All Questions
65,404
questions
0
votes
0
answers
17
views
Oauth 2.0 current best practice for SPA and backends
I want to build a application which having following architecture:
According to the BCP, I am going to implement Authorization Code Flow with PKCE. I am wondering:
Do I need to implement a separate ...
- 101
0
votes
0
answers
46
views
What are the purposes of having the IKE SAs in IKEv2?
What are the purposes of having the IKE SAs in IKEv2?
I see that the IKEv2 has IKE SA and IPsec SA. So I'm thinking that IKE SA is to secure the negotiation for IPsec. Is that alright and is there any ...
- 1
0
votes
0
answers
24
views
How can I inject JavaScript into a url whose contents will be written to the DOM in a way that it could execute?
I'm working with the API for a popular CI/CD app and I found a bug where path variables are being written directly to the DOM without being checked first. The tldr is that to access a project you go ...
- 11
0
votes
1
answer
29
views
Msfconsole-exploit command: what options are used to generate a payload?
I have the following test environment with three computers:
[victim] 192.168.0.104 running Windows 2003
[listener] 192.168.0.22
[Kali] 192.168.0.26
On the Kali machine, I used the following ...
0
votes
1
answer
124
views
Landlord wants to share a single 3Gbps fibre to the property line across 4 flats using a mesh network. Should I be concerned?
fibre to the property is being installed in my road for the first time
my landlord doesn't want lots of holes in their building
they acknowledges that FttP is probably necessary going forward
So ...
- 105
0
votes
0
answers
12
views
Leaving half open or full open connection having SYN cookie
Suppose an attacker collects a large number of initial sequence numbers sent by the server. Can the
attacker cause the server to create many fully open connections by sending ACKs with those initial
...
0
votes
0
answers
9
views
Creating half open or full open connection in presence of SYN cookie
Suppose an attacker knows that a target host uses SYN cookies. Can the attacker create half-open or fully open connections by simply sending an ACK packet to the target? Why or why not?
0
votes
0
answers
16
views
Key distribution protocol involves only 2 parties, given E[k1,E(k2,m)]=E[k2, E(k1, m)] [migrated]
Given an one-key cipher such that:
E[k1,E(k2,m)]=E[k2, E(k1, m)]
Is there any key distribution protocol that involves only two parties (Alice and Bob) without the key distribution center?
The protocol ...
- 1
0
votes
0
answers
31
views
How do different types of cyphers relate together? [migrated]
I understand that there are symmetric and asymmetric (public-key) cyphers. The first have the same key used for encryption and decryption, while the second use a public key for encryption and a ...
- 403
0
votes
1
answer
37
views
XD/NX Bit in UNIX [Memory Security]
I have been reading about XD/NX bit used in Memory Pages for security. I understand it is a security feature that can help reduce system exposure to viruses and malicious code. If enabled, processor ...
0
votes
1
answer
33
views
A few questions about fixation attack
I am writing a small app.
It creates a session once the user authenticates. I am aware of this definition of fixation attack from owasp.
Attacker uses the app
In this App, once they log out the ...
- 15
0
votes
1
answer
73
views
How to harden a FOSS and gratis operating system?
I want to migrate from Windows to Ubuntu.
I understand that Ubuntu's1 security model is a bit different than that of Windows but I don't aim to ask about this particular OS, rather, in general, what ...
- 3
0
votes
0
answers
68
views
How are scam call centers cctv stream easily hacked by scam baiters
Recently i have been seeing the videos of fake call centers being busted by scam baiters like Mark Rober
In all of these videos the scam baiters are easily able to hack into the the network camera ...
- 1
0
votes
0
answers
12
views
How to Scan Firebase Database?
I have the APK of an application and analyzed it using MobSF static analysis. It says the application talks with Firebase Database and provides a URL.
Obviously, the URL is not accessible.
I am new to ...
- 5
0
votes
1
answer
35
views
Import a exploit into msfconsole on ubuntu
I'm attending a offensive security courses and one of the subject is import a exploit from exploitdb into msfconsole. Commonly advice that it's required to create a exploit folder inside .msf4 and ...
0
votes
0
answers
32
views
bruteforce attack inside iFrame
How can I change the value of src parameter inside the iFrame tag with programs like wfuzz or fuff?
For example I have an iFrame on the server like this:
iframe.php
<html>
<head><title&...
- 221
1
vote
2
answers
77
views
Need help generating list with crunch
I am new to Kali Linux.
