All Questions

I've seen code like this: if(password.length !== allowedPassword.length || !crypto.timingSafeEqual(password, allowedPassword)) So timingSafeEqual is supposed to use the same amount of time to ...

When I'm scanning with Nmap, I make an effort to get proper hostnames associated with the target IPs. To do this, I scan UDP 53 on the targets to identify DNS servers and then run something like the ...

Background Some features are not yet available on the web platform and thus require cooperation with a native application in order to provide them. One method for a web application and a native ...

Does WhatsApp supply user data to government agencies like what Facebook or other social media does even if the regime is authoritaian? Do government agencies ask for information about users' text and ...

I've read that the Great Firewall now blocks TLS 1.3 connections with ESNI. Is TLS 1.3 usable without ESNI, or does the user have to downgrade to TLS 1.2?

I am currently creating a VPN Killswitch and so far it manages to keep traffic out, I just wanted to run it by others in order to catch something I missed. The killswitch uses source and destination ...

hello all, i'm solving a ctf challenge and i have this function that decrypts the cipher i want to build a function that encrypts plain text using vmUeu7D9bzE5JmNE as a key example output: //$...

I ran an nmap scan on my home network and linux machine. There were a few suspicious ports open so I used the command netstat -tanp|grep LISTEN to investigate further. The output was that dnsmasq is ...

I ran an nmap stealth scan on my home network (using linux) and this is my result. I don't know why netbios is open - I ran the samba command and it is not recognised, so I don't think I have Samba on ...

I did a netstat -a and was shocked to find that crazygames has a server running on my desktop, with open ports. see screenshot below. It does not show up in Control Panel nor in Task Manager. (Windows ...

I have basic knowledge about IT, but I want to become an expert in this field.

Had few chrome vulnerabilities [CVE-2020-6420] detected by BI(Retina). Upgraded the affected machines to chrome version 84.0.4147.89. After re-scan still the same vulnerabilities are detected. Anyone ...

With the public beta access to iOS 14 people got a warning when apps access the clipboard, and it lead to people realizing that many apps just grab everything from the clipboard they can get and send ...

I have a question about the Key Exchange Algorithm used in TLS process. I have read that the Key Exchange algorithm is used by client and server to exchange session keys. Do the client and server ...

For a web app, we are authenticating and authorizing users. There is no Sign-up option, but rather these users are provisioned into the system explicitly and are given certain permissions based on ...

There is a lot of information on how to avoid or detect XSS, but I couldn't find much information on how to monitor for reflected XSS. Is there a way to automatically detect reflected XSS in my ...

I've just read about the detecting and blocking of Tor traffic by DPI but now I'm curious about analyzing the data you send over Tor and matching it with your true identity by deep-inspecting the data ...

Let us say that a small company has an internal network for employees. All employees are granted Internet access via a NAT device (not a proxy) and perimeter firewall only allows outgoing connections ...

I am doing some xss challenges and I have a challence that has angle brackets, single, double quotes, backslash and backticks Unicode-escaped when I enter them in the search box. How can I bypass this ...

Is is it possible for Android development to remote debug an app from another network? I am not talking about WebView/Web Pages debugging but as stated here, as this page talks about remote debugging ...

Recently I've been trying to learn the mechanisms behind SSH keys but I came across this question that I haven't been able to find an answer to (I haven't figured out how to word my question such that ...

All i know is that it might be related to the quadratic equation and bhaskara. The text: nio8[8xe oj likkmp39347665mnsbcbhjsmnvkfkdioohhoqwex d xalzkzkncznc,zx zx,mm z,nllASAdja;sMCSKCNzmx;SLMXMCMMCC;;...

We would like to harden our Docker Image and remove redundant software from it. Our Devs and Ops asked to keep some Linux tools used for debugging on the containers running on our Kubernetes Prod ...

I'm trying to understand if a software obfuscator is able to protect the variables from apps like Cheat Engine which allow the attacker to modify the memory at runtime. Is this possible? If yes, which ...

While I understand their function, both IMSI and IMEI makes tracking and surveillance possible by virtue of being persistent idenfitiers for SIM and handset, respectively. Why aren't these replaced ...

