All Questions

0
votes
0answers
2 views

Is there a way to exploit file_get_contents that has a prepended website?

suppose I have the following code that will display an image. The name of the image is supplied by the user as follows: https://example.com/image.php?image=cat.jpg My image.php file contains $...
0
votes
0answers
8 views

Can you give me tips about bWAPP HTML injection on high level security?

I apologize if the question is not correct but I am trying to perform a HTML injection oh my buggy web app (bWAPP). So far I made it on low and medium level but I am really struggling with high ...
1
vote
1answer
6 views

Insecure Direct Object Reference - Change email from client end

I am testing a website that has "Forgot my password" functionality. If user clicks that, his email address will be displayed as a hyperlink. If that is clicked, an email to reset password will be ...
1
vote
0answers
11 views

Can a self-root certificate spy on me without a vpn or proxy on iOS?

Can a self-root certificate (implemented via mobile configuration) spy on me without a VPN or proxy on iOS?
0
votes
0answers
11 views

SQL injection in Go with database/sql lib

Is it possible to inject SQL statements with fmt.Sprintf instead of Db.qwery with the ? and not %s parameter? I know it's a bad habit to use it but I wonder if it's possible or not. Example : query :...
1
vote
0answers
12 views

Security on a wireless mouse with its two drivers

When I put my wireless mouse receiver on an USB port, hid-compliant keyboard as well as hid-compliant mouse driver are automatically installed. It is Microsoft wireless mouse 1850, which is not a ...
0
votes
0answers
9 views

why does my simple 0x86 shellcode execve not do anything?

I'm just starting to learn execve command, so I'm sure this is a very easy mistake, but I've stuck on this for hours, so any help or hints would really be appreciated, my code is as follows: section ...
-1
votes
0answers
15 views

How can i check my phone for being tracked and other spyware

I feel like my phone is being monitored/tapped as it keeps glitching out and other abnormal symptoms. How can I check/remove these unwanted programs?
0
votes
0answers
10 views

SQL injection in Go [on hold]

Is this code vulnerable to SQL injection (Golang) ? i tried to use the database/sql lib with the "?" properly. If yes how to improve my code ? func (dab *DbAuthenticationBackend) Authenticate(ctx ...
0
votes
1answer
25 views

TLS downgrade attacks

I'm currently looking at e-mail security and wondered whether server to server e-mail communication that enforces TLS, will prevent the risk of TLS downgrade attacks?
0
votes
0answers
11 views

macOS 'Preview' Executables Blacklist [migrated]

Does the preview application which comes native with macOS have a blacklist, which prevents the launch of common executable types (similarly to adobe reader which prevents .exe .js etc. files to be ...
0
votes
0answers
9 views

A hidden file in some pdf ebook downloaded from internet? [migrated]

I downloaded a pdf ebook and ran a quick scan using the Windows Defender. It reports: 0 threats found. Scan lasted 1 seconds. 2 files scanned. However, I only scanned that one pdf file. Does this ...
1
vote
0answers
24 views

Trying to understand Content-Security-Policy: Why do some sites (e.g Google) use a “nonce”, but also allow all inline scripts and use of eval()?

Here is an example of the CSP of accounts.google.com: content-security-policy: script-src 'nonce-DanEwkxkS1rktq35Z1hVcg' 'unsafe-inline' 'unsafe-eval';object-src 'none';base-uri 'self';report-uri /...
0
votes
1answer
35 views

What CA signed my certificate?

I'm trying to set up a Docker image that has our internal CA certificates installed so that users across the organization can make secure requests to intranet sites. We have a few different CAs that ...
-1
votes
0answers
18 views

b7c81.rbf file? Is it dangerous? [on hold]

I started the computer as usual but I noticed of a weird process in the task manager, the file was called b7c81.rbf and when I looked its properties, it said that it was from a Config.msi file (or ...
0
votes
0answers
28 views

Windows Firewall - How do I know that I have completely blocked a program?

I have a specific software that I cannot let out to the internet but it is crucial that it has access to the local network. I can create an inbound and an outbound Block rule for the main application'...
0
votes
0answers
10 views

Are JNLP connectors safe? How can I configure Jenkins to install it safely?

