All Questions

0
votes
0answers
7 views

Buffer overflow attack, executing an uncalled function

So, I'm trying to exploit this program that has a buffer overflow vulnerability to get/return a secret behind a locked .txt (read_secret()). vulnerable.c //no edits here #include <stdlib.h> #...
0
votes
0answers
10 views

How to skip a GET request from client to server?

I am trying to make a POST request, and after the request browser automatically sends a GET request. How to stop this GET request?. I can drop it using burp, but I need to drop every time I do POST. ...
0
votes
1answer
8 views

Is is possible to get the TLS implemetation information of the remote server?

I am trying to devise a way to find side-channels that reveal exact TLS library (and its version) running on the remote server by adopting similar approach to JavaScript Template Attacks However, if ...
1
vote
0answers
5 views

SSO level of trust external identity providers

I'm wondering how much I should trust our clients and their SSO implementations. We have an identity provider set up for @our-domain.com and most users of that domain have a lot of rights in our ...
1
vote
0answers
9 views

How x-permitted-cross-domain-policies is different from CORS(cross origin resource sharing)?

OWASP is recommending x-permitted-cross-domain header. I gone through many websites and blogs and didn't get to know the difference between x-permitted-cross-domain and CORS. Since I have implemented ...
0
votes
2answers
27 views

Is that a good idea? - Firefox/Chrome in-content encryption

I'm currently thinking about writing a Firefox/Chrome and Python/PHP/JS plugin to accomplish the following: Assuming you are on a non-SSL secured site or you simply don't trust any CA like Let's ...
1
vote
0answers
18 views

Are there any reliable and updated sources or feeds for password dumps? [on hold]

I am looking for any reliable, up-to-date sources (which may be RSS feeds, websites, or anything else OSINT-based) which contain password dumps and their relative links. I am looking particularly for ...
0
votes
1answer
24 views

Is there a way to exploit jquery 1.12.4 vulnerability?

According to https://cve.mitre.org/cgi-bin/cvekey.cgi?keyword=jquery+1.12.4 and https://snyk.io/test/npm/jquery/1.12.4, I see that jQuery 1.12.4 has medium serevrity vulnerability. I checked on ...
0
votes
0answers
13 views

What is the difference between psk_ke and psk_dhe_ke as defined in RFC8446 4.2.9

I assume one uses one uses dhe on top? / instead of? some other key derivation function. But I am confused as to what that actually means in practice and what the considerations are.
1
vote
0answers
28 views

Is there any sense in encrypting a file for one's own later use?

Let's say you have a single sensitive document. You're traveling to somewhere high risk and are advised not to bring your data, but you also don't have safe storage at home. So you encrypt your ...
1
vote
1answer
23 views

Verifying Host Sterility After Running Malware Tests on Virtual Machine

I know that "VM escape" is becoming a common issue now with malware testing. I'm just wondering if there's any way of verifying if the host system is clean from any infection after running a malware ...
-1
votes
1answer
35 views

Is it possible to trace a fraud who swindled money through email tracked IP addresses

I have been befrauded by an acquaintance of mine who borrowed large sums of money and provided contracts with his Turkish address and these contracts supposedly were sent by his lawyer in Turkey. But ...
0
votes
0answers
26 views

Dealing with OpenSSH CVE-2019-6109, CVE-2019-6110 & CVE-2019-6111 on CentOS 6

How are you dealing with the OpenSSH vulnerabilities CVE-2019-6109, CVE-2019-6110 & CVE-2019-6111 on CentOS 6 in a PCI server? OpenSSH doesn't seem to have a fix for this yet, but it fails ...
0
votes
1answer
39 views

Two Factor Authentication Secret Storage

I found this NPM package that looks like can be used to verify two factor authentication for websites, and also generating tokens for signing into other websites. In the README there is a section ...
-6
votes
0answers
42 views

I want to decrypt a message, but I know anything about algorithms and key [duplicate]

This is message: 34f6e67627164757c6164796f6e63712026496e616c6970297f6570236f6d607c656475646024786963702471637b6e2
3
votes
2answers
139 views

Reporting vulnerability to New York Times

I have successfully discovered a vulnerability in the New York Times website. Is there any known way I can report this? I have not attacked it. But I found a bypass. What should I do?
0
votes
0answers
33 views

OpenID Connect: Is storing access token in browser sercure?

