All Questions

0
votes
0answers
32 views

setuid hiajiaking [on hold]

I am doing a pentest a linux machine 32 bits , I have a limited shell and trying to escalate privileges. one interesting that I have found is upload binary inside /usr/local/bin/ hat has SUID ...
8
votes
1answer
107 views

What is the reason for the increase of CVEs since 2017?

According to CVEdetails.com, there were 6447 CVEs in 2016. In 2017 there were 14714 CVEs. That's 128% more than in 2016. Further, in 2018 it became even more with 16555 CVEs. A single peak in one year ...
0
votes
1answer
65 views

Does CCleaner permanently delete temp files?

Can temp files/ history be recovered after being deleted by CCleaner. I used the standard click and delete, I didn’t overwrite the files. If after sometime, will the files overwrite themselves or be ...
1
vote
0answers
42 views

Weak ciphers in TLS VPN

We have a firewall out of our firm network and administrators connect to this firewall by VPN over TLS. Scanning this firewall, the vulnerability scanner get us some warning as the 443 port allow weak ...
3
votes
1answer
26 views

PCI DSS 3.2 SAQ-A for card-not-present mail/telephone orders (MOTO)

What methods of processing payments fit into the definition of SAQ-A for orders made over the phone? I am confused because it says SAQ-A is valid when "All processing of cardholder data is entirely ...
3
votes
2answers
114 views

I received an encrypted email attachment as a reply to a previous conversation, months later

As in the title - I received an email reply to a months old thread containing a password protected zip file. I had previously asked them for a particular CAD file, but this was months ago and we had ...
-2
votes
0answers
37 views

Free S/MIME Certificates [on hold]

where I can get free S/MIME certificates? I tried applying for sectigo/comodo and Its been 3 days and I haven't receive the certificate yet. Also how do I encrypt gmail, without having GSuite.
1
vote
0answers
48 views

Need help in exploiting an overflow on Linux

There is a 32-bit linux application. It's possible to overwrite EIP easily. I will call this process: "send a string". It's also possible to send about 10000 custom bytes to heap (it's possible to ...
1
vote
2answers
57 views

How do I back up YubiKey-backed TOTP authentication?

I bought a YubiKey 5 NFC this week and have started using 2FA and U2F where I can but am deathly allergic to the idea of losing access. For backing up U2F access I'm going to buy a second U2F token (...
-1
votes
0answers
35 views

Can Snort be used as an IDS from outside the network? [on hold]

I am trying to find whether Snort can be used to inspect packets that are directed towards any visible Access Point,and whether it can act as an alerting system depending upon the rules set by us?
1
vote
1answer
46 views

Can the attacker view the response from a CSRF attack request?

In CSRF attacks, the attacker crafts a specific request and convinces the victim to visit the page. I have a doubt in one scenario. Suppose if the victim visits the page, and clicks on the button, ...
0
votes
0answers
4 views

Netcat script for testing HTTP methods with HTTPS [migrated]

I use this script to test which methods are enabled in a server: #!/bin/bash for webservmethod in GET POST PUT DELETE TRACE CONNECT OPTIONS PROPFIND COPY MOVE LOCK MKCOL; do printf "$webservmethod "...
14
votes
5answers
2k views

Why are users tracked? [on hold]

I'm trying to get a well-informed and full picture of why one as a single person should worry about being tracked across sites and uniquely identified. The reasons I can think of are: Serving ads as ...
0
votes
1answer
42 views

How to direct devices by hacking a router changing the DNS settings?

If I hacked a router's admin panel outside my network, is it possible to direct all devices in that network to any website I want by DNS settings? If it is possible, how?
2
votes
1answer
44 views

Server certificate proving client identity

When we look at StackExchange's server certificate (by clicking on the Lock icon), it says: This certificate is intended for the following purposes: Ensures the identity of a remote computer. ...
0
votes
0answers
43 views

Can't understand specific cryptographic based symmetric algorithm, how to solve? [on hold]

I am working on a cryptographic based symmetric algorithm. But before that's, I have to make software code in java for a previous proposed algorithm. The algorithm that's i have to solve looks like: ...
1
vote
0answers
33 views

Does the Steven Black hosts file make ad/tracking blocking browser add-ons unnecessary?

