All Questions

0
votes
0answers
7 views

ASA VTI NAT policy options

I am using a virtual tunnel interface to connect my ASA to a router in order to use BGP between the two. The inside network on the ASA (10.10.10.0/24) needs to use source NAT to make it appear to the ...
0
votes
1answer
32 views

Have I been hacked? Terminal shows me in a different location than my machine

Sorry for the generic title but really don't know how to call this. I've just upgraded my MacBook Air to macOS Mojave 10.14.3. Usually, when opening the terminal it would show something like ...
0
votes
0answers
14 views

How to secure an application deployed in some port

I was wondering, If there is a (private) application or service deployed at example.com:5000, how can someone prevent undesired requests to that port ? I was thinking about a solution were the ...
-2
votes
1answer
51 views

If I hash a password 40 times, will it be breach proof?

Let's say I have a password like: password123 If I was to hash it 30 times, will it be (nearly) breach proof? I have a loop which goes through all the hashing algorithms and hashes them continuously. ...
0
votes
1answer
19 views

Does 2-Factor Authentication protect against malware?

My quest has to do with whether 2-Factor Authentication protects against a compromised system (malware)? There's a couple of scenario's in which I wonder whether it does: Everytime you login into a ...
0
votes
0answers
16 views

Rogue AP without internet connection

Can anybody help me to figure out why the rogue AP does not have internet connection please? I use Kali on raspberry. I have the integrated wifi adapter - wlan0 and 2 the same wifi adapters (Alfa ...
-1
votes
1answer
43 views

Bank sites are protected by their own adblocking software

I do not currently have any adblocking software or extension. Ads are flourishing on foxnews and some other sites but not on my banks page. Do banks use some their own addblocking software?
0
votes
0answers
12 views

How much VirtualBox device/ios emulator/blueStacks informatin can be logged/tracked by servers/ apps?

This question is intended to know if we can be tricked by Virtual devices emulators. How much logging information can servers/apps request to tell the difference? In the other word, Can we hide our ...
0
votes
1answer
24 views

Fingerprint image (jpeg/tif) to comparable artifact [on hold]

I'm working on a project and I need to generate a unique code from a fingerprint image (jpeg/tif) obtained from a fingerprint scanner. The idea is to use this code to check for a match. The code has ...
0
votes
1answer
49 views

How to report “cryptographic bad practice” to vendor?

An appliance is suffering from "cryptographic bad practice"-class of problem, more details here. It would take quite some person-months to prove just for one firmware version if it can be exploited. ...
0
votes
0answers
17 views

Database in DMZ and SMTP relay

I have an application that talks with a database in the DMZ. There is a firewall between the apps and the db but our developer thought that they require a mail notification that is triggered from the ...
0
votes
0answers
7 views

Check OpenVAS tests

I have a list of security policies that need to be implemented. These are for example: standard passwords shall not be used and must be replaced. standard admin accounts like root and admin shall be ...
1
vote
0answers
30 views

rar and zip password encoding scheme [on hold]

What encoding scheme is used in last versions of ZIP archives(6.3.2+) and RAR archives(3.90+), including RAR5? UTF-8/16, ASCII or something else?
0
votes
1answer
23 views

Session spanning, resumable file uploads with resumable.js

I'm currently working on a web app pentest, where resumable.js (http://www.resumablejs.com/) is used to provide a resumable file upload. Resumable.js uses a value called resumableIdentifier to ...
0
votes
0answers
24 views

HTTP Debug method reveals Server header on IIS

Stuck with really weird problem and can't figure out how to handle it. So, I have asp web api application hosted in IIS 10. I use IIS Rewrite module with outbound rule which removes any Server header: ...
0
votes
2answers
54 views

Is it possible to establish a secure TLS connection using only client certificate?

I'm considering using TLS for a peer-to-peer, SSH-like usage without PKI. First, there is a setup phase of the clients, before any connection between them is established. The setup consists of ...
0
votes
0answers
17 views

shellcode JMP-CALL-POP technique ( Segmentation fault (core dumped) )

I write this shellcode for spawn a shell on the box using JMP-CALL-POP technique but i keep got this error i don't now why !! Segmentation fault (core dumped) my shellcode : section .text ...
0
votes
1answer
31 views

Is it safe to just forget OAuth tokens, and not invalidate them in a mobile app?

