All Questions

Filter by
Sorted by
Tagged with
0
votes
0answers
5 views

Using timingSafeEqual

I've seen code like this: if(password.length !== allowedPassword.length || !crypto.timingSafeEqual(password, allowedPassword)) So timingSafeEqual is supposed to use the same amount of time to ...
0
votes
0answers
6 views

Does Nmap use only one of the DNS servers specified in the --dns-server flag per host?

When I'm scanning with Nmap, I make an effort to get proper hostnames associated with the target IPs. To do this, I scan UDP 53 on the targets to identify DNS servers and then run something like the ...
2
votes
0answers
15 views

Does this registry entry for implementing custom protocol handlers in Windows present a security risk?

Background Some features are not yet available on the web platform and thus require cooperation with a native application in order to provide them. One method for a web application and a native ...
0
votes
1answer
23 views

Does WhatsApp supply user data to authoritarian regimes? [closed]

Does WhatsApp supply user data to government agencies like what Facebook or other social media does even if the regime is authoritaian? Do government agencies ask for information about users' text and ...
0
votes
1answer
20 views

Is it possible to use TLS 1.3 without ESNI?

I've read that the Great Firewall now blocks TLS 1.3 connections with ESNI. Is TLS 1.3 usable without ESNI, or does the user have to downgrade to TLS 1.2?
0
votes
0answers
19 views

Hardening my VPN Killswitch

I am currently creating a VPN Killswitch and so far it manages to keep traffic out, I just wanted to run it by others in order to catch something I missed. The killswitch uses source and destination ...
0
votes
1answer
33 views

reversing php dencryption function using openssl_encrypt

hello all, i'm solving a ctf challenge and i have this function that decrypts the cipher i want to build a function that encrypts plain text using vmUeu7D9bzE5JmNE as a key example output: //$...
0
votes
0answers
4 views

Is dnsmasq using port 53 a vulnerability? [migrated]

I ran an nmap scan on my home network and linux machine. There were a few suspicious ports open so I used the command netstat -tanp|grep LISTEN to investigate further. The output was that dnsmasq is ...
0
votes
0answers
24 views

Are the open ports 53,139,445 and 49152 expected on a Linux machine? [closed]

I ran an nmap stealth scan on my home network (using linux) and this is my result. I don't know why netbios is open - I ran the samba command and it is not recognised, so I don't think I have Samba on ...
0
votes
0answers
43 views

Is crazygames malware? It has a server running even though it is not installed nor shows up in Task Manager [closed]

I did a netstat -a and was shocked to find that crazygames has a server running on my desktop, with open ports. see screenshot below. It does not show up in Control Panel nor in Task Manager. (Windows ...
0
votes
0answers
34 views

I want to become a cyber security expert. Can anyone tell me how i become one? [closed]

I have basic knowledge about IT, but I want to become an expert in this field.
0
votes
0answers
27 views

Chrome Vulnerabilities are detected in vulnerability scan even after upgraded with latest versions [duplicate]

Had few chrome vulnerabilities [CVE-2020-6420] detected by BI(Retina). Upgraded the affected machines to chrome version 84.0.4147.89. After re-scan still the same vulnerabilities are detected. Anyone ...
1
vote
0answers
28 views

Log/Detect Clipboard access

With the public beta access to iOS 14 people got a warning when apps access the clipboard, and it lead to people realizing that many apps just grab everything from the clipboard they can get and send ...
1
vote
1answer
42 views

TLS- Key exchange for session keys. Why?

I have a question about the Key Exchange Algorithm used in TLS process. I have read that the Key Exchange algorithm is used by client and server to exchange session keys. Do the client and server ...
0
votes
0answers
20 views

Restricting authorization on a web app based on certain criteria

For a web app, we are authenticating and authorizing users. There is no Sign-up option, but rather these users are provisioned into the system explicitly and are given certain permissions based on ...
1
vote
1answer
24 views

Reflected XSS monitoring

There is a lot of information on how to avoid or detect XSS, but I couldn't find much information on how to monitor for reflected XSS. Is there a way to automatically detect reflected XSS in my ...
1
vote
2answers
46 views

Analyzing Tor traffic through Deep Packet Inspection?

