All Questions

Filter by
Sorted by
Tagged with
1
vote
1answer
26 views

What are the security implications of adding an Intermediate Certificate into the Trusted Root Store in Windows?

I have 2 certificates (one root and one intermediate). In Windows OS, the Root certificate is in the trusted root store (for current user). The other intermediate certificate (signed by the root CA), ...
0
votes
0answers
12 views

Is it possible to port or migrate tripcodes from one server to another?

Specifically, I'm looking to determine if tripcodes for users on 4chan could have been migrated to 8chan, and then to 8kun. My (limited) understanding of this mechanism is that each server creates its ...
0
votes
1answer
19 views

XSS - Setting Values and Attributes w/ jQuery

I was looking at the answer here and got curious if a function I use may be susceptible to XSS. Mostly because of this statement: Some HTML attributes are inherently dangerous. This includes href, ...
1
vote
0answers
19 views

Cookie is not being set after CRLF Injection in one domain but set in another domain. How can i bypass/set it?

Ok i am facing a very weird behaviour that sets and doesnt set cookie both. So, first i have found CRLF injection in 2 domains, redacted.de and redacted_another.com. When i go to redacted_another.com ...
1
vote
1answer
36 views

Can a third-party service within an e-banking portal actually be safe?

I am using a e-banking portal from a major Swiss bank (let's call it "Bank"). Some month ago, a new solution for the processing of electronic billing (e-bill) was introduced. The whole e-...
0
votes
1answer
23 views

Why do IPSec VPN Phases have a lifetime?

I was working on a bug with our VPN, and read about VPN Phases 1 and 2, each of which have a lifetime in seconds. I was investigating to validate if these had anything to do with the bug we had and ...
0
votes
1answer
60 views

Mongo DB hacked (read_me_to_recover) without the port exposed in the firewall?

I Have recently setup parse-server on a DO vps, using 3 docker containers, one for parse-server, one for parse-server dashboard and one for mongodb. Because I am just testing this setup I left the ...
0
votes
0answers
30 views

“Not secure” after RestAPI request

I am working on an e-commerce SPA (Single Page App) hosted in server A, I don't understand the security (Auth) that good, I'm consuming a PHP RestAPI hosted in server B only to show products, as it is ...
0
votes
0answers
25 views

Client-side encryption of data, but the server can also add data without reading stored data

For a new application I'd like to store messages for each user's account on a centralized server. The user accesses the application through a SPA javascript web app through their browser. These ...
0
votes
0answers
53 views

“Your connection is not private” for specific website, once when opening a new tab

Like many, since March, I've been working from home and using the company's VPN to do my work. Recently, if I open a new tab in Chrome, and navigate to "news.bbc.co.uk", I got the ...
0
votes
0answers
14 views

How does Instagram know my location even if I use VPN and have no sim card? [duplicate]

I'm using this Instagram account only on my 2nd phone which has no sim card and airplane mode always on. I use VPN 100% of the time when connecting to the internet. The account isn't linked with any ...
0
votes
0answers
6 views

Encryption between two switches [migrated]

We have two offices located across the street and the distance allows us to keep everything in one LAN without going through the Internet. However, it seems to require some MITM protection, since the ...
0
votes
0answers
32 views

How to monitor the internet at large for threats to your organization?

What are approaches for monitoring cyber threats “outside” of the organisation, such as data like account passwords, credit cards, company data for sale, etc? While there are services for monitoring ...
0
votes
1answer
26 views

AutoRecon is taking too long to complete

AutoRecon is a multi-threaded network reconnaissance tool which performs automated enumeration of services. It is intended as a time-saving tool for use in CTFs and other penetration testing ...
0
votes
1answer
35 views

Do ISPs like Xfinity gather geographical information about their users?