Is there a modification I can make to these installation arguments to make a Jenkins slave installation more secure... java -jar agent.jar -jnlpURL https://myserver/computer/myslave/slave-agent.jnlp -...
0
votes
2answers
48 views

Windows - How to restrict access to VBScript.dll and JScript.dll?

In a recent blog post from a company called Recorded Future, which specializes in data protection, details were provided on commonly exploited vulnerabilities on the Windows platform. Recorded Future ...
1
vote
1answer
50 views

Information leakage through json response

I am testing a product survey website. As a response to getSurveyResults() call, the following details of all survey participants shall be displayed to all website users. Nick name Location Rating ...
0
votes
0answers
25 views

SQL Server, aes_256 without salt [on hold]

I need to used an agnostic encryption. Is it possible to use encryption in SQL server 2017 column? and how do I disable the salt in with aes_256?
2
votes
0answers
63 views

Does the use of pepper for passwords violate Keckhoffs's principle? ​

Kerckhoffs's second principle: "It should not require secrecy, and it should not be a problem if it falls into enemy hands." Does the use of a pepper for passwords violate this principle, since ...
0
votes
1answer
28 views

Reflected XSS which only displays in the input [on hold]

I am trying to execute an XSS in an HTTP GET request,but it just displays the input without running the script. I checked in BurpSuite and I see it added my input to referer: url and then my input. ...
0
votes
0answers
24 views

Local account authentication protocol [on hold]

I know that in a Windows Domain environment, there are two ways to authenticate users: NTLM and Kerberos. But, in a non-Domain environment, what is the protocol that takes place when trying to ...
0
votes
0answers
26 views

how to disable the Windows key and ctrl and alt keys? [on hold]

It's for security purpose on a supervisory Windows 10 Pro client.
1
vote
0answers
26 views

Key reinstallation attack how does it work without a pre-shared key?

The author of the key reinstallation attack released scripts on Github to test AP and clients. To test the clients, you have to connect to a fake AP but you still need to know the pre-shared key. Of ...
0
votes
0answers
13 views

How to intercept AD authentication attempts [on hold]

My work Windows account keeps locking and the unlocking process is frustrating (you have to call the HelpDesk to request them account unlocking). They don't have any type of log and so they can't help ...
1
vote
2answers
66 views

Work internet redirecting to Twitch?

When connecting my laptop with the work LAN, I noticed that certain websites get redirected always to a twitch channel. I have changed the DNS configuration and used 8.8.8.8 and 8.8.4.4, but the ...
0
votes
1answer
43 views

How to crack AES-based Kerberos TGS tickets (Kerberoasting)?

All material I can find is related to RC4-based Kerberos TGS tickets, since these are easier to crack to obtain the service account's password. However, I want to attempt to crack AES-based Kerberos ...
1
vote
0answers
30 views

If only getting and storing BIN part of credit card number, should I comply with any PCI (or other) specification?

I have a fraud detection system. In my system I do not process or store credit card number (or any other payment method). I also don't process or store any personal information (don't get user name / ...
0
votes
0answers
27 views

Finding images with high white content [on hold]

I have a large amount of mixed-content images that also contain some scanned documents. I want to filter out potential documents automatically by defining some lower bound of "whiteness" that ...
0
votes
1answer
73 views

Login Password not encrypted

So, I was just playing with BurpSuite when I found something I didn't understand. When using BurpSuite on banking websites, I see that after I supply the credentials, the form transmits an encrypted ...
-1
votes
0answers
18 views

What mechanizm of updating Last-Logon attribute in AD?

What mechanizm of updating Last-Logon attribute in AD? I suppose that its value update not just when user login (write user\pass ang login into windows? and then we whach it into AD) but plus in some ...
0
votes
0answers
18 views

Authentication on B2B server-to-server using mutual TLS considered to be a recommended solution?

Bunch fintech are doing business with each other (B2B) sharing user info that considered sensitive, we researching online I saw mutual-TLS server-server used two different businesses as solution but I ...
-1
votes
0answers
48 views

I just found out that my port 53 is opened [on hold]

My phone has been taken over. Pretty much nothing works. I can see a lot of odd traffic coming and going. Try to reboot and reset and it won't let me. It always returns the bootloader they have placed....
2
votes
1answer
46 views

What is MITM attack in terms of implementation?

