All Questions

-1
votes
2answers
100 views

How does a hacker get access to my files if he got access to another user's files on a shared server? [closed]

I host files on a shared server with Ubuntu 14.04. How does a hacker get access to my files if he got access to another user's files and how do I prevent it?
4
votes
1answer
68 views

API pentesting for mobile and web. What's the difference?

So, I have to pentest an API that is both used by a web app and two mobile apps (Android and iOS, obviously). My question is: do I have to test three times (i.e., for each app) or just once (since it'...
0
votes
1answer
156 views

Is it possible to install a hardware key logger in iPhone?

I took my iPhone to a repair shop today to get the broken screen repaired. It was not an Apple shop but typical kiosks you see in shopping malls. Post the screen install things work fine but I am a ...
23
votes
3answers
6k views

How to bypass password on Windows XP account?

I have an old ThinkPad R40 family laptop running Windows XP lying around and there's an account on it that has a password and it gave me a hint and I put everything I could possibly think in there and ...
11
votes
5answers
3k views

Are variable time comparisons always a security risk in cryptography code?

I came across the cryptography python package, and noticed it had the following about reporting security vulnerabilities: Examples of things we wouldn’t consider security issues: Using a variable ...
0
votes
0answers
57 views

Is there a cleaner way to save a copy of an object (with its data) for access throughout the application than making it global?

The framework is WordPress. There's a thing such as "filters". Filters are, more or less, global variables but without the stigma, the way they work is: you give the filter a name and what you want to ...
0
votes
0answers
44 views

Who / what has access to delete cookies?

I'm experiencing an odd issue lately where I'm frequently being logged out of YouTube, but not from other Google services. Upon further investigation, it looks like the SID cookie which is used to ...
0
votes
0answers
59 views

What “stability and security will suffer” by using a browser with the --no-sandbox flag?

Starting Brave browser (on linux manjaro) shows a “You are using an unsupported command-line flag: --no-sandbox. Stability and security will suffer.” message. Reading the support forums it seems that ...
0
votes
1answer
63 views

Icon on desktop

I was doing some work when I noticed new icon on my desktop called "sl_files". I couldn't help but open it. It contains CSS files, and there is some recognized as .download files. It has pictures of ...
0
votes
0answers
33 views

Assess anti-malware detection techniques

Are there any known, conventional, ways of assessing the types of detection techniques an endpoint security product might employ? I know AV-Test and AV-Comparatives exist to test the effectiveness of ...
0
votes
1answer
56 views

Is my checkNumber() function secure?

function checkNumber(number) { event = document.all ? window.event : number; key = document.all ? event.keyCode : event.which; window.event.keyCode if(key<48||key>...
0
votes
1answer
43 views

How secure is pgAdmin to save database password?

When we are creating a new connection with pgAdmin, we are presented with an option to save the password into our computer, so we won't have to retype it every time we want to connect with the ...
-1
votes
0answers
39 views

What do these codes mean? (for encrypted data) [closed]

I got this data from debugging an apk. It uses an AES hash for decrypting password and email. (`encrypted password : hivhigf , NKB62GnZ5zugT+ArL/QQEg== & encrypted email : fifyusiih@example.com ,...
0
votes
1answer
45 views

How to make a buffer overflow run shell? [closed]

I have a simple C program that asks for two inputs I'm trying to overflow them so that I can access a shell, but I'm not sure what I need to do to access the shell. I can overflow them to just print ...
3
votes
1answer
85 views

How is typing “name at example dot com” safer than “name@example.com”?

