All Questions

Filter by
Sorted by
Tagged with
0
votes
0answers
9 views

Does Corporate Outlook Webmail Provide Rate Limiting of Login Attempts?

My company provides a corporate Outlook webmail access similar to this one, and our employees login thru the Outlook webmail regularly when they're working in the field. Recently, a co-worker in my ...
0
votes
0answers
13 views

Password using same hash value [on hold]

In a application, there is using of same hash value,suppose ssl will implement how its surity that password will using salted hash value after this
0
votes
1answer
23 views

Application throwing 500 internal server error only when i use burp

I am performing a security testing on one application. It is throwing 500 internal server error when i intercept with burp proxy. It is working fine if i turn off the proxy. I have tried the ...
-1
votes
1answer
29 views

Windows Hello Biometric Data

I have two PCs, A and B. I set Facial Recognition (Windows Hello) on A and then I took out the SSD from A and inserted it into B. I tried to sign in using Facial Recognition on B and it was successful ...
0
votes
1answer
22 views

Received Whatsapp security code through a local mobile number. Is this a thing to be worried about?

Before when I used to register my number of whatsapp .... I used to get verification code from a special number like (56789).... but recently when I tried to register my number I got code from a local ...
0
votes
0answers
14 views

Secure Peer-to-Peer Multicast Communication?

The problem: A single broadcaster needs to send a series of messages through a peer-to-peer mesh network such that only specific other pre-approved nodes can read them. The set of authorized receivers ...
0
votes
1answer
14 views

Why is Nmap not working with -oG commang

I am trying to learn how to use Nmap. I am running the following command in order to scan my WIFI subnet, nmap -oG - 192.168.1.0-255 -vv It starts the scan but get stuck at the last host, 192.168.1....
0
votes
1answer
34 views

Differences between compromised shared hosting and dedicated/virtual hosting

My webspace has been compromised as explained on this answered question. While ooking for advice on other q&a it seems to me in the answers it is assumed the compromised system is a full ...
0
votes
2answers
38 views

Is Google Play enough to protect an outdated device?

Depending on the brand, some Android devices stop receiving security updates as soon as one year after release. In my case, I own a Moto Z Play which latest security update was a year ago... However, ...
0
votes
1answer
35 views

Guessing speed in offline password cracking

What is the current speed an offline password cracking attack can be performed in guesses per seconds? It is for sure heavily influenced by the used hashing-algorithm and the used hardware. But i am ...
1
vote
1answer
61 views

Just another suspiciously looking php script [duplicate]

My hosting blocked my website because malware, they say. I dived into the (shared) server via ssh and found a file that looks suspicious. This file was in an old, not working installation of wordpress ...
0
votes
1answer
29 views

What is the difference when scanning external IP's from my LAN vs cloud/external scanner?

Im concerned if I am scanning effectively. When I scan our external IP's with the scanner on my laptop the packets are leaving my network through my firewall and routing across the internet to hit ...
0
votes
0answers
33 views

Digital signature using only x509 certificate

Is it possible to digitally sign a document only with a x509 certificate (ie public key)? We received a question from one customer saying that they wanted to sign a document using only a certificate. ...
-1
votes
0answers
38 views

what can be done by php method able to do 1+1 [on hold]

I just analyzed an app. found a php method on app used to bring profile credentials: POST service/bring_profile.php HTTP/1.1 Host: xxx.com Content-Type: text/plain Origin: file:// Connection: close ...
0
votes
0answers
27 views

Nessus showing missing KB

Nessus is showing that KB4512501 is missing from my endpoints, but I believe it has been superseded by KB4512509. I have approved both on WSUS. https://support.microsoft.com/en-gb/help/4512509 Can ...
0
votes
1answer
26 views

How do I verify that an ssh public/private keypair go together, is it different for openssl and ssh-key generated keys?

Generating a Private Key... $ openssl genrsa -out ./oci_api_key.pem 2048 Generate a Public Key...from the private key: I'm trying to generate a public key from a private key in PEM format (the ...
0
votes
2answers
54 views

Password generator and password limitations

I would like suggestions for a good strategy for dealing with web sites that have arcane rules about what must or must not appear in a password. My ideal are the sites that allow a good range of ...
0
votes
1answer
45 views

Is an open public WiFi network considered safe if employing client isolation?

