All Questions

0
votes
0answers
6 views

Is there a way to exploit file_get_contents that has a prepended website?

suppose I have the following code that will display an image. The name of the image is supplied by the user as follows: https://example.com/image.php?image=cat.jpg My image.php file contains $...
0
votes
0answers
11 views

Can you give me tips about bWAPP HTML injection on high level security?

I apologize if the question is not correct but I am trying to perform a HTML injection oh my buggy web app (bWAPP). So far I made it on low and medium level but I am really struggling with high ...
2
votes
1answer
7 views

Insecure Direct Object Reference - Change email from client end

I am testing a website that has "Forgot my password" functionality. If user clicks that, his email address will be displayed as a hyperlink. If that is clicked, an email to reset password will be ...
0
votes
2answers
103 views

How does this spyware intercept my https traffic? [duplicate]

The firm I'm working for has installed a "spying" software on my computer which intercepts my https traffic. No hard to understand how it works, it's something like mitmproxy, which signs on the fly ...
0
votes
0answers
13 views

SQL injection in Go with database/sql lib

Is it possible to inject SQL statements with fmt.Sprintf instead of Db.qwery with the ? and not %s parameter? I know it's a bad habit to use it but I wonder if it's possible or not. Example : query :...
1
vote
0answers
13 views

Can a self-root certificate spy on me without a vpn or proxy on iOS?

Can a self-root certificate (implemented via mobile configuration) spy on me without a VPN or proxy on iOS?
1
vote
0answers
15 views

Security on a wireless mouse with its two drivers

When I put my wireless mouse receiver on an USB port, hid-compliant keyboard as well as hid-compliant mouse driver are automatically installed. It is Microsoft wireless mouse 1850, which is not a ...
0
votes
0answers
11 views

why does my simple 0x86 shellcode execve not do anything?

I'm just starting to learn execve command, so I'm sure this is a very easy mistake, but I've stuck on this for hours, so any help or hints would really be appreciated, my code is as follows: section ...
-1
votes
0answers
18 views

How can i check my phone for being tracked and other spyware

I feel like my phone is being monitored/tapped as it keeps glitching out and other abnormal symptoms. How can I check/remove these unwanted programs?
-2
votes
1answer
76 views

how does DNS cache snooping work?

I've seen there are programs for pentesting, such as FOCA, that provide tools for DNS snooping. The part I don't understand is how can we know the DNS server an organization is using. Also, from what ...
1
vote
1answer
68 views

How to verify Diffie Hellman uses a “Safe” prime

I'm the developer for a web application that was recently pen tested. One of the vulnerabilities reported from the pen test is that our server uses an unsafe Diffie-Hellman prime in our key exchange. ...
0
votes
0answers
10 views

SQL injection in Go [on hold]

Is this code vulnerable to SQL injection (Golang) ? i tried to use the database/sql lib with the "?" properly. If yes how to improve my code ? func (dab *DbAuthenticationBackend) Authenticate(ctx ...
0
votes
2answers
148 views

Getting the column names of a table by brute force blind SQL injection

Is there a way of getting the column names of a table by brute force blind SQL injection in MySQL. so the query would be: select column_name from information_schema.columns WHERE table_name = ‘...
0
votes
0answers
11 views

macOS 'Preview' Executables Blacklist [migrated]

Does the preview application which comes native with macOS have a blacklist, which prevents the launch of common executable types (similarly to adobe reader which prevents .exe .js etc. files to be ...
0
votes
0answers
28 views
+50

Invalidate API tokens when LDAP user is invalid

I'm using oauth2 and LDAP for authorization and authentication of an API. Authentication flow is given below. User sends LDAP username and password (with password grand type) to the server. Server ...
0
votes
1answer
27 views

TLS downgrade attacks

I'm currently looking at e-mail security and wondered whether server to server e-mail communication that enforces TLS, will prevent the risk of TLS downgrade attacks?
4
votes
2answers
3k views

Is Plaid, a service which collects user’s banking login information, safe to use?

