All Questions
69,325
questions
0
votes
0
answers
30
views
Stolen certificate attack in MITM attack [duplicate]
Let say there is a client want to connect over https to a server. There is me, the attacker, in the middle between the client to the gateway.
The attacker (me) see that the client want to do TLS ...
- 1
0
votes
0
answers
10
views
Validating file paths to satisfy GitHub CodeQL's "Uncontrolled data used in path expression" alert [migrated]
I'm writing functions for a Python package to register files from a file system to an SQL database, and GitHub's CodeQL has flagged that the file paths are a potential security risk.
I have ...
0
votes
1
answer
116
views
Strange way of handling forgotten password
I was about to signup for ebanking solution, but then noticed their instructions for forgotten password are: Create a new account.
So there's no option to reset your password, just a suggestion to ...
- 103
0
votes
2
answers
118
views
Is there a machine-readable way to document dangerous sinks in libraries?
One of the key questions when investigating the security of software and libraries is what are the dangerous sinks? What functions are potentially dangerous, if called with untrusted data?
It would be ...
- 34.6k
1
vote
1
answer
75
views
Is there an equivalent to passkeys but to prevent cookie stealing?
Passkeys prevent phishing, no one can make you login remotely (without exploits) and if they are hardware based and never leave the hardware, them even exploits might have a hard time getting them.
...
- 375
4
votes
4
answers
3k
views
What's wrong with my app authentication scheme?
I'm writing my own networking layer for my video games startup and am using TCP for connection/authentication. I wanted to know how safe my authentication scheme was and what I could do to improve it.
...
1
vote
1
answer
86
views
Is the SIM Card PUK saved on the SIM Card?
Somone I know had entered the PIN 3 times wrong. And she didn't have the PUK either. I resolved the issue (here we talk about German Vodafon, prepaid CallYa) by telling her to remove the SIM Card and ...
- 11
0
votes
2
answers
92
views
Attacking Public Key Ciphers
I’m reading the GNU Privacy Handbook where it says:
A hybrid cipher uses both a symmetric cipher and a public-key cipher. It works by using a public-key cipher to share a key for the symmetric cipher....
- 33
1
vote
0
answers
64
views
Base64 encoded payload detection rule on crowdstrike
I am new to threat detection. I was figuring out a way for crowdstrike falcon to block the execution of malicious base64 encoded payloads on a Linux machine.
Wanted to know if a setting prevention ...
- 11
0
votes
0
answers
41
views
How to retrieve TLS shared key in SSLKEYLOGFILE?
I would like to extract the session key, master key and premaster key in TLS connection. In my case nginx plays TLS termination. So I want to see those key in nginx side. Here is my nginx.conf
user ...
- 1
0
votes
2
answers
442
views
How should be set an unprotect environment on modern linux to test an old buffer overflow example?
Reading a technical paper on the issue I wanted to test it on my computer.
The idea is to provoke privilege escalation (change on the whoami output from peter to root) through a buffer overflow.
The ...
- 1
3
votes
1
answer
160
views
OAuth 2.0 - why is the state parameter needed in order to prevent CSRF at authorization code login flow?
I'm having a really hard time understanding why the state should be used to protect against CSRF at the OAuth 2.0 login flow.
Imagine I have an Authorization Server with a legitimate client registered ...
- 155
1
vote
1
answer
77
views
ReDOS - Vulnerability found, but DOS not possible
I have an API which is protected by AWS Cloudfront. I found a ReDos in one of my API Endpoints. The endpoint looks like this:
https://mywebsite.com/api/myendpoint?apikey=xxxx&namefilter=yyyy
The ...
- 11
1
vote
0
answers
91
views
HTTP to HTTPS Redirects - Possible Vulnerability
Sorry this question could be a bit more clearer.
Consider this as typical scenario where
http://example.com is set up to redirect to https://www.example.com
http://www.example.com is set up to ...
- 11
24
votes
4
answers
8k
views
can a CPU once removed retain information that poses a security concern?
In the interest of data security...
when a cpu fails in a server and you remove it is there any way that removed cpu can retain any kind of data that poses a concern?
For example an Intel Xeon 1st gen ...
- 443
1
vote
1
answer
39
views
Do microcontroller processors like Arm Cortex-M support the TPM's Dynamic root of trust (similar to e.g. Intel TXT)?
The TPM (Trusted Platform Module) has a feature called dynamic root-of-trust. If i understand correctly a measurement of the current system is taken (to enable attestation) by the CPU and transmitted ...
