All Questions

4
votes
2answers
723 views

Why is breach-detection site “Have I Been Pwned” considered safe?

Whether it be due to technology the site is using, or any manual behind-the-scenes work with the data, why does this breach detection site seem to be unquestioningly safe? Wouldn't the data of you, ...
0
votes
1answer
27 views

How to track network file share accesses on workstations

I shared a folder created in my C drive with a colleague over the network and he was able to access it. Is there any log that will track this kind of activity? I am aware of Windows Security Event ID ...
2
votes
1answer
58 views

Why is TLS1.2 wrapped in TLS1.3?

I was just curious about TLS1.3 which Cloudflare is one of the companies leading the implementation. I then visited blog.cloudflare.com and turned on my Wireshark. I am not 100% clear about all ...
3
votes
2answers
123 views

How can a client verify that code sent from the server has not been tampered with?

While trying to understand the recent controversy involving ProtonMail, I started to wonder if its possible to verify that the opensource JavaScript being sent from the server to the client hasn't ...
0
votes
0answers
14 views

From a technical perspective, how are popups like this generated on a smartphone? [closed]

I'm a SysAdmin and dabble in code a bit, but I'm not a developer and certainly don't know frontend stuff like this. How are these oh-so-annoying and ubiquitous popups created exactly? HTML5? ...
1
vote
1answer
59 views

Does this attack on RSA keys reveals a major flaw, or this is no big deal with good entropy?

William Kuszmaul published a study of an attack for RSA public keys on his blog https://algorithmsoup.wordpress.com/2019/01/15/breaking-an-unbreakable-code-part-1-the-hack/ The basic idea is, when ...
1
vote
3answers
88 views

When websites use SMS as part of a password reset scheme, why do they ask for the user's phone number?

I've noticed if you do a password reset on iCloud, for example, it prompts you for your phone number before sending the SMS. Since many people already know your phone number, or it may be listed ...
0
votes
0answers
17 views

What security controls that needs to be evaluated for DB2 Mainframe, SQL Server, PostgreSQL, and Guardium application?

I am an Information Security analyst, evaluating the above mentioned applications and looking for a high risk items the requires deeper testing. I would really appreciate guides, books, or anything ...
3
votes
1answer
83 views

Is it a common practice to give a user an unmodifiable password?

I created an online account on a website, they do not ask me for a password but just an email address, then, after acknowledging "terms of service" I was already logged-in. Then I received an email ...
-4
votes
0answers
88 views

I'm being remotely hacked & stalked by a man living about 1,750 miles away for the past 6 years [closed]

First off I know it is him, because he presented a text message I had written to a family member for them to read. When they asked if they could keep the printed copy, they were told no & an ...
1
vote
2answers
31 views

How to view last run shell command via cmd.exe through a HKEY_CURRENT_USER.reg file?

I'm working on improving my security skills and a challenge I have is a .reg file which is HKEY_CURRENT_USER. I need to find what the last run command on the box was.
1
vote
0answers
18 views

Using build time generated, self-signed certs for inter application authentication

I need to be able to authenticate requests between different applications I am responsible for. My company does have CA signed certs, but there are two problem with using it for this purpose. ...
0
votes
0answers
20 views

mod security rule to send email on every trigger

I made a script that reads the log file of the modsec 3 module in apache. It sends an email every 5 minutes with new triggers. I discovered that it is also possible to execute a script (e.g. send ...
-2
votes
1answer
32 views

How to identify the private key encryption algorithm using OpenSSL API? [on hold]

I am creating a C++ application which involves loading in private key files (RSA/DSA/DH) into their respective class containers. Is there an OpenSSL function that can take a file as a parameter and ...
0
votes
0answers
27 views

router/modem bridge mode security [closed]

I thinking about using my TP-Link TD-W8950ND as a modem, by enabling bridge mode and disable the firewall and the DHCP. There is any risk my router/modem will be vulnerable to WAN attacks by doing ...
1
vote
0answers
25 views

openVAS: uninitialized constant OpenVASOMP::OMPConnectionError

I was searching in many forums regarding this issue like here and here, but they were mentioning using port 9390. I launched OpenVAS on port 9390, but I still get the same error. I am using openVAS ...
0
votes
0answers
56 views

What does w.r.t. mean [closed]

What does the abbreviation w.r.t. mean in the context of security and/or cryptology? It's being used the crypto books combined with other terms like: anonymity w.r.t. third parties constant-round ...
1
vote
2answers
117 views

How secure is this schema for Online Licensing System?

