All Questions

Filter by
Sorted by
Tagged with
0
votes
0answers
8 views

SQLmap is repeatedly showing error messages

I've been able to successfully download SQLMap and a lower version of Python than what I already had. Unfortunately it doesn't seem to functioning properly. The commands I enter just don't seem to ...
0
votes
0answers
5 views

PBKDF2 hash over PBKDF2 key derivation

Dear security experts, Imagine an app where any user provides a username and a password. This password is used to generate a 'strong' encryption key (for AES encryption) with the PBDKF2 key ...
0
votes
1answer
10 views

Is this a PEM certificate?

I'm doing research on certificates and I've managed to find a dataset. It is a single large text file where each line appears to be a PEM encoded certificate but I am unable to load them using pythons ...
0
votes
0answers
8 views

Ubuntu Server SSH configuration file help

This is my sshd_config file settings I can connect to my server with my pc using public key but I can also connect from another pc with the password of sudo user account. How can make the login ...
0
votes
1answer
19 views

Is NSA disclosure of CRYPT32 vulnerability a charitable public service? [closed]

News coverage of this makes it sound like the NSA is mending fences and helping us all out, kindly and heroically. I have nothing against the NSA but isn't it more likely an adversary has been ...
0
votes
1answer
24 views

CVE-2020-0601 (CRYPT32.DLL exploit) standalone patch?

Is there any standalone patch for CVE-2020-0601 (CRYPT32.DLL exploit) besides installing Windows 10 latest cumulative update? Or is there other ways to mitigate this exploit, when immediate ...
0
votes
0answers
32 views

How to safely reinstall Windows in Thailand - avoiding BadUSB/SSD

I have newly bought HP Pavilion laptop, which i am planning to nuke and reinstall. I really do not like the bloatware as it might posses a security risk. However, in Thailand, i do not trust the ...
0
votes
1answer
17 views

Signature hash algorithm SHA256 (Certificate) vs Peer signing digest: SHA1

As client I am using an API of a company. To be able to connect I have to decrease the security level to CipherString = DEFAULT@SECLEVEL = 1 in /etc/ssl/openssl.cnf using OpenSSL 1.1.1d. Then if I ...
-1
votes
1answer
42 views

What is this forensic software?

Please help me identify this software. It looks like a forensic tool with a really sexy interface.
0
votes
0answers
12 views

Which messages are included in (D)TLS Finished message's verify_data field for session resumption

The https://tools.ietf.org/html/rfc5246#section-7.4.9 states which messages are included for PRF computation that is included in Finished messages It is clear for 'regular' (initial) handshake But ...
0
votes
1answer
29 views

Login based on password only (might call it a token)

I hate remembering account names and passwords and noticed I often handle new accounts this way: If a site is asking for a password I use passwordsgenerator.net to generate a long random password and ...
0
votes
0answers
11 views

What's the field before ssh-rsa in known_hosts on Raspbian GNU/Linux 9 (stretch) [migrated]

ssh-gen by default creates a public key like ssh-rsa AAAAB3NzaC1yc2E...6OEBTVwLRP1Ocyr user@DESKTOP-8BL3U5O The Raspbian 9 has a different format |1|dMpV8+ILjAAD11mhp57Q7hVk/4A=|...
-1
votes
2answers
57 views

How dangerous can a file be with no detected malware?

Let's say there is file which successfully passed all scans by all antivirus software there is on VirusTotal. Does it mean that it can't be dangerous. If no, what kind of dangers we can expect?
0
votes
2answers
52 views

Why do firewalls focus on tcp and udp?

From what I can see, most firewalls seem to focus on tcp and udp. Why is that? Is it impossible or at least very unlikely for malware to use other protocols/custom protocols?
0
votes
0answers
4 views

BIOS/UEFI update and BitLocker suspension [migrated]

I can read on many pages that when you update your BIOS/UEFI, you need to suspend BitLocker (for information, mine is configured to ask for a password at startup, no TPM in my machine). But none of ...
-4
votes
0answers
61 views

How can i create an isolated and anonymous OS inside my employer's laptop? [closed]

My employer monitors every website I visit on company laptop, so i need to create an isolated OS and connect to a stealth VPN so the IT department won't know which websites I visit and they even ...
-1
votes
1answer
46 views

Can I execute code in this situation?

