All Questions

Filter by
Sorted by
Tagged with
0
votes
1answer
69 views

PAKE - What to do when a weakness is found?

In the case of a password hashing function like Argon2, I know that when a weakness is found, you use another password hashing function, wrap it around the existing hashes and calculate the hash of ...
0
votes
0answers
29 views

ARP Spoofing: Replying to requests meant for spoofed IP, while also being able to communicate with spoofed IP

I am simulating an ARP Spoofing attack on a local network. I have an Attacker machine on Linux, a web server, and a Victim machine which is trying to access the web server. I am successfully able to ...
12
votes
1answer
2k views

How can I practice log file analysis?

There are a lot of excellent resources to sharpen your pentesting skills (like Hackthebox, Vulnhub, Juiceshop, Burp Suite Academy and so on), but I couldn't find something similar for forensics, ...
0
votes
0answers
47 views

Securely Sharing passwords with Users external to Organization

What is the most secure way to share passwords by a user in one organization (say alice@alice.com) with another user in another Organization ( say bob@bob.com ) A trivial solution is alice@alice.com ...
1
vote
0answers
28 views

Are there any security advantages to using Kernel Keyring versus the default file based caches for Kerberos on Linux?

In a containerized environment, what would be the most appropriate way of configuring Kerberos caches?
0
votes
1answer
57 views

Could video streaming pose a security threat?

lately I have wondered if through video streaming you could get infected by some type of malware, can it be possible? I have two cases I would like to consider, lets say I stream a video that was ...
0
votes
1answer
41 views

Odd Kerberos Hosts After HD Wipe, and fresh OS re-install

After reformatting my hard disk and rebuilding/re-installing the latest macOS operating system, I found the following IP addresses after running Kerberos.internal.com: kerberos.internal.com has ...
0
votes
2answers
73 views

CSRF attack when form data isn't parsed

How can you do a CRSF attack on express if it only accepts JSON? Sample Node app: const express = require('express'); const app = express(); app.use(express.json()); app.post('/item', (req, res, ...
0
votes
0answers
35 views

Is it dangerous to run malware in DOSBox? [closed]

I made a DOS malware in Assembly and here is the code of my malware: org 100h file db "*.*", 00h mov ah, 4Eh loop: mov dx, si int 21h mov ax, 3D01h mov dx, 9Eh int 21h ...
0
votes
1answer
62 views

Sensor device web interface certificate

I have sensor devices with a configuration web interface. Each device has a unique serial number. The devices are deployed in various environments with private IP addresses such as 192.168.x.y or 10.x....
0
votes
1answer
56 views

DNS local cache spoofing with malware or RAT

I was learning networking and knew that browsers don't have algorithms to convert domain names to IPs. It queries a DNS server. After that, the computer remembers the IP, so next time the domain is ...
0
votes
0answers
53 views

Microsoft Outlook “confirm your current password” scam? [closed]

I continue to have this pop-up preventing me from accessing my email (the first pop-up said in all lowercase "don't lose access to your account!"). It seems unprofessional to be all ...
0
votes
0answers
15 views

Blockchain based energy auction [closed]

I'm trying to implement an MPC-protocol in an blockchain based auction such that participants sell and buy their generated energy based on the smart meters readings. I need the energy to be secret ...
-2
votes
0answers
38 views

How EDR host isolation works [closed]

I was wondering how EDR isolates hosts from the network but somehow allows the EDR solution to interact with it. For example: how does Carbon Black EDR isolation work? You can isolate and unisolate ...
0
votes
0answers
36 views

What will happen if https traffic goes through the WAF? [duplicate]

A web application firewall (WAF) is an application firewall for HTTP applications. It applies a set of rules to an HTTP conversation. Generally, these rules cover common attacks such as Cross-Site ...
0
votes
0answers
28 views

Cpanel email spammed? [closed]

Before 4 months a problem has occurred to my hosted email. My clients were trying to send me an email to my hosted email (info@mydomain.com) and always were getting an error like this bellow although ...
0
votes
0answers
40 views

Why does nmap scan from a Window machine then a Kali machine give different outputs for the same target? [closed]

Kali: ┌──(kali㉿kali)-[~] └─$ nmap -sV -T4 -Pn --script ssl-cert -p19009 (TARGET) Host discovery disabled (-Pn). All addresses will be marked 'up' and scan times will be slower. Starting Nmap 7.91 ( ...
1
vote
0answers
41 views

Can tabnabbing be prevented with “allow-popups”?

