All Questions

Filter by
Sorted by
Tagged with
0 votes
0 answers
5 views

openvpn windows how to setup

I have ipv4 proxy (although I can change its type to socks5) , it looks like this: 11.17.33.11:8000:XMcor6:2Zg2xW And now I want with open vpn( or any other programm to setup secure connection ...
1 vote
1 answer
14 views

Creating a wordlist based on a password given

I have a password with the example of buddy9221!! Using Johntheripper or crunch, how can I generate a password with buddy 4 numbers and two special characters?
2 votes
1 answer
59 views

Reasons to untrust Let's Encrypt certificates

We have a service running behind https and we are using SSL certificates from Let's Encrypt. The problem is that one of our clients distrusts Let's Encrypt CA and on certificate renewal it requires to ...
0 votes
1 answer
27 views

Is redirecting back to login page bad practice/insecure

One of our company sites redirects all bad URLs back to the login page which is required to even access the site. Is this insecure? It feels like it may cause some weird issues as I have never seen ...
  • 3
0 votes
0 answers
12 views

Two access-control-allow-origin headers displayed in response

I was testing CORS on a web application and when I tried to change the origin to another domain using a web proxy, I saw two access-control-allow-origin headers in the response, one containing the ...
0 votes
1 answer
11 views

Anyconnect VPN whitelist physical devices

My company uses Anyconnect VPN of Cisco, and any company PC device is required AD username/password to access the network. I'm thinking about the case when an employee copies the whole windows (copy ...
0 votes
0 answers
10 views

Expectation of surveillance camera vs iphone. Resolution vs field of view [migrated]

I'd like to be able to identify licenses plates as they enter our cul-de-sac. My question is triggered by a comparison between an Arlo Pro 4 and an iPhone 12. The iPhone produces extremely high ...
0 votes
0 answers
18 views

Are the WhatsApp internal metadata stats cleared when a chat is deleted? [closed]

Assume, I have access to the internal WhatsApp metadata tables. I am interested in the lifetime count of messages sent to a particular contact. Is this total count reset if the chat history is deleted ...
  • 1
0 votes
0 answers
15 views

Smardcard-Login and LDAP-Webinterfaces

If "smartcard required" is ticked in an active directory user account the password is wiped. In my enviroment there are a lot of applications with webinteface logins connected via ldap to AD....
0 votes
0 answers
10 views

Appending Data to LNK Shortcut File [Emotet TTP]

There has been a rise in the use of LNK shortcut files to deliver malware, in particular Emotet. Within the LNK file is a payload (usually a VBS script) that is found with findstr.exe. The payload is ...
0 votes
0 answers
4 views

Find/Remove suspected virus/malware on macbook air (mapi.sport80.com) [migrated]

I've found a program running on a friend's Mac that is under the name "mapi.sport80.com" in screen time & it has been running consistently for 5 days straight, it looks to be accessing ...
0 votes
0 answers
33 views

Which of these filesystem encryption philosophies and methodologies are better for which purpose?

Currently on the "FLOSS market" there are multiple options for encrypting remote cloud storage following different security models and different philosophies. To name a few: encfs (I guess ...
0 votes
1 answer
112 views

Identifying a ransomware with .mkp file extensions

Yesterday, a ransomware hit my PC. I didn't pay the ransom and didn't comply with what the attackers were asking for and I wiped everything and every drive on my PC and then reinstalled my stuff from ...
0 votes
3 answers
46 views

Can secret recipients be included in PGP cryptography

Can we be sure that a cleartext message that becomes encrypted by pgp or openpgp which is intended for one-or-more specific recipients doesn't also get secretly decipherable by a third party? Since i ...
  • 1
0 votes
0 answers
11 views

Unable to view VPN traffic for analysis [migrated]

I am currently working on a VPN client application. I want to analyze the app's network communication but cannot get any traffic in TCPView Sysinternals tools. What's the issue here? Am I missing ...
  • 36
0 votes
0 answers
11 views

Continuous Automated Red Teaming (CART) vs Breach and Attack Simulation (BAS)

Both the terms are similar i.e. they automate the manual task of red teamers. But what's the difference between them? Are they interchangeable?
  • 1
1 vote
0 answers
14 views

Using GPG is there a way to label public keys on my OpenPGP keyring?