There is a code snippet like that in a php based web application. <form action="home.php?parameter=<?php echo $_GET['parameter'] ?>" method="post"> Can I execute arbitrary code using get ...
1
vote
1answer
29 views

How does proxychains avoid DNS leaks?

Also directly related, how are the DNS servers queried when using proxychains? Assume I'm using Tor for proxychains. If I uncomment the DNS part of proxychains.conf, my requests supposedly get sent ...
0
votes
0answers
30 views

Bypassing Windows Defender VBA custum code

I've recently wrote a simple keylogger using classic dll-injection technique. I wanted to simulate a real phishing attack where user opens office document with macros and by enabling them he downloads ...
0
votes
1answer
66 views

How do I protect my info from apps like CallApp?

It appears to me that apps like Whoscall and CallApp might access your photos and such. In case of a potential data breach/hacking in one of these apps - how can I delete my info from their servers?
2
votes
2answers
50 views

Can I use the same truststore and keystore on the client and the server?

TL;DR: Is it possible to have both sides of a SSL/TLS connection have the same public and private key, so long as that public key is trusted by both sides? More info if helpful: I'm trying to test ...
0
votes
0answers
16 views

Newly bought HP Pavilion laptop - bloatware - security risks [duplicate]

I’ve recently bought a new HP Pavilion laptop, it came with pre-installed software (bloatware) such as various games and other useless stuff. When setting up the laptop, i was connected to AIS, which ...
0
votes
1answer
29 views

Does the “Key Encipherment” key usage make sense when using ECDH P384?

I configured a Windows CA and created a certificate template to issue certificates with ECDH_P384 keys: Then I noticed that it's not possible to set the "Key Encipherment" key usage in the "...
0
votes
1answer
70 views

How to securely store decryptable passwords

I'll quickly outline the purpose of our application: The user logs in using his username and password. He will receive a list of servers he can connect to. After choosing a server the connection to ...
0
votes
0answers
16 views

How to list signatures of public key file without importing it to keyring?

How can I list all signatures made to a public OpenPGP key without importing it? A file with the public key is available. I would like a similar output to gpg --list-signatures <key-id>, but ...
8
votes
0answers
86 views

How does CVE-2020-0601 (ChainOfFools/CurveBall) work to undermine ECC?

What is the recently patched and disclosed Windows 10 OS family Crypt.dll vulnerability CVE-2020-0601, nicknamed ChainOfFools and/or Curveball? I've read up on it and while I understand the basics (...
1
vote
1answer
29 views

EKS managed worker nodes security patching

Do AWS EKS managed nodes receive security patching automatically or is it the owner's responsibility to patch?
6
votes
1answer
56 views

Why was the Same-origin policy originally introduced (before XMLHttpRequest)?

As I understand it, the Same-origin policy (SOP) basically prevents a script in a web page from obtaining or sending information from/to a different domain. I understand that this is important to ...
0
votes
0answers
6 views

how can i change DH key , enable SMTP and FTPS on plesk [migrated]

one of the clients has run a security scan for the site web that I am working on, so he found some issues that I need to fix these issues are : FTP Unencrypted Cleartext Login // solution: Enable FTPS ...
2
votes
1answer
74 views

Is there a difference between a rainbow table and a dictionary attack?

I'm trying to learn a bit more about the different types of attacks but as far as I understand it, a rainbow table is a large collection of prehashed data which is then compared to hashed data ...
1
vote
1answer
42 views

Sanitising a file/folder path from user input

I have an external server make backups of my main server via scp and a backup-only user account. I successfully restricted it to scp only using GNU Rush. The scp command below executed on the backup ...
0
votes
1answer
40 views

Can you restrict the services a certificate can access on the client side?