Is it possible to prevent tabnabbing attacks in a sandboxed iframe with allow-popups?
0
votes
0answers
61 views

Is it a valid concern that these webpages are prompting users to install Adobe Flash Player? [closed]

Is it a valid concern that these webpages (https://services2.hdb.gov.sg/ebook/Hip/ease.html and https://services2.hdb.gov.sg/ebook/hip-guide/main.html, linked from near page-bottom of https://www.hdb....
0
votes
0answers
31 views

I am trying to configure SingleSignOn (Kerberos) and get 2 error messages in the log. Even google hasn't heard of them [closed]

I am trying to activate SingleSignOn for a new browser-based application hosted on a server by us, which we implemented at work recently. The application works flawlessly, the only thing that doesn't ...
0
votes
0answers
29 views

Data identifier hash function [closed]

I have a case where I need to identify input data. Input data can be in JSON, XML, HTML, or text. In case of JSON or XML, the order doesn't matter, what matter is the structure, keys name, and values ...
0
votes
0answers
66 views

How do I audit Proton VPN app? [closed]

I'm relutant in installing Proton VPN's linux app. Actually the .deb from the website simply installs the right repo from where the proton app is loaded. I find it very dangerous and would like to be ...
0
votes
1answer
92 views

Should I use my own domain in my proton mail?

Using my own domain on Proton Mail is cool, but what if someone hack my namecheap account? What if some government orders that my domain is redirected? Should I use @protonmail instead of @mydomain? ...
2
votes
1answer
124 views

Is it not useless to increase iterations in KeePass?

So if increasing the number of iterations makes the computation power needed more in a linear way. Wouldn't that be a small increase compared to even a single more character added to your password? ...
-1
votes
0answers
102 views

Former Boyfriend has hijacked my computer systems, software programs and/or network communications [closed]

How do I recover from a calculated near unbelievable cyber hijacking? It started with my Verizon phone two weeks after a break up. The phone began linking and syncing apps, contacts just everything to ...
1
vote
1answer
85 views

Can I get AES CBC key from known plaintext, ciphertext, iv? [duplicate]

Long story short: I was using AES CBC PKCS5 on my image server, but I lost my keys (one key per image). I know the first 61 bytes (the original and the encrypted) of each image plus I know the IV, and ...
-1
votes
1answer
68 views

Is it possible to change the string of EICAR file? [closed]

Is it possible to change the string of EICAR file and still detectable? For example, print "KGMAL" instead of "EICAR".
0
votes
1answer
165 views

Is there malicous HTML?

I'm writing a chrome extension that evaluates certain code blocks from GitHub pages, e.g., Lorem ipsum ```html-embed <iframe></iframe> ``` dolor site amet. and adds their content as HTML ...
0
votes
0answers
51 views

What Are These Adapter TCP/IP Settings For? [closed]

What are those settings for, and which options would be the best for security?
0
votes
1answer
45 views

Protect server-side key with client token

I'd like to encrypt some data on the server using a user-managed secret. I could just ask for a password and derive a key from that, but ideally I'd like to offer users the option of using a yubikey ...
0
votes
0answers
30 views

Block Cross-Origin requests for Youtube embedded video (with js api)

I am developing webpage in which I am embedding some Youtube video's. On my localhost environment I get the following errors: "Cross-Origin Request Blocked: The Same Origin Policy disallows ...
17
votes
1answer
6k views

John the ripper password cracked or not?

I have the shadow file from an embedded device running linux. Trying to use John to crack it. There is only the 'root' hash in the shadow file. 12 seconds in, John finds the password for 'root', but ...
0
votes
1answer
124 views

How to verify there is no malicious code in an opensource library?

I am planning to use an opensource library to my project instead of developing from scratch. How can I verify there is no malicious code in the library or someone cannot access my files? Currently ...
1
vote
0answers
58 views

What to study in summer free time as a 16 year old? [closed]

I'm a 16 y old student who has recently finished 10th grade and has always been interested for tech. I knew some Windows tricks, and few more. Gaming and Netflix really occupied my time, but playing ...
0
votes
1answer
83 views

Why some payment methods allow being embedded in an iframe and some don't?