Do ISPs like Xfinity gather geographical information about the users of their public hotspots? If so how is it done and how accurate is it?
0
votes
1answer
39 views

CVSSv2 score of 10, but no CVSv3 score

We are working on our Vulnerability Management process and as part of that, I was going through the reports from our infrastructure vulnerability scanner. In the reports, I noticed that some of the ...
0
votes
0answers
69 views

Could I have been hacked? [closed]

So for a while I have been using this chat to talk with random people: talkwithstrangers.com. I've used it to practice conversation. Yesterday though I had a weird conversation. The person with I ...
0
votes
0answers
21 views

OAuth device code grant - JWT

I am looking at implementing an API Gateway for a system using WS02 as the IdP. Users will be signing in using OAuth via federated SSO with social providers (initially Google). The users will also ...
0
votes
0answers
19 views

Can Azure CDN mask vulnerability scans

We have a website https://ourwebsite.web.core.windows.net/ which needs to be made public(available on Internet for anyone) and did a Qualys scan using an external scanner on it which found 40 ...
0
votes
0answers
24 views

how to bypass a ids's decoder to bypass waf? [closed]

if a ids using a decoder. and we can bypass the decoder ,the ids will be invalidated . like some decoder can't handel '&#0114' . how to bypass ids will be a important thing.
1
vote
0answers
29 views

Student Project Ideas using Openstack [closed]

I am a student at University and have completed all on my CompSci courses and am getting started in my concentration, security. What I want to do for my project is create and monitor a secure cloud ...
-1
votes
1answer
58 views

how to safely open files downloaded with tor? [duplicate]

If I download a file (PDF,doc,image,video etc) with a tails/tor setup, how can I ensure the file doesn't "call home" or isnt imbedded with malware (other than looking at the hash)? Will a ...
0
votes
0answers
60 views

What can a government agency see if they control Tor nodes? [duplicate]

If I use Tails/tor on public WiFi, and a government agency is controlling /snooping nodes or uses malware to conduct a waterhole attack, what information can they gather about me?
0
votes
1answer
70 views

Very Strange Access Request to my website [duplicate]

Recently I got a very odd request to my website. This is from the log file: 20.42.89.182 - - [12/Aug/2020:18:48:13 -0400] "GET /cgi-bin/kerbynet?Section=NoAuthREQ&Action=x509List&type=*%...
-1
votes
0answers
32 views

How to connect to a domain without vpn [closed]

I have domain name and we can connect to it over vpn only. Thus all CNAME are accessed when vpn is connected. I think the domain is delegated to a nameserver that's only accessible on the openvpn ...
0
votes
2answers
54 views

This application is not using CSRF token but they are still able to protect sensitive actions on the site

This application is not using any CSRF token and not even cookies to identify users on their server. All they do is use a authorization header to identify users. Since an attacker doesn't know value ...
-2
votes
1answer
68 views

Why ProtonVPN is using datapacket.com

I'm using ProtonVPN free trial. It is saying its OpenVPN. When I tried a test on dnsleaktest.com, the result is: unn-195-181-***-***.datapacket.com. Why is ProtonVPN is using datapacket.com?
2
votes
1answer
59 views

Pros/Cons for showing a user how many failed login attempts they have remaining before getting blocked?

For context, my web app will be used by users who don't have a strong technical background. What are the pros or cons for displaying a message like this? Something like:
0
votes
1answer
54 views

Security and privacy concerns about “IMEI check” websites

I know there are few questions about the risk of IMEI with various answers from rare risk to none. But my question is regarding the kind of websites that provide IMEI check services for free with some ...
1
vote
0answers
44 views

How smart cards are blocked?

I have a Yubikey NFC 5, when I enter a wrong PIN or PUK three times the smart card is blocked. Can someone please explain to me how it is blocked ? Does the PIN/PUK functionality is disabled somehow ? ...
0
votes
0answers
38 views

How secure is the apple cross device copy and paste feature?

I can copy and paste between my iPhone and MacBook Pro it's a great feature that I find myself using frequently. I am frequently copy and pasting from my password manager to log in to different sites....
0
votes
1answer
76 views

Insider threats vs. insider attacks

I understand that a threat is a possible security violation that might exploit the vulnerability of a system, and a attack is an action on a system that harms the organisation in some way. Therefore, ...
0
votes
0answers
33 views

How does the Amass intel module correlate information?

Can someone explain to me how OWASP Amass correlates information regarding the intel module domain search? As an example, if I run the command: amass intel -d example.com -whois I'll get a list of ...
0
votes
1answer
72 views

Can a .exe file scanned and verified safe by many antivirus hack my personal information?

