All Questions

Filter by
Sorted by
Tagged with
0
votes
0answers
8 views

can Tor browser protect me from being found out?

am using my computer but am connected to my work's WiFi, can my company see what websites i visit when am using Tor browser?
0
votes
0answers
10 views

Using a site as email

I've received emails recently, where the sender is an address to their personal website. From: name.net Instead of a normal email such mine, which is always in the form: From: name@mail.com I ...
0
votes
2answers
20 views

Explicit vs transparent proxy

As far as I have understood it: An explicit proxy challenges the user/application within his session. NGFW (transparent proxy) and SSO/identity-based solutions are just letting everything pass that ...
0
votes
0answers
17 views

Should IDM be private or exposed for app login?

In the diagram below, I have two options for authenticating into a protected resource. Both options use and IDM (in this case keycloak) to store credentials and present as a JWT once properly ...
0
votes
0answers
9 views

How to add to Domain Admins group? [migrated]

How do I add a user to the Domain Admins group when it says I do not have permission. I have Active Directory installed on a Windows Server 2019 virtual machine hosted in Azure. The VM is domain ...
0
votes
1answer
32 views

Unclear attack(?) on web server: GET requests for tar files

I am currently looking at the logs of my server and it is currently targeted by an IP address in the Netherlands performing requests to routes such as /X.tar.gz, where they increment X from a to z and ...
0
votes
0answers
18 views

Service that monitors information security incidents [closed]

I am looking for a service (paid/free) that monitors data breaches, scams, and other related information security incidents on behalf of a given company. Please suggest such service, if they exists.
0
votes
0answers
25 views

Could just downloading (not opening) .tgz file infect Windows 10? [duplicate]

Today I received some e-mail to Thunderbird. It had image attached that I clicked: Which sent me to onedrive.live.com/download?... and automatically downloaded .tgz file. I am not even sure if the ...
1
vote
0answers
28 views

Spawning child processes from root using runuser command

I am working as an intern for an online coding platform startup (similar to LeetCode or HackerRank). The backend is written in Nodejs. Instead of running the code in a sandbox of some sort, the lead ...
2
votes
0answers
50 views

Is Firefox's new JavaScript support within PDF files a security concern?

Historically, we have learned that many security vulnerabilities and exploits have resulted from allowing document files to contain executable code, whether it be JavaScript, VBScript, another ...
1
vote
0answers
31 views

VirtualBox: Making a Keylogger file from Kali VM after exploiting Metasploitable (Bridged Adapter) [closed]

I am fairly new to Kali Linux and Metasploitable and I am trying to set a keylogger for when I gain root access to Metasploitable. I have gained root access by using the use exploit/unix/irc/...
1
vote
1answer
79 views

Passwords stored as obfuscated text, not encrypted

An application I admin (but did not develop or implement) claims to be storing passwords in a database using “reversible encryption.” I have access to the database table, and was able to work out that ...
1
vote
1answer
65 views

How does a Certificate get associated to the private key pair?

I am new to SSL certs and trying to understanding once the certificate is imported into the Certificate Store (in Windows), how do we associate the private key pair to the certificate? Is that by ...
0
votes
0answers
36 views

CRSF protection in Next.js applications

So, I am trying to add CSRF protection to my Next.js application. I have tried a development branch of the next-csrf library. I have a couple of questions though: The library saves the CSRF token as ...
0
votes
0answers
53 views

ESP32: Secure WiFi credentials via WebCrypto?