Let's take some examples: Pay Pal, Apple Pay (examples via Saferpay) - will not load in an iFrame Visa Checkout, Stripe (example), Saferpay (link above) - credit card data can be input in an iFrame ...
1
vote
0answers
45 views

Is Google OAuth login in 3rd party applications via system browser secure?

Numerous mobile applications allow me to "Login with Google". From technical perspective, I assume this would usually follow those OAuth native app login integration guidelines: https://...
0
votes
1answer
53 views

Intel Ethernet Driver Advanced Settings for Security/Privacy

There are some settings found on Device Manager > Ethernet Driver > Advanced Tab. Are there suggestions for any of these settings? or any suggestion to improve ethernet driver security? Adaptive ...
1
vote
2answers
143 views

Encrypt login and password in cookie to keep user logged in

What is the best alternative to encrypting data to use it in a cookie so that i can decrypt it later to validate the user data? Currently saved: Login - Password and IP in an array and then encrypt it ...
0
votes
0answers
50 views

Huffman Coding Image Decode to get hidden data [closed]

I came across the base64 code and performed a base64 to image and perform exiftool of that image and found out that there is some encoding in the image which is Baseline DCT, Huffman coding I used ...
0
votes
0answers
47 views

ASP.NET or PHP for an online market? [closed]

Hello i wanted to create a little online market and i need to learn a language for that. I looked at C# and PHP and wanted to ask wich of these two are better? (Security ect.) Probaly there is no real ...
0
votes
0answers
34 views

General sites or documentation that specificies common information security points for individuals( small business) [closed]

I am wondering if there are concise sites that deal with how individuals can mitigate risks from data breaches, stolen phones, phishing attacks. e.g. Contact credit bureaus to create freeze with pin. ...
0
votes
2answers
89 views

How to mitigate ransomware from locking attached storage

I have OSX. Time machine takes periodic backups. This backup is encrypted. If my machine were to be infected and locked by ransomware, what prevents the backup from also being comprised as it is just ...
5
votes
1answer
84 views

Is it safe to allow CSS filter: url(data:<SVG SOURCE HERE>)?

We have a web service where logged in users can create web page content and write custom CSS for their pages. All the HTML goes through a whitelist parser and doesn't allow any executable content. All ...
0
votes
0answers
11 views

How to prevent wireshark translating macsec protocol into the original protocol [migrated]

I am trying macsec between computers. Currently, the encryption mode is disabled, the state of the exchanges is categorized as "protected" by macsec. I got a Wireshark capture from ubuntu to ...
0
votes
0answers
50 views

Securely deleting Volume Shadow Service (VSS) in Windows 10

Suppose that VSS is enabled and snapshots exist. If I run a program to wipe the free disk space on my drive, would this delete the VSS snapshots? It might do since the program works by filling up the ...
1
vote
1answer
56 views

How to exploit with Control over return address and knowing the address of printf

I have this program that uses ASLR and it leaks information when i overflow a buffer, namely the address of printf. Furthermore i can overwrite the return address. How can i use this to spawn a shell? ...
0
votes
1answer
58 views

Should a web application block access by old browsers such as Internet Explorer? [closed]

Is it standard procedure nowadays to block access to Web Apps by old browsers such as Internet Explorer? I tried to find out what is the industry best practice, but I could not find a reference. One ...
6
votes
0answers
106 views

Are Ubuntu Snaps more secure than the classic installation method from the official repos?

Today Ubuntu (and some other distros) offer a new way to install software, which is snaps. It's software packaged with all its dependencies, run with some kind of containerization, and auto-updated. ...
2
votes
2answers
170 views

Will Google Authenticator stop a sim-swap attack from compromising my Coinbase?

If I use Google Authenticator for Coinbase, and someone sim-swaps my phone number and gains full access to my email account, can they drain my Coinbase account? They would be in control of my email, ...
1
vote
0answers
80 views

Is Zircon kernel (from Fuchsia OS) safer by being a microkernel?

Fuchsia's possible Android replacement uses the Zircon microkernel. This means that the drivers should run in userspace. Is this an advantage over Android? For example, closed source drivers now can't ...

15 30 50 per page