Say I want to type my email address in a forum...say, hank.chief123@gmail.com. Obviously, that's a bad idea since spam bots will likely find it. So, I would just "cleverly" type hank dot chief one two ...
0
votes
1answer
53 views

Two Factor Authentication Multiple Devices

Most websites (that I have seen) that implement two factor authentication don't support multiple two factor authentication devices linked to one account. The biggest reasons I can think of for that ...
0
votes
0answers
40 views

XSS vulnerability [closed]

I have a html page and a segment of PHP code. I know that is vulnerable to an XSS attack but I don't know how to perform the XSS attack. HTML <!DOCTYPE html> <html> <body> <h1&...
88
votes
12answers
15k views

When is phishing education going too far? [closed]

I currently work on the IT security team at my workplace in a senior role. Recently, I assisted management in designing the phishing / social engineering training campaigns, by which IT security will ...
1
vote
3answers
263 views

Losing the Initialization Vector in Cipher Block Chaining

I have written a message and encrypted it using cipher block chaining. What will happen if the receiver loses the Initialization Vector, or doesn't receive at all?
2
votes
1answer
86 views

What happens if incorrect SIM card PUK entered 10 times?

I know that if incorrect SIM card PIN is entered three times, it is erased, so there is no longer any valid PIN, but user can set up new PIN with PUK. But when incorrect PUK is entered 10 times, it is ...
0
votes
0answers
50 views

How to reasonably use TLS in a setup without PKI?

For an embedded industrial application, I want to use TLS to encrypt HTTP communication. I'd like to offer users easy to use options if there is no PKI readily available. What are my choices here, to ...
0
votes
1answer
91 views

Can I use a virtual machine to connect to a public WIFI to use Internet by totally isolating the host from it?

I want to use my laptop to connect to a public WiFi in a library but... I have strong security in my Windows host machine (comodo firewall using a public network settings and rules, protocols ...
2
votes
1answer
572 views

How to dynamically generate the hash value of a file while it gets downloaded from any website?

I've tried generating the hash value of a file that is trying to get downloaded and compared it against the list of hash values, and if there is a match then it doesn't get downloaded.Here i have ...
0
votes
1answer
56 views

Password storage which avoids privileged insider attack

What are the standard password authentication protocols in client-server setting where authentication happens at the remote server? Is there any password/pin verification protocol which reveals zero ...
0
votes
2answers
57 views

Can I increase strength of ECB by decorrelating input data with compression

I know that ECB block cipher mode is the weakest method of encryption because repetitions in input data with a stride of a block size lead to repetitions in output data. However, as I may consider, ...
0
votes
0answers
17 views

Security risks in confirming the username instead of confirming the username and password combination [duplicate]

Most of the login pages like Google, Outlook and Yahoo! confirm the username first and then ask for a password instead of confirming the username and password combination altogether. Isn't it less ...
2
votes
1answer
36 views

How do client and server authenticate random number which is sent

Both a client and a server send their random number each other in the ClientHello and ServerHello of handshake protocol of TLS. At the time, how do they authenticate the client or server which they ...
1
vote
0answers
50 views

How to test behavioral detection of antivirus

I want to test to see if my antiviruses are working correctly and if possible to see which one is better. As each antivirus has two parts I want to test both. For signature-based detection, I use ...
0
votes
0answers
26 views

Perform an authorized action via Postman [closed]

There's an old php website that I want to automate some tasks. Think of it as Craigslist in another country but much less sophisticated. In this website, I can send messages to users only when I am ...
0
votes
0answers
71 views

Facebook AI constantly “Detects suspicious activity” = locked account [closed]

Super tired of Facebook locking my account after declaring it's detected suspicious activity. Don't want to use it at all, but pretty much have to. :( Have 2FA turned on (Google Auth), so: 1) Not on ...
-1
votes
0answers
50 views

Is there an open source implementation of the KRACK attack?

As in the title, simply: Is there an open source implementation for the KRACK attack? https://www.krackattacks.com/
3
votes
1answer
137 views

Is hashing without a salt secure for random passwords?

I'm designing an API with token authentication. I don't want to store tokens as plain text in the database, for the same reason user passwords are not stored as plain text: if the database gets ...
2
votes
0answers
44 views

Extracted LM Hashes doesnt match actual password

I'm new to LM Hashing and Windows authentication, and I'm having problems with LM hashes. I've created 2 accounts with the password "123", and both of them have different hashes, and none of the ...
4
votes
1answer
144 views

What can scammers see on my devices after I delete the remote desktop software?

