All Questions

0
votes
0answers
6 views

Burst and rebuild pdf to discard eventual embedded malware

This question deals with how to scan, while i am curious if my acrobat reader DC is compromised but in an isolated container and i pull out the pdf. Is it safe to disassemble the pdf by pdftk burst .. ...
0
votes
0answers
3 views

Is Opal-based full disk encryption fully working for Linux?

I'd like to know whether I can realistically use hardware based full disk encryption with Linux, both at start-up after putting the computer to sleep. Ideally I would like it to just work, regardless ...
0
votes
0answers
13 views

What's better when using Qubes-Whonix: Tor -> VPN or just Tor?

I read somewhere that it's unsafe to use VPN with Tor when using Qubes-Whonix. Is that the case? If not, how would one route the Tor traffic through the VPN?
0
votes
0answers
14 views

iStorage DatAshur PRO AES-XTS 256-bit - 15 Digit Pin Time Til Brute Force

I am looking into the above encrypted usb drive, however, my concern is that its only a 15 digit pin of numeric characters, and I am not sure how to do the math on time til brute force... Is a 15 ...
1
vote
0answers
20 views

Is it a security concern to publish the current boot_id?

On linux, a machine comes with a machine_id. From the man page, it is said to be considered as "confidential" and must not be exposed to unstrusted parties. Should the boot_id (from /proc/sys/kernel/...
1
vote
2answers
72 views

Is using weak login credentials always bad?

I am currently using 9 digit numbers to authenticate writers on two apps. In the first app, this unlocks editing tools for use in making content rich dhtml documents which are stored on the local ...
0
votes
1answer
29 views

What should I use to encrypt data between a centralized server and multiple devices running NodeJS?

I have a centralized server and DB that each of my devices polls every ten seconds. The centralized server may respond with a list of "active jobs", which the devices will then run. I need to ensure ...
0
votes
0answers
25 views

Why is generated different traffic for the same attack?

I created a scenario in VirtualBox (configured as internal network) with two machines: Windows XP and Kali Linux. I used ms08_067_netapi exploit from Metasploit and the payload windows/meterpreter/...
0
votes
0answers
35 views

What is the most secured way to store private key on the client's machine

I'm building the equivalent of a blockchain wallet, it is an end-to-end encryption desktop program, the user (client) must be the only one to know his private key, with this private key, he can send ...
0
votes
1answer
27 views

Can I use a normal wifi adapter instead of a alfa card for evil twin attack?

I am new to security and more leaned on application security. But now I learning attacks like the evil twin I need an wifi adapter (correct me if I am wrong ) to do the attack. I live in a remote ...
0
votes
0answers
23 views

Is it possible to log the touch history on the screen of an Android phone?

I have a Samsung running Android 6.0.1. Is it possible to get logs for when the screen was touched in the last hour or so?
0
votes
0answers
17 views

Securing IPC between kernel and user-mode application

We are currently developing a security software for Windows. This application consists of a service running in user mode and a driver in kernel mode. These two need to communicate, so that the service ...
0
votes
0answers
13 views

Using keys inside a secure enclave on a non trusted hardware and OS

Are secure enclaves like intel SGX protected from memory leaks? What if a non trusted privileged user dumps all the physical RAM memory. Is it possible to extract the keys in this way?
0
votes
1answer
29 views

Connection changes after waking from sleep

On Debian, Linux, I am using netstat to monitor connections. After waking my system from sleep, I noticed a change in one of the connections, using port 6667 for irssi (identified by PID). I like to ...
0
votes
0answers
13 views

Deterministic private entropy from OAuth2

On web-cryptocurrency-wallet some users don't want to store private keys for small sums of money and want to authorize via google/twitter. As far as I understand the typical way is to have some sort ...
1
vote
2answers
76 views

How secure is Libra considering Visa and Mastercard are behind it?

Libra, the upcoming crypto currency by facebook which facebook claims is supported by variety of tech companies including but not limited to Mastercard, Paypall and Visa Facebook also enforces real ...
0
votes
0answers
28 views

Unable to intercept android app traffic neither in Burp Suite nor in Network Profiler. Can anyone help?

