All Questions

I'm trying to generate all possible variation of a password. The base word is like "PleaseSub!" and I need all possible version of it with uppercase, lowercase, etc.. I know there is ...

In my test setup I have a root CA only. I also have a node cert (joe0.lab.local.pem). I did the following: openssl verify -CAfile ca.pem joe0.lab.local.pem joe0.lab.local.pem: CN = joe0.lab.local ...

I'm currently working on a library with secure authentication process. I wanted to support ppk file loading for ed25519 private keys. I used the original source code of putty to determine how the ...

Microsoft offers RAP as a Service for various platforms like AD, Exchange, Windows Servers/Desktops etc. Does anyone have an insight about these services from Microsoft vs other free tools like for AD ...

I was testing Burp Suite Crawl on some old php sites I made and it found Sleepy User-Agent SQL injection vulnerability User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, ...

I'm trying to consume a payment processor API (not developed by my), but (being honest) I don't know anything about security, I don't understand API keys and authentication, I have multiple questions ...

I'm definitely understanding something wrong with the TLS process, and am hoping one of you fine folks will point out the flaw in my thinking. So from what I've read on TLS, the client (and therefore ...

I know servers have something to block you from just sending them an HTTP request that is actually some malware or a webpage that is malicious, because it would be so easy to just spam HTTP requests ...

Using a Powershell script how do I grant the "Read all properties” and “Create Computer objects” permissions to this Computer object: mylab.com/Computers/Cluster1. The permissions should be ...

I clicked on a phishing website. I was surprised to find that this website looked exactly like google and had my information displayed. The information displayed were my email and my profile picture. ...

I came across a very interesting case: The user uploads a file The file contains <script>alert(2)</script> The web app shows the file's content to the user -> the XSS payload is ...

I keep setting my DNS on a Mac to 1.1.1.1 and 8.8.8.8 and ATT keeps changing it back to theirs. On my Mac! How is this possible? and how can I prevent it?

I looked at a certificate of (e.g. stackoverflow) a website and the fingerprint in chrome was different then microsoft edge, so I was wondering how it that possible? chrome: ...

I want to collect certain data from my application using the driver and transfer it to the server to check its integrity. And I want to sign these packages using TPM to avoid forgery. However, a user ...

Just out of curiosity, could you provide (old) real world X.509 v2 certificate examples that include the deprecated (in some version of X.509) and forbidden (in RFC 5280) issuerUniqueIdentifier or ...

I recently discovered that on one of my pc the Solar Winds software was installed. I didn't install this software on my machine. I also saw that SolarWinds was cracked by russians hackers and also ...

To me, security is most important topic for messaging or video conference applications. I am searching if end to end encryption is possible for group chat or group video conference. There so some ...

Facebook tends to "recommend" your account based on IP and collected data. How do I keep it hidden from people that are geographically related to me? I want to create a pseudo-anonymous ...

Recently a utility provider has started to attach a zip file including my bill inside, however, they have secured the zip file using my online web account password. I am not too concerned about ...

Let's say I have the following url: https://secure.sub.domain.com/?continue=https://sub.domain.com I found out that I can put anything I want before sub.domain.com in the continue parameter as long as ...

I have a python-script being run regularly on my Linux system by means of a cron daemon process - every weekday 18:00 scraping stockmarket data. This scraping script is placed in cgi-bin folder so ...

I have a zip file (.zip created by 7zip v15.10) that I remember the password to (~12 characters long), but it seems I've typed the password wrong while zipping it and now it doesn't open. What are the ...

I know that the access token can be of any format(it is up to the authorization server), but I noticed that most of the times the access token is not a JWT whereas the id token is a JWT. Why is that ...

Let's say I had a ca bundle with many certificates in it on my server. I accidentally gave this to a team of programmers I have hired. Could they theoretically use this to somehow ssh into my server ...

When using Remmina in Ubuntu connecting to Windows remote desktop, a message about a mismatch of certificates get displayed. However, Remmina is displaying it in SHA256 format. But when I look at ...

