All Questions

am using my computer but am connected to my work's WiFi, can my company see what websites i visit when am using Tor browser?

I've received emails recently, where the sender is an address to their personal website. From: name.net Instead of a normal email such mine, which is always in the form: From: name@mail.com I ...

As far as I have understood it: An explicit proxy challenges the user/application within his session. NGFW (transparent proxy) and SSO/identity-based solutions are just letting everything pass that ...

In the diagram below, I have two options for authenticating into a protected resource. Both options use and IDM (in this case keycloak) to store credentials and present as a JWT once properly ...

How do I add a user to the Domain Admins group when it says I do not have permission. I have Active Directory installed on a Windows Server 2019 virtual machine hosted in Azure. The VM is domain ...

I am currently looking at the logs of my server and it is currently targeted by an IP address in the Netherlands performing requests to routes such as /X.tar.gz, where they increment X from a to z and ...

I am looking for a service (paid/free) that monitors data breaches, scams, and other related information security incidents on behalf of a given company. Please suggest such service, if they exists.

Today I received some e-mail to Thunderbird. It had image attached that I clicked: Which sent me to onedrive.live.com/download?... and automatically downloaded .tgz file. I am not even sure if the ...

I am working as an intern for an online coding platform startup (similar to LeetCode or HackerRank). The backend is written in Nodejs. Instead of running the code in a sandbox of some sort, the lead ...

Historically, we have learned that many security vulnerabilities and exploits have resulted from allowing document files to contain executable code, whether it be JavaScript, VBScript, another ...

I am fairly new to Kali Linux and Metasploitable and I am trying to set a keylogger for when I gain root access to Metasploitable. I have gained root access by using the use exploit/unix/irc/...

An application I admin (but did not develop or implement) claims to be storing passwords in a database using “reversible encryption.” I have access to the database table, and was able to work out that ...

I am new to SSL certs and trying to understanding once the certificate is imported into the Certificate Store (in Windows), how do we associate the private key pair to the certificate? Is that by ...

So, I am trying to add CSRF protection to my Next.js application. I have tried a development branch of the next-csrf library. I have a couple of questions though: The library saves the CSRF token as ...

Background information: I am not a computer scientist. However, in a research project I am currently building a ESP32-based sensor. Multiple sensors of this type are going to be used by multiple users....

I would like to set up for personal purposes a DNS server on the cloud and offer its service to several members of my family/friends. Based on their IP and the filtering options they'd like, DNS ...

I would like to know if there is a way for me to determine which 0.0.0.0 are minimally necessary for me to use Facebook, Reddit or Twitter. This would enable me to block or add only all other (...

I would like to listen to a sort of "saftey course". It should cover all things required for secure operation and teach how to Choose suitable hardware (phones, computers, routers, usb ...

What I am asking is does big tech companies like google have new users to hash their passwords on their browsers before it is sent to the back end? Do users send their password in plain text then the ...

A strange case occurred recently on our Windows Server 2019. It runs some Hyper-V VMs, Apache+PHP7 via mod_fcgid (as a service logged in as a restricted user www), Nginx (as a service logged in as a ...

Passwords of length 4 or 5 made up of letters where repeats are not allowed. Count the possible numbers.

I'm trying to learn and solve some 'kernel related' ctf challenges (reading writups to try to run same environment and achieve root using one of the kernel-pwn technique...). I'm using Ubuntu 20 VM ...

I'm trying to recreate a Watering hole SMB theft attack where you send a victim a link to your website containing code like "file://ip/file.gif" Causing forced authentication which passes ...

I have worked on many API integrations scenarios, and I used 2 approaches to authenticate the API calls, as follow:- Using API Keys For example inside hubspot integration i use this web call to get ...

I got "hacked", my various accounts have been broken into. I have now changed all my passwords, random 16 character strings, on a secure machine, disconnected the compromised computer and ...

