All Questions

2
votes
0answers
85 views

Hacked Raspberry-pi server

My internet provider doesn't let me open my ports, it's an optional service, and even when they finally said over the phone that I was allowed to open the ports I was still not able to. So I was ...
0
votes
1answer
47 views

Command injection with brace expansion

Does anyone have more experience with bash brace expansions when dealing with command injections that filters whitespaces? I am encountering most likely not a filtering engine, but an bad parsing ...
0
votes
0answers
34 views

XenForo website hacked through PHP shell script

My XenForo forum was hacked today using a PHP shell script. The website is ran on Linux (Ubuntu 18). I'm not too experienced with backend stuff so I apologize if I use the wrong technical names. ...
0
votes
1answer
37 views

Defeating proxy using hosts file

I had somebody say that it would be possible to defeat any http proxy url blocking, "by editing the hosts file and so that some whitelisted site maps to an IP address they control, with a server set ...
0
votes
0answers
35 views

How can I create a self-signed certificate with a custom field? [duplicate]

For experiment, I want to add a custom field in a TLS certificate then validate it. Because it is experiment, it will be a self-signed certificate. I use OpenSSL 1.1.0g and Ubunut 18.04. Any hint will ...
2
votes
2answers
38 views

Is it ok to send plain text credentials in a XHR GET request?

When testing my api server, I often requested the website http://domain.tld/api/?username=john&password=123456 to test things and after a while of course, my browser would autocomplete the url, ...
1
vote
1answer
125 views

What is a spinner (empty while loop) doing, and why?

I've seen that in the latest iOS jailbreak, they use so called "spinners". What exactly is a spinner doing? And why? Apparently it's "blocking the thread execution", but why does the exploit need ...
2
votes
2answers
62 views

Why is OpenSSL verify output depending on source of cert files?

As a test of my TLS/SSL knowledge, I'm trying to verify wikipedia.org's TLS cert. I have downloaded the server-distributed certificate to a file called cert.pem and the root cert (from Globalsign's ...
-1
votes
0answers
39 views

What do I have to learn in order to encode trojan files? [closed]

I'm interested in hacking and viruses and trojans, but the AV always detects them. So I want to learn how to encode trojan files to avoid AV detection. I want to make my own trojan files and viruses, ...
0
votes
0answers
28 views

Does a small max password length indicate there might be a security issue? [duplicate]

Some websites state specific requirements for a password when you create an account. Some are understandable, but in particular the maximum password length doesn't make sense to me. Some websites ...
4
votes
1answer
83 views

How to Best Minimize Damage After Loss of Computer

Myself and the rest of my coworkers on my (former) employer’s dev team were all just laid off from our jobs, and the employer took our MacBook Pros without letting us clear of our personal information ...
0
votes
0answers
18 views

When sharing confidential information, which is more secure share via Outlook vs store on Sharepoint then provide access?

I'm trying to figure out what is good practice and what is more secure for my small team. I wanted to set a standard or governance on how to share confidential information within our team. One person ...
0
votes
2answers
66 views

I know where I downloaded a virus, should I report it somewhere [duplicate]

I was installing pytool forge and accidentally downloaded virus (clicked wrong link). Should I report this link somewhere? Are there plans to create global virus police task force? I am sorry, it is ...
0
votes
0answers
18 views

Security risks in allowing IP phones to easily auto-configure

I wonder what are the main security risks in allowing Voice VLAN ports to provide QoS and most VoIP deployment configurations (via auto configuration) to the phones? Since it's best practice to ...
0
votes
0answers
26 views

How to capture non-HTTP or HTTPS URLs in Burp

I want to intercept URLs except for HTTP and HTTPS, is that possible with Burp Suite? For example, I want to get a response of following URL in Burp Suite: jar:file:///C:/Program%20Files/Mozilla%...
85
votes
5answers
22k views

Can a malware power on a computer?

I've just downloaded and executed a piece of malware on my computer. I don't have much time right now, so I just powered it off (turned it off via the Start menu), hoping that it won't be able to ...
0
votes
0answers
20 views

Cloudflare checking to reach a web site [duplicate]

I recently encountered the message from Cloudflare wanting to check my browser. Can I stop the checking my of browser? It is disruptive to me.
0
votes
1answer
39 views

Is sFTP as a technology acceptable in FedRAMP compliant projects?