Does using the Steven Black hosts file make ad/tracking blocking browser add-ons more or less unnecessary, since it stops requests to ad/tracking servers at the kernel level? Reasons I can think of ...
2
votes
2answers
79 views

Are some privacy add-ons superfluous when using Tor browser?

If running the Tor browser, should you still have the same privacy add-ons as you would if you were running a "regular" browser? Or will some of them be superfluous because of the built-in ...
0
votes
1answer
50 views

How to track anonomous SMS on your smartphone [duplicate]

I sometimes receive sms from unknown numbers asking me to send money on another unknown number. Is there a way to track the source of such numbers through logs or other technologies or solutions?
-1
votes
1answer
45 views

How do I open port 443 or HTTPS in Windows Server and Ubuntu Server? [on hold]

I am trying to open port 443 on Windows Server 2012 R2 and Ubuntu Server 18.04. I am scanning both of these in zenmap to see if port 443 is opened and it is closed on both of them. I would like for it ...
0
votes
0answers
18 views

Extension language that is sandboxed by design and by default [on hold]

I have a GUI app I wrote for which I've just implemented a very basic mechanism for user-defined extensions written in Guile, a dialect of lisp. I've been studying how to keep this from being a vector ...
0
votes
0answers
28 views

What is the difference between SGX and TPM? [duplicate]

What is the difference between Intel Guard Extensions (SGX) and Trusted Module Platform (TPM)? This answer tells you what the similarities are and what the features are, but not explicitly what the ...
6
votes
1answer
132 views

Username Enumeration in 2018 - How serious is this

I am looking at an application redesign and one of our business team research says that we are not getting or losing customers because they are not able to login. While I don't really care about the ...
-1
votes
0answers
55 views

Microsoft account compromised without any recent activity

I received a notification about my Microsoft account stating that: We think that someone else might have accessed the Microsoft account email@example.com However, when I reset my password and ...
-1
votes
0answers
8 views

Kali_space hard drive [migrated]

I install kali but after installation all of space that Considered for kali filled. I have 100gb for kali but all of this filled. In addition this big file stored in var folder. What i do?
80
votes
5answers
18k views

How to proceed with a white-hat hacker claiming a vulnerability?

I am a security member of a small company which recently got contacted by someone claiming to be a Hackenproof member. They were reporting on our website being indexed by googlebot (metadata, thin ...
1
vote
0answers
34 views

Bot detection without client script

I am working in a small startup and we are looking for Security tools - mostly WAF and Bot Detection (specifically to identify click fraud). Some solutions that integrate client side scripts are ...
1
vote
1answer
38 views

Understanding which privacy tools provide very similar functionality

https://amiunique.org/tools has a list of recommended privacy tools. uBlock Ghostery HTTPS Everywhere Lightbeam AdBlock Plus Disconnect Privacy Badger NoScript Self-destructing cookies However, aren'...
-1
votes
0answers
29 views

How do I go about finding the 'flag' in this QR image? [duplicate]

How do I find the flag in this QR image? After scanning the QR image, I obtain the following text which may be of help: N2QzNjYyMzQ2NDMzMzMzMzM3MzAzNDM0NjEzMzMyNjEzNjM2Mzk2NTY2MzQ2NDMwMzgzODMyMzQz ...
-5
votes
0answers
57 views

Google account password [closed]

How to get Google login password!?? Are there anyway can bypass it!?
1
vote
1answer
49 views

How do I switch appearances with Tor when onion routing is disabled?

