All Questions

-1
votes
0answers
14 views

configure Tableau server OpenAm with OpenID + OAuth2 [closed]

Dears I want to configure OpenAm with OpenID + OAuth2 on tableau server Is some one have experience to configure tableau server with OpenAm?
0
votes
1answer
41 views

access-control-allow-headers: * is being ignored

Although the OPTIONS returns * for Allow-Headers I'm getting the following CORS response. Access to XMLHttpRequest at 'https://example1.com' from origin 'https://example2.net' has been blocked by ...
0
votes
1answer
43 views

Need help in creating a .PFX file for SSL Certificate Installation

I am trying to install an SSL Certificate in IIS on Windows Server. It only accepts the .pfx file format for importing & installing an SSL certificate for hosted applications. I downloaded and ...
2
votes
0answers
101 views

What are the security implications of RAMBleed?

The RAMBleed vulnerability uses Rowhammer induced bitflips to derive contents of memory that it should not have access to. This works with ECC RAM too. It is definitely scary. Is this vulnerability ...
1
vote
1answer
90 views

What is the purpose of using hex escape sequences when writing buffer overflow exploits?

I was trying to overwrite fp function pointer to 0x8048424(win() location) so that function win() will be called to solve this problem(machine is little endian) #include <stdlib.h> #include <...
-2
votes
0answers
84 views

I would like to crack a very mysterious code but have no idea what algorithm it is or who made it [closed]

Here is the text message my friend got, all of which is encrypted in some way. Here is a transcript: V-X4IÖøäV ≡5≡%aQ7oH£ivMÆ7iÖæØ$ ¤Φ:b£fÆìèæ4e¡L#ΨLÆ: ÜΘ¥BÅZ2fUkV-Θ9 DΩ¥ΦøæΔA¤ Sb)Σ:oZéìDX< ph)¥...
1
vote
1answer
50 views

AWS S3 resource access control through IAM permissions or bucket policies?

The way we create buckets in our org and ensure sane ACLs around it is by providing an automated tool (that internally uses Terraform) to provision an S3 bucket. So say when a user requests for a new ...
0
votes
0answers
64 views

What process inside Windows recognizes exploits?

When I try to save a file containing code exploiting a well-known vulnerability (link redirects to an example git-hub code), windows alerts, that a virus was found and a few seconds later, the file is ...
2
votes
1answer
110 views

Car registration paper stolen from glovebox, what kind of scams are possible?

I carelessly left my car unlocked, and it was searched by trespassers in the night. They only took the registration and insurance card (Ohio, United States). This seems strange to me, as these ...
0
votes
1answer
60 views

java script in link href=“javascript:alert(1)”

In an app I am testing they allow to input a domain name, store it, and when they print it on the browser they concatenate "http://" at the beginning of the domain. So, if you input "google.com", then ...
1
vote
1answer
81 views

What's the goal behind signing a CRL with an old certificate key?

I was reading a CPS/CP for a CA, and it mentioned that there's a possibility after rekey that you can still use the old key to sign CRLs of the old end user certificates verified by the old CA ...
0
votes
1answer
117 views

How to prevent contradictions in policies

Some things in policies can be good controls, but the same controls can open up vulnerabilities or can be contradicted by other controls and conditions in other policies. What can be a good measure ...
0
votes
0answers
17 views

How to get public key from private key stored in HSMs [migrated]

I have some private keys stored on the HSM but without public keys. I want to get the corresponding public key using PKCS11 interface. If the private key is a RSA key, I can extract the modulus from ...
2
votes
0answers
25 views

Best luks setup disk [duplicate]

I want to encrypt my disk but I want to know what is the best configuration, I currently use ths: cryptsetup -v --cipher serpent-xts-plain64 --key-size 512 --key-file=- --hash whirlpool --iter-time ...
-3
votes
2answers
134 views

How to prevent police from tracing Instagram account? [on hold]

I created this fake Instagram account on my phone while using TunnelBear VPN without any links to my ‘real’ account. Now I’m wondering if the police are still able to trace my true location? If so, ...
1
vote
1answer
71 views

What are the risks of redirecting my email with Google Domains?