I seem to recall that there was some problem with using sFTP in some government environments, but now I need to know if it poses a risk on a FedRAMP-compliant project.
0
votes
0answers
32 views

WAF tuning for SQLi

We have a record tracking application behind WAF. Everytime end users submit a record with special chars such as ' or " or () it blocks it as SQLi even when the payload is completely benign. At the ...
0
votes
0answers
31 views

Monitoring of Logging

I wish to implement logging and auditing features on a Windows 10 client used for carrying out secure transactions through our FTP server, with a client organisation. What all features could I ...
0
votes
0answers
9 views

SSL Encryption with Azure WAF and AKS [closed]

I am currently working on the topic AKS behind a WAF. We already have an AKS running. The requests are already secured by the WAF. Now I would like to encrypt the connection from WAF to AKS and the ...
0
votes
0answers
15 views

Json Web Tokens with anonymous login

I have inherited an app that allows users to buy a gift card, and then see the gift card details after they have bought it. There are 4 main API calls - one to buy the gift card, one to get gift card ...
0
votes
0answers
40 views

How long does it take for law enforcement to link an IP address to a person? [closed]

How long does it take for law enforcement to link an IP address of an ISP in their jurisdiction to the person behind the IP address. Is that a process that happens in minutes, hours or days?
0
votes
0answers
57 views

A method for stopping government interference in software development [closed]

I had received a bad comment about my project but without any explanation. If you too think this idea is bad, please tell me why. Idea: This system tries to avoid software publishers' cooperation ...
3
votes
1answer
83 views

Why does Authenticated Encryption not decrease confidentiality?

Recently, another question here made me start thinking about authenticated encryption. In my understanding AE allows to check whether a key is valid for decryption without even decrypting the ...
1
vote
5answers
92 views

How to stop a request for an external image from exposing my IP to the server hosting the image?

Suppose I have a server A, and that there is a website W hosted on A. The HTML of W contains: <img src=https://www.domainD.com/testT.jpg> Then I have a computer C, that accesses W. Will ...
1
vote
2answers
65 views

Is it legal to store users searches [closed]

Im developing a webshop and i got a task asking for storing users searches. Is it legal? It will be stored in a db with the fields Date, Search text, userId
1
vote
0answers
12 views

How to change cipher & elliptical curve priority/order in Firefox? [migrated]

Bugzilla.mozilla.org dev's suggest this was added a couple of years ago (references below) however I see no information anywhere or any options under about:config to accomplish this... I only see ...
0
votes
2answers
125 views

Safest & Secure Way To Store People's Login Information?

I am looking to create an application that aggregates data from people's online accounts. The application (Frontend made with HTML/CSS/PHP and Backend made with Python) will log into people's ...
1
vote
0answers
39 views

How to whitelist an iframe and script of some other source embeded/ called by an iframe that is whitelisted in the CSP?

For example I am having an iframe with src https://iframe1.com which is listed in my content security policy. If the whitelisted iframe calls some iframe from another source like https://iframe2.com, ...
-3
votes
0answers
45 views

Password Transmitted over Query String [closed]

I developed an web application. I was sending password information on query string. I got a password transmitting over query string warning when security scanning with netsparker. After that i fixed ...
0
votes
1answer
71 views

What's the security concern of browsers using the HTTP CONNECT method?

The XMLHttpRequest spec says that attempted usage of the CONNECT method should throw a security error. Is there a security issue with client-side JavaScript sending CONNECT requests to servers? It ...
0
votes
0answers
39 views

How to anonymize writing style? [duplicate]

Writing styles can be used to identify individuals. What are some tools can anonymize writing styles? The tools are not maintained anymore. It is very difficult to get them work on modern systems. ...
1
vote
0answers
21 views

Is the OAuth implicit flow too insecure for serverless single page web applications?