I'm trying to make a good licensing system without affecting user's experience and at the same to make it as secure as possible. I know it's impossible to make it 100% secure, but I would like to make ...
29
votes
1answer
2k views

Is the core idea behind CSRF protection that the hacker doesn't know the token value?

I'm trying to fully understand the concept behind CSRF, and more importantly, how to protect against it. Can I assume, using only CSRF, so no XSS or other techniques, a hacker cannot know the value ...
86
votes
6answers
17k views

Is it safe to give my email address to a service like haveibeenpwned in light of the publication of “Collection #1”?

There is a new big case of stolen login/password data in the news. At the same time, I am reading that there are services that let you check if your own login data is affected, e.g. Have I Been Pwned. ...
0
votes
1answer
51 views

Sql injection bypass against KONA(akmai) WAF

I have been trying to find sql injection against a site in bug bounty.I tried a few parameters via sql map.One such query was shown to be injectible. Parameter: query (GET) Type: boolean-based ...
0
votes
2answers
126 views

SQL-injection, unable to get it to work!

I've recently found a SQL-injection vulnerability in one of our web applications. I've been able to exploit this SQLi, but only able to extract some very basic information. I'm not an expert pentester ...
1
vote
0answers
29 views

Most used Linux terminal tools that take passwords as a parameter [closed]

I am writing a tools that basically searches scripts and configurations files for hard-coded passwords. My first approach is to identify the most commonly used Linux terminal applications that can be ...
-1
votes
0answers
16 views

Can be use same public and private keys of cure25519 for x25519 and Ed25519? [on hold]

I want to build system used hybrid Cryptosystem. Thus, I use for key exchange x25519, and I would like to use the same public and private key of the x25519, for Ed25519 digital signature. For example ...
0
votes
0answers
23 views

MITMF takes too long to start [on hold]

When I write the following command, it starts normally without any error but seems to stop at SMB server online. Although I tried keeping it for minutes and realized that it started working after ...
2
votes
1answer
71 views

Problems with this 2 factor authentication implementation

I'm implementing my own 2 factor authentication using SMS. We have a gift card service and the users are sent a link to their gift card. Every time they click on their link, we are verifying it's ...
0
votes
0answers
9 views

ECC protocol practical implementation in python [migrated]

My goal is to code a program for ECC implementation. Right now i am at the basics and i am trying to follow an example found on the internet. I will give the code below. The problem is the after ...
-3
votes
0answers
54 views

How am I writing encrypted language naturally without software/computer [closed]

Ghcgibh. H can cc hc h This is not a joke, should I be concerned? I can use this method to find any information I need, but not necessarily what I want. yjctv yhfhch xt
2
votes
0answers
22 views

How does the “Control Frame Attack” bypass the MAC-Randomization on Smartphones?

In this Study regarding MAC-Randomization of different Smartphone Manufactures on page 15 the so called Control Frame Attack is described. I'm not sure whether I understand this correctly. Are they ...
0
votes
0answers
5 views

Can't log into router after firmware update [migrated]

I have a Motorola WiFi Router setup at home MG7700. After the recent firmware update, I am facing some issues with logging into my WiFi router. Whenever I try to log in to the cPanel of my router, ...
1
vote
1answer
87 views

Detecting USB-based(Arduino Leonardo) attacks

Can a USB-based atack, e.g., BadUSB, RubberyDucky be detected by observing the output from dmesg? I bought a brand new DFRobot Beetle, which is essentialy a miniaturized Leonardo. A few seconds after ...
0
votes
0answers
32 views

Can't Ping other devices on the same LAN [closed]

I'm still new to networking but managed to configure a Mikrotik RB1100AHx2 router to supply internet to our LAN. There is a 24 port switch that some devices are connected to via LAN cables, while ...
0
votes
1answer
31 views

Metasploit Bruteforce Errors [closed]

I use metasploit pro for penetration testing. For one of the servers, i was running bruteforce check. While checking, i received these errors. Can anyone tell me if someone has come across such errors ...
2
votes
1answer
110 views

How does wireless keyboards' encryption prevent frequency analysis?