When I search for MITM in the google most of the results say an unauthorized person positions himself in a conversation between two authentic users for malicious reasons, and there are several types ...
1
vote
0answers
23 views

OpenAppID with Snort on pfSense

I'm using OpenAppID with Snort on pfSense, it actually work but when I view some script detector, it just detect by http pattern, which I can replace by using snort rule (with "content" option). So ...
-1
votes
0answers
41 views

Should KYC considered as cyber a security possible threat? [on hold]

Seems like there is a lot of confusion since there is compliance for this, so not sure if KYC can also be considered as cyber security threat. More info on KYC: https://en.wikipedia.org/wiki/...
0
votes
1answer
25 views

Are there any chrome extension VPNs that use the chrome.vpnProvider API? [on hold]

Seems most extensions use the old proxy api which requires giving them full "read and change site data" access. A more recent API is available made for VPNs: https://developer.chrome.com/extensions/...
0
votes
1answer
72 views

For a cipher school challenge I need help breaking this cipher [on hold]

[CIPHERTEXTSTARTS]HI wsndtonInehbihs if at t iyoncniegtrf .e noionbpni y,iu.w ahoui hs hroyh!euecsy m.ot ew hrc hb;ntsresnmdma ipMsat ln ts , ryiceg ensh c n byr t k t oe de uhw stiytoer s ...
1
vote
0answers
17 views

VPN encryption per device

When you use the same VPN on several devices, if one device is compromised/hacked, can it be used to decrypt the traffic of the other device using the same vpn? Or does it weaken the encryption of the ...
1
vote
1answer
37 views

Custom Suricata's HTTP alert isn't triggered when using “..” as part of the scanned uri. Why? [on hold]

I have a doubt with a Suricata custom rule. If I do: alert http any any -> any 80 (msg:"blabla"; content:"abc"; http_uri; sid:1000000;) I can get requests to http://x.x.x.x/abc uri in fast.log ...
1
vote
1answer
68 views

How to verify Diffie Hellman uses a “Safe” prime

I'm the developer for a web application that was recently pen tested. One of the vulnerabilities reported from the pen test is that our server uses an unsafe Diffie-Hellman prime in our key exchange. ...
0
votes
0answers
28 views

Need to encrypt RTSP over LAN

I tried googling everywhere, but got no help with what I needed specifically. Let's say I have several IP cameras on a local area network. This LAN will NOT be connected to the Internet. The IP ...
1
vote
1answer
41 views

Remote detection of spring framework

I would like to know if there is a remote way to understand if a web app uses the Spring framework. In particular Spring security. Is there any kind of analysis on HTTP headers that can provide ...
1
vote
0answers
60 views

Is zeroing out values on the stack and arguments overkill?

I generally zero out memory the moment it's served its usefulness, but only with heap-allocated chunks. Is it a sin (or overkill) to do the same with arguments and stack values? Thanks in advance. ...
0
votes
2answers
64 views

Account Recovery: Displaying username without verification

I'm not a security guy, so bear with me. As discussed in other topics, usernames in and of themselves are valid forms of verification, and there's nothing particularly sensitive or secure about ...
1
vote
0answers
54 views

XSS stored in DVWA

Trying "XSS stored in DVWA" and now I am completely confused. It is not letting me bypass, I tried many inputs and I know what the preg_replace() is doing still nothing seems to work for me. I used ...
1
vote
1answer
37 views

OPC-UA Certificate Handling

I am currently developing and extending an OPCUA-Server based on "node-opcua". The next steps would require to add certificate handling and that's also the point that makes me the most problems. My ...
0
votes
2answers
68 views

What does “This request does not comply with Chrome's Certificate Transparency policy.” in Chrome's Security Tab mean?

When you open up Chrome's DevTools and switch to the Security Tab you'll see the message This request does not comply with Chrome's Certificate Transparency policy. on some origins. (Example: https://...
1
vote
0answers
46 views

Is there any key in HKEY_CURRENT_USER which sad when user was login on pc?

Try to find information about user login time. Has no any events for searched time saved in windows security events. Thing that maybe registry can help me for that. Is there any key in ...

15 30 50 per page