All Questions

Filter by
Sorted by
Tagged with
1 vote
1 answer
37 views

How serious are npm module vulnerabilities?

Obviously any known vulnerabilities are not great, but I'm curious how much I should be concerned about them. I've seen plenty of articles that talk about the rise in malware/spam in npm packages: ...
fyrekcaz's user avatar
0 votes
1 answer
41 views

Difference between "circumstance" and "event" in the definitions of threat

On the Wikipedia page of threat (in textbooks too) various definitions are given where almost all agree in defining a threat as a "circumstance or event". I'm having trouble understanding ...
gomd's user avatar
  • 117
0 votes
1 answer
34 views

Do I need an IP whitelist on top of a VPN?

My company requires me to access resources through a VPN connection -- specifically, an OpenVPN client configured to require a password plus an authenticator token. But the company also restricts ...
Sasgorilla's user avatar
0 votes
0 answers
49 views

How can I understand the zip2john hash format?

I had a .zip file that was apparently encrypted with AES-256 deflate. 7z l -slt archive.zip | grep Method Method = AES-256 Deflate Then I used zip2john to get a "hash" out of it: archive....
IRP_HANDLER's user avatar
0 votes
0 answers
22 views

Inheriting Old Website Maintenance: Demonstrating Code Vulnerabilities [closed]

I've just inherited the maintenance of an old website. The code is awful and I'd like to demonstrate to my superiors that the code is bad and vulnerable. <?php if (!empty($_GET['page'])){ ...
arno's user avatar
  • 101
1 vote
0 answers
35 views

Why does Amazon make you enter specified digits upon calling their customer service switchboard?

If one calls the Amazon customer services number, a robotic voice asks one to enter three numbers. Along the lines of “to be connected to a customer service associate, please press [XYZ]” (where [xyz] ...
Seeking answers's user avatar
0 votes
0 answers
26 views

Default nmap script execution when specifying --script banner

I have a subscription for a NSE scripts feed for nmap. There are some of those scripts which have the default category (among others) I am running nmap in the following way nmap --privileged -oX - -T3 ...
alvaroalo's user avatar
0 votes
0 answers
22 views

How kerberos hashes its keys? [closed]

My manager said that kerberos passwords are hashed using aes256-cts-hmac-sha1-96 & aes128-cts-hmac-sha1-96 algorithms. I that these are hot hashing algorithms but encryption algorithms. My manager ...
sluge's user avatar
  • 1,085
0 votes
1 answer
53 views

Modern VPNs and average MITM attacks

I am trying to untangle a number of concepts (all of which i am unfamiliar with) in this question, but they all point to a seemingly basic question; With modern tunneling protocols, SSL ciphers and ...
myol's user avatar
  • 133
0 votes
0 answers
19 views

Does other frontend framework have similar issue like AngularJS?

I'm reading an article that talks about XSS exploitation on AngularJS, AngularJS will render the template in ng-html, and it bypasses sanitize-html. My questions, I'm wondering if other frameworks ...
daisy's user avatar
  • 2,057
0 votes
1 answer
24 views

Necessity of CSRF Protection with ID Token Authentication in Firebase

I recently came across a statement in the Firebase documentation that suggests "CSRF protection should be taken into account." This guidance appears in the context of using an ID token for ...
Nobuhito Kurose's user avatar
-1 votes
1 answer
67 views

Is encoding random with module insecure? [closed]

The ID library Nano ID claims that modulo based encoding (e.g. Base64) would lead to uneven distribution in the output: Uniformity. random % alphabet is a popular mistake to make when coding an ID ...
deamon's user avatar
  • 99
3 votes
2 answers
74 views

Benefit of permissive Content-Security-Policy

I am new to the concept of Content-Security-Policy (CSP) so please forgive my ignorance. The site https://securityheaders.com parses headers and provides a score. For example unibet.com is awarded a ...
Andreas F's user avatar
  • 131
2 votes
1 answer
87 views

API key embedded in clients: how to defend against over-usage?

I am new to client-side development and I have a naive question. Right now, I'm using Google APIs (the map ones). If I want my client-side application / webapp to display a map, I would include ...
Rififi's user avatar
  • 157
0 votes
0 answers
69 views

Use a virtual machine to do risky stuff. How to stay as safe as possible? [duplicate]

I have a PC with Ubuntu and Windows in dual boot. I use this PC for basic stuff: Windows for gaming, shopping and common browsing, Ubuntu to do something such as home banking. I was thinking to create ...
koxige9113's user avatar
0 votes
0 answers
18 views

Is POST-based XSSI possible?

