All Questions

3
votes
0answers
31 views

Examples for use of encipheronly and decipheronly bits in the keyUsage field of a X.509 certificate

I am requesting for real life example of using the encipheronly or decipheronly bits together with the keyAgreement bit in the keyUsage field of a X.509 certificate. The RFC 5280 specifies about these ...
8
votes
1answer
112 views

isn't it a security hole that locked tablet/PC lets you change WiFi settings without warning the user?

Certain tablets and PCs, including at least the Kindle Fire and Windows 10 computers, allow you to change WiFi settings even if the device is locked and you don't have the PIN/password. The valid use ...
0
votes
1answer
36 views

Encrypting data as a middleman

I'm working on a financial app that uses Plaid to provide financial data and updates as users spend money. As of right now, I'm using Hashicopr's Vault to encrypt the transaction/bank account data, ...
0
votes
1answer
45 views

Vulnerabilities for Red Team assessment [on hold]

I'm working on my dissertation for my bachelor's degree. I'm trying to create a framework which would make it possible to launch an entire virtual infrastructure, this would then be used to simulate a ...
4
votes
1answer
63 views

Why do cipher suites with message authenticated cipher modes also specify a hashing algorithm

TLS 1.3 specifies these three ciphersuites: TLS_AES_128_GCM_SHA256 TLS_AES_256_GCM_SHA384 TLS_CHACHA20_POLY1305_SHA256 all of them both feature authenticated cipher modes and and a hashing algorithm ...
-3
votes
0answers
52 views

What are the most uncommon/weird wifi hacking methods that are possible? [closed]

the common methods are 1- WPA cracking 2- WPS cracking 3- evil twin
0
votes
0answers
44 views

Windows 10 enable Firewall logging via gpo [closed]

I am working on turning on the domain profile for Windows 10 via gpo. We have a relatively large environment and this has not been turned on for the domain profile in the past. So the current plan ...
8
votes
3answers
647 views

A link redirect to http instead of https: how critical is it?

I just join a project, and while browsing the code, I realize that some links redirect to another web page, in HTTP instead of HTTPS. The linked website has an https version, and there was no reason ...
0
votes
0answers
79 views

XML decryption with private key [closed]

I'm trying to understand how xml encryption is working. As much as I've already learned is that usually encryption.xml states which resources are encrypted + it has CipherValue. Cipher value is a ...
2
votes
1answer
67 views

OAuth: how to prevent phishing with malicious redirect URIs

To quote the OAuth spec: If the resource owner denies the access request or if the request fails for reasons other than a missing or invalid redirection URI, the authorization server informs the ...
2
votes
1answer
65 views

Why are there no free resources on exploit development on macOS? [closed]

There are many resources on Linux exploit development, but I cannot find any resources targeting macOS, except for some bad ones on YouTube. Why are there no write-ups on macOS exploitation ...
0
votes
1answer
52 views

Detect / Prove and Prevent Wifi Deauth attack

I'm suspecting that my neighbor is running multiple Wifi deauth flood attacks against my Wifi. I'm using WPA2 and I don't think he can really crack my password, but my devices keep having wifi ...
0
votes
0answers
29 views

Do I have to use two OAuth/OpenIdConnect bearer token with PKCE?

We have some REST APIs exposed to public applications. Those applications are registered with an (application protocol scheme) redirect URL and we provide to the developer a client secret and client ...
0
votes
0answers
31 views

TLS Robot testing with robot-detect.py script

Has anybody tested TLS Robot Vulnerability in Qualys WAS with robot-detect.py script (https://github.com/devsecur/robot-attack)? How to run the script for on an internal IP if there writing on step 3....
1
vote
1answer
93 views

What are the risks of publicly hosting OWASP Juice shop

For those who don't know it: The Juice shop is an intentionally vulnerable webshop which 'supports' SQL injection, XSS, DoS and all this kind of nasty stuff. It's nice to run on localhost and play a ...
-1
votes
0answers
19 views

Sample dataset for anonymization [closed]

Can you recommend a downloadable dataset that can be used to demonstrate anonymization/deidentification? Preferably with "names" of respondents included.
1
vote
1answer
57 views

