All Questions

Filter by
Sorted by
Tagged with
0
votes
0answers
39 views

How can I pass secrets to a compromised container without the attacker being able to see them?

The most common method of passing secrets to a docker container is through ENVs. The problem is: Imagine that your docker container is hosting a HTTP server that can have a security exploit (like any ...
0
votes
0answers
4 views

Can a non-admin user sniff network traffic? [migrated]

Is it possible for a non-administrator/non-root user in Windows/Linux to sniff network traffic? With or without third-party tools?
0
votes
0answers
37 views

Tech blogs for cyber security [closed]

What are some good news/tech blogs for cybersecurity which one could follow to keep oneself updated on the latest developments, news and threat discovery
0
votes
1answer
50 views

How could someone exploit a host header injection vulnerability that only effects the responses Location header?

If I go to the http site e.g. http://www.example.com the site will redirect (code 301) to the https version https://www.example.com. On various pentests I observed that if I modify the Host header in ...
0
votes
1answer
49 views

Open redirect adding symbol

I know there are some questions around open redirects but with this one I have some additional questions. In order to not release the assets I am going to replace the asset with "exampleeee.com&...
-1
votes
0answers
31 views

Signing a text file using a pfx file in java [closed]

I'm very new to java cryptography. I'm trying to use a .pfx file that contains a public key, it's private key and a digital certificate to sign a text file. I have been able to access the private key ...
0
votes
1answer
54 views

Does john the ripper not support yescrypt?

I'm learning about password attacks using john and am trying to use it for bruteforcing my shaddow file. I created a user called newuser with password stuff and then used sudo unshadow /etc/passwd /...
3
votes
2answers
246 views

A runtime sometimes converts string arguments (or string returns) from WTF-16 to UTF-16 between functions in a call stack. Is this a security concern?

Suppose that we have this code (in TypeScript syntax): function one(str: string): string { // do something with the string return str } function two() { let s = getSomeString() // returns some ...
12
votes
2answers
2k views

Any plans/research for SSL-like method in telephony?

I have recently read about attacks using Caller ID spoofing technology. Criminals used it to impersonate bank or police employees and asked to install malware or transfer money to a given account. A ...
5
votes
0answers
174 views

Windows Defender catches Trojan right after clean install

I recently upgraded some desktop PC components (GPU, SSD). I decided to perform a clean install of Windows 10 onto the SSD. I used a USB created using the Installation Media tool provided by Microsoft,...
0
votes
1answer
143 views

What stops a bad BIOS lying to the TPM?

I've learned that a TPM can supposedly attest to the state of a computer's BIOS being good. It does this by asking the BIOS to send a hash of its current state. So what stops a compromised BIOS from ...
0
votes
1answer
51 views

How to mitigate risk of spoofing / Impersonating in OAuth Device flow ( device code flow ) in Azure AD?

I have developed C# application and hosted it as a windows service on a machine http://localhost:5000 . This application registered in `Azure Active Directory Application is using the below details in-...
0
votes
1answer
54 views

Does data recovery of file depends on its extension?

Most free to use data recovery tools (Recuva, Easus, MiniTools) offers good recovery with known file extensions for picutres, videos and documents (.png, .xlsx etc). But lesser known file extensions, ...
0
votes
0answers
37 views

What and how should IP addresses and URLs be protected for HIPAA? [closed]

In the HHS Safe Harbor Method on this website, Universal Resource Locators and Internet Protocol Numbers are considered ePHI or PHI (protected health information) elements. I believe they are also ...
0
votes
1answer
75 views

Using ATA Secure Erase after buying a second-hand laptop : is this enough?

I bought a second-hand laptop from a stranger. My (totally unjustified) concern is that there might be malware on the device. According to this answer, there is no easy fix if it's malicious firmware. ...
0
votes
3answers
67 views

How to generate malicious input at processing stage?

I am developing an application and It needs to be highly secured. Because of that reason, I am researching more security vulnerabilities and I found the below paragraph. This is related to input ...
1
vote
1answer
58 views

E2E-Encrypted Storage: How to detect that data has been rolled back?

