All Questions

Why are there different pentest phases/stages/methodologies? Which one should be used? Why don't we come out with standard one? E.g. Wikipedia / Cybrary.it Reconnaissance Scanning Gaining ...

My question is about security groups/firewalls and protecting a virtual private cloud from the external world. Here is a description of VPC default policy for inbound/outbound traffic (on AWS): ...

Google has an IPv6 measurement page that reports that their numbers report on the percentage of users that access Google over IPv6. According to the report by Jan 2020 0.3% of users in China used ...

How do I compute my public key, if my private key for ECDSA in SHA-1 is equals to ab2c34b85dd576112f34? where: x = 54545578718895168534326250603453777594175500187 y = ...

I use an "anonymous" mail address (cock.li provider in my case). I have found that mainstream news sites in particular don't send their newsletters to such an addresses. It looks like the domains ...

I Have lost my zip file password and I tried to recover it with Windows 10, using John the Ripper 1.9.0 Jumbo. Things I know from this password: 9 to 11 characters Alphabetics A B E F and a b e f (...

If AV auto-scan will detect and prevent the malware from executing why there is a need to enable schedule/full scans? I'm asking because a full scan can create sometimes overhead on the machine and ...

Everyone knows that due to China's network regulation, users cannot use YouTube, Google, Twitter, and Netflix normally. If you need to use these network platforms in China, you must use a VPN to ...

I have been using AWS for hosting personal projects, mostly in the form of containerized Django web apps running on ECS with Fargate. I have referenced this article to better understand Fargate task ...

After doing some research about websites that have been taken down like Silk Road I have been extremely curious about the procedure that the FBI does to take down a website from the Internet. How do ...

When i run the command netstat -a to see the actual connections on my computer , i see all the time that my computer is connected to something like this ec2-xx-xx-xx-xx , not just one address it ...

As I was unable to find any thread about this particular question, I'm trying to ask the community for help. We're currently using RSA RADIUS based 2FA to authenticate external VPN users from ...

I was doing the google security challenges here: http://google-gruyere.appspot.com/part2 I don't understand the solution for the Ajax Stored Xss part. So here's the problem summarized: Every user ...

I'm using John to generate some word lists and I'm trying to figure out the most optimized way to do the next step. What I want to do is add ever possible 3 digit number to a set where the first digit ...

I am evaluating the idea of simplified second factor authentication by requiring a file to be uploaded, such as an image along with username/password. The file is stored on a user's device. My ...

Can an SSL certificate be signed by two issuers at the same time? Let's take an intermediate certificate as an example. It is usually signed by a root. A root certificate is often self-signed. In my ...

I was trying to use DNS spoofing in Man in the Middle attacks. But it didn't work. However, it did work for www.gmail.com once. I checked, and I could see that I was actually offline. Now I checked ...

I have a western digital blue disk, which is one of the SMR variations. I've heard that they support TRIM command. The disk is accidentally quick formatted on Windows 10, and now seems to be all zero. ...

I would like to copy a VIGIK RFID badge. It's MIFARE type badge. I've an ARC122 USB reader / writer and my OS is Linux like. I compiled mfoc and mfcuk successfully. First I tried to copy the badge ...

Since a router in bridge mode works like a modem, do you need to even update it?

I have been trying to generate a CSR which includes a san of type OtherName. the generated CSR does not seem to have the SAN field. this is the configuration file: distinguished_name = ...

I have been implementing server-sent shaders using OpenGL for a game (GLSL version 1.20.8). Executing server-sent shaders on the client obviously is remote code execution, which tends to be a bad ...

This question is essentially the opposite of Why isn't PKCE encouraged for Single-Page Apps?. In recent years, most OAuth API vendors seem to be have become unanimous in recommending that ...

I know printers are a security hole. I am trying to get the best setup to minimize risk. Here's the risk that I am trying to mitigate : that an attacker remotely access the printer, and use it as a ...

I have a mobile application and the backend is hosted on a cloud provider. I would like to ask for feedback on encrypting all REST API calls that will be used to communicate with the server, if we ...