I'm currently in the phase of integrating my web-site to OpenID Connect provided by KeyCloak. The web-site is not a single page application. However, different parts of the application are delivered ...
-1
votes
0answers
23 views

Management Deployment tools for Macs and Windows to push apps updates [on hold]

Anyone knows, can recommend, or is using a management deployment tool to updates desktop apps (Ex. Dropbox) on hundreds of Macs and Windows PCs in one shot? Can you share how you update apps in these ...
-3
votes
1answer
59 views

How to differ between hash file in terms of bits [on hold]

Suppose any two hash files that differ exactly in one bit from each other. How much the difference will I get in term of bits when hash value created? Assume MD5 or MD1 hash function.
2
votes
1answer
87 views

How to properly disclose a security vulnerability anonymously?

Let's say I found a login-bypass/root-backdoor in a software my company uses that gives you root privileges within that software by simply entering a keyboard combination. I've reported this within ...
0
votes
0answers
46 views

Does load balancing multiple WAN connections improve anonymity?

I would like to understand the advantages and disadvantages of load balancing outbound connections for anonymity. Scenario 1: My router (ip A) > VPN router (ip B) > VPN router (ip C) > web host ...
-1
votes
0answers
59 views

Deobfuscation Malicious Javascript Codes

I want to deobfuscate malicious code where they are embedded in the URL. I have these URLs downloaded from here, where the URLs are embedded with malicious JavaScript. URL
0
votes
0answers
38 views

Endgame AV malware criteria [on hold]

Endgame AV on Virustotal detects files as just malicious (medium confidence) or malicious (high confidence). Are there any criteria publicly available for these detections? Are there clean guidelines ...
0
votes
2answers
82 views

Basic things that need to be explained to employees about a security policy and at what point in their employment

I have was asked this question: What are the basic things that need to be explained to every employee about a security policy? At what point in their employment? Why? (List at least 4 things). ...
-1
votes
0answers
28 views

separator unmatched [on hold]

I was running the following command hoping to run a dictionary with hashcat (worked with kali) on windows and use the GPU to see the speed differences. (WPA2 handshake converted .cap file) hashcat64....
0
votes
0answers
20 views

John the Ripper: OpenMP mode vs using the “--fork=N” option?

Clang on OSX doesn't support OpenMP by default, so I could not compile JtR with OpenMP support without another Clang installation. However, after looking at the below option, I wonder what the ...
0
votes
1answer
67 views

Subdomain api.domain.com - more vunerable to attacks?

I am in the process of setting up an api which will have the subdomain "api.", I have been advised to change this to something "less obvious" to avoid automated attacks against it. I can't find any ...
0
votes
0answers
31 views

What are the risks of exposing the Docker for Windows daemon on localhost?

A developer running Docker for Windows needs to enable the option "Expose daemon on tcp://localhost:2375 without TLS" in Docker setting > General tab. There is a warning: Exposing daemon on TCP ...
0
votes
0answers
37 views

Different results in “forgot email” [on hold]

In a website when "Forgot Email" page opens it gives a textbox for email input but when in that text box some scripts or inputs like: ' OR '1'='1 is filled only a simple 'tick' sign comes in the send ...
0
votes
0answers
26 views

nvd json database without vendor and product info

I'm trying to parse nvd databases from nvd vulnerabilities feeds https://nvd.nist.gov/vuln/data-feeds#JSON_FEED I see many entries, where vendor product information is not filled in (cve->affects->...
0
votes
0answers
26 views

Bypassing ASLR using information leaks

Most of my questions were answered in this post ASLR bypass with info leak However, I just want to know the process of getting the memory address from the information leak to then using it in the ...
-2
votes
0answers
48 views

Please help me on this thing [on hold]

this is pretty odd but I want to change my school test marks. Yeah, it is unethical but I just want to do just on my tablet and not on schools website. I would just show some good marks to my Indian ...
0
votes
2answers
128 views

How to verify a private key has not been compromised?

