Questions tagged [windows]

Related to security concerns specific to the Microsoft Windows operating system itself. For security of applications that happen to be running on Windows, please use [appsec]. For the X Window System, please use [x11].

Filter by
Sorted by
Tagged with
1 vote
0 answers
51 views

Any Windows/NTFS trick to ignore/cancel out a file extension from a path?

I am pentesting an application. The application exposes a SOAP API, which I have access to, and internally that API makes the following call: File.Open("C:\Resources\"+resName+".res&...
0 votes
1 answer
29 views

CNG SSL Provider Functions - how are they called?

I've been studying the various cryptographic APIs on Windows, and the flow that Windows goes through when an application creates an SSL connection. One of the APIs I've come across are the CNG SSL ...
5 votes
1 answer
883 views

How to check which certificate is being checked for revocation?

I have a .net desktop application without a certificate on a network not connected to the Internet When I start it, there is a call to crl.microsoft.com that times out and slows down the application. ...
0 votes
1 answer
143 views

Can I recover files that I had on windows from a SSD that I converted to apfs (mac) and which method or tool to use?

I had some files that I want to recover from windows, but I formatted the ssd drive to macos (apfs)? Is there a tool or method to recover those files?
4 votes
3 answers
4k views

Could "system volume information" and $RmMetadata pose information leakage on a nuked HDD?

I recently nuked my HDD(s) via a Windows program (Disk Wipe to be precise: http://www.diskwipe.org/), now everything is fine when I try to retrieve the information on that disk by any program I can ...
-2 votes
1 answer
314 views

A simple but dangerous vulnerability in windows7?

I discovered that if you change the extension of any file to .lnk, that is make it like a shortcut file, then you can't change the extension again, even if you have set 'show the file extension names' ...
0 votes
0 answers
25 views

Retrieve list of trusted server public keys during an application run

I'm trying to implement a mechanism that allows me to maintain a list of SSL server certificate public keys that have been verified as trusted during an application run time. For example: Application ...
0 votes
1 answer
166 views

Does BloodHound include local users as part of the results?

I've read the documentation for BloodHound, but I'm still unsure, whether BloodHound includes local users (not domain users) as part of the results (or whether it is possible to make BloodHound ...
0 votes
1 answer
376 views

Can file recovery tools recover deleted small files from SSD drive's NTFS Master File Table?

According to this page and site, small files are kept in Master File Table when filesystem is NTFS. Let's assume that computer is using Windows 10 and a SSD drive with TRIM support. If a user ...
14 votes
1 answer
2k views

Git server security

I want to install a Git server for my company. I'm able to get a Windows virtual machine. Now I've been asked to assess its security aspects. I'm lost on how to achieve this goal. As it is a Windows ...
4 votes
3 answers
3k views

SFTP on Windows - is it likely to be disabled?

I'm a software engineer and I'm maintaining a product that allows a user to run commands and scripts on Linux servers via an SSH connection. We now need to extend this functionality onto Windows. We ...
2 votes
2 answers
243 views

What program can Decrypt specific a Folder/Files during Windows Boot/Loading? (Windows)

I've been looking into Encryption of my data for some time now; I've decided to move ahead with VeraCrypt for encryption all of my partitions (I have 2 disks in 1 laptop) except for the OS (C:) ...
0 votes
1 answer
2k views

How to crack AES-based Kerberos TGS tickets (Kerberoasting)?

All material I can find is related to RC4-based Kerberos TGS tickets, since these are easier to crack to obtain the service account's password. However, I want to attempt to crack AES-based Kerberos ...
9 votes
1 answer
669 views

Entropy sources used by modern Windows

A comment on a Microsoft blog from 2005 mentions over 150 sources of entropy for the Windows CryptGenRandom function. The majority of sources come from low-level system information (precise stat ...
0 votes
1 answer
300 views

Windows Defender's MsMpEng.exe Access lsass.exe

I detected an activity last week on our SIEM system. The MsMpEng.exe which belongs to Windows Defender access lsass.exe. I search it on the net for learn is it a normal acitivty or is it anormal then ...
1 vote
3 answers
1k views

Where can I find a list of checksums for windows files? Why don't MS sign all their executables?