Lately I have been attempting Portswiggers WebSecAcademy's HTTP request smuggling labs with the additional challenge of writing a python script to complete the challenge for me. Intended solution ...

Apps such as Fail2ban and DenyHosts enable unix administrators to limit username/password combo attempts to typically 3 attempts. But why 3? Some admins enable more, like 6 or 8 giving honest users a ...

I'm trying to manually verify the signature in an S/MIME signed email with openssl as part of a homework. While I have the mail and can extract the chain of certificates, I'm failing to extract the ...

My personal IPs on AWS are being scanned for 3379. Apparently, this is SOCORFS, registered to one Hugo Charbonneau. This port is getting scanned a lot more often in recent months: https://isc.sans.edu/...

The Post Quantum Cryptography is a type of cryptography that lies on physics properties instead of mathematics , it has many algorithms and implementations like NTRU , McEliece , SIDH ... etc But ...

I am using crypto module of node js for exchanging key using diffie-hellman algorithm. server.js const crypto = require("crypto"); const alice = crypto.createDiffieHellman(512); const aliceKey = ...

Is there a way to find the date when a CVE (identified by the CVE-ID) is detected and the date when a fix/patch is available?

I'm currently using a self-signed CA certificate in a development environment and I generate certificates signed by this CA. I want to add an AIA extension to any new certificates I generate with the ...

I have a VPS. There is a web-application running on this VPS. A user can log into his account, create a project (the system automatically creates a folder for this project) and then, he can create and ...

Let's say I access a website called example.com with VPN. Here's the flow: me → ISP → VPN → example.com Do typical VPN providers use the same IP address to receive data from ISP and send data to the ...

I have a computer from the company and, while working at home, I would like to know if the company could be capable of monitoring or spying on my computer. I am not connected to any company's server ...

I am interested in learning about setting up an (internal) enterprise PKI the right way. What's mostly clear to me is the technical part. Our PKI will implement an hierarchical trust model based on X....

The problem is that 2 people are sharing one laptop running windows-10, so they want to use VPN (different software, one is CISCO the other I dont know) but there is only one GUI on the laptop. So one ...

Django web framework uses the Double Submit Cookie pattern for CSRF protection. (The CSRF token is sent in a cookie and also in a hidden form field. Incoming requests are checked for a match between ...

I understand the normal operation is to encrypt with someone's public key and decrypt with the private. And I'm also aware of how signatures usually work. However I'd like to ensure that in order to ...

Some services, like https://2ip.io/privacy/, are able to detect (correctly) OpenVPN and its settings. For example, in my case: OpenVPN, AES, MAC is SHA512. How VPN fingerprinting works? I thought the ...

I am trying to scan our internal site's REST APIs using WebInspect. As the site does not yet follow the Open API Standards or use the Swagger tool, it does not have a .json file that contains the API ...

As per the title, what are the naming conventions when buying certificates ? When buying a cert for TLS / https from a particular Server, naturally I will default to the Server name, for example, if ...

About 2 decades ago (late 90s/early 00s), when I was still in high school, I opened up social media accounts online. Over the course of a few years and using these social media platforms, I posted ...

when getting a list of users in a channel I can see all of my personal details. First question is this what everyone else sees, and second how can I make sure my full name is never visible.

According to the Debian wiki on SecureBoot, This removes the risk of userland malware potentially enrolling new keys and therefore bypassing the entire point of SB. So SecureBoot stops users from ...

I performed some research on filesharing and anonimity, but it turns out anything I read is not about what I need. Most articles and forums recommend not to use services like Google Drive or Dropbox, ...

Using Nginx, I hope to restrict the permissible hosts for cookies. My initial intention was to employ a Content Security Policy for this purpose, but I don't see an obvious way to do this via a CSP. ...

I received an email on the 14th saying that a hacker has access to my pc it says that at the time of hacking my account (myemail@gmail.com) had this password (it was a version of my password but not ...

What if I have had the visa card in my wallet this whole time but somehow someone spent $192 on it. And I didn't even activate it yet so how did they take my money?