Questions tagged [microsoft]

The tag has no usage guidance.

Filter by
Sorted by
Tagged with
1
vote
0answers
519 views

Microsoft is spying me. What can I do?

I was getting into my Windows 10 configuration and I saw a lot of options which are sending data to Microsoft. Telemetries, tracking, statistics... even sharing Windows updates on my PC to other users!...
1
vote
0answers
727 views

Key usage not applied using Microsoft CA

I'm a bit of a newbie to Certificate signing, so please forgive any stupid questions I might have. I have a CSR, when I decode the CSR it cleary request the following key usages: Requested ...
2
votes
0answers
4k views

How to exploit a file upload to an IIS 5.1 [closed]

I found the following services in a testing environment: 21/tcp open ftp Microsoft ftpd 80/tcp open http Microsoft IIS httpd 5.1 The FTP server allows anonymous logins and ...
1
vote
0answers
383 views

Microsoft IIS 7.5 from Time Based SQLi DBA to shell

I am dealing with a time-based SQLi in a Microsoft IIS 7.5 Server and I want to upload a shell. My approach is to get the internal application path, and then, try to upload a file with sqlmap --file-...
4
votes
2answers
299 views

This is a working SQL-injection. What could the server side query string look like?

This question is about a small detail in a larger school assignment. I have been struggling with this little problem for too long. ABCTF arranged a Capture-the-Flag competition which was held earlier ...
0
votes
1answer
193 views

Why Microsoft leaves known security flaws?

There is very well known security flaw in microsoft windows. That you simle boot a linux OS from flash drive e.g Kali Linux. And just replace a cmd file with sethc file and you can prompt cmd with ...
6
votes
2answers
686 views

Can Google Docs be used to “sanitize” a Word or Excel document?

Sometimes I have to download some Word or Excel documents from uncredible sites. I need not only to read but also to edit them. I heard that the Microsoft Office suite is a very popular attack vector. ...
1
vote
2answers
53 views

What are the security risks of using downloadable email vs. remote/online email?

The organization at which I work wants us to download our e-mails rather than use a remote/online service like gmail. I have argued that this is less secure because downloading the e-mails brings the ...
2
votes
1answer
646 views

Is It OK If a Server Does Not Verify a Certificate?

I am currently learning a LOT about Azure, Azure Active Directory, and Azure Key Vault (AKV). To start with, please see this article: In particular, I am interested in this statement: When ...
1
vote
3answers
182 views

How secure is Windows 10 account control?

I have a Microsoft account in my machine (Admin). I set a guest account (Standard) for a friend so he can play games. Is there any way he could access my files/folders info? I mean, get data, view ...
2
votes
1answer
1k views

What does Microsoft mean by “Trusted Domain” in relation to Kerberos?

In the Microsoft documentation about using Kerberos, it is stated that: Both the server and the client computers must be members of the same Windows domain or members of trusted domains. If this ...
1
vote
1answer
766 views

Microsoft support asking me for my phone IMEI?

I just contacted Microsoft support on my Lumia phone via the preinstalled "Contact Support" app, about an issue of the language of comments on apps in the Store being in the wrong language (different ...
4
votes
3answers
3k views

Is Bitlocker trustworthy?

My question isn't about whether or not the encryption on Bitlocker works, but whether or not there has been any security audits about potential backdoors Microsoft may have installed. I don't have a ...
3
votes
2answers
4k views

How difficult is it to brute-force Windows EFS encryption?

With EFS I have C:\$USER\ encrypted so all files owned and used by said user are encrypted. If this laptop is stolen, am I correct that they could pull the microsoft user password hashes, crack them,...
1
vote
3answers
241 views

Since when can't any program get MS-DOS and MS-Windows admin rights?

I'm certain that I read that in the 80s with 8-bit Intel processorn, any DOS program that was run with MS-DOS was run in administrative mode and could do anything that any C program could do. Now I'm ...
3
votes
0answers
99 views

What personal information, if any, can be gleaned from a Microsoft APPCRASH problem signature?

I am trying to debug an "APPCRASH" problem event for a program running on Microsoft Windows 7. When this happens a problem signature is presented, like this example from SuperUser: Problem Event ...
0
votes
1answer
306 views

Different Microsoft-signed excecutables have apparently the same signature!

On Windows 10 systems, I found two versions of bootsect.exe (a Microsoft-supplied utility that writes disk boot sector) with different hashes (SHA-1 9b7463c79460a55a36b53bee0889f894b2379ec3 for one ...
1
vote
3answers
96 views

Securing online SQL database and server [closed]

I am trying to build a big project but lack the knowledge of security of servers and SQL. So, please help me by telling what necessary steps should i take. Block all remote access :- I have heard ...
0
votes
1answer
241 views

A seemingly innocent program is attempting to connect online. Should I be worried?

OS: Windows 10 64-bit updated, usually used for development and Steam-CSGO. Straight to the point: Solitaire just tried to connect to the internet. Details: After tightening my firewall rules after ...
2
votes
1answer
644 views

Microsoft and SHA-1 deprecating on Windows 7

Microsoft states: Effective January 1, 2016, Windows (version 7 and higher) and Windows Server will no longer trust any code that is signed with a SHA-1 code signing certificate and that ...
0
votes
1answer
136 views

What information can Adobe Reader and MS Word send over the internet when a document is opened? [duplicate]

I was reading the warnings with Tor and was curious about this one inparticular: Don't open documents downloaded through Tor while online The Tor Browser will warn you before automatically ...
2
votes
0answers
237 views

Is Microsoft trying to brush the Diagnostics Tracking Service under the rug?

I was working my way through disabling all of the spyware Microsoft has put into Windows 7 when I came across this Google result: "Sep 11, 2015 - Describes an update that enables the Diagnostics ...
-2
votes
1answer
267 views

Where should I report http500 bug in bing.com? [closed]

I found a way to easily get HTTP 500 Internal Server Error directly from https://bing.com/ site with proper query. It seems to be 100% reproducible. Should I report it? Where? I found site for ...