All Questions

My company provides a corporate Outlook webmail access similar to this one, and our employees login thru the Outlook webmail regularly when they're working in the field. Recently, a co-worker in my ...

In a application, there is using of same hash value,suppose ssl will implement how its surity that password will using salted hash value after this

I am performing a security testing on one application. It is throwing 500 internal server error when i intercept with burp proxy. It is working fine if i turn off the proxy. I have tried the ...

I have two PCs, A and B. I set Facial Recognition (Windows Hello) on A and then I took out the SSD from A and inserted it into B. I tried to sign in using Facial Recognition on B and it was successful ...

Before when I used to register my number of whatsapp .... I used to get verification code from a special number like (56789).... but recently when I tried to register my number I got code from a local ...

The problem: A single broadcaster needs to send a series of messages through a peer-to-peer mesh network such that only specific other pre-approved nodes can read them. The set of authorized receivers ...

I am trying to learn how to use Nmap. I am running the following command in order to scan my WIFI subnet, nmap -oG - 192.168.1.0-255 -vv It starts the scan but get stuck at the last host, 192.168.1....

My webspace has been compromised as explained on this answered question. While ooking for advice on other q&a it seems to me in the answers it is assumed the compromised system is a full ...

Depending on the brand, some Android devices stop receiving security updates as soon as one year after release. In my case, I own a Moto Z Play which latest security update was a year ago... However, ...

What is the current speed an offline password cracking attack can be performed in guesses per seconds? It is for sure heavily influenced by the used hashing-algorithm and the used hardware. But i am ...

My hosting blocked my website because malware, they say. I dived into the (shared) server via ssh and found a file that looks suspicious. This file was in an old, not working installation of wordpress ...

Im concerned if I am scanning effectively. When I scan our external IP's with the scanner on my laptop the packets are leaving my network through my firewall and routing across the internet to hit ...

Is it possible to digitally sign a document only with a x509 certificate (ie public key)? We received a question from one customer saying that they wanted to sign a document using only a certificate. ...

I just analyzed an app. found a php method on app used to bring profile credentials: POST service/bring_profile.php HTTP/1.1 Host: xxx.com Content-Type: text/plain Origin: file:// Connection: close ...

Nessus is showing that KB4512501 is missing from my endpoints, but I believe it has been superseded by KB4512509. I have approved both on WSUS. https://support.microsoft.com/en-gb/help/4512509 Can ...

Generating a Private Key... $ openssl genrsa -out ./oci_api_key.pem 2048 Generate a Public Key...from the private key: I'm trying to generate a public key from a private key in PEM format (the ...

I would like suggestions for a good strategy for dealing with web sites that have arcane rules about what must or must not appear in a password. My ideal are the sites that allow a good range of ...

The risks using open public WiFi networks has been done to death. What I've been wondering is whether an open WiFi network (typically public) is safe against packet-sniffing if that network is using ...

I did source analyzer with third party services to my wordpress project. It found out that there are heaps of cross site scripting vulnerabilities. One of the example is like image below. How do I ...

We have an application written in PLC Structured Text using the B&R Automation Studio. This application needs to send HTTP requests to an external API server that only supports TLS 1.2. According ...

When I configure Firefox to use 127.0.0.1:8080 as proxy, with the same settings in burp suite, I can intercept requests in burpsuite. There is a web app which I need to access BUT I MUST authenticate ...

I am working in React, and I have an image which has an src attribute of https://s3.amazonaws.com/sample_endpoint. My website domain is https://sample-website.com. I am using a library, dom-to-image, ...

I've seen a lot of websites by security teams & companies which use HTTP instead of HTTPS. I'm using HTTPS Everywhere and have found even some medium-big groups not using HTTPS. I'm a noob at ...

Whenever my wife and I invite each-other to an event which we create we always see the organizer above the guest but this spam invite does not have one. How is this possible? Can I achieve this?

I only want a bash shell in Windows 10 that runs faster and doesn't have any of the quirks of git bash / MINGW64, like for instance all of that CRLF garbage. Is there any security harm in ...