The risks using open public WiFi networks has been done to death. What I've been wondering is whether an open WiFi network (typically public) is safe against packet-sniffing if that network is using ...
1
vote
2answers
49 views

How to prevent cross site scripting in wordpress?

I did source analyzer with third party services to my wordpress project. It found out that there are heaps of cross site scripting vulnerabilities. One of the example is like image below. How do I ...
0
votes
0answers
48 views

How can I call an API that requires TLS 1.2 when my http client can only support TLS 1.0?

We have an application written in PLC Structured Text using the B&R Automation Studio. This application needs to send HTTP requests to an external API server that only supports TLS 1.2. According ...
0
votes
0answers
25 views

How to redirect traffic from browser to burpsuite while being connect to a VPN Client

When I configure Firefox to use 127.0.0.1:8080 as proxy, with the same settings in burp suite, I can intercept requests in burpsuite. There is a web app which I need to access BUT I MUST authenticate ...
0
votes
1answer
49 views

Does changing an image src attribute to call a PHP function on my server to retrieve an image from another server eliminate CORS policy issues?

I am working in React, and I have an image which has an src attribute of https://s3.amazonaws.com/sample_endpoint. My website domain is https://sample-website.com. I am using a library, dom-to-image, ...
1
vote
1answer
108 views

Why are many Security sites not using HTTPS?

I've seen a lot of websites by security teams & companies which use HTTP instead of HTTPS. I'm using HTTPS Everywhere and have found even some medium-big groups not using HTTPS. I'm a noob at ...
0
votes
0answers
31 views

Received Google calendar invite but no organizer?

Whenever my wife and I invite each-other to an event which we create we always see the organizer above the guest but this spam invite does not have one. How is this possible? Can I achieve this?
2
votes
2answers
131 views

Are there any security hazards to installing Ubutnu for Windows 10?

I only want a bash shell in Windows 10 that runs faster and doesn't have any of the quirks of git bash / MINGW64, like for instance all of that CRLF garbage. Is there any security harm in ...
1
vote
0answers
46 views

Has SQRL been extensively audited?

SQRL - Secure, Quick, Reliable Login - is an open draft for user authentication. Have there been "enough" publicly available tests to make any backed statements about the security of SQRL?
0
votes
0answers
98 views

Is it technically possible to clear WhatsApp chat also on receiver's phone?

A friend of mine whom I trust 100% states that a user he was exchanging messages via WhatsApp deleted the whole chat,on his phone as well. He was able to take a screenshot of the last messages before ...
1
vote
0answers
18 views

Is there any privacy- or security-relevant difference between FIDO2 and SQRL

I just learned about FIDO2 (WebAuthn) and try to make a comparison to the lesser-known novel SQRL authentication scheme. Both seem to use the same key elements: a private, user-resident "master key" ...
3
votes
1answer
188 views

While cleaning up a hacked Wordpress site, I got access to the hacker's database. What action should I take?

I've just finished cleaning up a compromised Wordpress site; it was hacked through a vulnerable plugin & several fake sitemaps & redirects set up to pollute google results with pharma ads etc. ...
0
votes
1answer
34 views

Character filtration in globalisation supported application

I am working on building an application which will be used in various language , to secure from attacks like xss, SQL injection I thought implementing character filteration (whitelisting/blacking) but ...
-1
votes
1answer
55 views

What is board installation mean? [on hold]

Hi today I got email from a security research program. Yesterday I asked "Did you interested insecure permission vulnerability on ... that allow "Guests User" have full permission?" They answer: "We ...
-2
votes
0answers
20 views

SHEMA and the use of certain words [on hold]

The best applications where you might use maxInclusive vs Unrestricted? Other case sensitive words that have extreme applications in certain scenarios, usages? Could we, as Tech', use SHEMA, ...
0
votes
1answer
31 views

PHP stuff requests on Node.js based web app? [duplicate]

We have a Node.js based web application, that has routes like: myapp.com/posts/[postId] We tracked strange requests, which lead to 404 on this routes. The requests were to routes like: /posts/...
-1
votes
1answer
63 views

Laptop Hacked and Google Voice Texts deleted [on hold]