I've found very little information on this topic after much googling. The only partial answer I found was by Microsoft: Microsoft_AES_Technical_Factsheet By adding random data to each message, each ...
0
votes
1answer
50 views

Is it safe to share an encrypted GPG private key?

I use the pass password manager, and I am trying to come up with a convenient way to bootstrap new machines with access to the git repository. I also have a GPG smartcard (Yubikey) with a different ...
2
votes
3answers
90 views

Returning POST JSON data securely?

I have a webpage (HTTPS encrypted and authorized only via domain credentials) that displays grid information. This grid information is received via a POST request to my server which will send back ...
1
vote
3answers
72 views

How Secure is OAuth2 for Web Applications?

Let’s consider a single page client side application, developed using HTML and Javascript. In this case, even if the implicit or authentication code flow is being used to request Access Tokes, still ...
0
votes
0answers
78 views

How was my Reddit hacked if I use a strong password and 2FA? [closed]

I very rarely use Reddit, I asked like 4 questions there and my account was hacked even though I have a strong password and 2FA, a code generator, not SMS, I received an email saying that my password ...
3
votes
0answers
33 views

Import GnuPG Subkey to other Primary Key

Let's say we have two gpg primary keys "Ident-A" and "Ident-B". There is also a subkey "Sub1" used for encryption by "Ident-A". It is possible to add a subkey "Sub2" to "Ident-B" using the private key ...
1
vote
0answers
8 views

Sending file from Linux to Windows with SCP Comand [migrated]

I know there are allready some threads about this but still none of them helped me to solve my problem. I want to send a simple text file from my Linux machine to my windows 10 pc using the spc ...
0
votes
1answer
62 views

Country Blocking

I use a Meraki firewall and want to block outside attack attempts. Is there a list of countries that are known to be malicious? I want to load them into the system and GEO block them. I know that some ...
0
votes
0answers
43 views

HTML - change text, and save it on the page [closed]

I need to change the content of a webpage. The page URL looks something like this: http://www.url.com/page.htm In the "page source" the code is HTML with tables, paragraphs, links, images. I would ...
1
vote
1answer
59 views

Does the key size have an effect of the size of the public key and signature

If I have a 2048-bit RSA and a 4096-bit RSA key is my signature and public key smaller when I use a 2048-bit key vs a 4096-bit one ? (In bytes)
0
votes
0answers
35 views

Why was I not asked for CVV in amazon.com for my debit card? [duplicate]

I ordered some items in amazon.com .Payment mode was through mastercard debit and I was not asked for cvv. This is the first time i added the debit card though I initially had my credit card details ...
0
votes
0answers
78 views

Snort rule to detect non-TLS traffic [closed]

I am having trouble creating a snort rule that will allow me to detect unencrypted traffic. My goal is to detect any unencrypted traffic. I was thinking to create a rule that if it doesn't match ...
2
votes
1answer
36 views

What is the impact of leaving disabled root key on AWS instance?

I have a user which, when asked to create an IAM root user account, left the now disabled root key on the instance. When asked to remove the root key, he said it's disabled now so what's the ...
0
votes
0answers
47 views

How to make an evil DNS server? [closed]

I want to make an evil DNS server that injects JavaScript code on any requested website even HTTPS. it could be used over WAN via changing the DNS setting on routers. Suggestions for best tool for ...
2
votes
1answer
42 views

Firefox warning: Content Security Policy: Couldn’t process unknown directive ‘require-sri-for’

Why does Firefox tell me Content Security Policy: Couldn’t process unknown directive ‘require-sri-for’ when Mozilla's documentation says they've implemented it? The meta tag Firefox is ...
3
votes
0answers
30 views

SAML - when creating new users, how do I get essential fields?

My company runs a saas product; as we move into enterprise customers, we're getting more and more requests for SSO. I understand the SAML workflow for authentication, and roughly how we'd implement ...
0
votes
0answers
21 views

Windows process documentation for tuning Sysmon

I recently installed Sysmon, which logs events to OSSEC and currently monitors several endpoints. I have been trying to whitelist benign processes such as Windows services. Many of these processes run ...

15 30 50 per page