All Questions

Filter by
Sorted by
Tagged with
20
votes
3answers
1k views

Should Stack Exchange be more obscure in its systems' structure?

I've noticed that Stack Exchange always reveals the detailed structure of its servers and systems (see these blog posts). And also the exact results of their tests and points of weakness (see the old ...
0
votes
0answers
7 views

Curve25519 vs. Curve25519 and AES Key vs. Curve25519 AES Ciphertext (Instagram)

I am trying to send a password from a client to the server. I just don't know how to encrypt it. method: I used a website (Instagram) as a guide here. Here the password is encrypted with AES and the ...
1
vote
1answer
29 views

Sync AWS snapshots to secondary account - supplier ask for “swap” - security theathre?

I'm managing an AWS account for a specific purpose for a company of 120 people. Another supplier of this company of around 5 people also has an AWS account. To protect resources in an AWS account from ...
0
votes
0answers
8 views

Should users be allowed to to login with the same email when an email change is requested but not completed?

I've found a very similar question: Should users be allowed to login with the same password when a password change is requested but not changed?. But the key difference here is that requesting an ...
2
votes
3answers
39 views

Which Diffie-Hellman Groups does TLS 1.3 support? And should we use TLS 1.3 as a guide?

This is a two part question - and I'm asking as someone moving into a security role, who'll need to standardize practices going forward. (1) I'm curious whether the following 10 different DH Groups ...
2
votes
1answer
35 views

Installed TPM, how to use BitLocker without USB key?

I have a Windows 10 computer with 3 hard drives: Samsung SSD 850 EVO 1TB (SSD, system drive where Windows 10 is installed, not encrypted yet) First 3 TB HDD already protected by BitLocker Second 3 TB ...
1
vote
1answer
58 views

How is PKCE secure?

I feel like I am missing an important point here, I have been reading up a bit on the PKCE flow but something doesn't sit quite right. How is PKCE secure on public devices? If I understand this ...
3
votes
2answers
1k views

PKCE vs Client Secret

If I was developing a web app client that would be served statically, I would need to either use the implicit grant flow (which is no longer advisable) or use the authorization code grant flow with ...
3
votes
2answers
75 views

Hierarchical Key Rotation. Should I rotate the lowest level keys?

I have a hierarchical key system designed for my project. In this system a block of data is encrypted using a Data Encryption Key (DEK). This DEK is encrypted using a Key Encryption Key (KEK) which is ...
0
votes
1answer
25 views

Are reproducible builds practically possible on major app stores?

'Reproducible builds' ensure that a published app matches the published open source code. This answer gives some great information on it. But numerous sources1,2 indicate reproducible builds are very ...
0
votes
2answers
180 views

Is an OTP alone useful for a hacker?

Further, does an unused OTP expire by itself? i.e in regards to digital banking - in case a hacker accesses your SMS's through malware or other means.
0
votes
0answers
14 views

Does TLS provide data integrity? [duplicate]

I've looked around on this site and I've not seen a clear answer on this question. From what I've read TLS does not provide data integrity unless specific ciphers are used which use HMAC'ing as part ...
1
vote
2answers
337 views

OIDC SPA Keycloak refresh_token storage location

I have Single Page Application based on Open ID Connect flow (keycloak). I wonder what are the security considerations for refresh token storage - what are the advantages and disadvantages for ...
4
votes
0answers
118 views

How is my ISP circumventing SSL on thepiratebay even though the certificate is valid?

When I visit https://thepiratebay.org it is displaying a message from my ISP saying it is blocked under government rules. BUT the https icon is green and the certificate is a SNI certificate from ...
0
votes
0answers
21 views

Whats wrong with this XSS vector? [duplicate]

Payload: <DIV STYLE="background-image: url(javascript:alert('XSS'))"> Reference: http://seguretat.wiki.uoc.edu/index.php/XSS_Cheat_Sheet Can someone please explain why this payload is ...
0
votes
0answers
44 views

Isn't this kind of password ultimately secure and insanely easy to remember? [duplicate]

Pick any dictionary word. Think of a number over 10 and below 20. Repeat the word as many times as the number, and end off with the same number (for example, "12"). Example: ...
0
votes
0answers
22 views

Is it possible to circumvent the 2FA protection on Gmail using a stolen photo id?