I have 2 certificates (one root and one intermediate). In Windows OS, the Root certificate is in the trusted root store (for current user). The other intermediate certificate (signed by the root CA), ...

Specifically, I'm looking to determine if tripcodes for users on 4chan could have been migrated to 8chan, and then to 8kun. My (limited) understanding of this mechanism is that each server creates its ...

I was looking at the answer here and got curious if a function I use may be susceptible to XSS. Mostly because of this statement: Some HTML attributes are inherently dangerous. This includes href, ...

Ok i am facing a very weird behaviour that sets and doesnt set cookie both. So, first i have found CRLF injection in 2 domains, redacted.de and redacted_another.com. When i go to redacted_another.com ...

I am using a e-banking portal from a major Swiss bank (let's call it "Bank"). Some month ago, a new solution for the processing of electronic billing (e-bill) was introduced. The whole e-...

I was working on a bug with our VPN, and read about VPN Phases 1 and 2, each of which have a lifetime in seconds. I was investigating to validate if these had anything to do with the bug we had and ...

I Have recently setup parse-server on a DO vps, using 3 docker containers, one for parse-server, one for parse-server dashboard and one for mongodb. Because I am just testing this setup I left the ...

I am working on an e-commerce SPA (Single Page App) hosted in server A, I don't understand the security (Auth) that good, I'm consuming a PHP RestAPI hosted in server B only to show products, as it is ...

For a new application I'd like to store messages for each user's account on a centralized server. The user accesses the application through a SPA javascript web app through their browser. These ...

Like many, since March, I've been working from home and using the company's VPN to do my work. Recently, if I open a new tab in Chrome, and navigate to "news.bbc.co.uk", I got the ...

I'm using this Instagram account only on my 2nd phone which has no sim card and airplane mode always on. I use VPN 100% of the time when connecting to the internet. The account isn't linked with any ...

We have two offices located across the street and the distance allows us to keep everything in one LAN without going through the Internet. However, it seems to require some MITM protection, since the ...

What are approaches for monitoring cyber threats “outside” of the organisation, such as data like account passwords, credit cards, company data for sale, etc? While there are services for monitoring ...

AutoRecon is a multi-threaded network reconnaissance tool which performs automated enumeration of services. It is intended as a time-saving tool for use in CTFs and other penetration testing ...

Do ISPs like Xfinity gather geographical information about the users of their public hotspots? If so how is it done and how accurate is it?

We are working on our Vulnerability Management process and as part of that, I was going through the reports from our infrastructure vulnerability scanner. In the reports, I noticed that some of the ...

So for a while I have been using this chat to talk with random people: talkwithstrangers.com. I've used it to practice conversation. Yesterday though I had a weird conversation. The person with I ...

I am looking at implementing an API Gateway for a system using WS02 as the IdP. Users will be signing in using OAuth via federated SSO with social providers (initially Google). The users will also ...

We have a website https://ourwebsite.web.core.windows.net/ which needs to be made public(available on Internet for anyone) and did a Qualys scan using an external scanner on it which found 40 ...

if a ids using a decoder. and we can bypass the decoder ,the ids will be invalidated . like some decoder can't handel '&#0114' . how to bypass ids will be a important thing.

I am a student at University and have completed all on my CompSci courses and am getting started in my concentration, security. What I want to do for my project is create and monitor a secure cloud ...

If I download a file (PDF,doc,image,video etc) with a tails/tor setup, how can I ensure the file doesn't "call home" or isnt imbedded with malware (other than looking at the hash)? Will a ...

If I use Tails/tor on public WiFi, and a government agency is controlling /snooping nodes or uses malware to conduct a waterhole attack, what information can they gather about me?

Recently I got a very odd request to my website. This is from the log file: 20.42.89.182 - - [12/Aug/2020:18:48:13 -0400] "GET /cgi-bin/kerbynet?Section=NoAuthREQ&Action=x509List&type=*%...

I have domain name and we can connect to it over vpn only. Thus all CNAME are accessed when vpn is connected. I think the domain is delegated to a nameserver that's only accessible on the openvpn ...