management web application to be used by a small organisation. When someone becomes a ...
1
vote
3answers
122 views

Why do web browsers provide websites with plain text passwords?

Suppose I sign up for website.com with username "John" and password "Secret". Currently the webbrowser supplies website.com with my real plain text password, and we must trust them to salt and hash ...
0
votes
1answer
27 views

Interpreting this F-Secure Video of a DMA-Attack

I'm trying to interpret this video demonstration by F-Secure of the big cold-boot attack discovered last year. What is happening at the 50-second mark? Why does he insert the USB boot-device before ...
0
votes
1answer
40 views

None of the Nmap scripts working on my university's official site

So first of all I'm extremely new to the world of programming, etc. The professor from our Ethical hacking class gave us a seemingly simple task of getting the registration date, expiration date, ...
0
votes
1answer
54 views

Why does the file “shell.php.jpg” can execute as a php file but “shell.jpg” cannot?

I am learning about file upload vulnerabilities using DVWA. After cranking the website's security level to High, the website checks both the post request's content type & file extension, so in ...
0
votes
0answers
16 views

Identifying and cloning NFC Card double size UID - type mifare plus 7 byte 2k or classic 7 byte 1k

I am trying to clone/write copies of an NFC card. I am using an ACR122U-A9 receiver and running nfc-tools on a kali linux VM. The card I am trying to clone is identified as a Mifare Classic 1k tag ...
0
votes
1answer
39 views

Why Would A Web Server Allow Loading XML External Entities?

I've been reading up on XXE Injection, and so far every example I've seen has involved a webserver voluntarily loading xml external entities (as below). <?php libxml_disable_entity_loader (false);...
0
votes
0answers
35 views

can't get into her own gmail account [on hold]

I am trying to help a friend who has a Mac Notebook with a firefox browser, and a gmail account for her emails. She has been in the hospital since the end of March and requested I bring her Mac from ...
-1
votes
0answers
28 views

Is it possible to hide a domain's email provider? [on hold]

All things considered, this question could possibly be a non-issue or simply too stupid a idea to consider for an attacker when other more viable options are available. Suppose you want to use a ...
-2
votes
0answers
33 views

How do I learn to build codes? [on hold]

I am a commerce stream student with some knowledge on computing. I can create and develop games and applications, and I know to use Operating Systems properly like a sceipt kiddie. Till now I know ...
1
vote
1answer
47 views

Can the conversion of a malicious PDF to image be exploitable?

Let's say I want to allow to the customer's of my website to upload PDF documents. What would be more safe to do: Convert the PDF to image using a library and store it in my file server as an image? ...
0
votes
0answers
16 views

Deeplinks in email that autologin

I was wandering if, a deeplink inside an email that auto-authentication even though the session is expired, it is GDPR compliant. For instance if I send to an user an email subscription with links to ...
0
votes
0answers
22 views

Are there any way to read (scan) video using camera? [on hold]

I know we can read QR codes using the phone camera. Are there ways to analyze short video bit stream using the camera?
0
votes
1answer
21 views

Distinction among the criteria “implemented correctly”, “operating as intended”, and “producing the desired outcome”

Throughout the RMF documents, one finds the phrase, a) "implemented correctly, b) operating as intended, and c) producing the desired outcome" with respect to meeting security requirements or control ...
0
votes
0answers
12 views

How long it takes to receive CVE-ID from cve.mitre.org?

I had applied for CVE ID at https://cveform.mitre.org/. I did followed their guidelines, and did exactly as their instructions said (didn't add PGP key as it seems optional). It's been 2 month since ...
0
votes
0answers
29 views

What's the advantage in encrypting data for data masking?

I'm in the process of selecting a product for data masking sensitive information in our DB so that developers won't see restricted information while testing production data. I came across some ...
6
votes
2answers
399 views

Generating a PIN from cryptographic bytes

One of our applications uses SQL Server for the back end, and that application requires a 4 digit numerical PIN for employees to be created that works with a key (more or less). The system itself ...
-1
votes
1answer
23 views

Java web app hosted in tomcat hanged for more than 10 min with logs containing powershell attack

We have a java web application running in tomcat which is hosted in AWS. The operating system used in the server is Centos. Today it become inaccessible for more than 10 minutes. When we got access, ...
0
votes
0answers
8 views

Rotating Tang Keys - change Clevis bind without passphrase

Using standard RedHat documentation... https://access.redhat.com/documentation/en-US/Red_Hat_Enterprise_Linux/7/html/Security_Guide/sec-Using_Network-Bound_Disk_Encryption.html Created enrypted ...
1
vote
1answer
23 views

aireplay-ng deauth not working

aireplay-ng deauthentication does not work for me. Despite everything goes well before, when I enter command aireplay-ng --deauth 2000 ... it only sends a few packets (like 3-4), but sometimes more, ...
0
votes
1answer
41 views

How do I get the list of cipher suites supported in a specific TLS version?

