All Questions

Filter by
Sorted by
Tagged with
0 votes
0 answers
17 views

Oauth 2.0 current best practice for SPA and backends

I want to build a application which having following architecture: According to the BCP, I am going to implement Authorization Code Flow with PKCE. I am wondering: Do I need to implement a separate ...
user avatar
0 votes
0 answers
46 views

What are the purposes of having the IKE SAs in IKEv2?

What are the purposes of having the IKE SAs in IKEv2? I see that the IKEv2 has IKE SA and IPsec SA. So I'm thinking that IKE SA is to secure the negotiation for IPsec. Is that alright and is there any ...
user avatar
  • 1
0 votes
0 answers
24 views

How can I inject JavaScript into a url whose contents will be written to the DOM in a way that it could execute?

I'm working with the API for a popular CI/CD app and I found a bug where path variables are being written directly to the DOM without being checked first. The tldr is that to access a project you go ...
user avatar
0 votes
1 answer
29 views

Msfconsole-exploit command: what options are used to generate a payload?

I have the following test environment with three computers: [victim] 192.168.0.104 running Windows 2003 [listener] 192.168.0.22 [Kali] 192.168.0.26 On the Kali machine, I used the following ...
user avatar
0 votes
1 answer
124 views

Landlord wants to share a single 3Gbps fibre to the property line across 4 flats using a mesh network. Should I be concerned?

fibre to the property is being installed in my road for the first time my landlord doesn't want lots of holes in their building they acknowledges that FttP is probably necessary going forward So ...
user avatar
  • 105
0 votes
0 answers
12 views

Leaving half open or full open connection having SYN cookie

Suppose an attacker collects a large number of initial sequence numbers sent by the server. Can the attacker cause the server to create many fully open connections by sending ACKs with those initial ...
user avatar
0 votes
0 answers
9 views

Creating half open or full open connection in presence of SYN cookie

Suppose an attacker knows that a target host uses SYN cookies. Can the attacker create half-open or fully open connections by simply sending an ACK packet to the target? Why or why not?
user avatar
0 votes
0 answers
16 views

Key distribution protocol involves only 2 parties, given E[k1,E(k2,m)]=E[k2, E(k1, m)] [migrated]

Given an one-key cipher such that: E[k1,E(k2,m)]=E[k2, E(k1, m)] Is there any key distribution protocol that involves only two parties (Alice and Bob) without the key distribution center? The protocol ...
user avatar
  • 1
0 votes
0 answers
31 views

How do different types of cyphers relate together? [migrated]

I understand that there are symmetric and asymmetric (public-key) cyphers. The first have the same key used for encryption and decryption, while the second use a public key for encryption and a ...
user avatar
  • 403
0 votes
1 answer
37 views

XD/NX Bit in UNIX [Memory Security]

I have been reading about XD/NX bit used in Memory Pages for security. I understand it is a security feature that can help reduce system exposure to viruses and malicious code. If enabled, processor ...
user avatar
0 votes
1 answer
33 views

A few questions about fixation attack

I am writing a small app. It creates a session once the user authenticates. I am aware of this definition of fixation attack from owasp. Attacker uses the app In this App, once they log out the ...
user avatar
  • 15
0 votes
1 answer
73 views

How to harden a FOSS and gratis operating system?

I want to migrate from Windows to Ubuntu. I understand that Ubuntu's1 security model is a bit different than that of Windows but I don't aim to ask about this particular OS, rather, in general, what ...
user avatar
0 votes
0 answers
68 views

How are scam call centers cctv stream easily hacked by scam baiters

Recently i have been seeing the videos of fake call centers being busted by scam baiters like Mark Rober In all of these videos the scam baiters are easily able to hack into the the network camera ...
user avatar
0 votes
0 answers
12 views

How to Scan Firebase Database?

I have the APK of an application and analyzed it using MobSF static analysis. It says the application talks with Firebase Database and provides a URL. Obviously, the URL is not accessible. I am new to ...
user avatar
0 votes
1 answer
35 views

Import a exploit into msfconsole on ubuntu

I'm attending a offensive security courses and one of the subject is import a exploit from exploitdb into msfconsole. Commonly advice that it's required to create a exploit folder inside .msf4 and ...
user avatar
0 votes
0 answers
32 views

bruteforce attack inside iFrame

How can I change the value of src parameter inside the iFrame tag with programs like wfuzz or fuff? For example I have an iFrame on the server like this: iframe.php <html> <head><title&...
user avatar
  • 221
1 vote
2 answers
77 views

Need help generating list with crunch

I am new to Kali Linux. I am trying to generate a wordlist of 6- whatever character words where: the first part is an English word that starts with a capital letter the last 5 characters are 8765. It ...
user avatar
  • 51
0 votes
1 answer
45 views

Session cookie security

I am creating a small login system. It looks like the standard username/pwd and user can either log or register. If they pass (authenticate), I create a session cookie that will be sent with the ...
user avatar
  • 15
1 vote
1 answer
97 views

Potential problems with insecure password hashing

For my job I use some industry-specific software that stores sensitive information. The software has a web interface with a public login page. One time I attempted to log in, but mistyped the last few ...
user avatar
0 votes
1 answer
59 views

OS on external drive -- is it safe?