I have a mobile application that a user signs into using OpenId Connect and OAuth 2.0. Currently when the user logs out, I open up a webpage to the end_session_endpoint (http://docs.identityserver.io/...
0
votes
0answers
6 views

File permissions mechanism on OS level [migrated]

Might be a duplicate of (Are file permissions set in Unix/Linux effective in Windows or Any other OS?) but... Let's assume we have a file (preferably in Linux/Unix OS but I believe this applies to ...
3
votes
3answers
3k views

Is there a limit on the layers of encryption a file can have?

Consider symmetric GPG encryption of a given file my_file.txt. Something like (in command line) gpg --symmetric --cipher-algo AES256 my_file.txt After suppying the prompt with the new password, the ...
0
votes
0answers
22 views

Malware Attack Error On Wordpress Website [on hold]

How to fix malware attack error from Sucuri on WordPress website? I am getting this malware attack error on my WordPress website: Malware entry: rogueads.unwanted_ads Description: Varios malicious ...
0
votes
2answers
29 views

Using HTTP Strict-Transport-Security with preloaded

Lets say I have a site that accepts example.com and www.example.com I want to enable HSTS and use preloaded on this site. I've read that I need to be very careful because all the sub domains need to ...
1
vote
0answers
16 views

Getting VPN users to trust a non-global Root Certificate Authority on Windows in order to use TLS on intranet websites

Consider the following scenario, keeping in mind the restrictions: Your goal is to secure intranet-only web applications to start using https - so you need a certificate issued, so you can bind ...
0
votes
0answers
26 views

Meterpreter Over HTTPS Proxy

I have a proxy server on the WAN as well as my box open to the WAN. I want this proxy server to (when it receives a shell), route it to my host so it can be the "man in the middle" between my ...
0
votes
0answers
20 views

evil twin like attack [duplicate]

Is it possible to make a fake AP with the same SSID that has a password and when clients try to access it and type a password, the software verifies it with a handshake?
0
votes
1answer
64 views

Question about birthday attack on password

Based on birthday attack, you need to generate at least 2^n/2 of possible combination to have 50% chance of finding a password. I have a list of 3000 random password make from 16 characters of upper, ...
0
votes
1answer
43 views

Browser session cookies stolen/copied to another PC, why websites not smart enough prevent it?

Just out of curiosity and security test, i copied my own browser's cookies to another pc on same browser and surprisingly i managed to open facebook and google accounts with existing sessions even ...
1
vote
1answer
72 views

Is my pseudo “password manager” solution secure?

My solution to store passwords is just using this free program, SafePad, and then writing in a document all my passwords, plain text; for example a line might be Facebook.com - user: johnsmith - ...
0
votes
0answers
20 views

gpg2 --full-generate-key generated 2 keys with different expiry dates

I was trying to generate a new gpg keypair earlier, so ran: gpg2 --full-gen-key. I selected the default key type (RSA & RSA), keysize (2048) and specified that the key should expire in 2 years (2y)...
2
votes
2answers
43 views

Definition of information in ISO 2700x

I've searched through recent versions of ISO 27000, 27001 and 27002 and couldn't find definition of "information". Where can I find it? Is "information" defined anywhere? Or maybe I should look at ...
0
votes
2answers
112 views

Do I lose the anonymity of a VPN if they open a port for me?

I currently use a VPN supplier that does not allow for opening ports. They argue that I lose the whole point of a VPN and the anonymity by doing this. I can't see how and they don't seem to be able to ...
0
votes
0answers
15 views

EVP_get_cipherbyname returns NULL

When I try to compile my code using OpenSSL 1.1.0i, EVP_get_cipherbyname() is working properly. But when compiled with OpenSSL 1.0.2p, this method always returns NULL and the error is "error:00000000:...
0
votes
0answers
28 views

What is my ip address? [migrated]

Previously I was with Bell Canada, and the public IP address they provided me is your standard xxx.xxx.xxx.xxx. It was something like 172.16.254.1 which is what google told me, and also what running ...
1
vote
2answers
26 views

What happens if I use a proxy through software such as Proxifier and also use a software which supports working through proxy servers?

