All Questions

Filter by
Sorted by
Tagged with
0 votes
0 answers
24 views

Matching the user IP on OTP

I'm not an expert on information security. But I'm thinking on a way to improve the security against social engineering attacks on the OTP password through SMS. We know that in some cases careless ...
2 votes
1 answer
70 views

Does a SSH pubkey or private key contain the key comment?

I know that a ssh id_something.pub key by default contains a comment user@host for where it was created. But is it also contained in the key itself? On one host it seems that ssh -vv somehow got the ...
  • 3,277
0 votes
1 answer
50 views

When to use application layer encryption

When to use application layer encryption? Is it important in backchannel communication (machine-to-machine) without users? And e.g. when we create state in OpenID Connect's client and redirect the ...
0 votes
0 answers
11 views

TLS1.2 Handshake to SharePoint Online Failing from Windows Server 2012 R2 [closed]

Having some trouble communicating with our SharePoint Online (SPO) site. I am simply going to a browser (IE v11) on a Windows Server 2012 R2 VM and navigating to the SPO home page. In Wireshark I see ...
  • 1
-1 votes
0 answers
29 views

Tool to automatically collect email from crawled pages [closed]

I'm looking for a way to check for emails on the pages of my domain. Is there a crawler that can do that?
0 votes
0 answers
30 views

Is AirPlayXPCHelper a normal process? It keeps restarting [closed]

This was found in Activity Monitor - when the process is quit, it constantly reboots and there was more than one, it's the last one that reboots all the time. Parent Process: launchd(1) User: root(0) ...
0 votes
0 answers
26 views

How dump only corrupt data in sqlmap [closed]

I am dumping a column of large table with almost 200000+ entries. I am running sqlmap for weeks to dump that column. But the problem is sometimes sqlmap extracts corrupt codes like @@ as shown in the ...
  • 59
1 vote
0 answers
20 views

Presenting users their API Keys on frontend

I'm not talking about showing them a popup upon api key generation, where the user is specifically warned about the fact that This is the only time you will see it. Make sure to save this to a safe ...
  • 11
1 vote
2 answers
58 views

Job prospects for Red Teaming in cloud security?

I want to make my career in cyber security, but am confused which field to choose. According to this Burning Glass report, https://www.burning-glass.com/wp-content/uploads/2020/10/...
  • 11
0 votes
0 answers
57 views

What are the security benefits or concerns about upgrading to Windows 11?

My Windows 10 machine is saying that I should upgrade to Windows 11. It even says that it brings "enhanced security". Upgrading always brings a measure of uncertainty and while upgrading ...
  • 124k
1 vote
1 answer
30 views

Distrusting a cross signed certificate

Consider the following scenario OpenSSL and x.509v3 is used. You have 2 CA's: CA1 and CA2. Both CA's have cross signed each other, meaning CA1 has signed CA2 and CA2 has signed CA1. When CA1 signed ...
  • 78
0 votes
1 answer
30 views

Security headers: Are they needed on subsequent requests (eg. Scripts, Images) after they have been sent on the main HTML request?

I had a discussion with PenTesters at my company today, who have said that security headers, like for example Content-Security-Policy, Strict-Transport-Security, Referrer-Policy and Permissions-Policy,...
1 vote
1 answer
58 views

What is the purpose of PGP email signatures?

As far as I understand, the only purpose of PGP signatures is to prove your identity. Assuming your email account is secure and has 2FA, haven't you already proven your identity by sending an email ...
user avatar
0 votes
0 answers
16 views

What would you see in Wireshark if you did arp poisoning on a device that is arp poisoning your device? [closed]

Let's say you did arp poisoning on another person's computer and then they did arp poisoning on your computer while you were doing arp poisoning on their computer. What would you be seeing in ...
0 votes
1 answer
43 views

When hardening my SSH key, why would I use yubikey-agent instead of the built-in `-sk` key type native to OpenSSH?

OpenSSH 8.2 added -sk key types that allow for FIDO/U2F hardware authenticators (like a YubiKey, etc.) yubikey-agent allows for the same functionality, except it (a) requires an additional client on ...
1 vote
2 answers
104 views

Is it OK to use client TLS certificate for site login instead of username/password?