I got a call from a call centre today which convinced me that they were calling from BT. They made me download TeamViewer which was unresponsive so I downloaded supermo instead. After this they gained ...
3
votes
1answer
109 views

What is a SOCKS proxy? [on hold]

I am having a hard time understanding what a SOCKS proxy really is. I have been searching on Google, but so far, most websites compare SOCKS with an HTTP proxy, but they do not explain in detail what ...
5
votes
2answers
223 views

Why were hyperlink auditing pings used for DDoS attacks and not any other requests?

A few days ago this new story has been published: Researchers have found that the HTML feature called hyperlink auditing, or pings, is being used to perform DDoS attacks against various sites. This ...
0
votes
2answers
42 views

How can I check what scripts are in Nmap's default category (`--script=default`)?

I know that the -sC and -A options run the "default" category of scripts (--script=default): https://nmap.org/book/nse-usage.html I've searched the nmap script folder for a default sub-folder, but ...
0
votes
0answers
48 views

How to bypass character filtering in XSS?

I am solving XSS challenges. I found difficulty in one that filters the character "o" both uppercase and lowercase. I can run tag. I have to call function "prettyRobot" to complete the cahllenge. But ...
0
votes
1answer
297 views

Bypassing password authentication in example PHP

I have pseudocode of the following script: $pass = '...'; $answer = '....' extract($_GET); if (($inp)) { if ($inp === get_contents($pass)) { return $answer } else { echo ...
0
votes
1answer
69 views

What is bad control chars?

In a video of Jason Haddix "How To Shot Web" he said that you can bypass CSRF protection by adding bad control chars to CSRF parameter value. what does he mean? This video: https://youtu.be/-...
0
votes
0answers
37 views

How does cellular data differ from an ISP, and what can be tracked? [migrated]

Are IP addresses given to a phone static or not? Also, how can phone companies keep track of a person if they wanted to find them? For example, I don't have an account and use a pre-paid card. I'm ...
1
vote
1answer
85 views

What is the difference between Anti - APT (Advanced Persistent Threat) and ATP (Advanced Threat Protection)?

Like the question says, is it the naming difference only or are they entirely different?
0
votes
1answer
59 views

Outsourcing PCI data: Is this ok?

The organization I work for hold PCI-DSS compliance as merchants (we fill in SAQ-D). At the same time, due to document/payment verification processes, we request from our customers pictures of their ...
0
votes
0answers
40 views

How can I perform DNS rebinding using evil twin at the local level?

How can I perform DNS rebinding using evil twin at the local level? I want to perform a DNS-Rebinding-Attack using an evil twin on local level. The curl command to login into the router curl "http:...
2
votes
2answers
49 views

For PCI compliance, is a central Auth required for domain and non-domain security principles?

We have a Saas offering that is hosted within our own data centers. Our software offering utilizes OpenLDAP as it backing for token auth security. Our operations team has asserted that for PCI ...
0
votes
1answer
105 views

I need to compute a string whose SHA256 hash matches a given prefix. How should I approach it? [duplicate]

Is there any (more efficient) way for computing any string with a given prefix in it's SHA 256 hash? And how probable am I to stumble on such a string if I brute force?
-1
votes
1answer
66 views

Does Tor network encrypt the message before it reaches the first Router in Tor network?

I'd like to know this aspect in the inner working of Tor network. Right now I'm unable to find documentation that solves this, although by logic I guess the answer is 'no' I'd like to know for sure. ...
2
votes
1answer
61 views

Is copying passwords to iOS clipboard secure?

Since apps on iOS can access the clipboard should I worry about it when copying passwords from the keychain? I do that when AutoFill feature doesn't work so I would not have to manually retype ...
1
vote
0answers
45 views

How can Apple allow all my devices to use iMessages without the key leaving my phone?

This question is related but different to this question. Apple says that all iMessages are end-to-end encrypted, but how can a newly enrolled apple laptop read my phone's iMessages that were sent ...
0
votes
0answers
24 views

Multiple authentication servers providing authorization to resource server

What I want to achieve? To authorize people to single resource server over multiple different Authentication servers. Clients want to login via their own Domain credentials and have credentials only ...

15 30 50 per page