I need to perform MITM attack on an app which doesn't use HttpURLConnection and OkHttp libraries for network connection. Analysis : Configured burp on the devices, able to capture request of Chrome ...
0
votes
0answers
39 views

How to send wifi configuration from server to mobile?

I am testing Mobile Device Management. Here, the Admin needs to publish WiFi configurations (SSID, Password, Security Type etc.) to the mobile over the air. So what should the approach be of sending ...
0
votes
1answer
29 views

MAC/IP address hiding

I am doing some experiments with wireless protocols on ns3. What I want to ask is how can I hide MAC address/IP address, because I need it for my experiments? Is it possible to use encryption on these ...
0
votes
0answers
19 views

Will ret2plt technique, where libc address is leaked by e.g. puts, not fail if the .got entry contains 0-bytes?

In the ret2plt technique, puts is used to e.g. output its own .got entry after it has been resolved. But won't this technique fail if e.g. the .got entry stores the address 0xffff00ff? In this case,...
1
vote
2answers
86 views

How can a malware retrive victim data without compromising the malware owner?

I was wondering how can malware, for example a keylogger, deliver its data without compromising its owner? Because as soon as you know you got a malicious program running on your computer you could ...
0
votes
1answer
26 views

Securing implicit tokens (Example: Moltin)

I'm fairly new to security but I'm trying to understand how companies have their APIs set. One such case is Moltin's Implicit Token. Basically they provide you with a read-only (for the most part) ...
0
votes
1answer
37 views

Should I use ReCAPTCHA v2 or v3?

I've seen lots of SO posts and other articles on the internet about the differences between Google's ReCAPTCHA v2 and v3, but I'm not sure which one I should use. I'm looking to protect my website's ...
1
vote
1answer
57 views

How long are password hashes stored locally?

Suppose Alice logs into Windows machine M (which is part of an enterprise network managed through Active Directory). My understanding is that M will contact the domain controller to get Alice's ...
0
votes
0answers
42 views

Can I2P traffic be identified?

If one is using Tor, the network administrator or ISP will be able to know that one is using Tor (reference). What about for I2P? If one uses I2P, can the network administrator find out that one is ...
0
votes
2answers
129 views

Does combination of TOR and VPN result in total security and anonymity?

I want absolute anonymity online without anyone being able to track me down or sites I have visited. Are TOR nodes secure? And if you use a VPN would this mean that eventually if someone wanted to ...
0
votes
1answer
81 views

If a vulnerability has no relevant attack vectors, is monitoring still legitimate for a company?

Today while reviewing vulnerability scan results with a colleague, we had a debate about what vulnerabilities can be considered "true or legitimate" and hence worthwhile to spend resources in ...
-2
votes
0answers
23 views

best encryption [duplicate]

what is wi-fi best encryption between aes wep and wpa2 and enterpri
2
votes
2answers
66 views

What's the point of S/MIME?

I received an email recently which displayed as an empty body with a smime.p7m attachment. After some Googling, I discovered it was an encrypted email -- neat! So I started looking for the key. But... ...
0
votes
0answers
35 views

Where are Advanced Hydra Options for http-form-post Documented?

I'm trying to brute force a login page (checklogin.htm) that returns a blank response in the event of a failed login, instead it forcing a browser redirect to a different page (login.htm), passing a ...
1
vote
2answers
74 views

Is it possible to determine the specific version of a website's web server?

I know I can use tools such as BuiltWith and Wappalyzer to find a web app's web server, but is there a way of determining the specific web server's version? The web app I am looking at has a nginx ...
1
vote
0answers
36 views

Encrypting mobile user data in event of PIN/device compromise

As I understand it, modern mobile OS's often encrypt app data when a device is locked with a pin or password. However, how do I protect users if their device or pin has been compromised? If I ...
1
vote
1answer
32 views

Which benefits personal anti-spams bring w.r.t. e-mail provider's ones?