I reported an incident to my HR rep via Google Voice. The text string is now gone. My boss is a master hacker. How can I prove he hacked my account and removed the text string. Can I sue him for doing ...
0
votes
0answers
41 views

OAuth access token/API key patterns for large web sites

First off, let me preface this post by saying I'm not a security expert. I'm trying to build regular expressions to find OAuth 2.0 access tokens and API Keys for common web sites such as Google, ...
0
votes
0answers
17 views

Raid-5 with 5 2T sata in conjunction with an AI - partition part as ram boost [on hold]

Plus & minuses to achieving a stable application. Is there a limit on ram you can boost? Would it have to be water cooled or a good cost effective means to keep it stable? Is there true ...
0
votes
0answers
33 views

Image Metadata and GDPR Compliance?

I'm building an application that allows users to upload images/videos which are then publicly available. Just like 99% of all other apps do. The issue is that the metadata in these files can ...
0
votes
0answers
57 views

Are there any specific weakness in this crypto implementation?

I am reverse engineering the firmware of a particular router/modem. I am focusing on the functionality to export the router configuration. I an searching for a way to decrypt the configuration backup ...
0
votes
0answers
41 views

Setting user-agent for CSRF [on hold]

Consider a scenario where a POST request is completed successfully for a request with specific user-agent. The only protection against the CSRF at the endpoint I am testing is user-agent.I want to ...
0
votes
0answers
50 views

How can I recover an important gmail password that I've forgotten [on hold]

Forgotten a gmail account that I'm using to apply for grad jobs. Im waiting on several emails back but got locked out of the account. is there any program that or way i can use to try and recover it. ...
0
votes
0answers
38 views

Wifi Pineapple Tetra - Can't Clone Portal

Here are the steps to reproduce the issue: Connect pineapple, go through initial set up screen. In advanced options, upgrade firmware to version 2.6 Set up again, specifying root password, ssid ...
0
votes
1answer
106 views

Preventing Basic Directory Traversal Attack in Linux application

I have a Raspberry Pi connected to my network and keep getting this vulnerability warning from my security software. I turned off the apache2 web server on the Pi, which fixed my port 80 issue but ...
0
votes
2answers
60 views

Can MitM spoof a signed certificate by imitating the Certificate Authority?

I understand that a signed certificate is a server public key signed by the private key of a certificate authority. As a result, a client allegedly rest assured that the signed public key is for the ...
1
vote
0answers
36 views

Inbound rules for a port is configured and disabled yet an NMap scan shows that the port is opened

I am new to Windows Defender but have read about it to understand the basics of Inbound/Outbound rules. As mentioned on the app, Inbound connections that do not match a rule are simply blocked. For ...
0
votes
2answers
60 views

Is a web app vulnerable if it only uses session token in cookie to authenticate a user

I am new to bug hunting and i came across this website, so i came across this bug or atleast what i think is a bug so help me understand and tell me if i should consider it a vulnerability. The ...
0
votes
0answers
15 views

Is there any anti-virus that only uses behaviour-based malware detection? [duplicate]

I would like to know any antivirus software that uses strictly only a behaviour-based malware detection technique as the aim of my research is to compare behavioural-based and signature-based malware ...
3
votes
2answers
95 views

Final-Mile Shipping Company Wants Customer Email Address - PCI Compliance Issue? (United States)

My company ships very large, very heavy products to the homes of everyday consumers (think big home renovation materials). Currently, we provide the customer's name, shipping address, and phone number ...
0
votes
1answer
92 views

Where to store secrets in .NET applications?

I have some secrets that need to be transferred from my .NET application to another. I am using the CNG DPAPI to encrypt these secrets, and I wish to find the most suitable place to store them (in ...
0
votes
2answers
87 views

how common is it for an antivirus program to give false positive?

Often antivirus programs trigger a false alarm that a certain file is corrupted or infected. My question is that how common is that and if it is too common, can we really rely on them. Along with ...
0
votes
1answer
40 views

Secure API key mechanism for identification

In my web application, when the user logs in, a pair of JWT(JSON web tokens),access token and refresh token is sent with some fixed time validity. Using access token client is authenticated and using ...

15 30 50 per page