All Questions

Filter by
Sorted by
Tagged with
0
votes
0answers
16 views

Tomcat AJP vulnerability CVE-2020-1938 aka Ghostcat

I have a question about Tomcat vulnerability CVE-2020-1938 aka Ghostcat. The security researcher who discovered the vulnerability created a write up here: https://www.chaitin.cn/en/ghostcat and a PoC ...
0
votes
1answer
33 views

How can I give out a secret to the public that only I can decipher?

I wish to add an extra layer of security to my product (web app that people download and install on their server) that have a module that allows me, the developer, to access their sites instantly with ...
0
votes
0answers
16 views

How to save image in base64 format as file in secure way? [closed]

My try: import base64 def form_valid(self, form): self.object = form.save(commit=False) if self.request.POST.get('image_as_base64', None): format, imgstr = self.request.POST.get('...
-2
votes
0answers
27 views

Which open source tools are being used for scanning websites on crypto-miners? [closed]

I'm searching for an open source tool for massive scanning to check whether the website is using crypto-mining scripts or not.
0
votes
1answer
39 views

Yahoo! Mail logging in with 2FA code only

I came across a serious issue with Yahoo! Mail that I hope someone would help to fix or raise awareness for. I wanted to create an account on Yahoo! Mail. I entered my phone number to the Yahoo! ...
0
votes
0answers
19 views

Mounting MTD with qemu-system-mipsel

I've been trying to get a firmware to run with firmadyne. Which basically just call qemu-system: qemu-system-mipsel -M malta -m 256 -kernel <kernimg> \ -drive if=ide,format=raw,file=<...
-4
votes
0answers
61 views

How to prevent attacker from viewing what's on my Android phone screen? [closed]

How to prevent attacker from viewing what's on my Android phone screen? Can someone give me advice or suggest apps to prevent this? For example, if I write in notepad, and it's offline, they can read ...
0
votes
1answer
32 views

how to trust a PGP smartcard

I understand the interest of using a PGP solution that is based on a PGP smartcard, such as the Nitrokey pro or similar. But then, how can I decide that I trust a PGP smartcard?
0
votes
0answers
31 views

Is tails needed to securely generate a PGP key on raspberry Pi?

I understand that usually one should use Tails on a trusted machine to generate PGP keys. However, I find it difficult to trust a machine with an Intel CPU, many wireless interfaces, a hard disk that ...
1
vote
1answer
62 views

InfoSec certifications for global startup

I am working in a global startup. Recently we have undergone several InfoSec processes with potential large corporate customers. All of them asked for: SOC ISO 27k Which makes sense for large ...
0
votes
1answer
33 views

How to check/test security issues of freeware?

My company is implementing the software whitelisting process. There are bunches of freeware needed security-testing. Actually, it just requires a preliminary evaluation rather than a deep analysis. ...
1
vote
1answer
39 views

Is this sufficient to verify a website's domain?

I'm building a browser extension that will run some javascript, which contains some sensitive information (essentially injecting authentication info). Therefore I want to make sure it only executes it ...
0
votes
4answers
48 views

How to identify UDP based DoS

I'm running a Counterstrike server on UDP port 27015. I'm using Amazon AWS to host the game server. I have added only my friend's IP into a security group so the rest of the traffic is always blocked. ...
0
votes
1answer
47 views

Should the Router or Firewall Come First?

Network scenario.... I have a typical enterprise network meaning ISP>>>>Edge Router>>>>>Firewall|DMZ>>>>Switch>>>LAN. I know there are several debates on the internet about what device comes first ...
0
votes
0answers
28 views

Is it possible to set permissions on a per application basis?

I wold like to set permissions on a per application basis, permissions like: Creation of sockets Creation of sub-process If an application creates a sub-process child processes should inherit the ...
1
vote
3answers
75 views

Downsides of allowing multiple emails per user?

There's lots of information on using one email for multiple accounts, but how about the other way around? I'm building a service and considering allowing users to log in with any of their registered ...
0
votes
0answers
41 views

Can a file upload function be vulnerable without it the file name getting passed?