I am unable to identify certain public keys on my keyring because the key owner generated their public key using a UID that contained no identifiable information. For instance they're completely ...
  • 11
0 votes
0 answers
20 views

Firewall necessity [duplicate]

Without a program, which accepts incoming connections, you wouldn't have an open port, even if the firewall is disabled. So why is the firewall necessary?
0 votes
0 answers
18 views

How to use Hydra in Kali Linux with Ajax form?

I have a website that contains a login form, which works with Ajax jQuery. I am using Burp Suite to intercept requests to this form. Burp Suite returns this when I try to log in: POST /php/process.php ...
0 votes
1 answer
55 views

Linux x86_64 Assembly works standalone, but Segfaults when ran as shellcode in C

I wrote a NASM program that uses the execve system call to run wget inside a newly spawned shell and execute the retrieved page: [bits 64] global _start section .text _start: xor rcx, rcx ...
0 votes
0 answers
25 views

Self-encrypting drive - eDrive vs ATA Security

Let's for a moment forget about the possible drawbacks of SEDs themselves. One of the upsides of SEDs is that the encryption key never leaves the drive but wouldn't using eDrive negate this advantage ...
0 votes
0 answers
14 views

How to extract the primary user id from a PGP key

I am writing a front-end to display details about the PGP keys that we have stored in a database. One question I have is how to know which user id is the "primary" user id. For example, a ...
2 votes
2 answers
225 views

Web application discovery: Can there be virtual hosts configured even when there is a response without host header?

I'm currently learning how to discover web applications running on a machine using port scanning, vhost bruteforcing and directory fuzzing. When it comes to port scanning, there is one thing I can't ...
  • 125
2 votes
0 answers
33 views

Is WPA3 mixed mode less secure than pure WPA3?

I want to use WPA3 alone, but it seems that a lot of devices I have only support WPA2, so I have to enable WPA2 in one way or another. Currently, I have created two Wi-Fi networks on the same router: ...
0 votes
1 answer
27 views

SSTP VPN security feature

Do we know exactly whether and for which parts of the packet confidentiality and integrity properties are guaranteed using SSTP VPN? Specifically confidentiality is enforced on the header of the ...
  • 3
1 vote
0 answers
33 views

What damage can a malicious wifi hotspot cause? [duplicate]

I've just seen a Youtube video with an advertisement for NordVPN in which they claim that NordVPN would protect passwords when people are on potentially malicious coffee shop WLAN. That seems strange ...
  • 3,902
2 votes
2 answers
98 views

Is it safe to use an untrusted server for an SSH jump?

The question is a thought experiment. Junior works in IT at Finsurance Corporation™. He works from home now, and has to VPN into work but hates it because they've blocked Gmail and Reddit. Junior ...
  • 163
0 votes
1 answer
32 views

Why did Nmap not yield results when scanning a friend's public IP address? [duplicate]

I am trying to learn more about Nmap but it seems like it can only really give any information if you're actually connected to the network you're scanning on. For example, a friend and I gave each ...
0 votes
0 answers
27 views

The request contains no certificate template information

I am trying to create a CSR from MMC on one of our servers. I have previously submitted a lot of requests without any issues by going to MMC. Certificate folder > Select "Personal" > ...
  • 415
0 votes
0 answers
30 views

Will whitelisting IP's and hashed passwords be enough to protect my site? [closed]

I'm getting ready to deploy a website and wanted a second opinion on the security. I have a database containing hashed passwords with correlating usernames to log in with. On top of that, I'm using a ...
-2 votes
0 answers
29 views

Best practices for IP protection on photography site [closed]

Before all the un-helpful comments come out of the woodwork (i.e. "if you want to protect it, don't upload it") - I get it. The only way to protect it is to not put it out there. Not an ...
0 votes
1 answer
19 views

Deploy to Digital Ocean droplet from Github Action - Should I leave the SSH port open for future deployments?

I'm going to a deploy a web app (angular static frontend and node backend in docker) to digital ocean droplet. Deployment is done from Github Action by essentially loging via SSH to the droplet and ...
1 vote
0 answers
25 views

Can an Android app with device management and microphone permissions spy in background secretly? [migrated]

As far as I know, since Android 12 an app needs to have a Foreground Service Worker (with an active permanent notification) to run in all the time without being stopped when no activity is in ...
0 votes
0 answers
9 views

How to install cloud software locally for security research [migrated]

How you can test cloud software locally? For AWS, there is Localstack, but what about Google Cloud, and Azure? I want to try it, change a lot of configurations and maybe install some software there, ...
0 votes
0 answers
17 views