I am trying to generate a wordlist of 6- whatever character words where:
the first part is an English word that starts with a capital letter
the last 5 characters are 8765. It ...
- 51
0
votes
1
answer
45
views
Session cookie security
I am creating a small login system. It looks like the standard username/pwd and user can either log or register.
If they pass (authenticate), I create a session cookie that will be sent with the ...
- 15
1
vote
1
answer
97
views
Potential problems with insecure password hashing
For my job I use some industry-specific software that stores sensitive information. The software has a web interface with a public login page. One time I attempted to log in, but mistyped the last few ...
- 113
0
votes
1
answer
59
views
OS on external drive -- is it safe?
So I'm installing macOS to my external hard drive partition, so I can have a 100% clean environment where I can engage with cryptocurrencies. (Exchanges, stable coins, protocols, putting actual money ...
0
votes
0
answers
22
views
Compromised machine. Should I create a partition or volume to install a clean OS?
My goal is to create a 100% clean environment where I can interact with cryptocurrencies. For that, I can partition my disk or I can create a volume. Which one should I prefer?
Some context about the ...
0
votes
0
answers
19
views
Slow Loris Attack Wi-Fi variant
I watched a Computerphile video. In the end Dr. Bagley talked about the fact that a router can only receive/send a packet at a time, so if one device is slow it will slow every device down, because ...
- 1
1
vote
1
answer
29
views
Passing traffic from a script through proxy / tor network [closed]
I am applying for a job that involves creating unit tests and end to end tests for a website. Right now, i am assigned with a task, in order to test my skills.
However, my country has blocked access ...
- 367
-1
votes
0
answers
55
views
How do I engage with cryptocurrencies wallets in a compromised computer?
I am using a Mac machine and I suspect it has been compromised.
Would partitioning the disk and installing a clean OS on this disk just for cryptocurrency activities solve the problem? That would be ...
-1
votes
0
answers
35
views
What is this unknown 10-digit device address? Found on an iPhone [migrated]
I saw this unknown address under my personal hotspot summary on an iPhone:
e:69:a5:97:7:17
Interestingly enough, it only has 10-digits so it cannot be a MAC address. What is it then? Should I be ...
-1
votes
0
answers
39
views
How to stop/reduce constant DNS Spoof/Poisoning Attack from NGINX server if DNSSEC is not offered from provider?
Currently my domain is sitting without DNSSEC security because my domain provider didnt support it for my ccTLD domain, the feature will only be available once i renew my domain in about 2 months time....
0
votes
1
answer
28
views
Keylogging virtual machine from host
Can a keylogger in a host machine capture keystrokes in virtual OS?
I'd like to get into cryptocurrencies but I don't know if my machine (mac) is secure. So I thought I could create a VM for it but I ...
0
votes
1
answer
36
views
Using -s with --increment
I have multiple computers which I am planning to use. They all run a custom-made client that starts hashcat with different args.
I am able to submit the current progress, candidates etc (everything in ...
- 1
1
vote
1
answer
43
views
Onion Routing Encryption
I'm curious how, in onion routing, the relay nodes identify which node to forward the message to? From my understanding the message must travel a specific path based on the keys the user has. I don't ...
- 113
-2
votes
2
answers
161
views
Why do people claim Tails is more secure than Windows?
Why do some people say that using Tor within my normal operating system will not be safe? What differentiates Windows and Tails in this regard?
I believe that running Windows together with a VM, VPN ...
0
votes
1
answer
24
views
OAuth 2.0 POST to Authorization Endpoint
The OAuth 2.0 specification states:
The authorization server MUST support the use of the HTTP "GET" method [RFC2616] for the authorization endpoint and MAY support the use of the "POST&...
1
vote
1
answer
34
views
Is there any way to disable/not allow unquoted service paths in Windows?
Unquoted service paths might be used as a privilege escalation vector after an attacker gains access to a Windows host.
Given Hector's answer in the following question:
"Windows Unquoted Search&...
- 133
0
votes
1
answer
100
views
Why don’t routers request permission when attempting to connect to an unknown address? (Or why do they still assume every connection is trustworthy?)
I’m imagining a system similar to UAC on Windows but implemented at the router level for IP addresses instead. (Or AS numbers, BGP numbers, Port number, etc…)
Naturally this makes router setup ...
- 101
1
vote
0
answers
89
views
How exactly does OpenVPN's tls-auth option apply HMAC to packet messages?