I've just read about the detecting and blocking of Tor traffic by DPI but now I'm curious about analyzing the data you send over Tor and matching it with your true identity by deep-inspecting the data ...
0
votes
1answer
35 views

How to stop outgoing SSH on port 443

Let us say that a small company has an internal network for employees. All employees are granted Internet access via a NAT device (not a proxy) and perimeter firewall only allows outgoing connections ...
0
votes
0answers
21 views

How to do and XSS on angle brackets, single, double quotes, backslash and backticks Unicode-escaped

I am doing some xss challenges and I have a challence that has angle brackets, single, double quotes, backslash and backticks Unicode-escaped when I enter them in the search box. How can I bypass this ...
0
votes
0answers
16 views

Remote debugging android app from another computer on different network [closed]

Is is it possible for Android development to remote debug an app from another network? I am not talking about WebView/Web Pages debugging but as stated here, as this page talks about remote debugging ...
0
votes
2answers
65 views

What prevents someone from spoofing their public key when trying to establish an SSH connection?

Recently I've been trying to learn the mechanisms behind SSH keys but I came across this question that I haven't been able to find an answer to (I haven't figured out how to word my question such that ...
-1
votes
0answers
32 views

I need to decrypt a text but i don't know it's algorithm and key [duplicate]

All i know is that it might be related to the quadratic equation and bhaskara. The text: nio8[8xe oj likkmp39347665mnsbcbhjsmnvkfkdioohhoqwex d xalzkzkncznc,zx zx,mm z,nllASAdja;sMCSKCNzmx;SLMXMCMMCC;;...
3
votes
1answer
57 views

Is it possible to run commands that exist only on the host on a docker container?

We would like to harden our Docker Image and remove redundant software from it. Our Devs and Ops asked to keep some Linux tools used for debugging on the containers running on our Kubernetes Prod ...
0
votes
1answer
44 views

Is an obfuscator able to protect my app against Cheat Engine?

I'm trying to understand if a software obfuscator is able to protect the variables from apps like Cheat Engine which allow the attacker to modify the memory at runtime. Is this possible? If yes, which ...
0
votes
1answer
45 views

Why are IMSI and IMEI still used?

While I understand their function, both IMSI and IMEI makes tracking and surveillance possible by virtue of being persistent idenfitiers for SIM and handset, respectively. Why aren't these replaced ...
1
vote
1answer
45 views

What are the security implications of adding an Intermediate Certificate into the Trusted Root Store in Windows?

I have 2 certificates (one root and one intermediate). In Windows OS, the Root certificate is in the trusted root store (for current user). The other intermediate certificate (signed by the root CA), ...
0
votes
0answers
25 views

Is it possible to port or migrate tripcodes from one server to another?

Specifically, I'm looking to determine if tripcodes for users on 4chan could have been migrated to 8chan, and then to 8kun. My (limited) understanding of this mechanism is that each server creates its ...
1
vote
1answer
35 views

XSS - Setting Values and Attributes w/ jQuery

I was looking at the answer here and got curious if a function I use may be susceptible to XSS. Mostly because of this statement: Some HTML attributes are inherently dangerous. This includes href, ...
1
vote
0answers
28 views

Cookie is not being set after CRLF Injection in one domain but set in another domain. How can i bypass/set it?

Ok i am facing a very weird behaviour that sets and doesnt set cookie both. So, first i have found CRLF injection in 2 domains, redacted.de and redacted_another.com. When i go to redacted_another.com ...
2
votes
2answers
69 views

Can a third-party service within an e-banking portal actually be safe?

I am using a e-banking portal from a major Swiss bank (let's call it "Bank"). Some month ago, a new solution for the processing of electronic billing (e-bill) was introduced. The whole e-...
0
votes
1answer
41 views

Why do IPSec VPN Phases have a lifetime?

I was working on a bug with our VPN, and read about VPN Phases 1 and 2, each of which have a lifetime in seconds. I was investigating to validate if these had anything to do with the bug we had and ...
0
votes
0answers
89 views

Mongo DB hacked (read_me_to_recover) without the port exposed in the firewall?