With standard XSSI, an attacker can include a remote script which contains user-bound secrets across origins, and then read them out. I have an endpoint which returns sensitive Javascript code, but ...
tim's user avatar
  • 29.5k
0 votes
0 answers
41 views

How to remove someone from our wifi network? [closed]

One of my mother's students, I don't know how, but he found out our home wifi password without our consent. He said he could scan it from our router. We didn't believe him at that time, but today he ...
Fading Sketches7's user avatar
0 votes
0 answers
43 views

MITM with forwarding between 2 hosts in the same network

I have 3 hosts in the same network, let's say their IP addresses end with: .10 (Host A) .11 (Host B) .12 (Host C) I want to sniff packets between A and C through host B, so that host B acts as MITM. ...
SempriGno's user avatar
2 votes
1 answer
62 views

How to feasibly digital sign high volume documents with CA issued digital certificate?

My organisation, say Acme, is building an e-signature platform where global businesses sign up and use the platform to send out e-signature requests. And when signers in a particular e-sign request ...
BambiBundle's user avatar
0 votes
0 answers
10 views

How Does a Database that Supports TDE Work In Practice? [migrated]

I'm very curious on how does TDE is implemented in practice. My goal is to get understanding on the usability constraint and possibility performance impact of applying such technique. Thus I'm trying ...
Mycotina's user avatar
  • 101
0 votes
1 answer
119 views

My personal info was leaked on the dark web through my Gmail Account; is it still safe to continue using said Gmail Account?

I have been using my personal Gmail Account for years to create accounts on a wide range of websites like evite.com and Instagram. Google conducted a dark web scan and created a report of instances ...
lcd12375's user avatar
0 votes
0 answers
54 views

How does admin identify routers connected to a network?

In my campus, we are provided with a LAN port to each room to access the internet. Also, they didn't allow students to use routers in their respective room. The only way one can access the internet is ...
Corrupter's user avatar
1 vote
1 answer
81 views

Does not storing passwords in browser really matter given cookie hijacking exists?

I see lots of articles suggesting not storing passwords in the browser, and it made perfect sense to me, if I can access this data easily, an attacker probably can too. But then I found out about ...
Arthur Moraes Do Lago's user avatar
0 votes
0 answers
83 views

Is linux really that insecure? [closed]

Recently, I came across this article where the author complains about the slow response to exploit protections in the Linux kernel and also highlights that CVE is a poor way to address vulnerabilities....
Mark Kern's user avatar
0 votes
1 answer
34 views

Is it necessary to implement both Content-Security-Policy and X-Content-Type-Options for ensuring the security of a website?

Is it necessary to implement both Content-Security-Policy and X-Content-Type-Options for ensuring the security of a website?
Vikas's user avatar
  • 9
1 vote
1 answer
32 views

Business impact assessments and quantifying impact

I have been looking into business impact assessments and I am confused about the "Impact" part. I have been asked several times about what the impact would be when a system fails, and it ...
Mattey's user avatar
  • 57
0 votes
2 answers
89 views

Is there a tool for auditing my root certificates?

Is there any tool out there that will monitor my system's use of root CAs? So far I have not found anything, and so I am hoping that this community will know if such a tool exists. For background, I ...
Cogitative's user avatar
0 votes
2 answers
69 views

Why spamassasin is doing dns lookup?

I have a server which have configured Amavis and Spamassasin (in default state only). I recently noticed log lines that probably indicate DNS query failure, below is an excerpt: Nov 21 11:15:40 ...
SUNITA GUPTA's user avatar
0 votes
0 answers
57 views

How can this friend of mine always find me on Reddit? [closed]

I met this guy online and became close friends for about a few years now. We often use Reddit to troll people, and that's that. I made alt accounts and made personal postings about my life, and ...
Daniel's user avatar
  • 1
0 votes
0 answers
34 views

OAuth2 component scopes

I'm currently implementing a system which consists of a collection of apps. Similar to the way Microsoft 365 consists of Word, Excel, etc. Ideally I'd like to log in once, then navigate between apps. ...
Andy N's user avatar
  • 502
0 votes
0 answers
31 views

Fail2ban not resulting in any update of IPTables

I have: Installed Fail2ban Created a local jail file. Changed lines within /etc/fail2ban/jail.local where enabled is mentioned x2 to true. Added enabled = true to the Asterisk section of the jail....
onerealbeanie's user avatar
24 votes
3 answers
5k views

Why is the absence of a Content-Type header with a HTTP 204 response considered a security vulnerability and what should we do about it?

We have recently developed a web application with a RESTful API backend. This web app need to have a certain security certification (something called PCI-DSS), and thus it is being scanned ...
Dantre's user avatar
  • 343
-1 votes
2 answers
106 views

What happens to the key pair once the CSR has been enrolled?

I have a key pair which I used to generate a CSR. Once I enrolled that CSR PKCS10, I get from the PKI (or CA) a certificate signed with the PKI private key. From here, I would like to know if my ...
MoBe's user avatar
  • 1
0 votes
0 answers
15 views

Using Gnupg with either a smartcard key or a local key

I added a second signing subkey to my GPG key, which I then moved to a Yubikey: /home/user/.gnupg/pubring.kbx ---------------------------- sec# ed25519/ABCDECAD 2023-11-12 [SC] ...(fingerprint ...
j0057's user avatar
  • 101
-1 votes
1 answer
27 views

Migrating Large Export of Dashlane, 1password, lastpass data to another password manager. Delete old sites?

