All Questions

0
votes
1answer
29 views

Difference in Results: a Query to DuckDuckGo and the Same Query to Google.com [on hold]

Why? FAQ does not adequately cover: Result based on “Amanpour and friends Brexit:” Using DuckDuckGo: —————— #1 Result From DuckDuckGo: “Leftist Shill TRAITOR WITCH, Christiane Amanpour on BREXIT” (...
0
votes
0answers
65 views

network issue after using macchanger. no internet, no ipv4 [migrated]

I used macchanger with these commands: sudo ifconfig eth0 down sudo macchanger -r eth0 sudo ifconfig eth0 up I am using it with virtualbox on a local network, I've never had issue with that before, ...
0
votes
0answers
14 views

Why lsadump is not working?

I have a shell with root privileges, and I invoke mimikatz in it by using load kiwi in meterpreter shell. Now the problem I have facing is, I can't get the positive results. When I run this lsadump::...
0
votes
1answer
16 views

XMAS Scan vs Inverse TCP

Whats the difference between a XMAS Tree scan and an Inverse TCP scan using the FIN, URG, and PSH flags? Are they the same thing? XMAS Tree scans are designed to manipulate the PSH, URG and FIN flags ...
0
votes
0answers
13 views

Get all active ASP.NET Session ID's as an attacker

When a user logs into my ASP.NET application an ASP.NET_SessionId is assigned to them. This means that, potentially, an attacker could impersonate a user by using their SessionId in requests (sending ...
-3
votes
0answers
93 views

Hacked aiming xgirlfreind [on hold]

All my info gets changed I'm also getting messages from old Facebook I don't even have access to.at one point I supposedly won money and I was conversation and a third person joined in from my account....
0
votes
0answers
22 views

Why is Veracrypt showing 2 created partitions?

I wiped my 1TB Samsung 850 Evo SSD and I just used veracrypt to perform full disk encryption with it. I have another HDD drive as well that I've done this with. The HDD is sdb, and the EVO is sdc. ...
1
vote
1answer
81 views

Is a Password secure if I change one letter?

If I use a long password (64 characters), which is written on paper and its encrypted content never sees the internet (veracrypt volume), would a secondary volume with the same password, but one ...
0
votes
2answers
24 views

Confused about GitHub's GPG key association and authenticity

I'm not sure I understand GPG, and something on GitHub has left me wondering. In git, a GPG private key can then be used to sign commits, which allows someone who is in possession of the public key ...
-1
votes
1answer
37 views

how to exploit file upload functionality [on hold]

I'm pentesting a website, where i'm testing an upload functionality and it only accepts pdf files and when we visit the url where the file gets uploaded it shows download prompt instead of any content....
1
vote
1answer
38 views

Can my machine be compromised if I use an outdated application and the input data is trusted?

Suppose I decide to use an outdated application for some reason: maybe I can't update it for compatibility reasons, or updates are not provided in the official repositories I use, or maybe I just don'...
49
votes
10answers
14k views

Why check your email in haveibeenpwned rather than regularly changing your password regardless of any leaks?

There's a lot of news right now about haveibeenpwned but I don't understand why people need a service like that in first place. If you're a security conscious user, you'd change your passwords ...
1
vote
3answers
103 views

What should a secure passphrase look like?

We all know that passwords should not only be randomly generated, but also look random. The reason is that attackers can use patterns or existing words to be able to bruteforce the passwords faster, ...
1
vote
1answer
35 views

How to launch a Metasploit module with arguments in just one command

I am developing my first Metasploit module on Metasploit v5.0.1. I would like to launch my own module in one command with args and not using meterpreter. At this time, I launch my module with these ...
-1
votes
1answer
33 views

How does an antivirus flag homemade malware? [duplicate]

Say I made some malware in python or c# or whatever language, How would an antivirus detect that the program has malicious intent because how does the antivirus know that the program is malicious ...
0
votes
1answer
43 views

How fill up a gig interface bandwidth with hping3?

I've been trying to test our software against DOS attacks. So, I used 'HPing3' but it just fills up 10-11M of my interface's bandwidth! I ran the tool 40 times, I mean 40 hping3 processes, ...
1
vote
2answers
37 views

How do i extract data from response and use it in url for next request in Burp Intruder?