From googling, a lot of file upload vulnerabilities rely on injecting something into the filename and also rely on the picture being stored on the server, is it safe to just do a post request of the ...
-1
votes
0answers
42 views

Webserver blocking other servers but not clients

I am currently pentesting a webserver and found out that its subdomain is blocked when pinged from another server (I tried pinging it w/ my Digital Ocean server and other ping tools from websites). ...
0
votes
0answers
33 views

Who implements Cryptoki on PKCS#11 Infrastructure, Software or Token/Devices

I am new to PKCS#11, and I am going through the docs, and I am a little bit confused where Cryptoki fits in. And after I read the initial part of the OASIS Spec, I came to conclusion that the ...
16
votes
5answers
3k views

If I send a plaintext e-mail using Gmail to somebody, including my PGP public key block, is that secure?

I've been trying to figure out "practical encryption" (AKA "PGP") for many years. As far as I can tell, this is not fundamentally flawed: I know Joe's e-mail address: cool_joe@gmail.com. I have a ...
0
votes
2answers
44 views

How can you hide the usage of an external VPN?

Let's assume we need a VPN to access some site, e.g. for bypassing geo-blocks. But those site doesn't want VPN users. A good example is Netflix. However, I don't want to specify this just on Netflix, ...
0
votes
5answers
69 views

Are downloads from http connections safe?

When downloading a file is there a safety concern when downloading from http connections/websites not https?
-4
votes
1answer
73 views

How can any intelligent person believe that PGP, HTTPS or anything else we have today is secure, given history and logic? [closed]

It truly feels like we are living in an "afterworld", long past the era when smart, intelligent, real men and women worked on things that really did matter. I'm talking about Enigma, Lorenz, Collossus,...
0
votes
0answers
15 views

libgcrypt and rdrand usage [migrated]

for some reasons, i was looking into libgcrypt source code and found this : https://github.com/gpg/libgcrypt/blob/b64b029318e7d0b66123015146614118f466a7a9/random/rndlinux.c#L189 if i understand this ...
1
vote
0answers
30 views

Block WireGuard clients' access to specific websites

I have installed a WireGuard VPN server on a Raspberry Pi (running Raspbian) using PiVPN and I would like to either block the VPN clients to access specific websites (i.e. block them access https://...
0
votes
2answers
77 views

Can my employer see my phone browsing history on my work desktop?

What if i logged in my work pc using my personal google account? Can my employer see what i have been googling on my phone under my work desktop's browsing history? What about under “my activity” ...
0
votes
0answers
57 views

Who is this person in the right corner at the floor? [closed]

I know this question has little to do with security excuse me for this. I lost my phone. Because I want to track the person who now has the phone, I'm trying to contact my phone anyway. But I see ...
0
votes
0answers
20 views

Any book/resource on ssl, client auth using cert, server auth pgp, keys, etc [closed]

Is there any book which can cover security from certs point of view in detail. I want topics like SSL certs for webservers/ sites Security certs for authenticating clients rather username/password ...
0
votes
0answers
24 views

JWT with a single audience claim accessing a resource server with multiple configured audience values

When a JWT id_token with a single audience is presented to a resource server which has multiple configured audience values, should the resource server reject the validity of the token on the basis of ...
0
votes
2answers
59 views

Can I bypass basic auth to fingerprint a web server with Httprint or netcat? [closed]

There is a web server I'd like to recon using httprint. But that web server has a basic auth protection on 443. Port 80 is not responding. When I launch httprint, it says Unspecified Error The same ...
0
votes
0answers
60 views

Opening OpenVPN to the world

I built my own private network with OpenVPN. I bought a VPS at hosting provider A(closer to home) and another two at hosting provider B(cheaper). Using openvpn I connected the two to the OpenVPN ...
2
votes
1answer
95 views

Suspicious calls to testgvbgjbhjb.com

On the last few days, one of our endpoints calls to testgvbgjbhjb.com the calls came from google chrome outside. I used TCPView to find suspicious connections and check if there any unknown ...
3
votes
3answers
99 views

Logging connections to hardcoded IP addresses

On a Windows system, I'm able to get a good idea of most outgoing traffic by enabling DNS query logging, but I am missing those connections that are made straight to hardcoded IP addresses. What would ...
0
votes
0answers
30 views

Loading seccomp rules from file [migrated]

