All Questions

Filter by
Sorted by
Tagged with
0
votes
2answers
175 views

What to do if my MAC has been spoofed?

My MAC address has been spoofed by a neighbor to access my WiFi, positively. I know it's futile changing the WPA key or not broadcasting the SSID. What are my options at this point ?
12
votes
5answers
426 views

How can one tell if a binary is safe to give sudo permissions for to an untrusted user?

sudo is sometimes used to give untrusted or "semi-trusted" users the ability to perform certain tasks as root, while not giving them unlimited root access. This is usually done via an entry into /etc/...
0
votes
1answer
77 views

MITM setup using airmon-ng, iptables, and isc-dhcp server

I want to set up a MITM-scenario as an exercise for myself. My setup looks like this: Internet <--------> Laptop <----------> Client At this stage I just want to route the traffic from my AP ...
1
vote
0answers
39 views

Is it possible to obtain a forensic image of an Android device without installation of custom recovery mode or rooting?

I need to forensically image a Samsung phone that is not rooted or running a custom recovery mode. I have not been able to pull an image using ADB, as the default Samsung recovery mode only allows ADB ...
-2
votes
3answers
333 views

My home router has been hacked, what can I do? [closed]

My router has been hacked and all devices have had some sort of spyware installed (Don't ask me how I know this, just please take my word for it). Since they can see everything I do on my devices, ...
1
vote
1answer
104 views

Which symbols can I whitelist to remain safe against SQL injection, XSS, and all other injections attacks?

I have an input field in a web that is being saved. This field can be shown in other systems that I do not have control over and that's why I would like to limit what is allowed in this field, ...
0
votes
0answers
39 views

Command line tools for checking if a VPN is leaking on a headless device

I have a headless device that is connected to a router with a VPN connection. Not al the devices connected to the router go through the VPN connection, since I have set rules on the router to tell it ...
0
votes
1answer
95 views

should giving salt to unauthenticated users be a problem

Let's say i have a scenario when the user salt is required in client side before login, the user obtains the salt by this url http://my-api.example/get-salt/userid that url should return a salt for ...
0
votes
0answers
50 views

Method to bypass \n in WAF (\n vulnerability)

I have this application that has an input box where the data is going to be sent in a JSON format. The JSON payload might look like this {“message”: “hello\nmy name is andi”} But the problem is the ...
1
vote
1answer
85 views

How to decrypt Chrome saved password from “Login Data” file

Is there a way to decrypt passwords from Chrome Login Data file? My goal is learning about the backend process of this decryption, so I don't want to use any pre-built applications.
1
vote
1answer
81 views

Is there any method or tool other than nmap for the detection of an OS?

I wanted to know if there was any other way to detect the OS of a network (other than nmap) since nmap doesn't detect most versions of Windows 10 at all and identifies them as a different OS ...
0
votes
0answers
37 views

How is Hopwood's Java interface attack related to least common mechanism principle?

I'm trying to understand LCM and how David Hopwood's discovery is a noteworthy example of it. This site contains two important things. First, it identifies Hopwood's interface attack (1996) as an ...
1
vote
1answer
73 views

Business located in USA does it need to be PCI and SCA compliant?

The business is located in the US. But: Has European customers who put a transaction via a custom-built shopping cart Sells via tradeshow in Europe or Asia in person Could Customers send credit cards ...
0
votes
0answers
39 views

Live Memory Analysis

I'm a developer working on a POC for an internal web app (Python\SQL) which will handle sensitive employee information within our company. In going over the application with our security department to ...
0
votes
2answers
117 views

Is MITM possible for Google services (TLS/SSL) as of today?

I personally trust Google in terms of security but I'm not sure whether man-in-the-middle (MITM) attacks against Google services AS OF TODAY possible or not. As far as I know, Google uses some ...
0
votes
0answers
46 views

Effectiveness and ethics of flooding phishing websites with fake data as a countermeasure

Today, I got a phishing email impersonating a large bank. To my surprise, the link in the email pointed at a rather sophisticated phishing website which could potentially result in many victims. The ...
0
votes
0answers
33 views

Latest CA Certificate Authorities List [duplicate]

I am posting this question after checking this question Where can I find all SSL CA certificates I need to verify couple of CA authorities.(below) CloudFlare NameCheap AWS commodo Where can in ...
0
votes
0answers
67 views

How does authentication in gmail work? [closed]

How does authentication in gmail work? Is the password sent in plain text format and gmail server checks against the password stored on its server? I believe http protocol is stateless, so this means ...
44
votes
2answers
8k views

Does a buffer overflow vulnerability always mean a code execution vulnerability?

