All Questions

Filter by
Sorted by
Tagged with
0 votes
0 answers
52 views

How to fix metasploit handler?

My Termux Meterpreter doesn't work. Commands: msfconsole set Proxies http://185.107.56.83:443 use exploit/multi/handler set PAYLOAD windows/meterpreter/reverse_tcp set LHOST 0.0.0.0 set LPORT 8080 set ...
Duck's user avatar
  • 11
1 vote
1 answer
172 views

Recommended way to store password that needs to be used as plaintext?

I'm making an application that logs multiple accounts into a game server. I'm able to do this by passing in the username and password as argument parameters to the game executable. Unfortunately, I ...
HandmadeWeakness's user avatar
1 vote
1 answer
147 views

Now that `sshcontrol` has been deprecated, how to use gpg key for ssh authentication with an agent?

The GnuPG Manual states that: This [sshcontrol] file is deprecated in favor of the "Use-for-ssh" attribute in the key files. What is now the correct way to configure gpg / gpg-agent to use ...
a2k42's user avatar
  • 123
14 votes
4 answers
6k views

Security of a non-random password but that relies on information an attacker cannot possibly know

I am trying to figure out whether a non-random password that relies on information an attacker cannot possibly know can be secure. To give an example, let’s say that I generate my password by putting ...
hb20007's user avatar
  • 559
1 vote
0 answers
57 views

Group admin in end-to-end encrypted group chat

I was thinking about building a simple end-to-end encrypted chat with group chat capabilities. Please keep in mind that 1) it's just an experiment to help me learn more about cryptography and 2) I'm ...
Tryer outer's user avatar
0 votes
0 answers
23 views

Does Vault (or basically any other system) require TLS when it only connects to a host on the LAN? [duplicate]

I'm trying to understand where TLS is required. I've heard that TLS encrypts data when a client communicates with a server through HTTP by verifying the server and passing encryption keys. This ...
Steven Kristian's user avatar
1 vote
0 answers
20 views

Can't print hexadecimal formatted address in buffer overflow

I'm trying to overwrite the return address caused by a buffer overflow. I've already calculated the distance between the buffer and the return address. The address that I want to jump to is ...
CJG's user avatar
  • 71
2 votes
1 answer
109 views

Does having 2 different cyphertexts for the same plaintext help an attacker

I'm considering using key rotation for a website. Let's say I generate new keys every month. In Jan someone saves a URL on their browser, let's say in plaintext it's https://example/12345 encrypted to ...
Adam Benson's user avatar
0 votes
0 answers
62 views

How can I safely write in my resume that I have written a MetaSploit exploit module without making employers nervous?

I have asked this question on The WorkPlace SE site and did not receive any comprehensive answers over there. I have around 10 years of cybersecurity industry experience and have gained proficiency ...
Anthony's user avatar
  • 1,756
0 votes
0 answers
28 views

Why is selecting a code in banking app necessary for MFA? [duplicate]

At my old bank, logging in via a browser required that I open their app on my phone and tap a button to authenticate my login. My new bank is very similar but instead of a single button to click, I ...
user2132672's user avatar
0 votes
0 answers
55 views

Is this X509 Subject field, with no space between 'jurisdiction' and an RDN, correctly formatted?

I recently purchased a new EV certificate (having previously used an OV certificate) and have successfully used it to sign my files. However I'm getting a lot of warnings from Microsoft Defender about ...
Dan Gravell's user avatar
0 votes
0 answers
64 views

AWS Key stolen out of Github Actions / Secret Store

Do you have an idea how my AWS credentials could be stolen in the following setup: A 4 weeks old GitHub organization with 5 repositories & AWS Account AWS CI User Credentials with Administration ...
user1845948's user avatar
24 votes
5 answers
9k views

Should I be worried about unusual SSH login attempts from unknown IP addresses?

I've been monitoring my server's SSH logs and noticed a steady stream of login attempts from unknown IP addresses, mostly from different countries. Heaps and heaps of account names are tried, and with ...
security_paranoid's user avatar
1 vote
0 answers
16 views

How to enable USB debugging mode when it has been disabled [migrated]

I have a Samsung Android which I am almost certain has malware/a rootkit on it. I'd like to take a forensic image of the device. In developer mode, the 'USB debugging' mode is shaded in and set to off....
chickenj0's user avatar
0 votes
0 answers
38 views

WAF vs. Application Layer for Bot Mitigation

In a layered enterprise security architecture with a Web Application Firewall (WAF) deployed in the DMZ, should there be shared responsibility between the WAF and application layer/ microservices for ...
Fahim Farook's user avatar
1 vote
1 answer
48 views

Why do OAuth2 PKCE authorization codes have client_id?

If I'm understanding OAuth2 PKCE right, it is to be used in cases where a client cannot be trusted to hold onto a client secret. I also understand (reading RFC 6749) that a client id is not a secret. ...
Cort Ammon's user avatar
  • 9,248
0 votes
0 answers
28 views

Why am I having trouble capturing and transmitting ARP packets to increase data in a WPA2 network injection attack?