Digital-based KYCs (Know Your Customer checks) are widespread these days, and given the number of reported data breaches, it is not unreasonable to assume that there's a non-zero risk that photos of ...
0
votes
2answers
50 views

How to run a meterpreter script multiple times

I have this very simple script to run a rpcbomb script from auxiliary/dos/rpc/rpcbomb for a DOS attack. use auxiliary/dos/rpc/rpcbomb set RHOSTS Victim_IP_Address set RPORT 111 exploit -j -z I want ...
1
vote
1answer
29 views

LFI php://input returning initial argument?

TLDR: Trying to execute commands on site thats got a LFI vuln. So I am making my post request to my vulnerable site and import requests header = { 'User-Agent':'Mozilla/5.0 (Windows; U; ...
0
votes
1answer
37 views

Should I redirect http request to https from my system's application or from DNS or other?

I want to create a web server that does redirects HTTP to HTTPS. What is the simplest method to do this but also secure? Should the DNS handle this? (For example, Route53) I used to do this with my ...
0
votes
0answers
28 views

Looking for recommendations for my Personal [closed]

I’m fallen deep into what I see as The Rabbit Hole of the tech world/technology. I started having very odd things happening with my phone & laptop a year ago. I won’t go into too much detail in ...
0
votes
1answer
50 views

how end certificate refers to intermediate certificate

As far as i know certificate chain is accomplished based on the issuer's CA name. It is possible that the algorithm to create certificate chain first reads end-certificate's issuer area and get the ...
0
votes
1answer
53 views

How to install and use scanlogd

I want to install and run scanlogd from my Ubuntu 16.04 machine. I am able to install and run it with apt-get install scanlogd and it works fine. But I am not able to change the parameters like log ...
8
votes
4answers
17k views

Does GHIDRA have a debugger?

Does GHIDRA have a debugger attached for dynamic analysis of application?
0
votes
2answers
110 views

Will carrier servers allow the ISP to see anything I'm doing even on a VPN?

AFAIK, if the connection to the VPN server is properly set up, the ISP is not able to see any of the traffic. Nevertheless, I just found a worrying comment to this blog post: https://www.stealth-...
0
votes
0answers
25 views

Surfshark virustotal alerts seen [closed]

Running the Surfshark install exe through virusTotal throws up the following alerts for some of the engines. Are these false flags?
9
votes
1answer
6k views

How can I spoof the Mimetype of a file upload?

There are posts that says php mimetype isn't secure, or can be bypassed. How do people spoof the mimetype?
44
votes
3answers
16k views

How can Android encryption be so fast?

Android uses full-disk encryption to encrypt files and decrypt them at startup. What I don't understand is that decrypting multiple gigabytes of files must take a lot of time, if nothing else then ...
4
votes
1answer
312 views

If rowhammer only results in capacitor discharge, how can it flip 0 to 1?

In rowhammer, why will changing the voltage on one row cause the other row to open/close? Is it related to induction? How can it change bits from 0 to 1? I understand from 1 to 0 - voltage discharge, ...
6
votes
1answer
1k views

How can I protect my home/office computer against row hammer?

Row hammer seems to affect ECC memory less, but ECC is still not immune. I have heard of software mitigations like ANVIL, but that doesn't seem to be 100% row-hammer-proof either. What software or ...
0
votes
0answers
16 views

What is the obfuscation method utilised in Playdead's 'LIMBO' video game? [migrated]

The game uses Unity3D engine, perhaps with a custom render pipeline. Reports have been made, it is not possible to disassemble it. How did they achieve that?
0
votes
2answers
64 views

Can GET Requests with Spring Rest controllers be intercepted by attackers?

I'm building a Spring app and a React app which also contains Chat functionality. I use WebSocket with RabbitMQ as message broker. I store the chat history as encrypted messages with AES, and before ...
56
votes
5answers
14k views

Is it secure to use MD5 to verify the integrity of small files (less than 15kb)?