Assuming that an e-mail service provider is using an excellent anti-spam software, for what reason its users should employ a personal anti-spam?
3
votes
1answer
91 views

Safe user input HTML in 2019

(I know this topic has been discussed a lot in the past, and I've read a lot of threads here as well as OWASP, but have additional questions including the specific CSP listed below.) We want to allow ...
-1
votes
1answer
85 views

How do I recover a deleted file too large to go to recycle bin? [on hold]

I mistakenly deleted a very important 50 gb file from my 1 tb hard drive, and the file was too big to go to recycle bin. How do I recover it?
0
votes
0answers
45 views

Malware or virus using all of my bandwidth [on hold]

There is a virus or a malware on my computer. My virus scanner won't pick it up nor malwarebytes. It has come onto my computer in the last couple of days. it sucks up all of my bandwidth. I have ...
0
votes
0answers
33 views

Unable to get information from a PKCS certificate

I sniffed the communication between the client and the server using Wireshark, and I found out that during the handshake session, the client sends its certificate to the server. I've managed to get ...
2
votes
0answers
60 views

How does Logitech Options software automatically launch from a mouse dongle?

I recently purchased a Logitech MX Master 2S mouse. I had no intention of installing the "options software" that came with the mouse. I simply desired a wireless mouse that wasn't cheap and flimsy. ...
-1
votes
1answer
41 views

How to use hashcat on windows 7 ? (GPU problem help please) [on hold]

I am trying to do this video (https://www.youtube.com/watch?v=LIgevN3x8WM) But I have problem on my Dell INSPIRON 3520, I cant use hashcat with MD5 encrypted text. I updated my Intel HD graphics 4000 ...
0
votes
0answers
25 views

What's the impact of UXSS in open redirect vulnerability?

i am well aware of the impact of reflected, dom and stored XSS. Recently i discovered what Universal XSS is and i am a bit confused by it. i know it executes locally in the browser, but is it possible ...
0
votes
3answers
106 views

Whatsapp web security

If I use WhatsApp Web on a computer at work that is connected through a proxy, is there a possibility that they will intercept my messages? I know that, thanks to the proxy, they can see the pages ...
0
votes
0answers
32 views

How to send file with SQLMap

Note: this is a challenge in a past CTF. There is a webapp where you can submit an image that contains some text and the app will run an OCR and search for the text in a database. The app is ...
0
votes
0answers
69 views

Is it safe to download images from the internet? [on hold]

If someone upload infected .jpeg or .png to the site which store pictures, will the malware still work if someone download and view this file?
0
votes
1answer
65 views

Why are js libraries designed to be loaded in iframe?

I am developing a JavaScript library which users would include in their website. a common theme across 3rd party libraries is that they are loaded in a n iframe. (ex you tube) . Is there any specific ...
0
votes
0answers
22 views

Logout User From all Browser When Password is changed except the browser on which password is changed in react.js

I am developing an website in Recatjs and want to restrict user to perform any action once the password is change in any of the browser except on which it has changed. In my case user can change their ...
0
votes
0answers
16 views

One JWT with different levels of permissions

I'm using JSON Web Token's to authenticate users. I have 2 types of tokens: 1/ basic token - no expiry, includes an embedded userAccessId(which is a guid) 2/ advanced token - expiry is 5 mins, ...
0
votes
0answers
29 views

Under which conditions can dllhost.exe spawn child process? | MITRE ATT&CK T1191

I was looking for conditions/circumstances under which Dllhost.exe can spawn a child process. I examined a huge quantity of event logs from various Windows system and didn't come across any event in ...
0
votes
0answers
33 views

Need help in understanding following terms while creating a .PFX file for SSL Installation on Windows IIS Server

Please refer to my previous question Here Having a general-level knowledge in SSL installation, I need to understand following, especially regarding the wild guesses: The error "unable to load ...
40
votes
1answer
6k views

Unusual mail headers, evidence of an attempted attack. Have I been pwned?

Today I found an extremely unusual email in my catchall inbox, without subject sender or content. My Gmail client for android reported the mail was sent by me. I had fear that someone had guessed my ...
-4
votes
0answers
43 views

bluetooth hacking [on hold]

using my android phone paired with my bluetooth speaker I was playing music when unknown songs started to play. I'm assuming it was hacked by one of my many apt. neighbors. how do I stop this from ...

15 30 50 per page