I recently signed up for Privacy.com, which uses a service called Plaid to link a bank account. To do this, it requires the user to provide their banking username and password to a webpage from Plaid,...
0
votes
0answers
25 views

Local account authentication protocol [on hold]

I know that in a Windows Domain environment, there are two ways to authenticate users: NTLM and Kerberos. But, in a non-Domain environment, what is the protocol that takes place when trying to ...
0
votes
0answers
9 views

A hidden file in some pdf ebook downloaded from internet? [migrated]

I downloaded a pdf ebook and ran a quick scan using the Windows Defender. It reports: 0 threats found. Scan lasted 1 seconds. 2 files scanned. However, I only scanned that one pdf file. Does this ...
1
vote
0answers
25 views

Trying to understand Content-Security-Policy: Why do some sites (e.g Google) use a “nonce”, but also allow all inline scripts and use of eval()?

Here is an example of the CSP of accounts.google.com: content-security-policy: script-src 'nonce-DanEwkxkS1rktq35Z1hVcg' 'unsafe-inline' 'unsafe-eval';object-src 'none';base-uri 'self';report-uri /...
2
votes
0answers
64 views

Does the use of pepper for passwords violate Keckhoffs's principle? ​

Kerckhoffs's second principle: "It should not require secrecy, and it should not be a problem if it falls into enemy hands." Does the use of a pepper for passwords violate this principle, since ...
0
votes
1answer
35 views

What CA signed my certificate?

I'm trying to set up a Docker image that has our internal CA certificates installed so that users across the organization can make secure requests to intranet sites. We have a few different CAs that ...
-1
votes
0answers
18 views

b7c81.rbf file? Is it dangerous? [on hold]

I started the computer as usual but I noticed of a weird process in the task manager, the file was called b7c81.rbf and when I looked its properties, it said that it was from a Config.msi file (or ...
0
votes
0answers
29 views

Windows Firewall - How do I know that I have completely blocked a program?

I have a specific software that I cannot let out to the internet but it is crucial that it has access to the local network. I can create an inbound and an outbound Block rule for the main application'...
1
vote
1answer
50 views

Information leakage through json response

I am testing a product survey website. As a response to getSurveyResults() call, the following details of all survey participants shall be displayed to all website users. Nick name Location Rating ...
0
votes
2answers
50 views

Windows - How to restrict access to VBScript.dll and JScript.dll?

In a recent blog post from a company called Recorded Future, which specializes in data protection, details were provided on commonly exploited vulnerabilities on the Windows platform. Recorded Future ...
0
votes
0answers
10 views

Are JNLP connectors safe? How can I configure Jenkins to install it safely?

Is there a modification I can make to these installation arguments to make a Jenkins slave installation more secure... java -jar agent.jar -jnlpURL https://myserver/computer/myslave/slave-agent.jnlp -...
1
vote
2answers
67 views

Work internet redirecting to Twitch?

When connecting my laptop with the work LAN, I noticed that certain websites get redirected always to a twitch channel. I have changed the DNS configuration and used 8.8.8.8 and 8.8.4.4, but the ...
1
vote
0answers
18 views

VPN encryption per device

When you use the same VPN on several devices, if one device is compromised/hacked, can it be used to decrypt the traffic of the other device using the same vpn? Or does it weaken the encryption of the ...
-2
votes
1answer
59 views

how to decode this request [on hold]

I need help for this. I got a request but I don't know what can I do: GET http://localhost/xor.php?plaintext=cipher=%00%00%1D%10%1A,%06%05%16%16%0D%12%0B%3A9%5DRT%06YVD HTTP/1.1 Full request : https:...
0
votes
0answers
59 views

How do I assess the difficulty of brute-forcing combinations of some public information?

I'm designing a piece of software whose information will be public, but I'm wondering how resistant this information might be to external analysis, without using any specific security mechanisms to ...
0
votes
1answer
45 views

How to crack AES-based Kerberos TGS tickets (Kerberoasting)?