I know that collision for MD5 has been documented since the 90s and that digital certificates based off of MD5 has been demonstrated to be completely compromised back in 2010 but how effective is MD5 ...
79
votes
10answers
23k views

Why is JavaScript “safe” to run in the browser?

JavaScript has certain limitations such as preventing reading and writing to disk and not allowing access to other browser windows or domains. But is that all that's needed to prevent malicious code ...
0
votes
0answers
46 views

What are the risks of a client application not verifying the server's certificate in an internal network?

Suppose the following: I have a domain controller (DC) in my corporate network (ACME.local). The domain controller has a self-signed/internally generated certificate, obtained through ACME's PKI. I ...
0
votes
1answer
33 views

Working code examples for stack or heap buffer overflows?

I understand how this exploits work on the theoretical level, but I can't find detailed worked tutorials that show for example how to overwrite the return adress in the stack when overflowing a given ...
22
votes
4answers
7k views

How is Sandboxing implemented?

What I would like to know is two fold: First off, what is sandboxing? Is it the trapping of OS system calls and then secondly deciding whether to allow it to pass through or not? How is it implemented ...
0
votes
1answer
2k views

bettercap - arp spoofing

I am new with bettercap, I am trying to do a simple ARP Spoof attack. Reading the online doc, I tried with: 1) bettercap # launch bettercap ' 2) set arp.spoof.targets "MYVICTIM IP" #example : 192....
0
votes
2answers
40 views

Investigating a downloaded certificate

I used the below command to open a certificate of a website that I downloaded from Firefox. What part of the downloaded certificate indicates that it is a CA's certificate? openssl x509 -in ca.crt -...
0
votes
1answer
45 views

Can't find cause of malware in Wordpress site - adding html files with redirects [closed]

I'm helping a non-profit and they have had malware on their WordPress site. I installed Sucuri and it quickly finds some strangely named HTML files in the base directory. I removed those files. ...
0
votes
1answer
42 views

Estimate the number of host computers on the private network by port scanning

If we have a private network connected to the Internet with NAT, how can an attacker estimate the number of host computers in network using port scanning? For both possible modes, the attacker inside ...
21
votes
2answers
45k views

Can a website make an HTTP request to “localhost”? How does it get around the cross-domain policy?

I found this website which talks about fixing a Redis vulnerability by exploiting that same vulnerability. The website in question has a "patch me" button, and if you have a password-less Redis ...
0
votes
0answers
59 views
+100

Why a curl piped bash command works but not the direct command?

So im doing some pentesting in a TryHackme box (Chill Hack) and I've come to some trouble. In this box I have available an input in a website where I can inject commands to the vulnerable system. This ...
2
votes
1answer
215 views

Non-upgradable usb device against badUSB

Lot of posts about badUSB (here and there) suggest to use a PS/2 connector for mouse and keyboard or to whitelisted USB devices or even use a hardware firewall that only allows whitelisted commands. ...
6
votes
1answer
363 views

What are the security implications of capabilities in Kubernetes pods?

We have a Kubernetes deployment with an application that need to be on a VPN. We implement this requirement by running openvpn-client in a sidecar container within the pod with elevated capabilities: ...
1
vote
1answer
57 views

I am unable to use an RSA key generated with the -aes-256-gcm option in openssl, help

When I run: openssl genrsa -aes-256-gcm -out rootca.key 4096 Then I get the following output: $ openssl genrsa -aes-256-gcm -out rootca.key 4096 Generating RSA private key, 8192 bit long modulus (2 ...
2
votes
1answer
89 views

Securely retrieving and exposing configuration within Docker

It seems that the correct approach to supplying secrets to Docker containers is debatable. This question is the closest to mine, to which one person answered that environment variables are ok, but a ...
0
votes
0answers
42 views

Can anyone identify this redirect popup? [closed]

I found a popup that seemed suspicious and just wanted to ask any security/coding experts if this is a malicious script/etc. hxxps://pastebin.com/Qbihrg90
1
vote
1answer
230 views

self reset password with MFA

I need to implement a reset password feature with Multifactor authorization. The plan is to use these 2 factors: ask a security qs and email/sms a code to the user. I think the order of these should ...

15 30 50 per page
1
2 3 4 5
1221