I am aware that it is possible to use a block cipher with the GCM-mode to provide authenticity, but this does not completely do what I need. I have a cloud storage provider I do not completely trust, ...
0
votes
1answer
47 views

Is a consent screen in an OAuth 2.0 implementation optional

I've read through RFC 6749: https://datatracker.ietf.org/doc/html/rfc6749 The only mention of consent is in this bit: The authorization server MUST implement CSRF protection for its authorization ...
0
votes
1answer
64 views

E2E-Encrypted storage: What to do when the lifetime of a key is over?

When using AES-GCM-256 with random nonces, a limit of 2^32 encryptions is specified in order to have a low nonce collision probability. A new key has to be generated to take its place afterwards, I am ...
1
vote
2answers
94 views

Is there way to know what headers can be accepted by HTTP server?

Imagine that there is server required authentication for getting an access to some endpoint. And developer added some logic to bypass the authentication: if server recieve HTTP header give_me_access=...
0
votes
2answers
62 views

What is the purpose of “certificatePolicies” in a CSR? How should an OID be used?

While looking for the best way to add multiple Subject Alternative Names (SAN) to a Certificate Signing Request (CSR), this namecheap article provided the following command: openssl req -new -addext &...
2
votes
1answer
63 views

SubtleCrypto with non-extractable keys stored in IndexedDB - Cross Origin Usage

In a browser I want to use SublteCrypto (https://developer.mozilla.org/en-US/docs/Web/API/SubtleCrypto) to create a key pair and store it locally in the IndexedDB (https://developer.mozilla.org/en-US/...
0
votes
0answers
25 views

Can't write to /etc/shadow with “echo” but with “nano” i can [migrated]

My goal is to write in /etc/passwd to escalate privileges to root. i generated password "test1" for the new root user : openssl passwd test1 and i use echo to append a new entry in /etc/...
0
votes
1answer
58 views

Why doesn't ISO27001 mandate an acceptable use policy?

I'm going through my first ISO27001 implementation and I can't seem to find a definitive list of what policies are required. I realise Annex A is "optional". I've found lists online a few ...
0
votes
0answers
46 views

Does azurevpnconfig (Azure) contain security-relevant information?

I created a new VPN gateway inside my Azure environment (OpenVPN SSL with AD authentication). After that, I downloaded the profile/config file which contains azurevpnconfig. With this file, the ...
0
votes
1answer
99 views

Sealing a pass-phrase with the TPM and associating it with a file state

Is there a way to associate the state of an arbitrary file to a tpm2 PCR value? I want to seal a secret pass-phrase onto the TPM, and I want the TPM to be able to unseal it only if the file is not ...
0
votes
1answer
127 views

Could there be malware in a video on twitter? [duplicate]

I don't know anything about security. I want to download the videos I like from twitter. And I'm not going to do it by writing a program. I will manually find the necessary link in the html document ...
0
votes
1answer
123 views

Emails being sent to strange addresses

I use Yahoo Mail from Android devices. In my Sent box over the last few weeks I see a handful of completely blank e-mails (no subject and no contents) being sent to very strange addresses such as: ...
1
vote
0answers
68 views

Needing help intercepting local SSL traffic on a difficult Android app

I'm trying to intercept traffic from an Andriod app. I've forwarded ports 80, 443, 6699 and 6698 on Kali to a listener port and set up arp-spoofing. I'm using BurpSuite on the same computer to listen ...
0
votes
1answer
57 views

Detect what antivirus installed on Windows Operating system

If we want to detect all Antivirus/Endpoint protection currently installed on a Windows machine? What is the best approach? Is there a list of registry locations we can read/iterate? Industry ...
4
votes
1answer
40 views

Mitigation for Insecure Deserialization

I'm trying to look for some way for mitigation of insecure deserialization vulnerability for the application front-end Then I found this link https://blog.jscrambler.com/exploring-the-owasp-top-10-by-...
0
votes
0answers
31 views

How does the inclusion of a subprime q value affect the Diffie Hellman equation for key exchange? [duplicate]

This is a follow on from this question: "Diffie-Hellman Key Exchange" in plain English In the answer to that question, the standard Diffie Hellman key exchange equation is derived: (g^a mod ...
0
votes
1answer
100 views

Security of email OTP authentication

I'm building my own authentication and deciding on the signup/login flow. I'm would like some security feedback on this type of flow: User submits email address. 6 character alphanumeric one-time-...
0
votes
0answers
36 views

Sqlmap won't pick up injection point. Tweak?