- 21
0
votes
0
answers
26
views
Is AIA or multi-tier architecture relevant?
I am working on a non-internet facing and internal/air-gapped system. The vendor providing the solution has architected their system with the application client and database on the same server.
I am ...
0
votes
1
answer
61
views
Is SMB/CIFS secure?
I am working on a non-internet facing and internal/air-gapped system. The vendor providing the solution is using Total Commander for file transfer which they mention is based on SMB/CIFS. Additionally,...
2
votes
1
answer
153
views
How to spoof browser fingerprint without it being obvious?
Is there a way to spoof browser fingerprint without websites being able to tell you have done it? This includes spoofing most or all types of known browser/device fingerprints such as canvas, ...
- 21
0
votes
1
answer
113
views
Ways Google identifies browser activity done in incognito mode? [duplicate]
I saw Google are being sued for tracking you in incognito mode and was curious as to how they identify the 'you' if you're not logged in to a Google account. Or are they logging the activity but not ...
- 9
2
votes
4
answers
1k
views
HTTPs compression, CSRF and mobile apps
I have a backend for a mobile application that has to serve large JSON responses from time to time, the transfer would be greatly helped by enabling compression, especially when the user has bad ...
- 123
1
vote
0
answers
27
views
Untrusted QEMU guest with access to host partition UUID/label
I'm analyzing a system where services are isolated via QEMU. For storage, it gives each guest access to their own block device/partition on the host (for performance reasons).
I'm wondering if this ...
- 143
2
votes
2
answers
100
views
How do I capture HTTPS requests with Python if I have full access to the user's computer
Before any of you answer, "HTTPS is built on top of TLS and everything is encrypted"
I need to specify a very important note: I have FULL access to the client's machine (Windows)
My ...
- 21
0
votes
1
answer
116
views
I want to know about some techniques to get phone number information [closed]
I was being harassed by a phone number on WhatsApp, and when I tried to get details about the number from the company whose SIM was being used, they said that the number is not registered with them. ...
1
vote
1
answer
47
views
Who generates the TACACS+ challenge in challenge-response authentication protocols?
Reading the TACACS+ RFC common authentication flows, the CHAP/MSCHAPv1/MSCHAPv2 sections state the following:
The entire exchange MUST consist of a single START packet and a single REPLY.
Which ...
3
votes
4
answers
419
views
Beginner in VPN, how to pick a safe one?
I am interested in understanding VPNs and being able to evaluate which commercial one to use.
I understand that using the wrong one is a big compromise and I am very skeptical that checking for books ...
- 167
0
votes
1
answer
43
views
What does installation of a VPN chrome extension do to the traffic from chrome
I am a networking noob who is trying to understand stuff from the expert community here. Here is my issue, I have a Proxy client ABC installed in my PC and all my traffic is routed through this proxy ...
0
votes
0
answers
120
views
Why is my browser fingerprint unique when running a fresh TOR browser installation?
Downloaded a fresh tor browser instance to test if the fingerprint is unique. (Signature was verified)
https://amiunique.org says that the browser fingerprint is unique
https://coveryourtracks.eff.org/...
- 173
0
votes
0
answers
96
views
MariaDB SQL Injection
I'm doing a website PT lab and I'm trying to figure out SQL vulnerability in MariaDB.
After some scanning I found the /api/ path, and one of them gives the desired SQL
I found out that ' gives me the ...
- 1
0
votes
0
answers
24
views
Hydra and JSON (grafana login)
I would like to use Hydra to test a login in Grafana. Grafana itself uses HTTP/POST and JSON, the request looks like this:
POST /login HTTP/1.1
Host: <HOST>:<PORT>
User-Agent: Mozilla/5.0 (...
- 1
0
votes
1
answer
58
views
Why chrome shows several certificates for encryption?
when i check connection status with google services (gmail for instance) i see that connection is secure. Then I can check certificate details. Chrome shows that it uses 3 different certificates with ...
- 1
0
votes
1
answer
36
views
Running and unknown nodeJS/react app
I made a mistake - i was reached out for work regarding a project. Accidentally built it and ran it locally and it was obviously a bunch of nonsense code designed to look like a normal react project ...
- 101
2
votes
1
answer
138
views
In theory, can you get hacked through watching streaming services?
I kind of get it that you can get hacked by loading up an image, as there can be code embedded in the file that may execute under certain circumstances, and the image itself won’t even look much ...