Background information: I am not a computer scientist. However, in a research project I am currently building a ESP32-based sensor. Multiple sensors of this type are going to be used by multiple users....
0
votes
0answers
52 views

DNS : Hints to limit access to known clients

I would like to set up for personal purposes a DNS server on the cloud and offer its service to several members of my family/friends. Based on their IP and the filtering options they'd like, DNS ...
0
votes
0answers
46 views

Which hosts are necessary? [closed]

I would like to know if there is a way for me to determine which 0.0.0.0 are minimally necessary for me to use Facebook, Reddit or Twitter. This would enable me to block or add only all other (...
0
votes
0answers
33 views

How to learn about applied operation security? [closed]

I would like to listen to a sort of "saftey course". It should cover all things required for secure operation and teach how to Choose suitable hardware (phones, computers, routers, usb ...
0
votes
0answers
61 views

Do large companies like Google have users hash their passwords client-side? [duplicate]

What I am asking is does big tech companies like google have new users to hash their passwords on their browsers before it is sent to the back end? Do users send their password in plain text then the ...
0
votes
0answers
36 views

Windows Server 2019 hacking case [closed]

A strange case occurred recently on our Windows Server 2019. It runs some Hyper-V VMs, Apache+PHP7 via mod_fcgid (as a service logged in as a restricted user www), Nginx (as a service logged in as a ...
0
votes
0answers
45 views

Discrete Math(COUNTING NUMBERS) [closed]

Passwords of length 4 or 5 made up of letters where repeats are not allowed. Count the possible numbers.
1
vote
0answers
48 views

ctf kernel challenges does not work [closed]

I'm trying to learn and solve some 'kernel related' ctf challenges (reading writups to try to run same environment and achieve root using one of the kernel-pwn technique...). I'm using Ubuntu 20 VM ...
0
votes
1answer
50 views

Watering Hole Website NTLM Steal Attack

I'm trying to recreate a Watering hole SMB theft attack where you send a victim a link to your website containing code like "file://ip/file.gif" Causing forced authentication which passes ...
0
votes
1answer
37 views

Is OAuth more secure compared to API Keys

I have worked on many API integrations scenarios, and I used 2 approaches to authenticate the API calls, as follow:- Using API Keys For example inside hubspot integration i use this web call to get ...
0
votes
0answers
75 views

Someone transferred funds from my bank to my ETrade account [closed]

I got "hacked", my various accounts have been broken into. I have now changed all my passwords, random 16 character strings, on a secure machine, disconnected the compromised computer and ...
6
votes
5answers
3k views

2FA: Why do I need to keep my backup codes for each platform on paper?

I'm looking into setting up 2-factor authentication for my registered accounts. However, when setting up 2FA, for example Reddit, you need to write down backup codes in order to regain access to your ...
1
vote
3answers
81 views

ubuntu sources.list urls are not HTTPS — what risk does this present, if any?

I was looking at the installation instructions for VS Code today and found this step curious: sudo apt install apt-transport-https I see that there appears to be https transport available for apt: $ ...
1
vote
2answers
44 views

How to source training data in ML for information security? [closed]

A company entrusts a Data Scientist with the mission of processing and valuing data for the research or treatment of events related to traces of computer attacks. I was wondering how would he get the ...
0
votes
0answers
28 views

What you can do with XSS attacks [duplicate]

I am practicing in a website which is vulnerable to XSS so as to learn better this kind of attacks. I have managed to inject somewhere the usual <script>alert('XSS')</script> and it seems ...
1
vote
1answer
59 views

Can a machine running a packet sniffer see what nginx is forwarding on localhost to a Flask app?

I want to serve a Flask application from my pc. Other machines in my network only should be able to consume the API. However, I wish to have the communication between the other machines and the API ...
0
votes
0answers
12 views

How to perform Man in The Middle between two link local ipv6 addresses [migrated]

I'm trying to do a Man In The Middle between a computer and a device which communicate only using IPv6 link-local addresses. I've used ettercap in a Kali Linux VM to successfully put myself between ...
1
vote
1answer
62 views

Randomness of hash of (password + suffix)

Suppose I have a password, say "thisIsThePassword". Then I have MD5 hashes of that password followed by an increasing numeric suffix: MD5("thisIsThePassword1") = ...
3
votes
1answer
53 views

ssh -Q key not listing all key types?