I'm trying to inject packets into my own WPA2 network and rapidly increase the data packets. I've followed these steps: Connected my wireless adapter to my Kali Linux machine. Put my wireless adapter ...
Mohammad dehghani's user avatar
0 votes
0 answers
47 views

Overcoming Middleware: Exploiting XSS to Retrieve Data

I am attempting to perform an XSS attack on my server and have successfully bypassed the CSP. In my server code, I store all users in the following manner: .get("/users", adminReq, (req, ...
EPiez's user avatar
  • 13
1 vote
1 answer
125 views

Library to securely expose query language to end user?

I have a DB that I would like to expose to end users for flexible search through their data. Currently using Elastic, but not tied to that: I can internally transform the data in any way to enable ...
curious-bunny1's user avatar
1 vote
0 answers
48 views

Overcoming Cookie Theft Barrier in XSS Attack despite CSP Implementation

I have a website that includes CSP rules: .use( helmet.contentSecurityPolicy({ directives: { defaultSrc: ["'self'"], scriptSrc: [ "'self'", "cdnjs....
EPiez's user avatar
  • 13
0 votes
0 answers
19 views

Google SAML auth not working through APP tile but works with direct link

We've recently migrated from Okta to Google for work for AWS authentication. Our amazon org authentication is setup through IAM Identity center. It was working flawlessly using Okta but since we ...
JeanneD4RK's user avatar
11 votes
3 answers
3k views

What security risks do you see with wrong OTPs appearing in application logs?

An application is logging wrong OTPs (but not correct OTPs). I asked the application developers to not log wrong OTPs because I do not see any benefits. However, they do not want to modify the ...
King Lance's user avatar
0 votes
0 answers
69 views

John the Ripper not working properly

I am new to JTR and am currently trying to crack some passworts I generated. Because I am new to JTR, I wanted to start by hashing a simple password like "Cat", write it in a file named pw....
darquis's user avatar
0 votes
0 answers
12 views

How do I remove a certificate from (RedHat) Linux ca-trust? [migrated]

I installed a duplicate certificate for a CN in the ca-trust store of my RHEL8 systems. I added the PEM file to /etc/pki/ca-trust/source/anchors and ran update-ca-trust. How can I remove the ...
bbaassssiiee's user avatar
0 votes
1 answer
78 views

Bypassing CSP and implementing XSS attack

I am using Content Security Policy (CSP) rules in my code to defend against XSS attacks. Here are the CSP rules I have implemented using Helmet: .use( helmet.contentSecurityPolicy({ directives: { ...
EPiez's user avatar
  • 13
0 votes
0 answers
44 views

How to add accounts management to a legacy blackbox application?

I have a legacy non-commercial (in-house) application that is distributed over several workstations on a private VLAN. I have to make it conform to some cybersecurity standards, but can barely modify ...
lalebarde's user avatar
  • 617
2 votes
2 answers
65 views

Best Practices for AES: Fixed Key with Unique IV vs. Unique Key with Fixed IV

I'm working on implementing AES256 encryption for file security and am considering two different strategies: Using a fixed key with a unique initialization vector (IV) for each file. Using a unique ...
petertc's user avatar
  • 121
4 votes
2 answers
959 views

How does a password prevent an evil twin if the password is publicly known?

This discussion of WPA3 OWE seems to imply that WiFi at Starbucks/the airport/whatever can be secured against an evil twin attack if they use WPA3-Personal instead of OWE. But it seems like that ...
Ethan Reesor's user avatar
3 votes
1 answer
104 views

Why does OWASP recommend only 1 degree of parallelism for Argon2id

Referencing this document, they give justifications for a number of their recommendations, but not any behind only going with 1 degree of parallelism for using Argon2id. Is there a reason why this is ...
Jesse C. Slicer's user avatar
0 votes
0 answers
48 views

Why whatsapp only let you create 1 passkey?

Whatsapp is rolling out passkeys. I don't think backing up passkeys in a password manager is a good idea. I'd like to have device bound passkeys but they only allow me to create one. How should I be ...
Gatonito's user avatar
  • 363
0 votes
0 answers
25 views

Which groovy is safe from gadget chains?

I have a java deserialization vulnerability, with a poc. The poc exploits using the groovy library, and the groovy version is 2.4.19. When searching online for a CVE related to this gadget I couldn't ...
anonymous's user avatar
0 votes
0 answers
47 views

Content security policy (CSP) reports that seem unrelated to the web app

I've setup Content Security Policy (CSP) on a web app. For the time being it's set to report only so that I can assess it first in production and then turn it on if things get clear. But so far they'...
Robert Koritnik's user avatar
1 vote
1 answer
69 views

Login with roles without internet

Disclaimer: question orignally posted here but i was encouraged to ask it in this stack instead. Introduction part I'm writing an application that requires authentication to be used, specifically the ...
Nifil's user avatar
  • 113
0 votes
1 answer
119 views

Can a USB stick be made to automatically hack a system?