Update: I've been able to work out everything I was asking about packet structure when I was finally able to get Wireshark to work, but there is one last thing I'm confused on which I detail at the ...
- 99
0
votes
0
answers
17
views
ACL management (file access) & security
I'll start by saying I'm not sure which stack community I'd ask my question, but I'm looking into using ACLs to manage file access on our server because of specific IT security requirements.
We mostly ...
- 1
0
votes
0
answers
34
views
Increment hearbeat request metasploit
I'm using metasploit to a university project and I have to try to make a botnet attack unnoticed and the if the blue team dettect it, I have t try to make as imposible as I can to
attribute the attack....
- 5
0
votes
1
answer
49
views
Key derivation for password manager backup?
Backing up your password manager is a good idea in case your house burns down, but where do you store the password to the off-site backup?
Remembering the master password is easy, but re-using the ...
- 175
0
votes
1
answer
57
views
What is the impact of OpenVPN SECLEVEL=0?
OpenVPN throws a "signature digest algorithm too weak" error when I try to connect to a specific VPN.
A common suggestion for a workaround is using the following config:
tls-cipher "...
- 29k
1
vote
1
answer
137
views
What's the point of password protecting your document in a 1st email, then writing the password in a 2nd email within 5 minutes?
What security is gained from this procedure? What does this procedure accomplish? Many professionals do this, like government officials and lawyers.
First, they email me the attachment (e.g. PDF, Word ...
- 13
2
votes
2
answers
70
views
Create a cryptographically secure random string for auth cookie in javascript
I know there are multiple libraries for managing authentication, but I have a hobby project and wanted to create a very simple authentication system. It'd set a cookie in the client's browser with a ...
- 205
0
votes
1
answer
35
views
DNS Enumeration by IP Address
I know all baseline steps to do DNS enumeration over a domain. But my questions is: how can I enumerate a server when I do not know which domain it is managing and I only have its IP address?
My ...
- 1
1
vote
1
answer
87
views
Comparing smartphones' to PC security
Comparing common smartphones running updated versions of Android or iOS to common desktop/laptops running updated versions of Windows or Linux:
Are smartphones inherently less secure? I get the ...
- 1,853
0
votes
0
answers
23
views
IIS Crypto 3.2 not getting rid of Diffie-Hellman algorithms of less than 2048-bits
I'm trying to stop a server using Diffie Hellman key exchanges of less than 2048 bits, but I'm getting confusing results.
I've run
Get-TlsCipherSuite | Format-Table Name, Exchange, Cipher, Hash, ...
- 1
17
votes
4
answers
3k
views
Is signing a file better than issuing a checksum, and does it render a separate checksum useless?
Alternatively, the question could be asked: Does issuing a checksum for a file we sign anyways just duplicate work?
Use case: Firmware sent to an IoT device. We sign it, and form a separate checksum ...
- 181
1
vote
1
answer
25
views
Export ECDSA certificate from Windows Store
I am trying to export public and private key of an ECDSA certificate from Windows key store. PFXExportCertStoreEx fails when I try to export ECDSA certificate. GetLastError() returns 0x80090016. I am ...
- 61
-1
votes
1
answer
78
views
Is there any way to make the Government not find out geolocation from the hoster?
The government can find servers very quickly by contacting the hoster that hosts your VPN server, and the service provider might give your IP address.
But what if I use torsocks ssh -d? I don't know ...
- 111
30
votes
3
answers
5k
views
Why is one-time pad informationally secure?
I am reading "Serious cryptography" and he wrote the following:
Informational security is based not on how hard it is to break a cipher,
but whether it’s conceivable to break it at all. A ...
- 403
0
votes
0
answers
21
views
Sending logs with bug reports: how to defend against easy exploits like malicious file enlargement?
When a crash occurs or when a user reports a bug, I'd like to send my application's logs to a cloud service (Firebase).
But I've just realised that there are tons of kindergarten level exploits. For ...
- 123
0
votes
0
answers
13
views
Shared credentials logins between separate websites and trust issues
Brand A has multiple, separate websites - these websites reference each other as part of the brand family, but do not have a shared single sign on system.
Instead, each website has their own login and ...
- 530
0
votes
1
answer
63
views
Detect port forwarding
If there are 3 machines A, B and C and A communicate directly with B (A -> B) but B is executing port fordwarding with the next command
socat TCP4-LISTEN:443,fork TCP4:<ip machine C>:443
So ...
- 5