- 155
1
vote
0
answers
31
views
Do I need to add TOTP 2FA for Facebook and mobile number logins in my app?
I’m adding 2FA to my app and have set it up for users who have registered with email. I also have users who log in with Facebook and others who use their mobile number.
Should I also add TOTP for ...
- 73
1
vote
0
answers
85
views
HTTPS Website Hacking
I'm trying to figure out whether a website that is secured by a certificate can get hacked? This source:
https://blog.mozilla.org/en/products/firefox/https-protect/
Refer to 3rd last paragraph where ...
- 33
1
vote
1
answer
91
views
Potential Linux.Xor.DDoS - chkrootkit
I have a Debian server, and I was recently contacted by my hosting provider that my server is being used to DDoS people/servers. Is this the cause?
Searching for Linux.Xor.DDoS ... INFECTED: Possible ...
- 11
0
votes
0
answers
46
views
Detecting Bluetooth mobile malware
I am trying to see if my Android phone has any malware that is exfiltrating or receiving data via Bluetooth, despite having it turned off in my system settings.
I have downloaded all available APKs ...
- 11
0
votes
0
answers
51
views
How do free website providers prevent fake payment pages being created on their (sub)domain?
Many providers of free websites allow the creation of subdomains.
What measures can these providers take to prevent (or mitigate) the following:
create a page demanding payment (with a link to an ...
- 101
0
votes
0
answers
67
views
Confirm If Website Unsafe/Compromised
Neither are recent, but I've encountered two websites that are on benign subjects but appear to be compromised and/or have triggered/transient pop-ups or redirects that seem malicious.
I run websites ...
- 1
0
votes
0
answers
46
views
Should OTP be resent during the sign-up process if the user is already verified?
I'm building an authentication backend API that includes a resend OTP endpoint. The question is whether the API should check if the user is already verified before sending a new OTP. Specifically, if ...
0
votes
0
answers
43
views
Can anyone provide any advice on this Logwatch analysis?
I received this Logwatch report:
Connection attempts using mod_proxy:
xx.xx.xxx.xx -> codeforces.com:443: 1 Time(s)
A total of 2 possible successful probes were detected (the following URLs
...
- 1
0
votes
1
answer
111
views
If you downloaded a video file that could potentially contain malware but it didn’t finish downloading, can it still do damage?
What happened was that I downloaded a video from dood(.)sh (a sketchy website), but while it was still downloading I closed the tab, so the download didn’t finished, I checked my files and it weren’t ...
- 1
0
votes
0
answers
36
views
bin/sh in return-to-libc attacks
Return-to-libc is an attack where the attacker, in most cases, returns to the system function, which it uses to execute shell commands. However, I am confused about two things:
The command that the ...
- 1
0
votes
1
answer
47
views
Nmap --disable-arp-ping [duplicate]
I was wondering what the option --disable-arp-ping is for? I have been doing HTB and sometimes I see them using it but I do not really know what is the purpose of this option.
0
votes
1
answer
76
views
Is it a good idea to run openssh-server into a docker container?
I want to have a server where I can connect many computers and open reverse tunnels, and then when I want to connect to those tunnels, I will SSH into the server and forward my local connection to it, ...
- 375
1
vote
0
answers
40
views
DNS records assignments from providers
I am in an uncertain situation (as in not sure what happened and if even this is the correct place to ask this question).
Situation:
I have a domain name that is registered in Namecheap and the NS ...
- 111
1
vote
0
answers
33
views
Does libc security vulnerabilities in a python web application are actually exploitable in a private cloud environment
We use a python web framework and gunicorn on top of docker to power a web application with frontend in a private cloud that can be accessed by a private network. Our security tools reports a lot of ...
- 63
0
votes
0
answers
33
views
Using the server hostname as a variable in openssl.cnf for the CN?
Is there a variable I can use to fill the openssl.cnf file with the Linux server hostname?
I know you can use -subj fields, but I specifically want to prefill the openssl.cnf if possible as I can then ...
5
votes
2
answers
2k
views
Addressing Potential JavaScript Injection Vulnerabilities
I am working on a project involving an input form where customers enter their name and email to start a conversation with support. The form works well, but I've noticed some issues with the 'Name' ...
- 59
0
votes
0
answers
69
views
Open Banking: How can a TPP integrate their mobile app with a bank's APIs without breaking the security profile
I've been researching UK Open Banking and getting to know the in and outs of the FAPI advanced security profile.
My question is based on the following premises (and I think I'm probably either ...
