All Questions

Filter by
Sorted by
Tagged with
0
votes
0answers
21 views

Circumventing inbound traffic rule by faking reply traffic

My question is about security groups/firewalls and protecting a virtual private cloud from the external world. Here is a description of VPC default policy for inbound/outbound traffic (on AWS): ...
0
votes
0answers
26 views

The reason behind IPv6 adoption rate dramatical drop in China according to Google measurements? [closed]

Google has an IPv6 measurement page that reports that their numbers report on the percentage of users that access Google over IPv6. According to the report by Jan 2020 0.3% of users in China used ...
-1
votes
0answers
26 views

Public key of Elliptic Curve Digital Signature Algorithm [closed]

How do I compute my public key, if my private key for ECDSA in SHA-1 is equals to ab2c34b85dd576112f34? where: x = 54545578718895168534326250603453777594175500187 y = ...
0
votes
1answer
61 views

Why certain sites don't send newsletters to “anonymous” mail addresses?

I use an "anonymous" mail address (cock.li provider in my case). I have found that mainstream news sites in particular don't send their newsletters to such an addresses. It looks like the domains ...
0
votes
1answer
48 views

Very beginner question about JtR

I Have lost my zip file password and I tried to recover it with Windows 10, using John the Ripper 1.9.0 Jumbo. Things I know from this password: 9 to 11 characters Alphabetics A B E F and a b e f (...
-1
votes
4answers
131 views
+50

What are the benefits of enabling antivirus full scanning?

If AV auto-scan will detect and prevent the malware from executing why there is a need to enable schedule/full scans? I'm asking because a full scan can create sometimes overhead on the machine and ...
0
votes
0answers
33 views

Is VPN testing in a single region of China worth a reference? [closed]

Everyone knows that due to China's network regulation, users cannot use YouTube, Google, Twitter, and Netflix normally. If you need to use these network platforms in China, you must use a VPN to ...
0
votes
1answer
30 views

Security implications of using public subnets in AWS VPC for hosting web and job servers

I have been using AWS for hosting personal projects, mostly in the form of containerized Django web apps running on ECS with Fargate. I have referenced this article to better understand Fargate task ...
0
votes
0answers
34 views

How does the FBI seize websites if they cannot use the law? [migrated]

After doing some research about websites that have been taken down like Silk Road I have been extremely curious about the procedure that the FBI does to take down a website from the Internet. How do ...
0
votes
1answer
63 views

Why is my computer connected to amazon instances

When i run the command netstat -a to see the actual connections on my computer , i see all the time that my computer is connected to something like this ec2-xx-xx-xx-xx , not just one address it ...
2
votes
2answers
70 views

prevent/prohibit duplication of MFA software-token / ensure user identity

As I was unable to find any thread about this particular question, I'm trying to ask the community for help. We're currently using RSA RADIUS based 2FA to authenticate external VPN users from ...
-2
votes
1answer
115 views

How do sites bypass VPN and get geo-location? [duplicate]

There's a website and it shows two pieces of information for a user: "IP location" and "Detected location". When I used a VPN (and WebRTC off), the "IP location" changed to the VPN location, but the ...
0
votes
0answers
26 views

Google Gruyere - Ajax Json Stored Xss

I was doing the google security challenges here: http://google-gruyere.appspot.com/part2 I don't understand the solution for the Ajax Stored Xss part. So here's the problem summarized: Every user ...
0
votes
1answer
35 views

John the Ripper / Hashcat rule, reject candidate if char at position X is the same as character at position Y

I'm using John to generate some word lists and I'm trying to figure out the most optimized way to do the next step. What I want to do is add ever possible 3 digit number to a set where the first digit ...
0
votes
1answer
41 views

What are Security Considerations of Using File Upload/Comparison as Simplified Second Factor?

I am evaluating the idea of simplified second factor authentication by requiring a file to be uploaded, such as an image along with username/password. The file is stored on a user's device. My ...
1
vote
0answers
43 views

Can an SSL certificate be signed by two issuers at the same time? [duplicate]

Can an SSL certificate be signed by two issuers at the same time? Let's take an intermediate certificate as an example. It is usually signed by a root. A root certificate is often self-signed. In my ...
-2
votes
0answers
49 views

DNS Spoof Not Working [closed]

I was trying to use DNS spoofing in Man in the Middle attacks. But it didn't work. However, it did work for www.gmail.com once. I checked, and I could see that I was actually offline. Now I checked ...
1
vote
1answer
37 views

Is it possible to recover data from a Western Digital TRIM supporting disks (not SSD) after quick format?