Using SUID program to avoid having entries in sudoers

Well, I've done a lot of reading and documentation around possible exploitation of sudoers files and SUID programs, but don't have a deep enough knowledge to pick up the wisest possible solution for ...
1
vote
1answer
43 views

Executing perl scripts without actual file on a cpanel account

Processes with arrows are from same cpanel account let say "charlie" This account was under control of client. Last week this server got blacklisted on emails because client run some perl script to ...
0
votes
0answers
11 views

How to export gpo rules on Windows 10 Pro? [migrated]

I want to export the GPO rules of different sessions to reproduce them on another windows machine. Is this possible?
9
votes
2answers
2k views

How to prevent Firefox and Chrome from opening ports in the firewall?

I have noticed that Firefox and Chrome have opened ports for unsolicited inbound traffic in the Windows firewall. This happened with Windows 7 x64 and Windows 10. (Here, I am talking about the ...
3
votes
2answers
125 views

Can websites uniquely identify users by the sim card used to access the website?

If I was to use a phone's data connection to access a website, and then pop that sim card into another phone to access the same website, could the website tell that I am the same user?
2
votes
0answers
39 views

Format String Vulnerability - Can't read an address from stdin with read() in C

I wanted to exploit this code using format string vulnerability: int jackpot; void fmt_str(void) { char buf[128]; puts("Give me a string to print"); read(0, buf, 128); printf(buf); ...
-1
votes
0answers
39 views

Any way to cache data [closed]

I am looking for a way to cache data if there is no network and resend the data out when there is network. Is there a way to do this? Preferrably with a 4g sim card with internet
2
votes
0answers
84 views

Can someone be tracked in real time 24/7? [closed]

I'm in a situation where I know the person behind this is doing it, but not sure how. It's been over a year and people seem to show up to places that I go to, places that I've told privately and ...
0
votes
1answer
91 views

Can't detect hash type even if I have the password?

I can't found the hash type used in a database hosted in a VM. My hash is c39e02416d974229752c28d7fcefe6e1, and my password is "azerty123456". I noticed that the user table has a column called ...
1
vote
1answer
61 views

Is there a list of open mail relays I can use for a pentest? [closed]

I'm currently pentesing a client (with permission of course) and we are testing their email filtering capabilities. We want to check whether they reject mail coming from open mail relays, but I seem ...
0
votes
0answers
26 views

how to substitute DisconnectHandlers of Joomla?

I am having problems with the exploit **Joomla! 1.0 < 3.4.5 - Object Injection 'x-forwarded-for' Header Remote Code Execution CVE : CVE-2015-8562 , CVE-2015-8566** It doesn't work on Joomla ...
0
votes
2answers
113 views

Can an attacker modify data so that the hashing technique cannot detect the change?

I'm just curious as to if this is possible or not?
4
votes
3answers
158 views

What password policy should a typical web app have?

By "typical", I mean in terms of the value of the data and how hard attackers are likely to try to breach it, as opposed to one that's guarding data sensitive enough that it's worth significant ...
0
votes
0answers
39 views

Is it possible to bypass firewalls and to see or even interact with everything beyond? [closed]

Im having some struggles with firewalls. Is it possible to actually somehow bypass it ( not only with nmap ) and somehow to interact with the services that are closed from outside?
3
votes
2answers
92 views

How to MiTM HTTP/2 Traffic

I recently had to MiTM an HTTP/2 connection over TLS and realized there is no MiTM tool out there that fully supports HTTP/2 over TLS, and no articles/blog posts written about this topic. After ...
1
vote
4answers
93 views

The safest way to transfer files to an offline test environment

I'm wondering what the best tactic is to transfer dangerous files from an internet connected machine to an offline, separated from the web, virtual machine. Why should I do that? Because I want to ...
2
votes
2answers
70 views

Can multiple SAQs be used for PCI compliance?

If we have a SAQ A compliant website for online signups, can we also use SAQ C-VT for phone orders? I'm thinking yes since they're separate payment channels but this aspect is new to me.
3
votes
1answer
134 views

Is there a security difference between GPG signing a file directly or its SHA512SUM file?

