All Questions

I am using AWS API Gateway to build my API, and securing it using API Gateway's recently launched Mutual TLS feature. My use-case is to only authenticate a few servers. Here is my approach in brief: ...

I am taking a computer security course but I have a question I am stuck on. You are the system administrator for a provider that owns a large network (e.g., at least 64,000 IP addresses). Show how you ...

I had some difficulty in grasping the concept on how "DNS sinkhole" is being utilize. Is it like setting up something similar to a honeypot to lure attackers away from the actual network, so ...

Is there possible situation where a file contains malicious codes and after the code is excuted, the virus attach itself to another file and delete the malicious code from the file where it comes from?...

So I am currently running parrot sec version is the latest one. I am running it on a 250gb dell laptop 4gb ram with a max of 3.5 ghz I believe. Parrot comes with Johnny the gui version and for some ...

I have an old application that needs the obsolete RSA key and not the ECDH. I know the ECDH is newer. I have tried this openssl genpkey -algorithm RSA -pkeyopt rsa_keygen_bits:2048 -out private-key....

I have the following network setup https://i.ibb.co/wwPLH2H/Network.png All traffic from 10.0.64.0 / 27 behind FirewallB (firewallsm) reaches 192.168.28.0 / 27 network via the LAN interface of ...

Using standard hardening options like PIC, Stack Protection ... does a mere recompilation make a program more secure against attacks? You have the source code of a program, compile it two times with ...

I'm implementing a model which I'll have to reupdate the users, so I want to deliver a unique link to the users and after confirmed the update, I expire that link, so I prevent reusing that link. How ...

When I use XAdES for file types other than XML, how is the file digested for signature? My understanding is that XAdES is XMLDSIG with a couple extra fields. For XML signatures, the signature is ...

In my existing setup, we have Exchange Server joined with Windows Active Directory. Both the username and email address are the same for user accounts. Our support party also recommended using this ...

I'm trying to enumerate a Microsoft Access database using sqlmap, in particular I run this command: sqlmap -r http.txt --risk 2 --dump-all Anyway it seems is not retrieving a single information. Am I ...

The IT dept at work refuses to install Garmin software on our PCs because they say that connect a Garmin GPS device to a machine is a security risk. What is the risk?

As per the title, I'm looking for insight on the crowdstrike sensor. Does anyone know if, on top of the outbound pt:443 access to the domains it requires, whether it also requires inbound connectivity?...

I am trying to understand this DNS cache poisoning from a textbook. Is it the case that the server does not check any pending requests for a given domain and will send all of the n "same" ...

Say I'm running a server with Ubuntu and an application stack and I want to lock down potential malicious access. Is there some OSS toolchain for disallowing execution of all unsigned binaries on ...

I've got a locked Samsung Galaxy Note 10+ 5G (running the latest android 10 and patches) The phone is locked with a pattern (unknown) What are my chances of any data extraction with cellebrite or ...

There is a bug in the WhatsApp story restrictions list that is questionable for me !! I always limit a story to certain people, but unfortunately the people for whom I have chosen a limit have been ...

I have a BigIP target server and try to meassure the (average) rtt. Usually I do this with sudo hping3 -S -p 80 <target>. hping3 works fine with the listed parameters for arbitrary hosts, but ...

I want to use a firewall to protect my device from hackers and RATs. What are the most effective rules to use when configuring a firewall - other than blocking everything and not connecting to the ...

I need to add extra security to my Android device using iptables and a firewall to defend against hackers. My specific goals are to prevent a hacker from remotely breaking into my device to begin with ...

Ben Laurie's original paper on Certificate Transparency proposed that clients (browsers) should "gossip". In particular, it proposed that when a browser connects to a web server, it should ...

I am creating a network with three layers. A sender layer, A gateway layer, and a Receiver layer; each having different platforms. See diagram below All platforms have published their public keys on ...

Is it possible to perform an SQL injection inside an XSS attack? And if so, where can I find information on this or some examples?

I'm trying to figure out how to establish trust in Windows executables that I download from the internet. Some software that I download, such as KeepassXC, has a Windows Digital Signature, but they ...