Is it OK to just use a client's TLS certificate as a way of logging in to a website? What are the drawbacks? Is there any real system doing it? Normally, there is mutual client/server TLS ...
0 votes
0 answers
12 views

openvpn windows how to setup [closed]

I have ipv4 proxy (although I can change its type to socks5) , it looks like this: 11.17.33.11:8000:XMcor6:2Zg2xW And now I want with open vpn( or any other programm to setup secure connection ...
0 votes
1 answer
42 views

Creating a wordlist based on a password given [closed]

I have a password with the example of buddy9221!! Using John The Ripper or Crunch, how can I generate a password with buddy 4 numbers and two special characters?
42 votes
3 answers
9k views

Reasons to distrust Let's Encrypt certificates

We have a service running behind https and we are using SSL certificates from Let's Encrypt. The problem is that one of our clients distrusts Let's Encrypt CA and on certificate renewal it requires to ...
1 vote
1 answer
70 views

Is redirecting back to login page bad practice/insecure

One of our company sites redirects all bad URLs back to the login page which is required to even access the site. Is this insecure? It feels like it may cause some weird issues as I have never seen ...
  • 13
0 votes
0 answers
18 views

Two access-control-allow-origin headers displayed in response

I was testing CORS on a web application and when I tried to change the origin to another domain using a web proxy, I saw two access-control-allow-origin headers in the response, one containing the ...
0 votes
1 answer
24 views

Anyconnect VPN whitelist physical devices [duplicate]

My company uses Anyconnect VPN of Cisco, and any company PC device is required AD username/password to access the network. I'm thinking about the case when an employee copies the whole windows (copy ...
0 votes
0 answers
10 views

Expectation of surveillance camera vs iphone. Resolution vs field of view [migrated]

I'd like to be able to identify licenses plates as they enter our cul-de-sac. My question is triggered by a comparison between an Arlo Pro 4 and an iPhone 12. The iPhone produces extremely high ...
0 votes
0 answers
16 views

Smardcard-Login and LDAP-Webinterfaces

If "smartcard required" is ticked in an active directory user account the password is wiped. In my enviroment there are a lot of applications with webinteface logins connected via ldap to AD....
0 votes
0 answers
11 views

Appending Data to LNK Shortcut File [Emotet TTP]

There has been a rise in the use of LNK shortcut files to deliver malware, in particular Emotet. Within the LNK file is a payload (usually a VBS script) that is found with findstr.exe. The payload is ...
0 votes
0 answers
4 views

Find/Remove suspected virus/malware on macbook air (mapi.sport80.com) [migrated]

I've found a program running on a friend's Mac that is under the name "mapi.sport80.com" in screen time & it has been running consistently for 5 days straight, it looks to be accessing ...
0 votes
0 answers
40 views

Which of these filesystem encryption philosophies and methodologies are better for which purpose?

Currently on the "FLOSS market" there are multiple options for encrypting remote cloud storage following different security models and different philosophies. To name a few: encfs (I guess ...
0 votes
1 answer
178 views

Identifying a ransomware with .mkp file extensions

Yesterday, a ransomware hit my PC. I didn't pay the ransom and didn't comply with what the attackers were asking for and I wiped everything and every drive on my PC and then reinstalled my stuff from ...
0 votes
3 answers
54 views

Can secret recipients be included in PGP cryptography

Can we be sure that a cleartext message that becomes encrypted by pgp or openpgp which is intended for one-or-more specific recipients doesn't also get secretly decipherable by a third party? Since i ...
  • 1
0 votes
0 answers
11 views

Unable to view VPN traffic for analysis [migrated]

I am currently working on a VPN client application. I want to analyze the app's network communication but cannot get any traffic in TCPView Sysinternals tools. What's the issue here? Am I missing ...
  • 36
0 votes
0 answers
16 views

Continuous Automated Red Teaming (CART) vs Breach and Attack Simulation (BAS)

Both the terms are similar i.e. they automate the manual task of red teamers. But what's the difference between them? Are they interchangeable?
  • 11
1 vote
0 answers
15 views

Using GPG is there a way to label public keys on my OpenPGP keyring?

I am unable to identify certain public keys on my keyring because the key owner generated their public key using a UID that contained no identifiable information. For instance they're completely ...
  • 11
0 votes
0 answers
23 views

Firewall necessity [duplicate]

Without a program, which accepts incoming connections, you wouldn't have an open port, even if the firewall is disabled. So why is the firewall necessary?
0 votes
0 answers
25 views

How to use Hydra in Kali Linux with Ajax form?