Let me give you an example: I use proxifier to use a proxy that uses IP from Germany. So when I check https://www.whatismyip.com/ it shows as if I'm from Germany. So imagine if I have a software on ...
1
vote
0answers
25 views

How to start with javascript engine exploitation [on hold]

I am beginner in exploit development. My experience is developing buffer overflow exploits and shellcoding. Now I want to begin with javascript engine exploitation. After making some research I ...
2
votes
1answer
83 views

Phone sending many packets

Earlier, I accessed my modem to check out the IPs in my network. The network was configured with DHCP (with 24h to expire), and I didn't recognize 3 or 4 of IPs: most of them were smartphones, but one ...
1
vote
0answers
65 views

Non-deniability of WhatsApp message

A is claiming that B has sent him a certain WhatsApp message. And if this incident is proven to be true, this will mean social and legal harm for B. But as a matter of fact, B has not really sent ...
0
votes
0answers
17 views

Exploiting MairaDB Sql Injection with procedure analyse and extractvalue()

I am testing a sql injection to a website. And spending several hours i just become to get the version of the database. test.com/abc.php?query=1&limit=3 procedure analyse(extractvalue(rand(),...
0
votes
1answer
37 views

Cmd shuts down computer immediately after windows boots up and logs into the default account/user

as the title suggests, after I login to default/main account which has administration privileges, after desktop loads almost instantly CMD opens and shuts down the computer, only way I found to stop ...
-1
votes
0answers
28 views

Get someone's information from IP address [on hold]

Someone unauthorized signed in to my facebook account. I have their IP address, but how do I get more information about them e.g. name/address? And how do I mess with them using their IP address?
-1
votes
0answers
18 views

Contact Form Security [on hold]

I've built a contact form for my website but I'm not sure if it's secure enough against SQL injections. I'm a novice PHP developer so I might even have made a dumb mistake. Could you please take a ...
1
vote
0answers
33 views

How to do forensis MBR hex dump?

I take OS first 512 hexdump using dd command. what kind of information extract using that and what are the tools or command(linux) can be used for analysis ? I take copy bytes dump using my Ubuntu ...
1
vote
1answer
36 views

gpg ignores passphrase on my key stored on yubikey 5 nfc

I just set-up my yubikey 5 nfc with 3 seperate subkeys (S, E, A). While encrypting and decrypting works fine (self-tested), I'm questioning the fact that gpg only ever asks me for the yubikey's pgp ...
2
votes
1answer
67 views

Why would a scammer ask for creation of a new email account?

I recently received the following email: Good day my dear friend, I am contacting you to help get the deposit (£8.5 million pounds), my late client Engineer Alexander left in his Bank before ...
0
votes
2answers
49 views

How to solve the problem of secure randomly generated GUIDs when the size of the data outgrows the GUIDs

I've been struggling with this problem for a little while... How to hide the order that records were created in, basically. You typically do this by generating a "GUID". But this GUID is arbitrarily ...
1
vote
1answer
40 views

Size of a secure random number taking into account quantum computing and size of universe

Most random secure numbers are 256 to 512 bits. But given the size of the universe and eventually quantum computing, wondering what is a better sized randomly generated number, taking into account ...
0
votes
2answers
74 views

Are there any security risks to accepting HTTP/0.9 style GET requests? (e.g. “GET /\r\n”)

I'm writing a web server for fun, and I'm first adding support for HTTP/1.0. The primary reference I'm using is RFC 1945 => Hypertext Transfer Protocol -- HTTP/1.0. In section 5.1 of the RFC, I ...
0
votes
0answers
13 views

IPv6 firewall problem with ps4 [migrated]

I'm experiencing a problem with my router cisco d3928 and codww2 online. I opened all the ports needed to play codww2 online and nothing worked, but if i disable ipv6 firewall i can play normally. ...
0
votes
0answers
36 views

Heap bugs - extinct now?

I've been practicing some computer security courses lately, and I'm bugged by one specific heap overflow that just doesn't work for me. Taken from The Shellcoder's handbook, chapter 5. While doing my ...
1
vote
1answer
26 views

Is it possible to LUKS require both password and key file?

My goal is to be able easily destroy medium with key file in emergency situation and make system unbootable, even is potential advisor knows right password for the system. I'd store this key file in ...

15 30 50 per page