I manually found an injection point, on CTF VM, located on POST form. I found it with the following manual payload : 1' OR SLEEP(1)-- t I would like to use sqlmap. I ended with following call : ...
0
votes
1answer
49 views

Securing and storing Active Directory logs

If we plan to log script block logging, module logging and transcription logs in Active Directory using group policy, what/where is the best place to secure these logs so we can be assured of their ...
0
votes
0answers
46 views

What are possible spoofing attacks on internal services in devices?

I have a service that runs as Windows Service on a device and developed using C#, and uses the gRPC protocol for communication as shown in the below diagram. The service is running on port 5000 as ...
0
votes
1answer
58 views

Should certificate pinning be implemented if the app can use many servers?

In a corporate context, mobile apps exist that require a user to enter the server address to connect to a specific instance of this vendor's application. The vendor sells software that it's customers ...
0
votes
0answers
26 views

Does NW.js send “crash reports” to Google (or anyone external) by default? [migrated]

https://nwjs.readthedocs.io/en/latest/References/Manifest%20Format/ crash_report_url Once the app crashed, the crash dump file and information about the runtime environment will be sent to the crash ...
0
votes
0answers
39 views

How do the X11 forwarded applications' vulnerabilities affect the client? [closed]

If I ssh to an X server, and forward an application that has vulnerabilities, would my machine be at risk? For example, if I forward Chrome, would my machine (client) be vulnerable to the browser's ...
0
votes
0answers
35 views

How to authenticate OAuth2 confidential client is making a REST call?

We are looking to implement some REST services to be called from partner servers (not end users via a browser). The out-of-the-box implementation seems to flow thusly: Partner server passes a client ...
0
votes
0answers
18 views

They tell me if an attacker gets your session ID, can use it to pose as the legitimate user. Specifically HOW would they do that? [duplicate]

I understand changing session IDs is important so this doesn't happen. But nobody tells you HOW this attacker would actually do this? How would they get it ... then, more importantly, how would they ...
1
vote
0answers
37 views

Security implications of an HTTP POST endpoint that accepts arbitrary HTML and returns it back

For generating PDFs in our web application we have a simple service that accepts a chunk of HTML from the client, wraps it in a standard template, does a couple of simple transforms (like replacing ...
1
vote
1answer
130 views

Are Whatsapp phone numbers viewable by network admins?

If I connect to a network, is the network admin able to identify user phone numbers used by Whatsapp through the network traffic? In other words, are phone numbers used to signup by messaging apps ...
2
votes
2answers
120 views

Feasability of deanonymizing commercially available advertiser data

Yesterday, Msgr. Jeffrey Burrill of the U.S Council of Catholic Bishops resigned because an investigation by Pillar, a Catholic newsletter, alleged that he had used Grindr to find hookups. Fairly ...
0
votes
0answers
53 views

Is the RSA Public Key size always the same as the private key size? [duplicate]

When working with x509 certificates and a public and private key pair, let's say you generate a private key that is 4096 bits. Is it possible to have a public key that is only 2048 bits then? Or are ...
0
votes
0answers
40 views

Red Team actions for Web domain [closed]

What red teams' actions and procedures could be used for threat hunting a web domain? I am planning to use some online threat hunting platforms for threat hunting. But not sure if there is a proper ...
1
vote
1answer
115 views

How may I check if an expired certificate was valid at the time?

I have an old let's encrypt (but disregard that, it could be any) certificate that is no longer active. How may I check if it was valid at the time?
0
votes
0answers
23 views

Does google classroom use your webcam? [migrated]

A few days ago I got kaspersky security cloud free and on opening google classroom, it popped up saying that google classroom was using my webcam. I checked that this was only when I launched ...
1
vote
1answer
34 views

Fuzzing in OWASP ZAP through the command line

First of all, I'm running ZAP in a Docker container and will automate ZAP scans using Jenkins. The official docker image seems to have a script that performs spidering and active scans but does not do ...
18
votes
3answers
5k views

What is the problem of using a self signed-certificate for a game?

I am trying to understand the security problems when working with a game that needs an account for its players. What is the problem of using a self-signed certificate? If I understand the problem ...

15 30 50 per page