I have a western digital blue disk, which is one of the SMR variations. I've heard that they support TRIM command. The disk is accidentally quick formatted on Windows 10, and now seems to be all zero. ...
0
votes
0answers
22 views

Stored Xss to Reverse Shell [closed]

I recently found a website where stored XSS vulnerability persists in edit profile. Can I use it to get an reverse shell or other users' data?
0
votes
0answers
29 views

How many times is taking mfcuk to find a key

I would like to copy a VIGIK RFID badge. It's MIFARE type badge. I've an ARC122 USB reader / writer and my OS is Linux like. I compiled mfoc and mfcuk successfully. First I tried to copy the badge ...
0
votes
2answers
52 views

Do you need to update a router that is set in bridge mode?

Since a router in bridge mode works like a modem, do you need to even update it?
0
votes
1answer
27 views

generate CSR with SAN does not seem to work. on centos 8

I have been trying to generate a CSR which includes a san of type OtherName. the generated CSR does not seem to have the SAN field. this is the configuration file: distinguished_name = ...
0
votes
0answers
18 views

Securing server-sent shaders

I have been implementing server-sent shaders using OpenGL for a game (GLSL version 1.20.8). Executing server-sent shaders on the client obviously is remote code execution, which tends to be a bad ...
0
votes
0answers
31 views

Why *is* PKCE recommended for single page JavaScript apps?

This question is essentially the opposite of Why isn't PKCE encouraged for Single-Page Apps?. In recent years, most OAuth API vendors seem to be have become unanimous in recommending that ...
0
votes
1answer
37 views

Risks of mobile printing

I know printers are a security hole. I am trying to get the best setup to minimize risk. Here's the risk that I am trying to mitigate : that an attacker remotely access the printer, and use it as a ...
5
votes
3answers
740 views

Should we encrypt all REST API calls from a mobile device?

I have a mobile application and the backend is hosted on a cloud provider. I would like to ask for feedback on encrypting all REST API calls that will be used to communicate with the server, if we ...
0
votes
1answer
40 views

Python Script POST Body Containing CRLF Characters and Malformed Headers. HTTP Request Smuggling

Lately I have been attempting Portswiggers WebSecAcademy's HTTP request smuggling labs with the additional challenge of writing a python script to complete the challenge for me. Intended solution ...
0
votes
1answer
46 views

Limiting number of combo attempts with Fail2ban and 128 bits of entropy

Apps such as Fail2ban and DenyHosts enable unix administrators to limit username/password combo attempts to typically 3 attempts. But why 3? Some admins enable more, like 6 or 8 giving honest users a ...
2
votes
0answers
52 views

Manually verifying signature in S/MIME mail with openssl

I'm trying to manually verify the signature in an S/MIME signed email with openssl as part of a homework. While I have the mail and can extract the chain of certificates, I'm failing to extract the ...
1
vote
0answers
50 views

Spike in activity with port 3379 (SOCORFS)

My personal IPs on AWS are being scanned for 3379. Apparently, this is SOCORFS, registered to one Hugo Charbonneau. This port is getting scanned a lot more often in recent months: https://isc.sans.edu/...
-1
votes
0answers
52 views

Quantum Cryptography Algorithms Implementations [migrated]

The Post Quantum Cryptography is a type of cryptography that lies on physics properties instead of mathematics , it has many algorithms and implementations like NTRU , McEliece , SIDH ... etc But ...
0
votes
0answers
48 views

how to send prime and generator of diffie hell-men to client over network node js?

I am using crypto module of node js for exchanging key using diffie-hellman algorithm. server.js const crypto = require("crypto"); const alice = crypto.createDiffieHellman(512); const aliceKey = ...
0
votes
1answer
43 views

How to find dates of a CVE?