The URL is https://www.example.com/send?session=abcabcabc. When the above URL is requested, a response comes with <a> tag which contains a new URL with a different session value like https://...
2
votes
1answer
42 views

Calculating HMAC

I've been trying to learn how HMAC is calculated but seem to be missing something. According to this wiki page, calling HMAC-SHA1 on an empty key and message should result in a value of ...
0
votes
0answers
12 views

How to interpret unicornscan output? [on hold]

I used unicornscan to scan a website's ports: unicornscan -v -I -mT ***.91.31.1 Output: TCP open ***.91.31.1:22 ttl 64 TCP open ***.91.31.1:53 ttl 64 TCP open ***.91.31.1:80 ttl 64 TCP open ***....
0
votes
1answer
33 views

How does key exchange work? Using symmetric algorithm such as AES

I was wondering how does the sender give the encrypted file and the key to the receiver securely? Particularly on situations where the sender doesnt meet with the receiver (through email or through ...
-1
votes
1answer
34 views

Is a md5 actually unable to be reversed? [duplicate]

If a md5 is one way and supposedly unable to be reversed why do we still have large data breeches with user names and passwords. Are these companies storing passwords in plain text?
2
votes
1answer
55 views

Is SQL Injection Possible without double and single quotes?

Let's assume we're building a SQL query like this: SELECT * FROM users WHERE username = 'Username' AND password='password' If we blocked the characters " and ', will an attacker be able to hack into ...
0
votes
0answers
21 views

Are there researches about the anonymity friendliness of distributed version control systems?

This question may qualify as wiki, because it is a bit broad. I accidentally discovered that fossil repositories, that are in fact sqlite databases, may contain sensitive data. I opened a repo ...
0
votes
1answer
33 views

What considerations are there for using USB WiFI adapters and how to protect against them?

Often with older machines, the built-in WiFi adapters have failed. These in turn drive a demand to procure USB WiFi adapters since ethernet connectivity is not a choice. Since the devices will be ...
2
votes
0answers
8 views

How to calculate Public Key exponent if I have p, q, Dp, Dq, QInv? [migrated]

I have a private key components p, q, Dp, Dq, and QInv. I need to calculate the public key modulus and exponent. Modulus was super simple p*q, but exponent I can't figure out. Have searched all the ...
1
vote
1answer
81 views

Why does windows defender scan my computer multiple times

Occasionally, Windows Defender sends me a notification that my device was scanned. This occurrence is quite ordinary and boring, but I actually devoted two seconds to reading the entire message once, ...
-1
votes
0answers
19 views

Secret conversation identity key

On my messenger I have one encrypted key code. On the messenger that I and my husband share there are three encrypted keys. What is this mean? And do you receive a new key identity each time you begin ...
2
votes
1answer
40 views

Does MathML pose a security risk?

MathML seems like a promising and attractive technology. But Google Chrome doesn't support it, allegedly because it has "architectural security issues" according this wikipedia page. But it also says "...
-1
votes
0answers
48 views

Why do people say Ruby on Rails is inherently insecure? [on hold]

Why do people say ruby on rails is inherently insecure, bad, and slow?
1
vote
2answers
54 views

Does red-teaming encompass the entire skillset of a blue-teamer?

Currently I am potentially facing impostor syndrome in regards to the role and skillset of blue team members (defence) and red team members (attack). I personally specialise in defence capabilities, ...
1
vote
2answers
107 views

Allow user to export data, what about security?

We developers of course try to create the most secure (web) application out there that will not be hacked. While we already know it's impossible to know for certain that your application is secure, we ...
0
votes
1answer
47 views

How to fix WordPress CVE vulnerabilities or preventive measures?

I have a WordPress site r,unning on version 4.9.8. In the recent security audit done by the organization following issues were reported. 1) Wordpress: CVE-2017-1000600: Input Validation vulnerability ...
0
votes
0answers
44 views

SSH-1 key length

What is the maximum size in bits of one SSH-1 key? 4096? I found some docs where this value is listed and others without limit
0
votes
1answer
92 views

Many websites allow passwords equal to username or e-mail address. Is this not a security risk?