I have bought a domain from Google Domains. One of the features they offer is to redirect all email sent to that domain to any other email address of my choice. Now I'm wondering; is it secure and ...
0
votes
0answers
96 views

“We noticed you’re browsing in private mode.” — how do they know? [duplicate]

I sometimes get messages such as the following from newspapers' web sites (Washington Post and New York Times): We noticed you’re browsing in private mode. Private browsing is permitted exclusively ...
16
votes
4answers
10k views

Is it a good security practice to force employees hide their employer to avoid being targeted?

A young tech company which operates on sensitive data has employees that fall victim to phishing/porting scams despite its best efforts to instill security fobs, vpn, password managers, non-sms 2FA, ...
0
votes
0answers
64 views

Unsafe deserialization from JSON

Seeking any example of exploitable unsafe deserialiazation where the serialized format is json and not some binary format. Even better would be an example where calling a Java constructor of an ...
0
votes
0answers
40 views

NO inspect sqlnet [closed]

I have a firewall that changes packets that arrive on the ingress interface (packets on the egress interface are on a different port). Users see the error message: ERROR: ORA-12592: TNS:bad packet ...
2
votes
2answers
109 views

SPF and Office 365 email accounts spoofing other Office 365 email accounts

After an incident, I have a question which answer's I cannot find. I cannot provide the real headers as they come from a client. Let’s consider a company which uses an Office365 tenant as mail server....
0
votes
0answers
19 views

How rootkits hide a specified process? [duplicate]

I heard that a rootkit can hide itself and specified files, processes, and network links. I know it can set a file to be hidden, but how does it hide a process? Such as, there is a httpd process ...
0
votes
0answers
27 views

How to view sophos antivirus scan results [closed]

I'm using sophos antivirus on the command line (sav-protect) on my Ubuntu 16.04. After running a scan, the software detected "28 errors" and "0 threats". I wanted more information on the scan results, ...
-3
votes
2answers
79 views

What's the main constituent part of botnet?

Is the botnet controlled broiler of servers or personal PCs? We know the botnet can be controlled to DDoS attack, but what's the main constituent part of botnet? I know the botnet's element maybe PC,...
0
votes
2answers
110 views

Identifying a script used for vulnerability scan

The logs of a server are showing a great number of 404 responses in a short time. Apparently somebody used a tool/script to look for known vulnerabilities by combining the server and part of the path ...
0
votes
0answers
34 views

Saved browser login information disappearing [duplicate]

I recently noticed that my browser (Chrome) is not saving my login state for websites anymore. The first time it happened I didn't thought much of it but it happened again and again. I also noticed ...
-4
votes
1answer
57 views

Identifying attackers address? [closed]

I'm analysing this wireshark packet to determine the attack method, victims IP and attackers IP. It's clear that this is a SYN flood DOS attack. What's not so clear (for a newbie like me) is what to ...
0
votes
1answer
181 views

How do I decrypt a .dmg image if I know details about the password?

I encrypted a folder and forgot to save the password. I remember how long I made the password (40 characters) I know the last two characters (40) I don't know the first 38 characters but I do know ...
0
votes
1answer
80 views

Credit card requires scans of drivers license to clear fraud

Someone stole my phone number from Comcast, then my Capital One credit card. I'm fearing identity fraud. I finally fixed the phone but Capital One is requiring me to send them a copy of my drivers ...
2
votes
1answer
163 views

Do video cards store any personal information? Should they be destroyed when getting rid of them?

I realize this question sounds a bit ridiculous but I figured it couldn't really hurt to ask. I am in the process of getting rid of some old computers of mine, and I know that I need to destroy the ...
1
vote
0answers
41 views

Are character passwords on my iPad needed?

I have a 20 character password on my iPad. I've been wondering, do I REALLY need it to be that long? Should I switch to a 6 or even 4 digit numeral password? Or should I just shorten my password? ...
0
votes
0answers
50 views

Hacked iPhone Account [closed]

Since few months, my iPhone is hacked. I accessed links that compromised my phone and whenever, I logged in on an application using my iPhone, another Android device is logging on in the same time. ...
0
votes
0answers
5 views

Is it possible to put my network card into Monitor mode without root privileges [migrated]

I want to put my network card into monitor mode to try out some simple network packet capturing but i need to have root on my user account in order to enable it. is There someway to do this without ...
0
votes
0answers
45 views

IP instead of domain name for non-public web client-server application [on hold]