I just recently downloaded a .exe file from a person's github.I scanned the file in virustotal.com(Scans the file with over 150 antivirus engines like kaspersky,avira etc)and it showed none of the ...
23
votes
3answers
2k views

Can ISP replace a website html/js/httpHeaders with something else?

It seems to me that "yes they can do". As I saw it in some countries, entering adult content will simply give a warning message that the site is blocked. Some places even block Facebook ...
0
votes
0answers
27 views

Can malware infect a network through PCoIP?

I work at an organization that has an intranet, but allows employees to access it through a PCoIP connection established with the VMWare Horizion client. With computers physically in the network, ...
1
vote
1answer
42 views

Is it acceptable to have SPA + API from security point of view?

We are building something like specific blogging social platform. Architecture was originally intended as to have: single page application: all gui, rendered in the browser on the client frontend: ...
0
votes
0answers
84 views

Dangers of hosting .onion from my house?

I have a pure html web page which is static, and i want to host it on another pc. I am going to use kali linux as operation system and did not decide on a web server. Which one do you suggest? Is ...
1
vote
1answer
44 views

Host filesystem manipulation from docker vs. virtual machine

When reading about docker, I found a part of the documentation describing the attack surface of the docker daemon. From what I was able to understand, part of the argument is that it is possible to ...
0
votes
0answers
13 views

E2EE through a browser for multiple users and devices in a many-to-many scenario

I've multiple IoT devices that read and write streams of data (audio/video signals, sensory data, ecc...) and multiple users that can do the same, I should be able to interchange informations from one ...
0
votes
0answers
34 views

Is it safe to use HMAC to create an API key?

I am planning to create an API key using the user's password as message and a random number assigned to that user in my database as key (or vice-versa). I will then store the hash of that API key in ...
0
votes
0answers
22 views

API GET Request resulted in a Bitdefender thread alert

This is a very strange occurrence and could be a false alarm. I am testing an API from an advertisement network for my WPF desktop app. I made a GET request to this exact test link (generic sample ...
1
vote
0answers
30 views

WhatsApp logged me out on device - is it a security concern?

I went to bed last night, and put my Android phone into Airplane mode, something I do pretty regularly at night, except when I'm on call. However, this morning my WhatsApp popped up telling me that I'...
0
votes
0answers
69 views

CSRF token not sent when calling the back-end?

My system composes of NuxtJs and AdonisJs application. Adonis handles csrf tokens for us by sending: set-cookie: adonis-session=XXX; Path=/; HttpOnly set-cookie: XSRF-TOKEN=XXX; Max-Age=7200; Path=/; ...
1
vote
1answer
45 views

why wireshark shows tls1.2 but it's actually tls1.0

Why does Wireshark show tls1.2 but it's actually tls1.0? and sometimes, in almost the same situation it shows tlsV1
0
votes
2answers
38 views

Can we use CORS policy to restrict api calls from native mobile app?

We can use cors to restrict api calls to a specific host in a web app. How to do the same for native mobile app? I want to restrict api calls from my app alone. Is it possible to do so?
0
votes
0answers
8 views

Enabling VPN kill switch shows no internet [migrated]

When I enable kill switch on a VPN client on Windows 10, I see no Internet sign on the task bar. However, I have Internet connectivity and I can browse the Internet with Chrome, Firefox or Edge. The ...
0
votes
0answers
38 views

How secure is pass compared to Keepass?

Is pass a real alternative to Keepass in terms of security? While Keepass has its own built-in encryption, pass relies on GPG to secure your passwords. GPG is obviously recognized as providing ...
0
votes
1answer
44 views

Is it good idea to re-authenticate a user to access sensitive actions and data?

In a web application there are several pages in which you have sensitvie data and actions like access controls or user management page. Is it a good idea to re-authenticate user to access those pages? ...
0
votes
0answers
16 views

CSP Violation ms-appx-web://

We have a java application which allows users to upload attachments and save it on the server. The application has a content security policy defined like this: base-uri 'self'; child-src 'self'; form-...

15 30 50 per page
1
2 3 4 5
1187