Since buffer overflows always let an evil hacker write outside the buffer and overwrite the return pointer to a shellcode the evil hacker can place, does it mean that successful exploitation of a ...
0
votes
2answers
68 views

Is it possible to attack the main server through a reverse proxy server that only serves as a url rewrite?

I have a content site https://www.mysite.com I'm asking a client to configure a reverse proxy server connection in their server so everything inside the subdirectory 'external-content' gets pulled ...
1
vote
1answer
45 views

Is it good or bad to use group in sudoers file instead of using aliases?

I have used user groups heavily while designing access control policies. I find user groups very convenient as it's very easy to implement with PAM. Another reason I have organized the users with ...
0
votes
0answers
84 views

SSRF to RCE or get it to print the out of file://?

Some site I am testing that retrieves data from some url, I could backconnect using ldaps://ip:port/ I tried wrappers like ldap://, dict:// but only ldaps seem to work. Also expect:// seem disabled, ...
-1
votes
1answer
69 views

How i can generate a DES3 key coded in base64 in openssl

How can I generate a DES3 key encoded in base64 using openssl tool?
2
votes
1answer
154 views

What's the limiting resource that makes DDoS attacks possible?

I often see DDoS attacks compared by network traffic, for example: The biggest DDoS attack to date took place in February of 2018. This attack targeted GitHub, a popular online code management ...
6
votes
2answers
189 views

Why do we receive contact form spam with random characters?

For the last two weeks we have been receiving a form of spam through our website contact form that I haven't seen before. It looks like this: Name: iYvNgmpTLwxqaCj Company: lqidQuVNMhIJsz E-...
1
vote
0answers
64 views

How is mkdir subject to a TOCTOU attack?

My answer here, resulted in this comment: This could be subject to a TOCTOU1 attack and needs to be developed to be correct. The answer is in Rust, but here's some equivalent bash: p=/home/roger/...
0
votes
2answers
64 views

DoD 52220.22-M (3 Pass wipe) and Virtual Machines

So my place of work, if you can tell by the title is either Gov or Mil, and we recently had a tech refresh where all of our workstations were replaced with VM's. We are running version VMWare Version ...
0
votes
0answers
43 views

Unable to connect to internet after setting up ZAP configuration on Android using a hotspot connection

I am trying to configure ZAP on an Android device using a hotspot connection opened on another Android device. I followed the setup instructions available here: https://security.secure.force.com/...
1
vote
0answers
36 views

How to implement a “Forgot password?” functionality using php-encryption's KeyProtectedByPassword and 2FA?

I'm currently migrating the encryption functionality used in a PHP project from mcrypt (which was deprecated in PHP 7.1.x and no longer works from PHP 7.2 onward) to openssl, using the defuse/php-...
3
votes
2answers
70 views

Weird DNS queries to messager.xicp.net

A DNS query for this domain (messager.xicp.net) was classified and detected as "Trojan.Generic.DNS" by the FireEye NX in our network. So, I used both VirusTotal and abuseibdb sites to check this ...
1
vote
0answers
38 views

How can access to Intel ME / AMT be disabled with firewall? [duplicate]

Short of flashing BIOS, there seems to be no way to disable the Intel ME. So, is there a reliable way to block access to Intel ME, such using HW firewall (Firewall in front of the machine, not ...
1
vote
1answer
47 views

are small SOC chips also affected by Meltdown and Spectre?

How can I find out, if given CPU is affected by the Meltdown and Spectre bugs ? My CPU is relatively older, and it is a SOC chip: AMD GX-412TC SOC I was not able to find, whether these chips also ...
1
vote
0answers
76 views

Is it safe to let users enter a URL in my app that queries an external REST api?