Is there anywhere I can download a list of checksums for microsoft-published OS executable files, preferably grouped by release name? I could do the same by decompressing files on a windows setup CD, ...
0 votes
1 answer
270 views

Excessive logons from domain controllers

I am quite new to analyzing the windows logs. I have been seeing excessive logons with 4624 and 4625 with the Subject/account name: DomainController(actual name of the domaincontroller is different) ...
-1 votes
1 answer
755 views

How can Runtime-Crypters stay FUD

A Runtime Crypter always works with the same principle: It decrypts its payload, starts up a process in suspended state, inserts the payload and resumes the suspended process under false flag. All ...
1 vote
2 answers
343 views

I installed a windows app that stores cookies in a plain text un-encrypted database. Is this a problem?

I have recently installed an application that was developed with Electron that requires I authorize via Google to use the application. I did this at the same time as monitoring the application with ...
0 votes
1 answer
61 views

Does linux in windows with wsl2 carry the usual security advantages of linux

I'm planning on running some bitcoin wallets I would like to be extra resilient to hack attempts. I plan on installing them on an encrypted usb stick and only interacting with the stick with linux ...
0 votes
1 answer
29 views

EAP-TLS for securing internal local WLAN?

I'm looking at securing a wi-fi network used in an industrial context. I have a pool of client devices which should automatically connect to an AP (selecting SSIDs which match a specific pattern). ...
1 vote
1 answer
97 views

How do I compare a signed .exe file with the unsigned version of the same .exe file?

I have had some binary executable files (.exe) for Windows signed, I have checked the signature of the signed files, but I would also like to check that the file that I sent for signing is indeed ...
0 votes
2 answers
93 views

Common attack vectors for Microsoft Exchange Server?

What are the common attack vectors for a Microsoft Exchange Server? My online searches only yield discussion into various APT groups, and technical write-ups of different 0day exploits. There does not ...
5 votes
1 answer
5k views

How does a developer interact with Microsoft Certificate *Web Services*

Microsoft Certificate Web Services is a HTTPS web service (WS-Trust) that has no Kerberos dependency and can be used on a variety of devices. This is new in Windows 2008 and is separate from the ...
0 votes
1 answer
294 views

What can prevent Mimikatz from accessing LSA?

I used to run Mimikatz in one of my computers. Then, I did something to block its action and I do not recall what it was. I am trying to revert it unsuccessfully. .#####. mimikatz 2.2.0 (x64) #...
0 votes
1 answer
71 views

File sharing with compromised Windows machine

I want to connect a known to be compromised Windows machine to the network for file sharing, it has lots of pirated software installed therefor not secure. Can it be isolated so that nothing can ...
2 votes
0 answers
91 views

Use platform TPM as U2F for web applications

The Problem: Use the platform TMP of my Windows Laptop/PC (no external device or USB token) as U2F in a web application to check if it is a known device. My intended solution: I need to store/create ...
35 votes
5 answers
15k views

Why can't Windows 98/IE5 connect to HTTPS sites in 2015?

Recently I found an old installation CD for Windows 98 Second Edition, and looking for a bit of a nostalgia kick, I installed it inside VirtualBox. Win98SE shipped with IE 5.0, and browsing the web ...
3 votes
3 answers
7k views

Why the Windows Firewall has so many exception rules by default?

Consider the default firewall configuration for Windows 10 Pro (Creators Update). So, in a nutshell: Block inbound connections. Allow oubound connections. 223 inbound exception rules (some of which ...
2 votes
0 answers
58 views

Does Windows 10 read/run/care about USB devices plugged in "Lock Screen" mode?

Whenever I leave my computer for the bathroom or anything inside the living space, I press WinKey + L to enter the "Lock Screen" mode. (If I go outside, I turn it off completely.) Let's say ...
29 votes
4 answers
25k views

Checklist on building an Offline Root & Intermediate Certificate Authority (CA)

Microsoft allows a CA to use Cryptography Next Generation (CNG) and advises of incompatibility issues for clients that do not support this suite. Here is an image of the default cryptography settings ...
6 votes
2 answers
9k views

Is opening port 3389 on a router and forwarding this to a Windows SBS 2003 server secure?

I know of a company who has port 3389 open on their router and forwards this to a Windows SBS 2003 server. The server has the Windows firewall switched on, is patched and has an up to date antivirus ...
0 votes
2 answers
31 views

Windows IP Helper service listening on port 1000

On a Windows 10 Home machine (21H2 19044.1741), I noticed one of my applications failed to listen on port 1000, because something was already using that port. That struck me as peculiar, because I ...
1 vote
1 answer
590 views

Show confirmation popup before running any downloaded program in Windows 10

I often download files either using my browser or by torrenting. Few times, I encountered an attack where the torrented file was called something like movie.mp4.lnk and the target was set to run a ...
0 votes
0 answers
44 views

How can apps track which other apps are running?