I'm curious what is best practice. I'm migrating a large export of an existing password manager data like lastpass, 1password, or dashlane into another password manager. Some of these services marked ...
Patoshi パトシ's user avatar
0 votes
0 answers
6 views

Is it possible to detect Stealthy False Data Injection attack through chaotic cryptography? [migrated]

I am doing a research on detecting Stealthy False Data Injection (SFDI) attacks in a smart grid context (a related paper). Besides I am working on a chaotic cryptography (e.g. with Lorenz attraction) ...
rgholizadehr's user avatar
1 vote
0 answers
25 views

Is it fine if I share a .pfx self signed certificate generated inside my machine with other users to test and use PnPCore SDK

We want to develop some Azure functions which use PnPCore SDK. For testing purposes, I registered an Azure app which uses self-signed certificate for authentication. Now I configured the Azure app ...
microsoftdeveloperdesigner's user avatar
0 votes
0 answers
40 views

Can I setup and enforce additional WiFi connection (and password) requirements on managed laptops using Windows or MacOS?

Can I setup and enforce additional WiFi connection (and password) requirements on managed laptops using Windows or MacOS? Such as: blocking (or entirely hiding) the option to connect to open networks ...
Bob Ortiz's user avatar
  • 6,651
0 votes
0 answers
24 views

ZeroLogon possible false positive events 5827? (CVE-2020-1472)

ZeroLogon checklist: August 11, 2020 updates have been deployed on all domain controllers. February 9, 2021 updates have been deployed on all domain controllers. All devices are running Windows 10. ...
Amedee Van Gasse's user avatar
0 votes
0 answers
33 views

How To Address Email Deliverability Problems When From Header Doesn't Match From Envelope?

So I'm using Active Campaign as a CRM and have configured DKIM, SPF, and a DMARC none policy. I am having one particular customer of mine that's not able to receive my emails despite them ...
Hunter Nelson's user avatar
0 votes
0 answers
24 views

Why is proxmox PVE installed on this drive? [migrated]

Some background: I paid up person in my local area to install a live USB to two jump drives for my own use some time ago. I never used them. I did however load them up this morning because I'm trying ...
user22945870's user avatar
0 votes
1 answer
32 views

Shadow Credentials attack with TGT and TGS

I am trying to replicate Shadow Credentials attack in Active Directory environment. My initial approach was to: Use Whisker to create a new certificate on behalf of DC (successful): Whisker.exe add /...
Teodor Cristian's user avatar
2 votes
1 answer
111 views

What are good data-at-rest encryption strategies for sensitive data?

I need to protect sensitive data by doing data encryption at rest. Context : I have at least the data of 20 app to protect. I want protection from those with legitimate access to the virtual machine ...
loic midy's user avatar
1 vote
1 answer
64 views

How to tell if BlackByte NT ransomware is on my computer?

The company I work at sadly fell victim to BlackByte NT ransomware this week. It ransomed many of the Windows machines on our factory floor. I have used my personal laptop (Windows 10 Home, version ...
Intrastellar Explorer's user avatar
0 votes
1 answer
66 views

What happens at a low level when authenticating server certificates?

Regarding the TLS 1.3 Handshake Protocol: When the Server sends it's certificate, exactly how does the Client validate this? I know at a high level the Client is verifying the data the Server sent ...
rare77's user avatar
  • 145
0 votes
1 answer
53 views

Is it possible to combine RSA and XOR?

For my project in uni I need to combine asymmetric and symmetric cryptosystems. I wanted to do thing with AES and RSA but it's a little difficult for me and I want something easier. So I thought that ...
karalesus's user avatar
0 votes
2 answers
114 views

Kernel level attack?

In a Unix-like system, the concept of privileged and non-privileged users is used for security, preventing numerous attacks. When a non-privileged user executes malicious code at a normal level, the ...
Student's user avatar
  • 101
1 vote
0 answers
43 views

Using Android Wireless Hotspot while connected to Hotel internet via VPN

I want to make sure I understand the security implications of this scenario: I am staying in a hotel. I have a VPN on my android phone. I connect to the hotel's unencrypted WiFi network with the ...
stochastic's user avatar
0 votes
1 answer
104 views

Does Firebase App Check provide CSRF protection?

Quoting the OWASP Cheat Sheet on CSRF Prevention: Using the Synchronizer Token Pattern: CSRF tokens should be: Unique per user session. Secret Unpredictable (large random value generated by a secure ...
Joel Burget's user avatar
0 votes
0 answers
25 views

Subdomain vs Virtual Path discovery by bots

I have a website with a URL of lets say "123.example.com" where I am hosting a large ERP system. Does hosting the application at "123.example.com/myapp" provide any layer of ...
Freeman Helmuth's user avatar

15 30 50 per page