Is there any cipher suites supported in one TLS version and not supported in the other? If yes, then is there any documentation that talks about the cipher suites supported in each TLS or SSL versions?...
1
vote
1answer
46 views

Looking for real penetration testing reports [on hold]

I'm wondering if there's any repository with leaked penetration testing reports? I found some samples but I'm not confident they are taken from real life cases. Does any one know where can I find ...
1
vote
1answer
38 views

Are there any risks from cloning a LUKS encrypted partition?

I'm using an installation of Ubuntu server on disk, with some extra packages installed and configuration carried out, on disk as a kind of base image for repeatedly creating other systems. I clone ...
0
votes
0answers
27 views

What are the correct network settings for VirtualBox VMs to allow DNS spoofing attack [on hold]

I need to implement DNS spoofing attack usign VMs. My host network is connected to a Wireless network. I created one Kali Linux machine (the attacker machine) and another Win10 machine (the victim ...
13
votes
2answers
1k views

At which point can a system be compromised when downloading archived data from an untrusted source?

If I download archived data from a possibly untrusted source at which point am I at possible risk of harming my system: Initially downloading and saving the archived data (still packed) Unpacking the ...
0
votes
1answer
40 views

TLS Can't find a Certificate Request during Server Hello

I build a https website and use IIS, I setup SSL settings with Client Certificate to Required, and when I visit the website on browser (chrome), it pops up a client certificate dialog and let me ...
0
votes
0answers
11 views

How to generate trusted SSL certificate for secure MQTT? [migrated]

I am a beginner with information security and everything about SSL just goes over my head. Currently I'm trying to get an IoT device(ESP32) to connect to an MQTT broker, broker.losant.com:8883 in ...
0
votes
1answer
92 views

Is there a way to check the authenticity of a forwarded email?

This question relates to an answer on Skeptics.SE. Read the comment where somebody wrote "Even if you forward someone the email you received, we can't be sure you didn't fake it." Is this statement ...
0
votes
0answers
48 views

What can cause this bizarre behavior? [on hold]

I came across a strange webpage crawled by google. A miscellany of text from different websites appears alongside images in a chaotic sequence. The search box at the top returns a different set of ...
0
votes
1answer
68 views

When signing up a new user, is there a way to secure the password using jQuery/PHP?

I'm of the opinion that HTTPS is sufficient for securing passwords from would-be MITM (man-in-the-middle) attacks, but I'm curious to know if there's anything else I should be doing. During signup, ...
1
vote
0answers
20 views

Usage of X-Content-Type-Options

Does it matter if X-Content-Type-Options header is not set to no-sniff in the response if the attacker cannot upload/include files in the application?
0
votes
1answer
66 views

Can (or should) a system admin test a login before sending login info to users?

I am a low-level system administrator for a new college Learning Management System, or LMS. (An LMS is the platform used by professors to post their syllabi, lecture notes, assignments, grades, ...
-2
votes
0answers
46 views

Build a C2C server to communicate with malware [on hold]

So, I have a piece of linux malware that communicates with a C2C server that is no longer active. I have reverse-engineered the malware and figured the commands that it expects. It uses IRC for its ...
2
votes
1answer
75 views

Can you exploit an application that imports a vulnerable library, but does not actually use the classes from the library?

Suppose you have vulnerable library, vuln-lib.jar, that you then import into your source code but never actually use: #My imports import com.vuln.lib.* #My code .. And you go onto to deploy this ...
1
vote
1answer
50 views

Is emulated SQL query preparation less secure?

I have been looking at PDO attributes, specifically at resources (some are linked at the end of this post) saying that emulated query preparation is less secure than using real prepared statements, ...
0
votes
1answer
37 views

Importing an expired certificate into my jks

I'm pretty new to the certificate renewal process, so bear with me if this is a stupid/easy question I'm asking. I have a jks store that had a certificate expire under the alias aliasA. Another ...
1
vote
0answers
25 views

Is it a privacy issue that iOS persists private keys between app installs of the same bundle ID?

In iOS apps, Apple goes to a lot of trouble to keep applications from creating a stable identifier for a specific device. For example, in iOS >= 5 they no longer allow apps to get the hardware-tied ...
-2
votes
0answers
24 views

Are prepaid credit cards traceable? [duplicate]

I got hold of a prepaid credit card if I buy amazon gift cards with it will I be tracked? if so how can i avoid that? Thanks

15 30 50 per page