If I run the Tor Browser with onion routing disabled at home, obviously my real IP address is sent to the Web servers I'm connecting to, and Web servers and various third parties can make a decent ...
0
votes
0answers
37 views

Can they trace the phone and find the location when it is switched off? [duplicate]

Is it possible to trace a telephone when it is switched off and without a battery and without a sim? And the SIM without being connected to the phone can be traced and located?
0
votes
1answer
35 views

Eval Exploitation Payload

I've got a basic PHP program that runs eval() and I'm trying to exploit it to read a file on the server. The program is: $x=$_GET['x']; $y=$_GET['y']; $z=$_GET['z']; echo eval("echo $x * $y / $z;");...
0
votes
1answer
70 views

Personal or computer information stored in a freshly compiled executable

I would like to know if there is any information that can identify a computer or a person that compiled a program (let's talk only about c++ on visual studio, windows , with no particular library). ...
0
votes
1answer
51 views

TLS certificate decoding

Anyone familiar with certificate decoding? I seem to have 3 more bytes at the end of a certificate than the length indicates. I have 3 certificates in the chain. The first one is 0x645 bytes, ...
0
votes
0answers
80 views

How do I satisfy a requirement to scan text files for malware?

We have a requirement (on our closed network) to scan any file(s) introduced on the system for content that will do something "bad". (Bad is not the exact wording, just the intent.) This started when ...
0
votes
0answers
49 views

could anyone help me to know what kind of password is this? [closed]

User:"$2:fqV'72G[<kABp5{rU^WIiuh~Zk3z*7Fs=3-(E73$" please help me to know my user account in my modem thanks
0
votes
0answers
27 views

Is it possible to direct traffic first to my OS firewall and then to a full tunnel VPN?

I have rules on windows firewall for specific programs that I don't want communicating. I use windscribe's openvpn for perceived anonymity, but more importantly I want the firewall rules followed. ...
0
votes
2answers
65 views

Bruteforce - Using Hydra with JSON

Trying for the life of me to get Hydra to work with a JSON request. General: Request URL: https://api.myapp.app/api/accounts/login/ Request Method: POST Status Code: 401 Unauthorized Remote Address:...
0
votes
0answers
24 views

FIlemaker: passwords' hashes location [closed]

Where does Filemaker store the passwords' hashes of its files when a user has protected them with a password? (location of the hash file)
0
votes
1answer
72 views

Can a CVE be removed from NVD database?

Normally, CVEs are added to the NVD CVE database and never removed. But can a CVE ID just disappear from the database after being there for a while? (Maybe because the entry was a complete mistake, or ...
0
votes
0answers
16 views

How can I allow only authorized devices/users to access a website using Cpanel? [on hold]

Is it possible to give permission to access website for particular user from only offices PC's or mobiles using cpanel CA settings?
0
votes
1answer
36 views

Do systemd-nspawn containers provide the same security guarantees as FreeBSD jails?

I am evaluating the systemd-nspawn containers security and would like to know if the systemd-nspawn containers provide the same security guarantees as FreeBSD jails? Specially, can an attacker escape ...
0
votes
1answer
97 views

Beginning with Kali Linux [closed]

I want to begin learning to use Kali Linux on my own. What could I do to attain expertise with this package of tools. I am a complete beginner and any help on regarding how to practice upon this would ...
49
votes
5answers
8k views

Downsides of showing email address on Android lock screen

My stock Android 9.0 gives me the option of showing some short text message on the lock screen. I want to add my email address here, so people know how to contact me if they find my phone. Are there ...
3
votes
2answers
115 views

How to block WhatsApp traffic in TP Link router? [on hold]

Can anyone tell me how to block Android WhatsApp traffic in a TP Link router?
0
votes
0answers
23 views

Signing JWTs with server's SSL/TLS certificate

I have a server that needs to sign JWTs asymmetrically. I can either generate a new public/private keypair or re-use my keypair used for my server certificate. Is there any concern about re-using my ...
0
votes
1answer
26 views

Do you need to validate compensating controls of a certified organization?

Our web application uses Google's G Suite Single Sign-on for authentication into our application. As part of writing documentation around compensating controls, the PCI DSS requires "Validation of ...
1
vote
1answer
50 views

Free/Inexpensive IP blacklists [closed]

What are some free or inexpensive places where I can grab blacklists automatically? I do not want to have to query for each individual IP. The firewall, PF, requires you to have the IPs or ranges in a ...
2
votes
1answer
75 views

Opera browser: no master password?

I've recently moved from Firefox to Opera (for performance issues). I used to protect my passwords in Firefox with a Master Password. But Opera, so it appears, lacks such feature. I use Debian 9.7 ...

15 30 50 per page