I'm currently testing password policies on websites to get a feeling for what might be an acceptable policy/trade-off that provides good protection for our users without frustrating them. I was ...
0
votes
1answer
90 views

Unexpected text pasted into Excel out of nowhere - hacked? [on hold]

While I was working in Excel, the following text appeared: 108.162.221.65 162.158.75.124 172.68.78.28 162.158.75.124 They are Cloudflare IP addresses that I hadn't copied. My first thought was, ...
0
votes
0answers
31 views

Are there password managers that support a mobile app that returns a password based on a photographed bar code?

The company I'm working for has to manage the passwords of thousands of OT devices. Technicians out in the field must be able to retrieve the passwords that belong to a given OT device in a simple way....
1
vote
2answers
86 views

Should ports be visible to nmap?

I'm currently working on the firewall when I discovered that the firewall exposes a lot of ports outside of the internal network. I discovered this when setting up a new FTP server using a basic nmap ...
0
votes
0answers
15 views

What are the security implications of not using Intel SGX's launch token?

I am currently experimenting with Intel SGX and didn't really understand what the security implications of not using the launch token would be and would appreciate to better understand the rationale ...
0
votes
0answers
24 views

Threat Hunting Observations : Basic Scoring Jupyter Notebook for Running processes on Windows Operating Systems

I am trying to create a scoring Jupyter Notebook created for Windows Processes and I was wondering about what information would I exactly need to generate a basic Score for each process running on a ...
1
vote
2answers
69 views

Is there any advantage to combining a hash algorithm with a key-derivation function?

Let's assume I would like to secure passwords using a modern KDF such as Argon2. The flow of information would look like this: $hash,$salt = argon2id($password, $salt). Is there any advantage to ...
-6
votes
0answers
75 views

bodily harm done from hacking, help! [closed]

Im goingvthrough a divorce. Husband hates me. I have been hacked since my husband and i parted. Im telling you this as i am looking sll over yo find sn answer. I have sustained an actual bodily ...
1
vote
2answers
79 views

When pasting sensitive links or text on Google Chrome bar - does Google store it?

When I paste some links or sensitive information by mistake on the Google Chrome URL Bar, that might trigger a search on Google. Does Google store all of them, including that sensitive information?
0
votes
0answers
27 views

Identify SSL invalid handshake using Wireshark

I am doing a research on "Network flow anomaly detection" and use Wireshark for my work. I have a problem of identifying the packets with invalid SSL/TLS handshakes. Is there a way/algorithm to detect ...
1
vote
0answers
50 views

Fuzzing of Mobile Applications

I have used AFL recently for fuzzing of OpenSSL and it worked great. Now I am interesting in fuzzing mobile applications like I have got some .apk and .ipa files which I need to fuzz. I searched on ...
2
votes
1answer
77 views

How do I scan a WordPress website which blocks WPSCAN from scanning the website?

I am trying to scan a WordPress website with WPSCAN in Kali Linux but an error is happening. Whenever I start the scan WPSCAN runs for 2-3 min and gets paused and after some time and error comes "the ...
0
votes
1answer
71 views

Techniques used by highly sophisticated entities to snoop on VPN or SSH traffic?

It is mentioned in almost every where that very strong agencies, and governments are able to watch the online activity of the people. Aside from techniques like attacking computer networks, and ...
0
votes
0answers
19 views

Does Auth0's free account have a limit on Auth0 Guardian Usage? [closed]

I am developing an application that uses Auth0 for authentication. I want to enable multi-factor authentication using the Guardian application. On the application page it says the following: ...
23
votes
1answer
310 views

Is a password manager better than an encrypted file for storing passwords?

For any passwords other than websites I log into regularly (such as Gmail, Facebook, etc.), I use apg to generate a random 20 character password. I then add that password and a username or email ...
4
votes
2answers
722 views

Why is breach-detection site “Have I Been Pwned” considered safe?

Whether it be due to technology the site is using, or any manual behind-the-scenes work with the data, why does this breach detection site seem to be unquestioningly safe? Wouldn't the data of you, ...
0
votes
1answer
27 views

How to track network file share accesses on workstations

I shared a folder created in my C drive with a colleague over the network and he was able to access it. Is there any log that will track this kind of activity? I am aware of Windows Security Event ID ...

15 30 50 per page