So I'm installing macOS to my external hard drive partition, so I can have a 100% clean environment where I can engage with cryptocurrencies. (Exchanges, stable coins, protocols, putting actual money ...
user avatar
0 votes
0 answers
22 views

Compromised machine. Should I create a partition or volume to install a clean OS?

My goal is to create a 100% clean environment where I can interact with cryptocurrencies. For that, I can partition my disk or I can create a volume. Which one should I prefer? Some context about the ...
user avatar
0 votes
0 answers
19 views

Slow Loris Attack Wi-Fi variant

I watched a Computerphile video. In the end Dr. Bagley talked about the fact that a router can only receive/send a packet at a time, so if one device is slow it will slow every device down, because ...
user avatar
1 vote
1 answer
29 views

Passing traffic from a script through proxy / tor network [closed]

I am applying for a job that involves creating unit tests and end to end tests for a website. Right now, i am assigned with a task, in order to test my skills. However, my country has blocked access ...
user avatar
-1 votes
0 answers
55 views

How do I engage with cryptocurrencies wallets in a compromised computer?

I am using a Mac machine and I suspect it has been compromised. Would partitioning the disk and installing a clean OS on this disk just for cryptocurrency activities solve the problem? That would be ...
user avatar
-1 votes
0 answers
35 views

What is this unknown 10-digit device address? Found on an iPhone [migrated]

I saw this unknown address under my personal hotspot summary on an iPhone: e:69:a5:97:7:17 Interestingly enough, it only has 10-digits so it cannot be a MAC address. What is it then? Should I be ...
user avatar
-1 votes
0 answers
39 views

How to stop/reduce constant DNS Spoof/Poisoning Attack from NGINX server if DNSSEC is not offered from provider?

Currently my domain is sitting without DNSSEC security because my domain provider didnt support it for my ccTLD domain, the feature will only be available once i renew my domain in about 2 months time....
user avatar
0 votes
1 answer
28 views

Keylogging virtual machine from host

Can a keylogger in a host machine capture keystrokes in virtual OS? I'd like to get into cryptocurrencies but I don't know if my machine (mac) is secure. So I thought I could create a VM for it but I ...
user avatar
0 votes
1 answer
36 views

Using -s with --increment

I have multiple computers which I am planning to use. They all run a custom-made client that starts hashcat with different args. I am able to submit the current progress, candidates etc (everything in ...
user avatar
  • 1
1 vote
1 answer
43 views

Onion Routing Encryption

I'm curious how, in onion routing, the relay nodes identify which node to forward the message to? From my understanding the message must travel a specific path based on the keys the user has. I don't ...
user avatar
  • 113
-2 votes
2 answers
161 views

Why do people claim Tails is more secure than Windows?

Why do some people say that using Tor within my normal operating system will not be safe? What differentiates Windows and Tails in this regard? I believe that running Windows together with a VM, VPN ...
user avatar
0 votes
1 answer
24 views

OAuth 2.0 POST to Authorization Endpoint

The OAuth 2.0 specification states: The authorization server MUST support the use of the HTTP "GET" method [RFC2616] for the authorization endpoint and MAY support the use of the "POST&...
user avatar
1 vote
1 answer
34 views

Is there any way to disable/not allow unquoted service paths in Windows?

Unquoted service paths might be used as a privilege escalation vector after an attacker gains access to a Windows host. Given Hector's answer in the following question: "Windows Unquoted Search&...
user avatar
  • 133
0 votes
1 answer
100 views

Why don’t routers request permission when attempting to connect to an unknown address? (Or why do they still assume every connection is trustworthy?)

I’m imagining a system similar to UAC on Windows but implemented at the router level for IP addresses instead. (Or AS numbers, BGP numbers, Port number, etc…) Naturally this makes router setup ...
user avatar
  • 101
1 vote
0 answers
89 views

How exactly does OpenVPN's tls-auth option apply HMAC to packet messages?

