All Questions

Filter by
Sorted by
Tagged with
0 votes
0 answers
12 views

Best Way to Reliably Performing Checksums Assuming Entire Internet is Compromised

I am under the assumption that large parts of the internet are under supply-chain MITM attacks all the time. I'm wondering what's the best way of reliably ensuring the integrity of system packages, ...
user avatar
0 votes
0 answers
13 views

How does this break out of a javascript tag?

How does putting the alert function '-alert(1)-' into a search field, where it ends up inside a script tag actually break out of the script string? Wouldn't this just be interpreted as an empty string ...
user avatar
0 votes
1 answer
19 views

Change directory is available throughout the whole project

Shared hosting, Ubuntu. I opened the access to a certain directory via SSH/FTP. Some adjustment to my web project is necessary, so I have organized an access for a programmer. The problem is that the ...
user avatar
  • 101
0 votes
0 answers
21 views

What is the steps to be taken when you suspect a linux malware has infected your computer?

Using Linux is a different beast entirely but sometimes malware can blend as seemingly harmless system binaries like this post Bpfdoor Like this post which documents a highly evasive Linux malware. ...
user avatar
  • 1
0 votes
0 answers
3 views

Deleted Message history on my iPhone is still on Apple Watch [migrated]

My partner has a message on his Apple Watch but denying it came from him. I searched his iPhone and couldn’t find the original message. Could this message have came from his Apple Watch only or ...
user avatar
  • 1
0 votes
0 answers
11 views

SQL Injection "Error 1 - Operand should contain 1 column(s)"

I am injecting: -35' and updatexml(null,concat(0x3a,(0x0a,(select database()))),null)-- - and I am receiving: Error 1 - Operand should contain 1 column(s) Any idea how to fix this? I am trying to ...
user avatar
0 votes
0 answers
21 views

Evil neighbors have recoded phone and use Firebase and Nulled out my phone please help [closed]

I have these two evil neighbors who have nulled out my phone and used firebase to recode my phone I'm sure through XDA. I have all the proof that I can show you in train shots. before they do more ...
user avatar
0 votes
0 answers
6 views

How can I encrypt Anti-Phishing Check with PGP 2FA [closed]

I need to pass a PGP Code Check, but I don't know how. I got a GPA Account but I can't encrypt the following key: -----BEGIN PGP SIGNED MESSAGE----- Hash: SHA512 http://...
user avatar
0 votes
0 answers
37 views

Can a VPN hide my IP on Whatsapp?

My IP can be seen by a Whatsapp contact using the netstat command. Can a VPN hide my real IP to them? Or their netstat will still show my real IP?
user avatar
0 votes
0 answers
8 views

Storing passwords and retrieving them to run an application

I have a web app that I use to run exe programs but the exe programs require a password to be passed. Currently this password is hard coded into the web app file in clear text. Since this is not ...
user avatar
  • 1
0 votes
1 answer
28 views

Is a buffer overflow / command injection attack possible with magnetic strip?

I am relatively new to security and I would call myself an amateur researcher as I do not even work in IT. However, I remember having a MS605 card reader / writer / encoder and I loved playing around ...
user avatar
  • 3
0 votes
0 answers
12 views

Exploit failed: NoMethodError undefined method `smtp_send_recv'

I was playing around with an old server (probably pre 2017) and I was running the following metasploit module: msf6 exploit(linux/smtp/exim4_dovecot_exec) However, after setting the LHOST (0.0.0.0), ...
user avatar
0 votes
0 answers
25 views

mounting /dev/sda on /media failed error [closed]

I tried using the iso file from the Kali website to install Kali. I am using a MacBook Air M1. I encountered the error mounting /dev/sda on /media failed many times. How can I try and solve this ...
user avatar
0 votes
0 answers
21 views

Can I brute force a telecom APN?

I'm currently curious about how an APN is verified in the telecom software. If there are multiple APN that are left unused since long time (like private apn and corporate ones), is it possible to ...
user avatar
0 votes
0 answers
12 views

Malware binaries for the SpySheriff scareware

When I first became interested in malware reverse engineering years ago, the first malicious program I encountered was a scareware called SpySheriff. It had a wide internet presence, as it spread ...
user avatar
-1 votes
0 answers
21 views

In order for my bank to clear a third party check the person signing it has to have their phone number verified [closed]

In order for my bank to clear a third party check they must call the third party.But their phone number must be verified in their name or they will not call them. The third party’s number could not be ...
user avatar
0 votes
0 answers
24 views

I clicked on a suspicious link with cross site scripting vulnerability [duplicate]

I clicked on a suspicious link with cross site scripting vulnerability. Redirected me to youtube's home page. Anything I can do right now?
user avatar
0 votes
0 answers
11 views

Remote Desktop from Work Computer to Personal Computer Risk

Im trying to brainstorm what security risks I would be opening myself up to if I used my work computer to RDP into my personal computer. I dont allow clipboarding or cut and paste from either They ...
user avatar
  • 165
0 votes
1 answer
28 views

Is it possible to trust a certificate authority ONLY when a specific domain is accessed?