Is there a way to find the date when a CVE (identified by the CVE-ID) is detected and the date when a fix/patch is available?
2
votes
0answers
42 views

OpenSSL : How do I add a AIA extension to a certificate

I'm currently using a self-signed CA certificate in a development environment and I generate certificates signed by this CA. I want to add an AIA extension to any new certificates I generate with the ...
0
votes
1answer
55 views

How to secure user folders on the server from the scripts running in other user folder on the same server?

I have a VPS. There is a web-application running on this VPS. A user can log into his account, create a project (the system automatically creates a folder for this project) and then, he can create and ...
5
votes
2answers
558 views

Can government track VPN traffic if it has control on both ISP and website server?

Let's say I access a website called example.com with VPN. Here's the flow: me → ISP → VPN → example.com Do typical VPN providers use the same IP address to receive data from ISP and send data to the ...
1
vote
2answers
69 views

Computer monitoring while working at home [duplicate]

I have a computer from the company and, while working at home, I would like to know if the company could be capable of monitoring or spying on my computer. I am not connected to any company's server ...
0
votes
0answers
35 views

WhatsApp group call and P2P connection [closed]

When we call someone with Whatsapp, as far as I know, first connection established via server (WhatsApp server, STUN) and then P2P connection established when possible. Is that same for group call? I ...
1
vote
0answers
49 views

Best Practices Setting Up an Enterprise PKI

I am interested in learning about setting up an (internal) enterprise PKI the right way. What's mostly clear to me is the technical part. Our PKI will implement an hierarchical trust model based on X....
-1
votes
0answers
27 views

sharing laptop, 2 VPN clients, but only one GUI [migrated]

The problem is that 2 people are sharing one laptop running windows-10, so they want to use VPN (different software, one is CISCO the other I dont know) but there is only one GUI on the laptop. So one ...
2
votes
0answers
41 views

What's the point of salting Double Submit Cookie (CSRF protection)?

Django web framework uses the Double Submit Cookie pattern for CSRF protection. (The CSRF token is sent in a cookie and also in a hidden form field. Incoming requests are checked for a match between ...
-1
votes
0answers
44 views

How can I encrypt something with a PGP private key?

I understand the normal operation is to encrypt with someone's public key and decrypt with the private. And I'm also aware of how signatures usually work. However I'd like to ensure that in order to ...
1
vote
0answers
53 views

Evade VPN fingerprinting

Some services, like https://2ip.io/privacy/, are able to detect (correctly) OpenVPN and its settings. For example, in my case: OpenVPN, AES, MAC is SHA512. How VPN fingerprinting works? I thought the ...
1
vote
0answers
45 views

REST API scanning using WebInspect

I am trying to scan our internal site's REST APIs using WebInspect. As the site does not yet follow the Open API Standards or use the Swagger tool, it does not have a .json file that contains the API ...
2
votes
1answer
75 views

X509 certificates - Are there any naming conventions?

As per the title, what are the naming conventions when buying certificates ? When buying a cert for TLS / https from a particular Server, naturally I will default to the Server name, for example, if ...
7
votes
3answers
181 views

I have lost control of my online identity due to mistakes made decades ago. What can I do?

About 2 decades ago (late 90s/early 00s), when I was still in high school, I opened up social media accounts online. Over the course of a few years and using these social media platforms, I posted ...
0
votes
1answer
43 views

New to IRC specifically BitchX, what is the best way to remain anonymous

when getting a list of users in a channel I can see all of my personal details. First question is this what everyone else sees, and second how can I make sure my full name is never visible.
0
votes
0answers
29 views

Is SecureBoot of any use if I keep my private key in a root accessible file?

According to the Debian wiki on SecureBoot, This removes the risk of userland malware potentially enrolling new keys and therefore bypassing the entire point of SB. So SecureBoot stops users from ...
0
votes
0answers
33 views

TAILS anonymous filesharing

I performed some research on filesharing and anonimity, but it turns out anything I read is not about what I need. Most articles and forums recommend not to use services like Google Drive or Dropbox, ...
0
votes
0answers
30 views

Is there a way to limit cookies to certain hosts in HTTP?

Using Nginx, I hope to restrict the permissible hosts for cookies. My initial intention was to employ a Content Security Policy for this purpose, but I don't see an obvious way to do this via a CSP. ...

15 30 50 per page