I have a website that contains a login form, which works with Ajax jQuery. I am using Burp Suite to intercept requests to this form. Burp Suite returns this when I try to log in: POST /php/process.php ...
0 votes
1 answer
66 views

Linux x86_64 Assembly works standalone, but Segfaults when ran as shellcode in C

I wrote a NASM program that uses the execve system call to run wget inside a newly spawned shell and execute the retrieved page: [bits 64] global _start section .text _start: xor rcx, rcx ...
0 votes
0 answers
29 views

Self-encrypting drive - eDrive vs ATA Security

Let's for a moment forget about the possible drawbacks of SEDs themselves. One of the upsides of SEDs is that the encryption key never leaves the drive but wouldn't using eDrive negate this advantage ...
0 votes
0 answers
16 views

How to extract the primary user id from a PGP key

I am writing a front-end to display details about the PGP keys that we have stored in a database. One question I have is how to know which user id is the "primary" user id. For example, a ...
2 votes
2 answers
237 views

Web application discovery: Can there be virtual hosts configured even when there is a response without host header?

I'm currently learning how to discover web applications running on a machine using port scanning, vhost bruteforcing and directory fuzzing. When it comes to port scanning, there is one thing I can't ...
  • 125
2 votes
0 answers
45 views

Is WPA3 mixed mode less secure than pure WPA3?

I want to use WPA3 alone, but it seems that a lot of devices I have only support WPA2, so I have to enable WPA2 in one way or another. Currently, I have created two Wi-Fi networks on the same router: ...
0 votes
1 answer
32 views

SSTP VPN security feature

Do we know exactly whether and for which parts of the packet confidentiality and integrity properties are guaranteed using SSTP VPN? Specifically confidentiality is enforced on the header of the ...
  • 3
1 vote
0 answers
42 views

What damage can a malicious wifi hotspot cause? [duplicate]

I've just seen a Youtube video with an advertisement for NordVPN in which they claim that NordVPN would protect passwords when people are on potentially malicious coffee shop WLAN. That seems strange ...
  • 3,902
3 votes
2 answers
134 views

Is it safe to use an untrusted server for an SSH jump?

The question is a thought experiment. Junior works in IT at Finsurance Corporation™. He works from home now, and has to VPN into work but hates it because they've blocked Gmail and Reddit. Junior ...
  • 173
0 votes
1 answer
39 views

Why did Nmap not yield results when scanning a friend's public IP address? [duplicate]

I am trying to learn more about Nmap but it seems like it can only really give any information if you're actually connected to the network you're scanning on. For example, a friend and I gave each ...
0 votes
0 answers
44 views

The request contains no certificate template information

I am trying to create a CSR from MMC on one of our servers. I have previously submitted a lot of requests without any issues by going to MMC. Certificate folder > Select "Personal" > ...
  • 415
0 votes
1 answer
20 views

Deploy to Digital Ocean droplet from Github Action - Should I leave the SSH port open for future deployments?

I'm going to a deploy a web app (angular static frontend and node backend in docker) to digital ocean droplet. Deployment is done from Github Action by essentially loging via SSH to the droplet and ...
1 vote
0 answers
25 views

Can an Android app with device management and microphone permissions spy in background secretly? [migrated]

As far as I know, since Android 12 an app needs to have a Foreground Service Worker (with an active permanent notification) to run in all the time without being stopped when no activity is in ...
0 votes
0 answers
9 views

How to install cloud software locally for security research [migrated]

How you can test cloud software locally? For AWS, there is Localstack, but what about Google Cloud, and Azure? I want to try it, change a lot of configurations and maybe install some software there, ...
0 votes
0 answers
17 views

Adding an email address to my Outlook mobile app will give the Office 365 admin ability to access my mobile phone? [migrated]

I work as a freelancer for many companies. For each company, they create an Office 365 account for me. To manage those emails, I am planning to download Outlook mobile app on my iPhone and add all ...
  • 101
0 votes
0 answers
26 views

Is Google Cloud Database encryption with customer specified keys PCI and / or HIPAA compliant?

Amateur Question... We've written a SaaS application that runs in Google Cloud on a GCP-managed MySQL database. We now need to make our application PCI and / or HIPAA compliant. I know we need to ...
  • 101
0 votes
0 answers
10 views

How can I add secure DNS (DoH) to Windows settings before Windows makes any connections to the Internet during installation? [migrated]

Is there a way I can add DNS over HTTPS details to Windows settings before it makes the first connection to the Internet during installation? I'm using the latest version of Windows 11. Either by ...
  • 1

15 30 50 per page