The idea was to allow users to enter a URL inside the application that would send a request to my backend, fetch the data, and load it into a local cache (Apollo/GraphQL). The only sensitive data sent ...
-2
votes
1answer
130 views

How should we deal with ransomware after it did happend? [closed]

I am trying to explain what happened and asking what could be done after being infected Yesterday a client called and told me something strange happened to his server and most of the file types are ...
2
votes
2answers
73 views

How should failures by a single user on a simulated phishing email be measured?

I work in the IT Security function of my company as a team lead. We periodically send out phishing emails to all users on company network as a form of continuous education of users on how to spot ...
1
vote
2answers
89 views

Hashing Session ID

For my app I use redis as a session store. Is it safe to store the session id without using a hash function? If I should use a hash function, the client would receive the cookie with the raw or the ...
0
votes
1answer
65 views

Deserialization Opportunity?

I have minimal experience exploiting deserialization vulnerabilities and I am working on and I have identified the following URL endpoint. This is it URL Decoded: /Account/Register?Count=0&Keys=...
0
votes
1answer
60 views

Is there a safe way to use external display with USB Type-C laptops?

Somewhat related to Is malware or screen capture possible with iMac as external display?, where we investigate the possibility of a DMA attack through DisplayPort, nowadays, many machines don't even ...
17
votes
3answers
5k views

Storing info in JWT payload

Currently, the access token expires in 15 minutes and the only info stored in the payload is the user id. Each user has a balance which he can use inside the app. Should I query the database on each ...
-1
votes
0answers
60 views

why does ssl need record protocol?

According to this answer, I think that this fact that at the beginning of communication, record protocol just uses a null cipher will make some issues. For detecting any issue, I need to know in which ...
1
vote
2answers
55 views

wordpress remote user authentication

I am having multiple wordpress sites with multiple users working on those. Therefore I would like to centeralize the user management, by having one authentication server, storing the username, ...
1
vote
1answer
52 views

Can session/cookie request token be sent via url?

What are the security concerns if a session token is sent via url over https? After authentication a rest api sends a unique session token that is used to validate subsequent requests. It is ...
0
votes
0answers
52 views

How TLS symmetric encryption works?

After the secret symmetric key is exchanged, how does it look like? What length (in a production use) is it and what can influence it? How the key is used to encrypt / decrypt a piece of data? I ...
0
votes
0answers
27 views

Amazon S3 policies: CORS or Service Accounts?

I have a question about accessing buckets on AWS S3. Let's suppose we have a bucket that has to have public read access by everyone and only my API has to be able to PUT and DELETE items from bucket. ...
1
vote
0answers
86 views

How could a mobile banking app be hacked?

My phone got stolen, and sent back to where it was stolen a day after. At the moment of stealing, the phone was locked. When I received it back, there was no money left in my bank account. The ...
0
votes
2answers
109 views

Baking a better cookie - How can we prevent a high-jacking of the user's local cookie file to exploit accepted cookie use?

This question is similar to Hashing cookie-values & preventing cookie-stealing however, it is significantly different as I am interested in preventing (internal) subscription fraud, rather than an ...
1
vote
0answers
59 views

Late to becoming interested in career in information security. How much disadvantaged am I against those talented people since young? [closed]

relatively new to stack exchange and I was about 1 year in my career as a Network Security Engineer before I am needed now by the same company as a Special Projects Engineer to help a department set-...
1
vote
0answers
50 views

Why does OAuth have two separate tokens (access and refresh)?

In the OAuth2 protocol, two kind of tokens are used: access_token: Granted by authorization server, used by resources servers to decide whether access should be granted for the resource ...
0
votes
0answers
21 views

Kaspersky detection locally 3 years old file, clean on virus total. Compromised? [duplicate]

I just got a warning on a file locally: Weird, as I have this program for like 2 o 3 years, Just before got cleaned, I upload to virus total, totally clean on cloud. https://www.virustotal.com/gui/...
0
votes
0answers
34 views

Why use a refresh token for authentication?

I recently stumbled upon this article which recommends using two tokens for authentication. Once the user is logged-in (or registered), the client receives an access token and a refresh token, ...

15 30 50 per page