All Questions

Filter by
Sorted by
Tagged with
0
votes
0answers
49 views

What would happen if letsencrypt suddenly went out of business (or discontinued free certificates)?

So many websites seem to rely on free letsencrypt certificates for their TLS, wouldn't it cause a major disruption? Isn't this a "single point of failure" problem in the modern web?
0
votes
2answers
53 views

Any reason why SHA-3 isn't yet present in GnuPG?

I was curious about setting SHA-3 as the preferred hashing algorithm for GPG but that looks like it is not yet supported and the documentation states this: SHA-3: SHA-3 is a completely new hash ...
0
votes
0answers
15 views

Can a client with x509 certificate and server side validation of ip-address and deviceId considered a trusted system for less secure login method?

we are working on an web application in which users needs to be able to switch easily between user accounts while working on the same computer. The idea is to have: a strong login (email,password) ...
0
votes
1answer
21 views

Why does message 1 of the WPA2 4 way handshake begin with the access point sending a random number?

All the references I have found https://en.wikipedia.org/wiki/IEEE_802.11i-2004 https://www.wifi-professionals.com/2019/01/4-way-handshake https://www.hitchhikersguidetolearning.com/2017/09/17/eapol-4-...
0
votes
0answers
5 views

Legal obligations of a company in case of RGPD-related vulnerability [migrated]

First of all I would like to state that my question occurs in a context of EU laws and EU citizen. I found a vulnerability in a product distributed in a few companies of EU countries. This ...
0
votes
2answers
57 views

Does it make sense to perform vulnerability assessment tests with admin user rights?

We have an admin web portal that we use to configure and monitor our system We recently had a security consultant scan our servers for vulnerabilities. Our admin portal is secured with username and ...
0
votes
4answers
43 views

Ingress client certificate authenticate requires CA certificate to be stored in secret?

I want to enable client-certificate authentication in my AKS cluster and I have a basic question which I just don't seem to understand. As per the docs, ingress requires the CA certificate to be ...
0
votes
0answers
38 views

Hydra Brute Force login form error [closed]

I'm trying to set hydra to work on http post form: Please enter your username to login. Then enter your password and press the button "Login to system". form id="loginForm" ...
0
votes
1answer
84 views

How do I differentiate a DDoS attack from a DoS attack?

My server is under attack on an specific port but I am confused whether is a DDoS attack or a DoS attack (if it requires a botnet or is using some kind of trick). The entire server is available (...
0
votes
0answers
26 views

Finding card sequence on msr606 [closed]

Is there app that can find the correct sequence of the debit card data when using msr606 with data numbers and expiration dates given?
0
votes
0answers
62 views

Phone got hacked using Google services [closed]

This question is related to this question with more related info. A friend of mine asked me to help him clean up his phone after some unusual activity happened, like random apps got deleted, whatsapp ...
0
votes
1answer
81 views

is metasploit under whonix anonymous?

If I run an exploit like EternalBlue with Metasploit on whonix to a remote machine, do I remain anonymous? I think I do because it goes over tor but I am not sure. Am I right?
0
votes
0answers
39 views

why the internal server error occured when using finfo_file function? [closed]

My code is that if (in_array($file_ext, $extensions)) { $finfo = finfo_open(FILEINFO_MIME_TYPE); $mime = finfo_file($finfo, $file_tmp); if ($mime == '...
-1
votes
0answers
43 views

Error: check your word list path file [closed]

I'm new to this, I'm trying to run a BruteSploit attack, I'm pretty sure the files are where I specified them to be, but I get the error, check your word list path. What could have gone wrong ?
0
votes
0answers
52 views

is XSS possible on modern versions of angular

I wondering if XSS is still possible with modern version of angular I that the older version have some sandbox bypass but what of the newer versions.
0
votes
0answers
26 views

Validate that CA really signed certificate [duplicate]

What is the process of validating that a ssl certificate I try to validate is really signed by CA I trust? What is the part of the certificate (The one I try to validate) is the one cant be faked? ...
0
votes
1answer
44 views

Hydra hangs after TASKS number of tries

I have dvwa set up and i am using the command: hydra -IV -t 1 -l admin -P rockyou.txt localhost http-get-form "/vulnerabilities/brute/index.php:username=^USER^&password=^PASS^&Login=Login:...
0
votes
1answer
56 views

Can a Man-in-the-Middle-Attack be achieved by adding a cloudfront distribution origin of a domain not owned by me?