Update: I've been able to work out everything I was asking about packet structure when I was finally able to get Wireshark to work, but there is one last thing I'm confused on which I detail at the ...
user avatar
  • 99
0 votes
0 answers
17 views

ACL management (file access) & security

I'll start by saying I'm not sure which stack community I'd ask my question, but I'm looking into using ACLs to manage file access on our server because of specific IT security requirements. We mostly ...
user avatar
  • 1
0 votes
0 answers
34 views

Increment hearbeat request metasploit

I'm using metasploit to a university project and I have to try to make a botnet attack unnoticed and the if the blue team dettect it, I have t try to make as imposible as I can to attribute the attack....
user avatar
  • 5
0 votes
1 answer
49 views

Key derivation for password manager backup?

Backing up your password manager is a good idea in case your house burns down, but where do you store the password to the off-site backup? Remembering the master password is easy, but re-using the ...
user avatar
  • 175
0 votes
1 answer
57 views

What is the impact of OpenVPN SECLEVEL=0?

OpenVPN throws a "signature digest algorithm too weak" error when I try to connect to a specific VPN. A common suggestion for a workaround is using the following config: tls-cipher "...
user avatar
  • 29k
1 vote
1 answer
137 views

What's the point of password protecting your document in a 1st email, then writing the password in a 2nd email within 5 minutes?

What security is gained from this procedure? What does this procedure accomplish? Many professionals do this, like government officials and lawyers. First, they email me the attachment (e.g. PDF, Word ...
user avatar
  • 13
2 votes
2 answers
70 views

Create a cryptographically secure random string for auth cookie in javascript

I know there are multiple libraries for managing authentication, but I have a hobby project and wanted to create a very simple authentication system. It'd set a cookie in the client's browser with a ...
user avatar
  • 205
0 votes
1 answer
35 views

DNS Enumeration by IP Address

I know all baseline steps to do DNS enumeration over a domain. But my questions is: how can I enumerate a server when I do not know which domain it is managing and I only have its IP address? My ...
user avatar
1 vote
1 answer
87 views

Comparing smartphones' to PC security

Comparing common smartphones running updated versions of Android or iOS to common desktop/laptops running updated versions of Windows or Linux: Are smartphones inherently less secure? I get the ...
user avatar
  • 1,853
0 votes
0 answers
23 views

IIS Crypto 3.2 not getting rid of Diffie-Hellman algorithms of less than 2048-bits

I'm trying to stop a server using Diffie Hellman key exchanges of less than 2048 bits, but I'm getting confusing results. I've run Get-TlsCipherSuite | Format-Table Name, Exchange, Cipher, Hash, ...
user avatar
17 votes
4 answers
3k views

Is signing a file better than issuing a checksum, and does it render a separate checksum useless?

Alternatively, the question could be asked: Does issuing a checksum for a file we sign anyways just duplicate work? Use case: Firmware sent to an IoT device. We sign it, and form a separate checksum ...
user avatar
  • 181
1 vote
1 answer
25 views

Export ECDSA certificate from Windows Store

I am trying to export public and private key of an ECDSA certificate from Windows key store. PFXExportCertStoreEx fails when I try to export ECDSA certificate. GetLastError() returns 0x80090016. I am ...
user avatar
-1 votes
1 answer
78 views

Is there any way to make the Government not find out geolocation from the hoster?

The government can find servers very quickly by contacting the hoster that hosts your VPN server, and the service provider might give your IP address. But what if I use torsocks ssh -d? I don't know ...
user avatar
  • 111
30 votes
3 answers
5k views

Why is one-time pad informationally secure?

I am reading "Serious cryptography" and he wrote the following: Informational security is based not on how hard it is to break a cipher, but whether it’s conceivable to break it at all. A ...
user avatar
  • 403
0 votes
0 answers
21 views

Sending logs with bug reports: how to defend against easy exploits like malicious file enlargement?

When a crash occurs or when a user reports a bug, I'd like to send my application's logs to a cloud service (Firebase). But I've just realised that there are tons of kindergarten level exploits. For ...
user avatar
  • 123
0 votes
0 answers
13 views

Shared credentials logins between separate websites and trust issues

Brand A has multiple, separate websites - these websites reference each other as part of the brand family, but do not have a shared single sign on system. Instead, each website has their own login and ...
user avatar
  • 530
0 votes
1 answer
63 views

Detect port forwarding

If there are 3 machines A, B and C and A communicate directly with B (A -> B) but B is executing port fordwarding with the next command socat TCP4-LISTEN:443,fork TCP4:<ip machine C>:443 So ...
user avatar
  • 5

15 30 50 per page
1
3 4
5
6 7
1309