I've started using a clipboard manager (clipBoardFusion) on Windows and I've noticed by chance that it also real-time tracks opened programs. It's creepy because it also tracks Tor browser which now ...
2 votes
1 answer
123 views

Does only having Microsoft Office installed make you vulnerable to the CVE-2022-30190 RCE or having Windows as your OS is enough?

I was wondering whether you need to have Microsoft Office installed to be vulnerable to CVE-2022-30190 RCE. As far as I understand, MSDT is the issue here (the attack vector so to say) and as shown ...
1 vote
0 answers
38 views

Can modifying environment variables in Windows cause vulnerability?

As normal user, if you open the Edit Environment Variable setting in Windows, you will get this: As you can see, the %path% variable that available for an user is a combination of %path% set globally ...
1 vote
1 answer
101 views

How risky is it to let someone know the name of your Windows PC?

I have here a situation where if I share this file with someone on the internet, the file may contain: 1. data pointing to the directories where it is stored on my computer, along with 2. the name of ...
0 votes
1 answer
95 views

Is there a difference between a bootkit and a ring-0 rootkit?

I understand the difference between a Ring-0 rootkit and a Ring-3 rootkit, in terms of their hierarchical depth in computational models. That is kernel mode and usermode, respectively. I am confused ...
0 votes
0 answers
52 views

Can a Bluetooth device hack a phone it used to be paired to if the device was removed from the phone, but the device was not reset/cleared?

If a Bluetooth device, like a toy, smart toothbrush, or headphones etc. is paired to a phone or computer, and the Bluetooth device is sold/lost without resetting the device or any Bluetooth data on it,...
1 vote
3 answers
1k views

Are all fields of the PE certificate directory hashed during authenticode signing?

In a Windows portable executable (PE) file the certificate directory points to an offset to a WIN_CERTIFICATE structure. My understanding is that while the field is named bCertificate, it actually ...
2 votes
4 answers
14k views

Two Tasks Running With No Name

I don't know if this is the right place to post this question but I have two tasks that have appeared recently and are always taking up most of my CPU. They don't have a name and when I go to stop ...
0 votes
1 answer
187 views

Is accepting arbitrary COM pointers over a process boundary safe?

I have a legacy Windows application that needs to be looked over in terms of security. During this review something caught me eye. In the out of process COM server I'm looking at is a method that ...
2 votes
2 answers
307 views

Fetching GPG private key from Linux server to decrypt files on a Win 10 computer in production

I have a need to fetch automatically the GPG private key from a Linux server to decrypt files on a Windows 10 computer in production. There are a few challenges here: How to assure SCP from the ...
3 votes
1 answer
29k views

System Account in Windows

I was thinking about SYSTEM account on windows 7 and while researching about it, I came to know that it is predefined account used by service control manager (SCM),The account is not recognised by ...
2 votes
1 answer
114 views

Does Windows use Bluetooth Authenticated pairing with encryption automatically?

Does Windows use Bluetooth Authenticated pairing with encryption automatically when you connect Bluetooth devices like earbuds to it? Is that Level 4? If it's not automatic, how do I get Windows to do ...
5 votes
2 answers
729 views

How do EDR prevent you from uninstalling even as local admin?

I have an CrowdStrike EDR and it seems like the only way to disable this on all OS is to provide maintenance-token or ask CrowdStrike to disable the defences so you can uninstall it. I also have a ...
1 vote
2 answers
1k views

How to trace SMB connection to what process initiated the connection?

I have a situation where I see a bunch of SMB connections initiated from a client to a server every night and it triggers an SMB brute-force alert on my Firewall. I installed Sysmon on the server to ...
0 votes
1 answer
443 views

Downgrade of NTLM Authentication

I have been experimenting NTLM and its different relay mitigations, including MIC and channel bindings. In my understanding: ntlm auth starts with a negotiation packet sent by the client. In this ...
5 votes
3 answers
970 views

Decrypt TLS 1.2 traffic between .NET Windows applications

I have attempted to decrypt traffic between two .NET applications (both on Windows platforms) using Wireshark but due to the Diffie Hellman with perfect forward secrecy, I cannot use my private key ...

1
2 3 4 5
43