Assuming the need for OAuth Imagine an application that is: A single page web application hosted on S3 Authenticated using implicit OAuth flow implicit Have the web application access resources ...
3
votes
1answer
55 views

Block Outbound Connections by Country

We want to reduce the number of phishing sites that our users can get to. Would it be useful or more problematic to block outbound connections by geo IP? We already block many inbound connections by ...
0
votes
0answers
42 views

How to store SSN in asp.net web-based application on a short-term basis?

After scouring the web to find countless similar questions, I still find it important enough to ask based on my client's specific requirements. Now I know most if not all are not a lawyer, but if you'...
0
votes
0answers
42 views

PGP file Decryption with gpg command [on hold]

I am trying to decrypt pgp encrypted files. I had both public and private keys and I created two files like pub.key and sec.key and imported them using gpg --import pub.key gpg --import sec.key and ...
2
votes
0answers
44 views

Can ISO 27001 auditors audit their own work?

It may seem that the question in the title is stupid, but it is not. There is a known case of deletion of "Auditors shall not audit their own work" rule in 2015 version of ISO 9001 and the remaining ...
0
votes
0answers
26 views

Enclosed FDE, Bridge & chipset FDE. what is the difference to SED

I was reading hardware based encryption, and found out that they are basically of 3 types. 1) SED - Encryption/Decryption done by the drive circuitry. Unlocked via Pre boot authentication. Can use ...
0
votes
0answers
38 views

How would one register a devices MAC Address to a WPA2 enterprise wifi? [closed]

I am studying abroad and trying to communicate with my tech support to get my device registered on the university wifi, but they do not really listen to what I have to say (either because they do not ...
1
vote
0answers
18 views

How do use ArcSight ESM to monitor powershell logs? [closed]

I have read mixed reviews, our team within our DoD sector suggest that ingestion the logs directly into the SIEM platform would be best and I feel that having a third party tool with signatures, look ...
0
votes
0answers
11 views

What are the risks of running an open resolver using DoT/DoH only?

It's become common knowledge that running an open resolver is a security risk, because your open resolver will be abused with amplification attacks. For amplification attacks to succeed, the attacker ...
0
votes
0answers
38 views

Zero Trust browsing? [closed]

I am looking for a solution that offers something like a Zero Trust framework for browsing and could accommodate 500+ endpoints spread across several different locations
0
votes
0answers
7 views

Passwordless(MFA) login Linux [migrated]

On windows there is Windows Hallo with support for bio-metrics/pin/yubikey/smartphone app. Even if it's not a 1:1 alternative Im looking for something similar. Is there any way to set up multi-factor ...
4
votes
2answers
288 views

Can JavaScript break anonimity provided by Tor?

Some time ago, I was browsing this website over tor. After selecting a location in the menu, it was able to tell me exactly how far away the nearest test centers to my location were, which means it ...
0
votes
1answer
40 views

Can Snort or Suricata *edit* packet on the fly?

I know that they can detect traffic by rules, but can they modify packets on the go? For example, not only detecting HTTP GET but also adding headers to the GET packet. If they can't, is there an ...
0
votes
0answers
6 views

Private RSA vs Openssh key on Cygwin [migrated]

When I generate a key with Cygwin I get a: -----BEGIN OPENSSH PRIVATE KEY----- but I need a: -----BEGIN RSA PRIVATE KEY----- (2048) I use the command: >ssh-keygen -t rsa -b 2048 How do I ...
-2
votes
0answers
41 views

which script language? [closed]

I am very new in this platform and also in cybersec. Can you please tell me which script language is better to learn for understanding and manipulating the metasploit modules? Python, Ruby? Maybe Java ...
0
votes
0answers
53 views

How to perform basic security testing without any tool on Web Application? [closed]

I am new to security testing. I really don't have any idea about security testing ...my senior says you can start security testing without any tool... Here I need clarification, that is it possible to ...
0
votes
1answer
35 views

How to verify if a RADIUS server certificate is really validated on Windows 10?

A RADIUS server has a self-signed certificate for radius.example.com. (There could also be Windows Active Directory Certificate Services PKI, but this should work similarly, shouldn't it?) The self-...

15 30 50 per page