I Have recently setup parse-server on a DO vps, using 3 docker containers, one for parse-server, one for parse-server dashboard and one for mongodb. Because I am just testing this setup I left the ...
0
votes
0answers
35 views

“Not secure” after RestAPI request [closed]

I am working on an e-commerce SPA (Single Page App) hosted in server A, I don't understand the security (Auth) that good, I'm consuming a PHP RestAPI hosted in server B only to show products, as it is ...
0
votes
0answers
39 views

Client-side encryption of data, but the server can also add data without reading stored data

For a new application I'd like to store messages for each user's account on a centralized server. The user accesses the application through a SPA javascript web app through their browser. These ...
1
vote
0answers
61 views

“Your connection is not private” for specific website, once when opening a new tab

Like many, since March, I've been working from home and using the company's VPN to do my work. Recently, if I open a new tab in Chrome, and navigate to "news.bbc.co.uk", I got the ...
0
votes
0answers
18 views

How does Instagram know my location even if I use VPN and have no sim card? [duplicate]

I'm using this Instagram account only on my 2nd phone which has no sim card and airplane mode always on. I use VPN 100% of the time when connecting to the internet. The account isn't linked with any ...
0
votes
0answers
6 views

Encryption between two switches [migrated]

We have two offices located across the street and the distance allows us to keep everything in one LAN without going through the Internet. However, it seems to require some MITM protection, since the ...
0
votes
0answers
37 views

How to monitor the internet at large for threats to your organization?

What are approaches for monitoring cyber threats “outside” of the organisation, such as data like account passwords, credit cards, company data for sale, etc? While there are services for monitoring ...
0
votes
1answer
35 views

AutoRecon is taking too long to complete

AutoRecon is a multi-threaded network reconnaissance tool which performs automated enumeration of services. It is intended as a time-saving tool for use in CTFs and other penetration testing ...
0
votes
1answer
40 views

Do ISPs like Xfinity gather geographical information about their users?

Do ISPs like Xfinity gather geographical information about the users of their public hotspots? If so how is it done and how accurate is it?
0
votes
1answer
40 views

CVSSv2 score of 10, but no CVSv3 score

We are working on our Vulnerability Management process and as part of that, I was going through the reports from our infrastructure vulnerability scanner. In the reports, I noticed that some of the ...
0
votes
0answers
77 views

Could I have been hacked? [closed]

So for a while I have been using this chat to talk with random people: talkwithstrangers.com. I've used it to practice conversation. Yesterday though I had a weird conversation. The person with I ...
0
votes
0answers
21 views

OAuth device code grant - JWT

I am looking at implementing an API Gateway for a system using WS02 as the IdP. Users will be signing in using OAuth via federated SSO with social providers (initially Google). The users will also ...
0
votes
0answers
24 views

Can Azure CDN mask vulnerability scans

We have a website https://ourwebsite.web.core.windows.net/ which needs to be made public(available on Internet for anyone) and did a Qualys scan using an external scanner on it which found 40 ...
0
votes
0answers
25 views

how to bypass a ids's decoder to bypass waf? [closed]

if a ids using a decoder. and we can bypass the decoder ,the ids will be invalidated . like some decoder can't handel '&#0114' . how to bypass ids will be a important thing.
1
vote
0answers
29 views

Student Project Ideas using Openstack [closed]

I am a student at University and have completed all on my CompSci courses and am getting started in my concentration, security. What I want to do for my project is create and monitor a secure cloud ...
-1
votes
1answer
62 views

how to safely open files downloaded with tor? [duplicate]

If I download a file (PDF,doc,image,video etc) with a tails/tor setup, how can I ensure the file doesn't "call home" or isnt imbedded with malware (other than looking at the hash)? Will a ...
0
votes
0answers
67 views

What can a government agency see if they control Tor nodes? [duplicate]

If I use Tails/tor on public WiFi, and a government agency is controlling /snooping nodes or uses malware to conduct a waterhole attack, what information can they gather about me?
0
votes
1answer
76 views

Very Strange Access Request to my website [duplicate]

Recently I got a very odd request to my website. This is from the log file: 20.42.89.182 - - [12/Aug/2020:18:48:13 -0400] "GET /cgi-bin/kerbynet?Section=NoAuthREQ&Action=x509List&type=*%...
-1
votes
0answers
34 views

How to connect to a domain without vpn [closed]

I have domain name and we can connect to it over vpn only. Thus all CNAME are accessed when vpn is connected. I think the domain is delegated to a nameserver that's only accessible on the openvpn ...

15 30 50 per page
1
2 3 4 5
1187