I have a machine with a process that signs code for users running 24/7 (encrypting the key is not possible), which will be protected as well as possible. Is there a way to set things up such that I ...
0
votes
0answers
29 views

Webroot marks valid file as [Trojan.Dropper.Gen] [on hold]

Webroot marks valid file as [Trojan.Dropper.Gen] We develop and deploy a Windows Desktop Software Application, but this gets repeatedly marked as [Trojan.Dropper.Gen] The antivirus software webroot ...
1
vote
1answer
28 views

Is it safe to enable - Trust Access to the VBA object model - Microsoft Office

I am trying to run a VBS script which calls a macro and won't run unless I click "Trust Access to the VBA object model" in Microsoft Office Trust Center. I forget where I read it but I thought I read ...
0
votes
2answers
73 views

netcat reverseshell hanging after connection

I put a reverse shell on a machine in my lab enviornment and it seems to just hang after there is a connection in netcat - I'm not sure why this is. I've tried different ports but no luck. See ...
-1
votes
0answers
31 views

*push-apple.com.akadns.net Pushing Malware to IOS & Mac?

Bear in mind it looks like Apple Push Notification Service is a gateway for pushing viruses and malware to users devices, if I am not mistaken, just look here: https://www.virustotal.com/gui/ip-...
0
votes
0answers
37 views

CSRF and XSS protection via Header & Cookie-based JWT (tokens)?

I have built a REST API, where users login, with extra permissions in some cases (or restricted to certain areas of the site; or even admin privileges). What I've built: JWT authorization (added to ...
-3
votes
0answers
66 views

Enterprise Password Management [on hold]

Does anyone have any recommendations for enterprise password management solutions? The main requirement is that it must be hosted and managed on premises by us.
0
votes
0answers
40 views

Web app: using two hashing schemes for CPU-friendly password validation & secure storage [duplicate]

Consider a web application that: uses HTTP Basic Auth over HTTPS, and therefore needs to validate a password (an API Key) on every request and needs to handle a substantial load has very few distinct ...
0
votes
0answers
27 views

Two message key agreement and mutual authentication protocol?

I am looking for, but not finding, a published protocol that does something similar to TLS 1.3 mutual authentication, but simplified by using assumptions to reduce the chattiness of TLS. If we assume ...
1
vote
1answer
35 views

What's the correct way to handle a failure with Client Certificate Authentication

I'm adding Client Certificate Authentication to my application - what is the correct way to handle an invalid certificate, untrusted certificate or an un-mapped user ID?
0
votes
0answers
28 views

VPN client DNS setup for maximum anonymity

I am installing a pivpn, on my raspberry pi, at my home network and it asks me for the DNS provider for my VPN Clients. I am concerned about the privacy of the DNS. What can I do to ensure the maximum ...
1
vote
0answers
39 views

Is there a way to exploit file_get_contents that has a prepended website?

suppose I have the following code that will display an image. The name of the image is supplied by the user as follows: https://example.com/image.php?image=cat.jpg My image.php file contains $...
0
votes
0answers
38 views

Can you give me tips about bWAPP HTML injection on high level security? [on hold]

I am trying to perform an HTML injection on my buggy web app (bWAPP). So far I made it on low and medium level but I am really struggling with high-security mode. Can you give me some tips?
2
votes
2answers
26 views

Insecure Direct Object Reference - Change email from client end

I am testing a website that has "Forgot my password" functionality. If user clicks that, his email address will be displayed as a hyperlink. If that is clicked, an email to reset password will be ...
0
votes
1answer
44 views

Can a self-root certificate spy on me without a vpn or proxy on iOS?

Can a self-root certificate (implemented via mobile configuration) spy on me without a VPN or proxy on iOS?
0
votes
0answers
26 views

SQL injection in Go with database/sql lib

Is it possible to inject SQL statements with fmt.Sprintf instead of Db.qwery with the ? and not %s parameter? I know it's a bad habit to use it but I wonder if it's possible or not. Example : query :...
0
votes
0answers
26 views

why does my simple 0x86 shellcode execve not do anything?

I'm just starting to learn execve command, so I'm sure this is a very easy mistake, but I've stuck on this for hours, so any help or hints would really be appreciated, my code is as follows: section ...
-2
votes
1answer
68 views

How can i check my phone for being tracked and other spyware [on hold]

I feel like my phone is being monitored/tapped as it keeps glitching out and other abnormal symptoms. How can I check/remove these unwanted programs?

15 30 50 per page