Some people on my email contact list have been receiving phishing emails that appear to come from someone else on my contact list. The people receiving the emails and the person purportedly sending ...

Problem: The hiring department occasionally sends me Word documents asking to clear the file as "safe" to open and review for purposes like resumes etc.; they can come from anywhere and are ...

Given an alert rule like -a always,exit -F arch=b32 -S open -S openat -F exit=-EACCES -k access how does adding multiple SysCalls (-S) options work? When an application gets executed do all the ...

Not sure if this is the right place for this question, but I'm looking for a way to establish secure inbound email traffic from external senders with an automated decryption mechanism within my ...

So a few weeks ago I came across a security report that stated that the SHA1 thumbprint of the certificate was a vulnerability. The vulnerability was raised due to fact that the thumbprint used the ...

Over a year ago, I have reported a few security vulnerabilities to one of the top bug bounty programs on HackerOne. All of them have been quickly triaged as critical, but no progress was made towards ...

Stripe's fraud detection documentation claims it has Proxy Detection When I search for how it might be detecting traffic from proxies, I see this great answer, which show how to detect that traffic. ...

I followed this guide and, in theory, the filesystem is read-only. $ cat /boot/cmdline.txt console=serial0,115200 console=tty1 root=PARTUUID=5838cc20-02 rootfstype=ext4 elevator=deadline rootwait ...

In translated from an English profile, combined from a couple of profiles (I found that one is Protection Profile for Application Software v1.2 of NIAP) I have something like "TOE security ...

I want to know is it possible to get malware from .txt files? I think it's possible, because a program executes the .txt file and program may get infected. Additional information I want If it is, how?

Many sites have a step during registration when you have to create security questions and answers for them. Is this type of security layer considered as 2FA? From what I know, 2FA is used for the ...

I have Layer3 ddos protection, but I want to upgrade it to Layer7 ddos protection. But when i look about Layer7 Ddos attacks, I see that they are usually HTTP/HTTPS based attacks. I have 3 questions; ...

I would like to learn how to find the private IP address of anyone connected to a network. Just as a side note, this specific network has a firewall, the only info I have on it is that it blocks ICMP ...

I was reading this article by Credit Karma (An American fintech). They mention that this system of "identity-aware encryption" helps them better protect the data of their users and to keep ...

Here's my not so theoretical scenario: A day-one Trojan horse attack where the attacker sets up a secure connection back to himself using a well known trusted port, such as 80 21 443. Or for instance, ...

I'm having some difficulty understanding when people say that VLANS provide security by logically separating/dividing the switch into different sections after trunking the VLANs on a router and ...

I have already set up a squid cache proxy server on a Raspberry Pi 4. I need to create some sort of GUI to turn on and off certificate checking for man in the middle attacks. First, how do I get squid ...

As part of bug bounty, I have a PATCH request to the API to change my name. I can post theses chars: : ; ' * ` = # / [ ] ( ) This is the HTML result : data-cy="label-input__input" value=&...

package.json file { "dependencies": { "express": "^4.17.1", "express-graphql": "^0.12.0", "graphql": "^15.5.0", &...

I've been messing around with Python to automatize downloading webpages and images when needed, and for that I'm using urllib.request, usually authenticated to the sites with my login. As someone ...

Source ip addresses can be spoofed. And because of IPv6 it is not enough to keep a look-up table of ip addresses that are excluded from visiting a website, because with ipv6 there are now enough ip ...

I'm building a REST API resource server with JWT authorization for an Angular web app. I'm looking for a method to perform an additional check if the request body sent from the client application has ...

I am just starting out on cyber security and one of the recommendations to us was to check out "MIT Licensed Whitelisting Agent". At first I thought this would like a service I would ...

I am using nginx as a reverse proxy with the following config: location / { resolver 1.1.1.1; proxy_http_version 1.1; proxy_pass http://webserver.example/$http_host$request_uri; } I have ...

TLDR: Is there a security benefit to regularly accessing the admin account with a hardware token rather than with a well-protected password? Long story: I'm both a developer and the system admin of ...