I am having some problems with understanding which types of host keys my SSH daemon actually provides or supports (stock debian buster, sshd 7.9.p1). From the manual (man sshd_config): ...
1
vote
2answers
40 views

openssl certificate chain - windows

I have a ROOT_CA and a subCA. The subCA issued a certificate for a website (CUPS1.local). Moreover I have Windows clients; the ROOT_CA is already installed as Trusted Root Certification Authorities. ...
1
vote
1answer
53 views

Is combining salt from two places secure enough and what length

I need to implement some hashing scheme for an open-source project. This is what I currently have and I'd like to hear whether this is secure enough - The password is hashed using PBKDF2-SHA256 (which ...
0
votes
0answers
37 views

Using PEframe tool to find indicators of compromise

I try to find some indicators of compromise through the PEframe tool. Firstly, by using the volatility tool, I found out that there is a DLL file that is malicious. I checked it with the help of Virus ...
0
votes
0answers
65 views

Security against local attack for remote FDE decryption?

Is there any remote FDE decryption that is resistant to an attacker that has local physical access? Tools like dracut-sshd need to store the private key used for the sshd server on the unencrypted ...
0
votes
0answers
55 views

What alternative standard for ISO 27001 can be used in Australia?

I am looking for alternatives, that are less strict and less time consuming, than ISO 27001. Australia is in the Commonwealth, so maybe Cyber Essentials Plus could work, but I do not know if that ...
1
vote
0answers
60 views

Detecting and understanding malware/spyware [closed]

Recently, stumbled upon the new FB 500m+ leak and decided to satisfy my curiosity and poke around. Basically just wanted to see how 500m+ user records were kept and what info was released( it was ...
1
vote
3answers
147 views

Can you protect against SQLi without using prepared statements?

I am learning about SQLi (SQL injection) and I know that the solution to avoid them is prepared statements. However, does this mean that without them we are sure that we can get hacked? Are prepared ...
0
votes
0answers
44 views

Root-me won't load through Burp proxy

I am trying to access the root-me security website through Burp in order to solve some challenges, as I did many times without any problem in the past on this specific website. In order to do so, I am ...
0
votes
0answers
35 views

How to intercept application specific MIME types used by 3rd party (Windows) browser/plugins apps?

I'm trying to intercept and decipher scripted code that is sent to a previously installed Windows application, after a user have clicked on a particular URL in their web browser which is somehow ...
0
votes
0answers
36 views

How to securely implement a bot that uses an API token to connect to a remote site?

I want to implement a bot that connects daily to a remote site using the site's published API, and I want this implementation to be as secure as possible. I have found much advice on what one should ...
1
vote
1answer
53 views

CSRF double submit cookie pattern questions

I have some questions about CSRF protection, specifically about the "double submit cookie" pattern. What I have learned so far, is that this pattern has some weaknesses. But we can add some ...
0
votes
1answer
49 views

How to create a secure password for a Java keystore?

What would be the recommended approach (industry standard) for generating a password for a Java keystore that contains TLS certificates? In the event that the keystore is obtained, an attacker would ...
0
votes
0answers
38 views

OAuth for command line application

I'm planning to add an "official" command line tool for developers to interact with our API. The tool is basically just a glorified curl client, interacting with the API via HTTPS ...
0
votes
1answer
68 views

SSH and PCI on Insecure, Dirty Side

Does current PCI code require SSH connections be restricted to enumerated (specific) client IP addresses on the unsecure, dirty side? Isn't that outside the scope of the PCI code?
0
votes
1answer
80 views

What's the point of Empire if all payloads get flagged?

I've been reading about how powerful frameworks such as Empire and Metasploit are but I'm confused about something. Say I gain access through a custom reverse-shell which I self-coded (so it bypasses ...
0
votes
2answers
62 views

What could re-enable uPnP on router apart from malware?

I'm the sole person who has access to this router. I turned uPnP off and have twice found it turned back on in recent weeks. The Router is Asus DSL-AC68U. I have a VPN running at the router level, ...
8
votes
1answer
1k views

Should I trust that the Android factory reset actually erases my data?

I bought a Galaxy S20 Fe, logged my LastPass in it and all of my accounts (google, twitter, etc). Now it has a malfunction and I'm going to have to send it back to get my money back. When I factory ...

15 30 50 per page
1
2 3 4 5
1244