SQRL - Secure, Quick, Reliable Login - is an open draft for user authentication. Have there been "enough" publicly available tests to make any backed statements about the security of SQRL?

A friend of mine whom I trust 100% states that a user he was exchanging messages via WhatsApp deleted the whole chat,on his phone as well. He was able to take a screenshot of the last messages before ...

I just learned about FIDO2 (WebAuthn) and try to make a comparison to the lesser-known novel SQRL authentication scheme. Both seem to use the same key elements: a private, user-resident "master key" ...

I've just finished cleaning up a compromised Wordpress site; it was hacked through a vulnerable plugin & several fake sitemaps & redirects set up to pollute google results with pharma ads etc. ...

I am working on building an application which will be used in various language , to secure from attacks like xss, SQL injection I thought implementing character filteration (whitelisting/blacking) but ...

Hi today I got email from a security research program. Yesterday I asked "Did you interested insecure permission vulnerability on ... that allow "Guests User" have full permission?" They answer: "We ...

The best applications where you might use maxInclusive vs Unrestricted? Other case sensitive words that have extreme applications in certain scenarios, usages? Could we, as Tech', use SHEMA, ...

We have a Node.js based web application, that has routes like: myapp.com/posts/[postId] We tracked strange requests, which lead to 404 on this routes. The requests were to routes like: /posts/...

I reported an incident to my HR rep via Google Voice. The text string is now gone. My boss is a master hacker. How can I prove he hacked my account and removed the text string. Can I sue him for doing ...

First off, let me preface this post by saying I'm not a security expert. I'm trying to build regular expressions to find OAuth 2.0 access tokens and API Keys for common web sites such as Google, ...

Plus & minuses to achieving a stable application. Is there a limit on ram you can boost? Would it have to be water cooled or a good cost effective means to keep it stable? Is there true ...

I'm building an application that allows users to upload images/videos which are then publicly available. Just like 99% of all other apps do. The issue is that the metadata in these files can ...

I am reverse engineering the firmware of a particular router/modem. I am focusing on the functionality to export the router configuration. I an searching for a way to decrypt the configuration backup ...

Consider a scenario where a POST request is completed successfully for a request with specific user-agent. The only protection against the CSRF at the endpoint I am testing is user-agent.I want to ...

Forgotten a gmail account that I'm using to apply for grad jobs. Im waiting on several emails back but got locked out of the account. is there any program that or way i can use to try and recover it. ...

Here are the steps to reproduce the issue: Connect pineapple, go through initial set up screen. In advanced options, upgrade firmware to version 2.6 Set up again, specifying root password, ssid ...

I have a Raspberry Pi connected to my network and keep getting this vulnerability warning from my security software. I turned off the apache2 web server on the Pi, which fixed my port 80 issue but ...

I understand that a signed certificate is a server public key signed by the private key of a certificate authority. As a result, a client allegedly rest assured that the signed public key is for the ...

I am new to Windows Defender but have read about it to understand the basics of Inbound/Outbound rules. As mentioned on the app, Inbound connections that do not match a rule are simply blocked. For ...

I am new to bug hunting and i came across this website, so i came across this bug or atleast what i think is a bug so help me understand and tell me if i should consider it a vulnerability. The ...

I would like to know any antivirus software that uses strictly only a behaviour-based malware detection technique as the aim of my research is to compare behavioural-based and signature-based malware ...

My company ships very large, very heavy products to the homes of everyday consumers (think big home renovation materials). Currently, we provide the customer's name, shipping address, and phone number ...

I have some secrets that need to be transferred from my .NET application to another. I am using the CNG DPAPI to encrypt these secrets, and I wish to find the most suitable place to store them (in ...

Often antivirus programs trigger a false alarm that a certain file is corrupted or infected. My question is that how common is that and if it is too common, can we really rely on them. Along with ...

In my web application, when the user logs in, a pair of JWT(JSON web tokens),access token and refresh token is sent with some fixed time validity. Using access token client is authenticated and using ...