I would like to know if there is a way to only trust a CA only when a specific domain is being accessed, eg. wikipedia.org. I'm using Chrome, and I'm not really tech savvy so the simpler the solution ...
user avatar
  • 1
0 votes
0 answers
30 views

I mistakenly clicked an .htm attachment from an spam email, help?

I messed up... I opened the htm file using chrome and entered my password... Upon realising that it wasn't a legit attachment, I immediately changed my Microsoft account password. However, I don't ...
user avatar
1 vote
1 answer
10 views

Managing multiple GPG keys

I'm currently attempting to setup my personal GPG key suite for the next few years, and I'm running into a question I don't have a ready answer for. I own 3 yubikeys, Primary/Secondary/Offsite Backup. ...
user avatar
  • 111
0 votes
1 answer
38 views

Bulletproof Way of Ensuring the Integrity of Base OS Images

is it practically possible to ensure that the integrity of an ISO image for an OS is legit with 99.999% certainty? I was thinking of buying a bunch of DVDs of Ubuntu 22.04 on eBay and comparing the ...
user avatar
1 vote
1 answer
29 views

How to perform analysis on a potentially malicious .torrent file?

I was recently sent a .torrent file from what I had thought was a trusted source, but when I opened it with qBittorrent, the computer automatically rebooted. I had already scanned the file with ...
user avatar
0 votes
1 answer
26 views

Should API keys, even for free services, be visible in a page's source?

I sometimes see API keys in page sources, such as the following: <span class="nf">init</span><span class="p">(</span><span class="nv">...
user avatar
0 votes
0 answers
32 views

A Continuous Flood of Kernel Warnings. Am I under attack?

I have a Linksys WRT1200AC with DD-WRT v3.0-r48865 std. It's connected to the Internet through the ISP's modem in bridge mode. My syslog reports continuously, many times per second stuff like this: ...
user avatar
1 vote
3 answers
50 views

Should deprecated versions of TLS not be used

I'm setting up an server, the default configurations allow for connections with deprecated TLS versions. Should I remove deprecated TLS versions from my server? What is the difference between a ...
user avatar
  • 225
0 votes
0 answers
30 views

French translation of technical words [closed]

While writing a memoir on Network Security I've encountered the following expressions: pervasive mechanism trusted functionality event detection security label The online translation provided is ...
user avatar
  • 101
0 votes
0 answers
25 views

What are some common vulnerabilities in APIs?

While doing web application security in startup companies, I am exposed to some backend APIs that integrate with the client web app, but testing APIs is a completely different procedure that I do not ...
user avatar
  • 1
0 votes
1 answer
39 views

What happens if both DoH and DoT are enabled?

If I have DNS over HTTPS and DNS over TLS activated simultaneously (router has DoT activated and smartphone browser has DoH activated, so I see on https://1.1.1.1/help DoH: yes and DoT: yes), which ...
user avatar
  • 71
0 votes
0 answers
10 views

Which browser add-ons prevent downloading of malware when clicking a malicious link? [closed]

Which browser add-ons prevent you from downloading malware when clicking a malicious/infected link? Both Firefox and Chrome.
user avatar
  • 101
0 votes
0 answers
18 views

Small file to trigger false positive when scanning with clamav 0.103 [closed]

I want to set up some scripts for running clamav scans but I want to test that they behave the way I expect them in case of a detection. I tried searching on the Internet but failed. What small non-...
user avatar
0 votes
0 answers
9 views

Change default classification label (Azure Information Protection) in Microsoft Office (Outlook, Word, Excel) by user

We have Azure Information Protection (AIP) configured for our organisation, we have 4 labels defined (public, internal, confidential, secret). The default label set for the organization is to "...
user avatar
0 votes
0 answers
42 views

Would removing a SIM disable the phone number and block text scams

I have a PAYG basic Nokia mobile, not a smartphone, and have noticed on my EE A/c there is a transaction for a Text Service with a charge of 15p, appearing every so often, which is nothing to do with ...
user avatar
  • 1
0 votes
0 answers
10 views

Can I store subject from a JWT from an external auth server in my DB?