If I have a file that I encrypted with PGP and I'd like to allow other people to view the file after I performed the original encryption can I simply add them to the PGP payload? Since PGP creates a ...

I am getting an error instead of Server Hello from the server handshake, an alert protocol version with error 70. The description of SSL Layer shows description of 70. https://tools.ietf.org/html/...

I'm running a docker container in Kubernetes cluster running in aws, I exposed the container through LoadBalancer service and limited access to it just to my ip address using aws security groups, but ...

With ethernet connected I can ping the router. Using a browser and letmeoutofyour.net:8080 returns W00tW00t, 443 sits and spins. Using a MacBook Pro early 2011, High Sierra 10.13.6. It seems to be a ...

When you plug a smartphone into a USB port on a Windows 7-10 computer, often a small message box pops up on the Windows device indicating that drivers are being installed. This happens automatically ...

I'm learning about X509 certs used in client-cert authentication to https endpoints. I have a nice Python script that checks many facets of the client-cert. Is there any validation that can be ...

I have added a root ca in my debian machine by using the following commands: mkdir /usr/local/share/ca-certificates/custom/ mv myserver.crt /usr/local/share/ca-certificates/custom/ update-ca-...

I know how Buffer Overflows work but in order to do them do you have to be on the same WIFI as your victim. You need to send a packet to a specific device on a specific port. Therefore, unless port ...

If the following data is known: URL of web site X, Exact time and dates when the visit to web site X occurred, Anonymized IP address of web site visitors (without the last digit, e.g. 125.251.101.x), ...

I'm working on app that uses MySQL database on XAMPP Control Panel on Windows. I am concerned about security part. I received advice about connecting to MySQL through VPN so it won't be accessible so ...

Is confidential computing/hardware-based trusted execution environment (TEE) the missing security jigsaw puzzle to counter data exfiltration? Today, we already have data encrypted at rest and data ...

The Israeli ministry of health reports many statistics on Covid patients (Numbers of confirmed cases, hospitalizations, people in quarantine - Divided by age and other demographics) available here (...

I wonder if the chat content's are encrypted in local storage on mobile devices (iOS, Android). I hardly found any reliable information about this topic. My thought is about somebody stealing my ...

I am aware that MS Word documents can be potentially dangerous due to the executable macros contained within them. But for a particular document, I have opened the macros and can see there are none. ...

I was thinking of the following scenario : a network is behind a router (performing NAT) and firewall this firewall denies all unsollicited incoming packet a user on a computer of the network opens a ...

I try to configure two servers 'httpd' with TLS1.2 (Client Certificate check enabled) It works fine on one. But not on the second... I get : "unable to get local issuer certificate" I tested ...

I'm wondering if the following system would be a secure way to store frequently duplicated files. Hash the source file, deterministically derive a key from it. The source file(s) are likely to be ...

the purpose of adding trusted timestamps to signatures is so that they can be considered valid long beyond the validity of the signing certificate. However, this is not so easy, since TSA's signing ...

If a template is provided to Perl's Template Toolkit, can you ensure that the code generation inside Template Toolkit is sufficiently subsetted to be safe?

I'm learning about X509 certs used in client-cert authentication to https endpoints. If I have an OCSP checker (Python script that creates, submits, decodes OCSP responses), do I need to check the not-...

Excuse me if this is obvious, but while encrypting one of my disks, I got bored and read the text on the window. And the question came to me, how the heck can I move a mouse in a way that a computer ...

I am running Zap version 2.10.0 and was hoping to gain more control of logins with users.authenticate_as_user, link It is, however, unavailable as when I list attributes of a users object in python I ...

I am struggling to implement JWT refresh tokens with the Double Submit Cookies method. My current set up for a browser based webapp without refresh tokens looks like this: Upon successful login, API ...

There is a lot of malware that can detect whether it is running inside a VM or sandboxed environment and if such environment is detected it can conceal it self and not execute. So why not make ...

While monitoring SIEM alerts, I saw that there was more than 200 failed logon for a user to several hosts in the domain. Obviously, it was triggered as a brute-force attempt. Assuming it was not an ...