All material I can find is related to RC4-based Kerberos TGS tickets, since these are easier to crack to obtain the service account's password. However, I want to attempt to crack AES-based Kerberos ...
4
votes
4answers
2k views

CISCO IOS service password-encryption

In Cisco IOS there's the service password-encryption command to encrypt all passwords in the config file to prevent unauthorized individuals from viewing them. quoting from http://www.cisco.com/c/en/...
0
votes
0answers
25 views

SQL Server, aes_256 without salt [on hold]

I need to used an agnostic encryption. Is it possible to use encryption in SQL server 2017 column? and how do I disable the salt in with aes_256?
1
vote
2answers
169 views

Best way to know the algorithm used for a password encryption

I have the following password captured using sqlmap- $2a$08$9eaKUtKdFV8fuOAx0sfr4emrG1aHzGeNsn/rVdW243nw6Ktt.Uc0O Now, I don't know how to decrypt this password because I don't know which ...
0
votes
1answer
28 views

Reflected XSS which only displays in the input [on hold]

I am trying to execute an XSS in an HTTP GET request,but it just displays the input without running the script. I checked in BurpSuite and I see it added my input to referer: url and then my input. ...
0
votes
0answers
26 views

how to disable the Windows key and ctrl and alt keys? [on hold]

It's for security purpose on a supervisory Windows 10 Pro client.
51
votes
2answers
12k views

Is this Paypal Github SDK reference really a dangerous site?

I'm working on integrating a payment system with paypal in C#, and I installed the official paypal nuget package. Then I went to the paypal github site. And linked to this below site (SDK Reference). ...
1
vote
0answers
26 views

Key reinstallation attack how does it work without a pre-shared key?

The author of the key reinstallation attack released scripts on Github to test AP and clients. To test the clients, you have to connect to a fake AP but you still need to know the pre-shared key. Of ...
0
votes
0answers
13 views

How to intercept AD authentication attempts [on hold]

My work Windows account keeps locking and the unlocking process is frustrating (you have to call the HelpDesk to request them account unlocking). They don't have any type of log and so they can't help ...
-1
votes
0answers
41 views

Should KYC considered as cyber a security possible threat? [on hold]

Seems like there is a lot of confusion since there is compliance for this, so not sure if KYC can also be considered as cyber security threat. More info on KYC: https://en.wikipedia.org/wiki/...
1
vote
0answers
30 views

If only getting and storing BIN part of credit card number, should I comply with any PCI (or other) specification?

I have a fraud detection system. In my system I do not process or store credit card number (or any other payment method). I also don't process or store any personal information (don't get user name / ...
0
votes
1answer
73 views

Login Password not encrypted

So, I was just playing with BurpSuite when I found something I didn't understand. When using BurpSuite on banking websites, I see that after I supply the credentials, the form transmits an encrypted ...
-1
votes
0answers
48 views

I just found out that my port 53 is opened [on hold]

My phone has been taken over. Pretty much nothing works. I can see a lot of odd traffic coming and going. Try to reboot and reset and it won't let me. It always returns the bootloader they have placed....
0
votes
1answer
72 views

For a cipher school challenge I need help breaking this cipher [on hold]

[CIPHERTEXTSTARTS]HI wsndtonInehbihs if at t iyoncniegtrf .e noionbpni y,iu.w ahoui hs hroyh!euecsy m.ot ew hrc hb;ntsresnmdma ipMsat ln ts , ryiceg ensh c n byr t k t oe de uhw stiytoer s ...
0
votes
0answers
27 views

Finding images with high white content [on hold]

I have a large amount of mixed-content images that also contain some scanned documents. I want to filter out potential documents automatically by defining some lower bound of "whiteness" that ...
-1
votes
0answers
18 views

What mechanizm of updating Last-Logon attribute in AD?

What mechanizm of updating Last-Logon attribute in AD? I suppose that its value update not just when user login (write user\pass ang login into windows? and then we whach it into AD) but plus in some ...
54
votes
8answers
15k views

How are passwords stolen from companies if they only store hashes?

Everywhere I look it says servers store passwords in hashed form, but then you have those breaking news about hackers stealing passwords from large companies. What am I missing?
0
votes
0answers
18 views

Authentication on B2B server-to-server using mutual TLS considered to be a recommended solution?

Bunch fintech are doing business with each other (B2B) sharing user info that considered sensitive, we researching online I saw mutual-TLS server-server used two different businesses as solution but I ...
2
votes
1answer
46 views

What is MITM attack in terms of implementation?

When I search for MITM in the google most of the results say an unauthorized person positions himself in a conversation between two authentic users for malicious reasons, and there are several types ...

15 30 50 per page