We are retrieving external users using OpenID with the PKCE flow. We are using the JWT returned from the auth server to authenticate the user. If it is valid, we extract the subject field from the ...
user avatar
  • 101
0 votes
1 answer
40 views

Does user uploaded image file to HTML input form pose a risk?

I have a site where I need to get a logo from the user, they can click the input form and upload only .jpeg or .png files. After this the file will stay client side and be used to automatically create ...
user avatar
6 votes
4 answers
1k views

What cybersecurity jobs are mostly technical? [duplicate]

I am doing my bachelor's in computer science and I have the chance to take multiple cybersecurity courses. Of course, before taking these course, I did some research about jobs in the field of ...
user avatar
  • 63
1 vote
0 answers
31 views

x509 certificates are still exposed even with Encrypted Client hello?

Encrypted Client Hello hides Server Name Indication (SNI). However, looking at the TLS Handshake (https://tls12.ulfheim.net/). Wouldn't it be possible for a middle-man to inspect the TLS Handshake and ...
user avatar
  • 111
0 votes
0 answers
33 views

Protect laptop BIOS rootkit when attacker has physical access

My idea is that, what is the point of disk encryption or any other security measures if attacker uses BIOS rootkit when he has physical access to laptop. Until laptop is off it maybe protected against ...
user avatar
  • 207
0 votes
0 answers
17 views

Cannot get SQL injection to work in DVWA [closed]

I get a blank screen when I inject 1' on low security, for example. If I type in 1 then it displays users, but that's all that will work. I found instructions on gihub that mention to alter .htaccess ...
user avatar
0 votes
0 answers
10 views

Can I use ssh-rsa AAA...== cardno:000123456 to import my yubikey public key into open gpg?

I made a private key and sent to my yubikey. However, I lost the public key file corresponding to it, but I have the ssh-rsa AAA...== cardno:000123456 thing. How can I import this public key to my ...
user avatar
  • 121
0 votes
1 answer
26 views

Recommendations on PKI roles as per ETSI EN 319 401 - V2.3.1

I want to configure roles (least privilege) on my CA instance (EJBCA) and I'm trying to find what are the best practices to do this. I've tried to read the ETSI EN 319 401 - V2.3.1 standard and try to ...
user avatar
  • 83
0 votes
0 answers
13 views

Nessus Scan failed: 5.2 Ensure 'file_priv' Is Not Set to 'Y' for Non-Administrative Users

Taking a look at the failure Description: The File_priv privilege found in the mysql.user table is used to allow or disallow a user from reading and writing files on the server host. Any user with the ...
user avatar
-1 votes
2 answers
91 views

What’s the most secure way to obtain & use a computer [closed]

What’s the most secure way to obtain (purchase) & then use a computer/device? I.e. even if I pay cash for a Mac at Apple. Right when I put in my Ethernet cable wouldn’t Apple see my IP address and ...
user avatar
0 votes
0 answers
33 views

Is it possible to assess the integrity of an SSD's firmware using SMART results or drive details?

I recently bought a used SanDisk SSD and I am curious to know if there is any way to assess the integrity of its firmware using information such as SMART or drive details. In addition to SMART ...
user avatar
  • 1
0 votes
0 answers
11 views

Microsoft Sentinel API for search a query

Is there any API in MS Sentinel to search a query, Workspace | where something == "something2" | where this "that" I tried using msticpy, any alternative that can be done using a ...
user avatar
-1 votes
0 answers
45 views

Encryption database on app that runs on client side

I'm having a discussion at work and I want to know the opinion of the community and know if I'm wrong or not. We have a product that runs on client computers (on-premises) and it uses a local database ...
user avatar
  • 1
29 votes
4 answers
7k views

Can I prove that I did not receive an email?

A company are saying they sent an email to me. I have gone through all of my inbox, junk, and deleted files and the email still doesn’t exist. They have asked me to prove the email never got to me by ...
user avatar
  • 291
0 votes
0 answers
18 views

GnuPG: How can I clean signatures from my encryption subkey?

Similar to Is it wise to remove redundant self-signatures from my PGP key? - I noticed that after a couple of years, and multiple key manipulation (I use keyoxide.org so my UIDs have multiple ...
user avatar
0 votes
0 answers
19 views

Can Proxy replace VPN? [duplicate]

I was reading about proxy vs VPN, to summaries that one could say that VPN is similar to proxy with the addition of encryption for better security. So I have a question, wouldn't it be better to use ...
user avatar
  • 1
1 vote
0 answers
19 views

Penetration testing framework for Windows Desktop applications

Is there a burpsuite-like framework for Windows Desktop applications? I.e. I'm looking for something that would allow me to intercept user-input data sent to my application for manipulation to test ...
user avatar

15 30 50 per page
1
2 3 4 5
1308