I'm looking into setting up 2-factor authentication for my registered accounts. However, when setting up 2FA, for example Reddit, you need to write down backup codes in order to regain access to your ...

I was looking at the installation instructions for VS Code today and found this step curious: sudo apt install apt-transport-https I see that there appears to be https transport available for apt: $ ...

A company entrusts a Data Scientist with the mission of processing and valuing data for the research or treatment of events related to traces of computer attacks. I was wondering how would he get the ...

I am practicing in a website which is vulnerable to XSS so as to learn better this kind of attacks. I have managed to inject somewhere the usual <script>alert('XSS')</script> and it seems ...

I want to serve a Flask application from my pc. Other machines in my network only should be able to consume the API. However, I wish to have the communication between the other machines and the API ...

I'm trying to do a Man In The Middle between a computer and a device which communicate only using IPv6 link-local addresses. I've used ettercap in a Kali Linux VM to successfully put myself between ...

Suppose I have a password, say "thisIsThePassword". Then I have MD5 hashes of that password followed by an increasing numeric suffix: MD5("thisIsThePassword1") = ...

I am having some problems with understanding which types of host keys my SSH daemon actually provides or supports (stock debian buster, sshd 7.9.p1). From the manual (man sshd_config): ...

I have a ROOT_CA and a subCA. The subCA issued a certificate for a website (CUPS1.local). Moreover I have Windows clients; the ROOT_CA is already installed as Trusted Root Certification Authorities. ...

I need to implement some hashing scheme for an open-source project. This is what I currently have and I'd like to hear whether this is secure enough - The password is hashed using PBKDF2-SHA256 (which ...

I try to find some indicators of compromise through the PEframe tool. Firstly, by using the volatility tool, I found out that there is a DLL file that is malicious. I checked it with the help of Virus ...

Is there any remote FDE decryption that is resistant to an attacker that has local physical access? Tools like dracut-sshd need to store the private key used for the sshd server on the unencrypted ...

I am looking for alternatives, that are less strict and less time consuming, than ISO 27001. Australia is in the Commonwealth, so maybe Cyber Essentials Plus could work, but I do not know if that ...

Recently, stumbled upon the new FB 500m+ leak and decided to satisfy my curiosity and poke around. Basically just wanted to see how 500m+ user records were kept and what info was released( it was ...

I am learning about SQLi (SQL injection) and I know that the solution to avoid them is prepared statements. However, does this mean that without them we are sure that we can get hacked? Are prepared ...

I am trying to access the root-me security website through Burp in order to solve some challenges, as I did many times without any problem in the past on this specific website. In order to do so, I am ...

I'm trying to intercept and decipher scripted code that is sent to a previously installed Windows application, after a user have clicked on a particular URL in their web browser which is somehow ...

I want to implement a bot that connects daily to a remote site using the site's published API, and I want this implementation to be as secure as possible. I have found much advice on what one should ...

I have some questions about CSRF protection, specifically about the "double submit cookie" pattern. What I have learned so far, is that this pattern has some weaknesses. But we can add some ...

What would be the recommended approach (industry standard) for generating a password for a Java keystore that contains TLS certificates? In the event that the keystore is obtained, an attacker would ...

I'm planning to add an "official" command line tool for developers to interact with our API. The tool is basically just a glorified curl client, interacting with the API via HTTPS ...

Does current PCI code require SSH connections be restricted to enumerated (specific) client IP addresses on the unsecure, dirty side? Isn't that outside the scope of the PCI code?

I've been reading about how powerful frameworks such as Empire and Metasploit are but I'm confused about something. Say I gain access through a custom reverse-shell which I self-coded (so it bypasses ...

I'm the sole person who has access to this router. I turned uPnP off and have twice found it turned back on in recent weeks. The Router is Asus DSL-AC68U. I have a VPN running at the router level, ...

I bought a Galaxy S20 Fe, logged my LastPass in it and all of my accounts (google, twitter, etc). Now it has a malfunction and I'm going to have to send it back to get my money back. When I factory ...