I am a cybersecurity professional who is interested in researching the field of injectables. Does a device exist, or can be made, that if plugged into a computer would instantly start attacking the ...
Julius Santiago's user avatar
0 votes
0 answers
73 views

How does ransomware store their decryption keys? [duplicate]

I've recently got into cyber security and really got into malware, more specifically, ransomware. While studying some of the strongest ransomware ever (example: WannaCrypt, CryptoLocker, etc...) I've ...
JoshuaKasa's user avatar
0 votes
1 answer
64 views

(Advanced) client-side session handling in browser

Is there a way (maybe via browser extensions) to make sessions forcefully expire after a while, even if the server side is set for longer durations? e.g. you authenticate to example.com and it starts ...
Aethalides's user avatar
2 votes
3 answers
150 views

Should one be concerned about public keys being copied to wrong servers accidentally?

I am currently automating the setup of a web server with Ansible. My two team mates should be able to run the Ansible playbook as well. Therefore, their public keys need to be added to the ...
rmoestl's user avatar
  • 121
0 votes
1 answer
56 views

Should I validate json web tokens on my app backend or login backend?

I wrote a login backend with express.js to provide authentication (through LDAP) and authorization (through a database of authorized users for each app on mysql). This backend generates jwt and sends ...
Harry Z. Huang's user avatar
4 votes
1 answer
335 views

Find password decryption used in MSSQL

I have the 2 encrypted passwords in my MSSQL database and I'm trying to decrypt it. Here's one of the encrypted password: E4-68-3F-BE-91-CC-BE-B9-27-4B-18-B1-5F-1B-39-66 The password to the above ...
Elaine Byene's user avatar
0 votes
0 answers
24 views

If I'm rolling out MFA to users, should I provide TOTP, SMS or both? [duplicate]

My site's users currently do not have any MFA options, but we're planning to release this feature in the near future. We've already built support for TOTP and have it working internally, but some on ...
Ben Johnson's user avatar
13 votes
6 answers
7k views

Is it impossible to protect an API from data redistribution?

Say there is a frontend mobile app and a backend server (let's call this service MyApp) which hosts an API for the mobile app to connect to. The backend server makes any needed requests to third party ...
Jiehfeng's user avatar
  • 233
0 votes
0 answers
25 views

Difference between Spire node attestation with VM instance identities and Kubernetes projected service account tokens

We deploy Spire to self-managed Kubernetes clusters on hyperscaler VMs (i.e. AWS EC2, Azure VMs, GCP Compute Engine) Technically speaking, we could set up node attestation either based on VM instance ...
mlenkeit's user avatar
  • 101
0 votes
0 answers
76 views

Is it possible to hide a secret value from my own processes on Linux?

I have an application with a shared secret. This application runs as my user. However, Linux has the /proc directory, and particularly /proc/{pid}/mem and /proc/{pid}/maps. Any process created with ...
Cort Ammon's user avatar
  • 9,248
0 votes
0 answers
65 views

httpOnly Session Cookies in an iframe context in the future w/o SameSite=None

My website is using session cookies (w/ SameSite=Lax, secure, httpOnly attributes) and a CSRF Token stored in localStorage. Recently I developed a teams app, which essentially loads the website ...
user4503817's user avatar
1 vote
4 answers
135 views

How do you rate limit bruteforce attempts on a Tor hidden service?

I'm considering the feasibility of a .onion domain for my website to cater to privacy conscious users. Actions that occur before there's a known UserID (eg. login page) need to have a bounded number ...
anthonyryan1's user avatar
-2 votes
2 answers
233 views

Why is Telegram's server-side code closed source?

Why is Telegram's server-side code closed source, but the client code is open source? Does having closed source servers improve its security? Telegram FAQ page: Q: Can I get Telegram's server-side ...
Geremia's user avatar
  • 1,753
0 votes
0 answers
24 views

Making a safe certifcates system for an actions API [duplicate]

I have been working on a certificate system for use (as a means of authentication) with my accounts system APIs. I am still thinking out the details, I have only watched a few videos on asymmetric ...
0xENDER's user avatar
1 vote
3 answers
193 views

Can my phone got infected if visit my mail inbox without opening any mail attachments?

I've found some articles saying some viruses/malware can attack your device by just opening an email without downloading or opening any attachments. Is this true? If yes, how risky for ordinary mail ...
Sasi Bulan's user avatar
0 votes
1 answer
97 views

Why Ransomware generate keypair in victim?

I read this answer Ransomware encryption keys and understood how wannacry works. But I still have a question: as I understand, the hacker will put the hacker's RSA public key in the malware, the ...
Thanh's user avatar
  • 1
0 votes
0 answers
33 views

Is it possible to see HTTPS traffic without intercepting? (With a copy of the traffic) [duplicate]

I have a WAF solution that can work both inline and out-of-band. And we want to try the OOB option first. And possibly want to see HTTPS traffic as well. But the vendor says if we want to see the ...
Sjomann's user avatar

15 30 50 per page