I have a verification certificate signed by my organisation’s CA, which I can use to authenticate my user account on intranet web services. Is there someway I can sign a new certificate which can ...
1
vote
1answer
58 views

Does OAuth 2 increase the risk for clients to expose their “client_secret”

Upon doing a bit of research about the OAuth protocol, I find it hard to avoid the glaring criticism of the OAuth 2 standard, and its supposedly inferior security. An answer on stackoverflow suggests,...
0
votes
1answer
33 views

Fraud related to teamviwer in my mobile [closed]

I was cheated by a fraudster who asked me to download teamviewer. Later he was able to transfer money from debit card to my paytm wallet. Later he transferred money to some other Paytm number. Later I ...
0
votes
0answers
44 views

What do apps like TrueCaller, CallApp and Whoscall share with others? [closed]

I've downloaded the apps TrueCaller, CallApp and Whoscall. Then I realised they have privacy issues. Do they share one's photos? Gmail? What can I do to remove my info from there? TrueCaller has had a ...
2
votes
1answer
55 views

What is the most unique data identifier for a phone user that cannot be repeated?

I'm currently developing an android (and probably iOS in the future) application for my company. I was wondering what is the most unique data identifier to authenticate the users. A data that cannot ...
1
vote
1answer
74 views

Is there any danger to downloading a malware binary, but not executing it?

I recently downloaded an ELF file which was discovered from an exploit attempt (wget to download this binary failed due to outgoing traffic being blocked if it isn't whitelisted). I downloaded it into ...
1
vote
2answers
41 views

Security Controls Categorization [closed]

I'm doing research about Information Security Controls. Considering that the topic is very wide, I would like to organize in macro categories the security controls that can be adopted by an enterprise ...
0
votes
1answer
29 views

How to block for open Web Shell in my CentOS 6

I currently use mod_security in combination with maldec and block almost all attempts to upload shells, leading them to error 406. However, I found one "problem" if I upload Shell through an ftp ...
0
votes
2answers
142 views

Would a porn site open in the background generate network traffic?

My friend walked into work with a porn site loaded into incognito in the background. He didn't click it while at work or open chrome it was just a background window. Would it ping it or anything ...
2
votes
1answer
102 views

What forensics should be collected as part of an incident response plan on Windows 10?

I am in the process of creating an IRP that responds to system hacks. I have attacked the Windows 10 myself (victim machine), using Metasploit on Kali Linux, where I managed to gain access via SSH ...
1
vote
1answer
54 views

Would there be a secure way to store an encryption key on server side for front-end decryption?

I am currently working on a web application with sensitive data to store (personal medical data). The app is on the very first stages of conception and I am to quickly produce a beta version that ...
0
votes
0answers
49 views

Do best practices eliminate the need for a CSRF token when writing an API server?

I realize that OWASP recommends CSRF tokens but I rarely see them used with public standalone HTTP APIs. This would seem to indicate that they're not always necessary. To make this a little more ...
0
votes
2answers
59 views

Is there anything I can do past SSL pinning to secure my connection?

My goal is to prevent man-in-the-middle (MITM) attacks through proxies. I've implemented SSL pinning, which has helped significantly, but I'm wondering if there's anything more I can do that's worth ...
-2
votes
1answer
68 views

Australian Bush fire donation hacking

On the recent Australian Bushfire event, people are donating to help them. But some inhumane(cybercriminals) are stealing people's money by injecting malicious script on e-commerce and donation sites. ...
3
votes
1answer
92 views

Could you store your passwords in a phone app governed by a QR code?

I had an idea a little while back to have an ID card with a QR code on it that you kept in your wallet. When you want to access your passwords (view them directly), you need your ID card and to scan ...
0
votes
0answers
25 views

Need examples for ztag

Can anyone provide some examples of ztag (https://github.com/zmap/ztag). I am trying to use it against a host that I found on the Internet, but ztag doesn't seem to handle the input sent to it, and ...
0
votes
1answer
40 views

Can I use a mobile passcode login exclusively?

I get absolutely no cell coverage in the building I'm working in, nor do I have access to wifi, so any time I need to use 2-factor authentication, I cannot receive the push request. I've been using ...
1
vote
1answer
134 views

my daughter just clicked a link she got on twitter and want to know is it safe and what does it do [closed]

My daughter received a masked link and clicked it, she knows better but it was masked as google.com/herusername. https://accounts.youtube.com/accounts/SetSID?ilo=1&...
0
votes
1answer
58 views

Can end-to-end encryption be securely implemented on a web application?

There are a lot of arguments around whether web applications can implement end to end encryption. Most of the arguments against javascript based solutions are centered around the fact that the the ...

15 30 50 per page