Adding an email address to my Outlook mobile app will give the Office 365 admin ability to access my mobile phone? [migrated]

I work as a freelancer for many companies. For each company, they create an Office 365 account for me. To manage those emails, I am planning to download Outlook mobile app on my iPhone and add all ...
  • 101
-2 votes
0 answers
40 views

Sam found a very useful web page, which contains links to many [closed]

Sam found a very useful web page, which contains links to many interesting papers. He wants to download those papers. Instead of clicking on each of the links, he wrote a program that parses a HTML ...
0 votes
0 answers
44 views

Optus cyberattack could have exposed up to 9 million Australians, now what? [closed]

Optus cyberattack could have exposed up to 9 million Australians Hackers have breached Optus’ systems in one of the largest cyberattacks in Australian history, accessing names, dates of birth, phone ...
0 votes
0 answers
23 views

Is Google Cloud Database encryption with customer specified keys PCI and / or HIPAA compliant?

Amateur Question... We've written a SaaS application that runs in Google Cloud on a GCP-managed MySQL database. We now need to make our application PCI and / or HIPAA compliant. I know we need to ...
  • 101
0 votes
0 answers
10 views

How can I add secure DNS (DoH) to Windows settings before Windows makes any connections to the Internet during installation? [migrated]

Is there a way I can add DNS over HTTPS details to Windows settings before it makes the first connection to the Internet during installation? I'm using the latest version of Windows 11. Either by ...
  • 1
0 votes
1 answer
60 views

Pre-generate random numbers or generate it on the spot

We are developing a lottery platform, and we are discussing what the best way to implement it would be. As we have it right now, the system pre-generates, using a TRNG device, all the winning numbers ...
  • 103
0 votes
1 answer
20 views

How do you control restrict actions within Docker without Kubernetes?

Based on the documentation here https://docs.docker.com/engine/security/, it does not seem that there are any built-in features to restrict the current logged-in user to run certain Docker commands. ...
2 votes
0 answers
25 views

What does OWASP mean by max incidence and average incidence rate?

Can someone please explain what is meant by the following analysis provided in the overview section of the OWASP Top 10 A03:2021 – Injection page: Injection slides down to the third position. 94% of ...
  • 7,669
0 votes
1 answer
60 views

Sent money to paypal account got refunded and sent it to another account? Possible scam? [closed]

I've matched with this girl on Tinder. She still lives in war-torn Ukraine. I've sent her 80$ to take a bus to central Europe, according to online data, the price checks out. Sending money to people I ...
  • 101
0 votes
1 answer
60 views

Suspicious looking requests to my NGINX server

For the past 2 weeks, I have observed 4-5 spikes in 5xx responses. After looking into the logs, I found a series of: > 51.159.150.125 - - [16/Sep/2022:06:37:55 +0200] "GET /some-legitimate-...
0 votes
0 answers
31 views

Can I email a lot of random people I don't know for no reason [closed]

I'm not going to do it, but is it legal to email a lot random people? Again, I'm just asking, not going to do it.
0 votes
0 answers
8 views

Is pipx a legitimate python tool? [migrated]

I have a terminal emulator that I'd like to manage from Python; but since the author of the Python library that is used to do this is telling me to download a tool that I've never heard of, I'm ...
  • 1,297
0 votes
0 answers
21 views

How to know if I exposed my computer by clicking on a suspicious link? [duplicate]

I have recently received a message with a link on skype and very stupidly clicked to open it. The url was shortened, and after I clicked it became that deep web-like thing and it gave me a dead link ...
1 vote
2 answers
38 views

Permissions, Groups, and Principle of Least Privilege

Lets say I have the following setup Two teams: TeamAlice and TeamBob A command that requires admin access: admin_command Two sets of computers: TeamAlice_Computers and TeamBob_Computers Only ...
0 votes
1 answer
41 views

How to create a cipher string that doesn't contain AES and CAMELLIA ciphers?

I am trying to learn about cipher lists and how to order them. I am new to this. I have gone through this doc. I don't get some of the things mentioned in it. Maybe this post can clairfy it. I want to ...
-2 votes
0 answers
50 views

Can a scammer use a picture of me, my full name, and my birthdate to steal my identity? [closed]

This person on instagram reached out to me and offered to give me a free tarot reading. I have this person my birthdate and name, and before they started, they asked for a donation. I sent it after ...

15 30 50 per page
1
2 3 4 5
1322