I'm trying to implement a simple container. I would like users to be able to specify whitelisted syscalls in a profile.json file. Example content of profile.json file: { "whitelisted_syscalls": ["...
0
votes
0answers
53 views

How to determine a site's expiration date as an outsider? [closed]

How to determine a site's expiration date as an outsider? What are the different options do this?
0
votes
0answers
42 views

Customize default Prompt options (camera to share) when I trigger camera in Firefox with code development

I am having 2 cameras in my PC. When I try to trigger camera in firefox it always opens a permission prompt box with a webcam options. But I don't want to show the camera options in the prompt box. So ...
-1
votes
0answers
36 views

importing ip ranges list as a text file in angry ip scanner [closed]

I don't know how to correctly import IP ranges in a text file for angry ip scanner. I copied the IP ranges from some website and import them in a .txt file like 45.5.0.0-45.5.3.255 45.5.15.0-45.5.15....
-1
votes
0answers
33 views

File That Sends Ping/Request On Server When Opened [closed]

I want to create a pdf/jpeg file that sends a ping or request to the server when opened by the user.
0
votes
0answers
7 views

libcurl: how to use TPM private key for mutual SSL authentication [migrated]

I use the C libcurl library. I need to do OCSP stapling combined with mutual authentication. For that, I'll take model on the below exemples. However, I need the private key of my client certificate ...
3
votes
1answer
70 views

Enforcing DMARC policy (reject) on an Office 365 tenant

The domain & tenant has SPF and DKIM properly configured and DMARC policy set to p=reject. Still, emails spoofed with the domain in the From header aren't rejected, but appear in the Junk Email ...
0
votes
0answers
34 views

Scapy sniffing in python [migrated]

I don`t seem to find how i can negate something in the filter parameter from the sniff function in scapy. For exemple, i want to scan the network for all the ports except 80 and 443(http/s). How i can ...
1
vote
3answers
97 views

Is it possible to scan the whole IP range to find a domain behind the CDN?

I am very curious if it is possible to find the real IP address of a domain "protected" by a CDN service. For example, www.cnn.com uses Fastly service, and the domain name only resolves to a Fastly ...
0
votes
2answers
84 views

Someone is using my email to create online accounts; what should I do? [duplicate]

I suspect it’s an attempt at getting into an existing account using a leaked email/password combo. I update my passwords regularly and do not reuse, so I don’t think the attack will be successful, but ...
-2
votes
0answers
34 views

Help with barcode creator software [closed]

I'm trying to find software for my business and I don't know what it's called that I'm even looking for. I'm trying to create barcodes quickly from a pad that I can send to a wireless printer, again, ...
1
vote
2answers
63 views

is iptable whitelisting secure enough in AWS

Suppose my app is hosted on multiple servers, within the same data center (say in AWS or DigitalOcean). To secure communication between these servers, I use iptable to whitelist each other's IP. ...
5
votes
0answers
52 views

Is there a standard for OTPs tied to transaction details (that has been implemented in apps/devices)?

There are standards for Time-based (TOTP) and Counter-based (HOTP) One Time Password schemes. Generated OTPs are independent of the transactions they are used for, such as authorizing a login or a ...
0
votes
0answers
43 views

If the Lorenz cipher machine was so much more advanced than the Enigma, how was it broken without having a physical machine? [closed]

The Enigma was commercially available before the war, and even during the war, they got their hands on "live" such machines, heavily helping them in breaking the encryption used by the Germans. The ...
-1
votes
0answers
41 views

Appropriate network coverage for Honeypots [closed]

We are trying to implement a system of honeypots at a relatively large organization. What we are having trouble with is how many sensors or VMs need to be deployed. For example, given a network of ...
1
vote
0answers
38 views

Benefit of using OpenSSH FIDO/U2F support over GPG mode?

OpenSSH version 8.2 introduced support for FIDO/U2F hardware authenticators, via the new public key types "ecdsa-sk" and "ed25519-sk". I currently have SSH authentication set up in combination with ...
2
votes
0answers
44 views

“Trusted memory” What does it mean?

It is often cited "to load from untrusted memory to a trusted system memory" when describing the secure boot process. I wonder, when can we consider a memory as "trusted"?

15 30 50 per page
1 2 3 4 5 1137