I am about to decide what SHA-512 hash sum and / or GPG verification scheme I will choose. Let me present you with two options: Signing the 25 GB ~ 23 GiB (one file fit to a Blu-Ray) directly with: ...
1
vote
1answer
64 views

Could it be possible to diminish the damage of having one's VPS inspected by the host?

I'm planning to run/have some quite sensitive data on a VPS, however, knowing well that the host could at any time access the data (rare but as long as it could happen in theory, I would very much ...
2
votes
0answers
73 views
+50

What security isolation exists between VDI instance to VMware Horizon to ESX?

I read about malware that was able to escape the VM and get to the VMware Horizon host and then to hypervisor ESX, but I am not sure what security controls exist to prevent malware from jumping to ...
1
vote
0answers
55 views

How a browser isolation product is safer than our enterprise-hardened Chrome? [closed]

We have been offered a security product that provides browser isolation but I am not really sure what the benefits could be of such a solution in an enterprise.
0
votes
0answers
59 views

Why is so hard to prevent terrorism that is planned on the deep web? [closed]

It turns out that the shooting that happened in a school in Brazil was planned on the deep web. That makes me wonder why it's so hard to prevent terrorism that is planned there? What security ...
0
votes
0answers
46 views

Google passwords security or lack thereof [closed]

I have been wondering about to what degree the info can be stolen if someone hacks into Google. Suppose an attacker got access to all of Google's data. Let's assume my Google password is good enough ...
1
vote
1answer
38 views

Can PKCS #11 object handles be used across sessions?

The PKCS #11 2.40 spec is a little ambiguous in its description of whether an object handle retrieved using session A can be used in session B to the same token. The main spec states (all emphasis ...
1
vote
1answer
38 views

Decrypting gpg2-symmetrically-encrypted files using non-gpg2 tools

If I encrypt a file using gpg2 and specifying AES256 as my encryption algorithm, can I decrypt it with tools other than gpg2? More generally, does the fact that one tool used AES256 for encrypting a ...
2
votes
1answer
81 views

Is it safe to use a passphrase to seed fernet key generation?

I have a cluster deployment that depends on a Fernet Key to secure some data. The deployment script generates the key with: FERNET_KEY=$(python -c "from cryptography.fernet import Fernet; k = Fernet....
1
vote
1answer
32 views

Handling User Permissions Between Front-end and Back-end

We are trying to come up with a permissions/security implementation on our MongoDB backend/Angular front-end environment that accomplishes what we need it to, without being over-bearing or too ...
1
vote
2answers
93 views

Deriving 2 keys from user password - one for login - one for encryption? [duplicate]

Context We have a browser-based client-server application. The client registers with email and password. The password is enforced to some guidelines. Problem The User needs an encrypted vault on ...
-5
votes
0answers
47 views

How to decrypt the cipher without key? [closed]

How to decrypt: GM3TANJRPM4DANRXGM2F6MJXGQ3TAMJTGYYTOOBV GAWTENZRHA2DQNBSGE3TIMZYL4ZDCMJVGM3DSOL5BI
0
votes
0answers
33 views

Security of PwnedPasswordsDLL / PwnedPasswordsDLL-API [closed]

I love the idea of integrating Active Directory with Troy Hunt's Pwned Passwords so that when users or admins try to set already-compromised passwords then they are rejected and it seems that there ...
1
vote
2answers
103 views

Is accessing by IP address without CA certificate secure?

If my server doesn't have a public domain name, and users access it via IP address, is using a self signed certificate (ignoring the warning) secure enough for https/ sftp? I am talking only from ...
1
vote
1answer
89 views

Insufficient serial number entropy in GoDaddy certificate

I came across this article last night regarding SSL certificates and issues with the serial number not being long enough. Here is a status report from GoDaddy. According to their csv file, our sites ...
26
votes
5answers
8k views

How could a scammer know the apps on my phone / iTunes account?

I received an email with the subject "Your invoice from Apple #xxxxx". It then continues by: "[...] your payment from "Pokemon Go was accepted [...]". That line made me sceptical. I just downloaded ...
0
votes
0answers
9 views

Protecting Linux systems from symlink attacks [migrated]

Linux-based systems are vulnerable to symlink race attacks from unprivileged UID processes. For example, a PHP process can create a symlink to /etc/passwd in a directory where Apache httpd will serve ...

15 30 50 per page