I am building an infrastucture that needs communication between a client and a server connected to the internet network. It is not a public web application, moreover privacy or any kind of encryption ...
0
votes
0answers
5 views

Would it be possible to run Certbot in the Linux environment for windows? [migrated]

I am running a windows server and am trying to figure out how I am going to add a certificate to my site (that isn't self-signed) and I was wondering if anybody had tried using the Linux Subsystem in ...
2
votes
1answer
51 views

IPsec installed algorithms

What happens if a laptop and a server don't have a encryption algorithm in common? Does IPSec abort the connection or does it always have default algorithms?
2
votes
0answers
62 views

Storing users' private keys to clone git repositories on their behalf

Let's say I have a multi-user application deployed in a customer's data center that needs to clone/update git repositories - both "interactively" when a user is creating a new project (which consists ...
-1
votes
1answer
53 views

Fuzzing with a Quantum computer? [closed]

Are there any projects, solutions, ideas where it is possible to fuzz a software: https://en.wikipedia.org/wiki/Fuzzing using quantum computers, quantum programming? https://en.wikipedia.org/wiki/...
0
votes
0answers
44 views

How safe is it to enable unprivileged user namespace: unprivileged_userns_clone

Linux user namespaces are special, as they play the role of the owner of the other namespaces. Distributions (Debian, Ubuntu, Arch, ...) seem to ship with unprivileged user namespaces disabled. For ...
1
vote
1answer
99 views

Swagger on production APIs

What security issues could arise from leaving the Swagger pages on production APIs that expose sensitive data (albeit secured with OAuth)? Are there web crawlers that look to harvest Open API ...
22
votes
2answers
7k views

Do Veracrypt encrypted volumes have any kind of brute force protection?

I have a 10mb encrypted volume which I made with Veracrypt and was planning to upload it to the internet. I have a pretty strong password but was worried about its protection against brute force ...
22
votes
1answer
3k views

Does a single fopen introduce TOCTOU vulnerability?

I'm actually fixing driver under Linux. Klokwork said that code like: file = fopen(fileName, "w+"); // w+,r,a and any mix of those is used here if (file != NULL) { /* do things*/ } else { /* throw ...
1
vote
1answer
41 views

Why is GRE tunneling is needed when having a BGP based solution against DDoS?

I understand that GRE tunneling is very handy when sending the data back to the client after scrubbing because it's designed to ensure that the data is sent reliably by initiating a private point-to-...
0
votes
1answer
62 views

Is it possible to browse HSTS sites over SOCKS5 proxy?

I am unable to browse HSTS websites using SOCKS5 proxy in chrome browser...getting this error... This site can’t be reached The web page at https://www.instagram.com/accounts/login/?hl=en might ...
0
votes
1answer
170 views

Is security by obscurity / obfuscation a valid option, or do the crawlers have JavaScript enabled?

I'm creating a new website, so I am thinking about how to protect my email address and phone number against crawlers, I actually mean email harvesters (most of which I suppose don't have JavaScript ...
0
votes
1answer
69 views

Is it reasonably possible to enable vulnerabilities via gadget chains?

The meta question here is that I'm trying to understand the risks to multitenant java applications from gadget chains. For example, we're all familiar with the deserialization gadget that allows the ...
0
votes
0answers
32 views

How to overwrite \x00 on the memory address

I'm trying to overwrite a return address by using buffer overflow. 1 #include <stdio.h> 2 #include <string.h> 3 4 void jumphere(){ 5 printf("SUCCESS!!"); 6 } 7 8 int ...
0
votes
0answers
28 views

How to decrypt wifi traffic in realtime and write it to file with Tshark?

I have Wireshark setup to decrypt and display packets in realtime. But I need to have them written to file in realtime also. Someone suggested Tshark, but I can only get it to write to file and not ...
0
votes
1answer
41 views

Bypassing valid certificate requirement for websockets

I'm attempting to connect to a websocket server hosted in C# using SuperWebSockets from a page. The issue is that the websocket server generates a self-signed certificate making it difficult to ...
2
votes
0answers
39 views

2FA options for single yubikey and many hosts

I'm considering using yubikey (5 NFC model) as second factor for couple of Linux hosts. I'm interested in sticking it somewhere in PAM stack, so things like sudo are protected. Most of those hosts are ...

15 30 50 per page