Cloudfront supports adding external origins, i.e. domains that are not S3 buckets or ALBs. This led me to wonder whether adding domains that are not owned by the entity as an origin could allow for ...
0
votes
1answer
54 views

How to detect fileless kernel compromise in linux

Is there a way to detect fileless kernel compromise in Linux? The only one way to analyze this kind of attack is by volatility. Volatility is a very good product, but not often updated especially with ...
-2
votes
0answers
39 views

How to overclock android? [closed]

Android overclocking is possible?. If any android users know how to do, replay to me. I need to overclock my android smartphone. I want to run some heavy games on my android smartphone. I read many ...
3
votes
0answers
86 views

Should I build my own login functionality? [closed]

I've looked at various ways of logging in users and I'm wondering if I should write my own. There are a lot of third party solutions that make it easy and cheap to get started, like Amazon Cognito and ...
0
votes
0answers
38 views

Can anyone give a practical example of exploiting reflected xss? [closed]

I know reflected xss can be dangerous but how can we exploit it more rather than just a popup. For example, I got a popup with this payload <IMG SRC=# onmouseover="alert('abc');"> Now ...
0
votes
0answers
35 views

Options for Integrating or developing a physical security solution (physical access control via in-house mobile apps [NFC/Bluetooh])

Our team is looking to either integrate or develop a physical security solution for a rather large campus. Requirements: Ability to either integrate (with reader/electronic lock hardware) from our ...
-2
votes
1answer
87 views

Certificates Do Nothing [duplicate]

Please correct me if I'm mistaken, but I've reached the conclusion that CA-signed certificates in the current Internet Public Key Infrastructure do not add any more security compared to servers ...
0
votes
0answers
53 views

password cryptography - individual password security [closed]

I don't really understand most concepts of cryptography all that well, I admit that. I've been reading through this 4 parts question and Why improvising your own Hash function out of existing hash ...
0
votes
1answer
66 views

Router firewall ICMP risks and threats? [closed]

I have found out, that my Router firewall has never blocked ICMP traffic. There is a lot of opinions online regarding ICMP, and whether it should be disabled or limited. So far I have found out, that ...
0
votes
0answers
31 views

Enable or Disable CORS for Domains and API

I currently have two domains that I use for my app: Ex: backend-app.example.com and api.example.com In both domains the access-control-allow-origin header is *. This configuration is this way because ...
0
votes
3answers
44 views

Unclear security impact of a Reflected XSS vulnerability

What is the security impact of a Reflected XSS vulnerability on a state website involved in financial relations? There are no user profiles on this page and it serves as an information board and a ...
0
votes
2answers
38 views

How does Anti-CSRF token get delivered?

I was reading an article describing how CSRF works. The article did a pretty good job but it started to talk about how to protect against CSRF and one of the methods that the article has mentioned is ...
0
votes
1answer
38 views

Escaping out of a select query to run a statement that modifies data in the database

Lets say you use SELECT * FROM ($query) sub where you can swap $query to any query you wish. Is there a way to escape this select and run a command that modifies data in the database?
5
votes
4answers
2k views

Can a cloned page have HTTPS certificates?

Imagine that a hacker is cloning Twitter or Facebook. The attacker uses his own website, but it is going to be HTTP, right? So can he have the certificates that ensure that his website is "secure&...
0
votes
1answer
48 views

Link test differs from link location in plaintext view is not visible in Thunderbird

Today I noticed something strange. I got an email containing a link that links to another site than the text says. In (Simple) HTML, the review is visible when hovering over the link. However, in ...
2
votes
1answer
97 views

AWS credentials seem terribly insecure. Why?

In my ~/.aws/credentials I have the following: [default] aws_access_key_id = <something> aws_secret_access_key = <something-else> This file has permissions 0600 but doesn't ...
1
vote
0answers
46 views

Android System Update Spyware Can Steal Your Photos, Money, Record Calls and Track You Too. What to do if this happens? [closed]

I came across this website and suddenly I got worried. What worries me is apart from the system update threat mentioned I have been visiting so many sites, clicked on pop-ups, downloaded apps from ...
1
vote
0answers
23 views

How to choose specific file names in php code? [migrated]

$_FILES['userfile']['type'] == "image/gif" There is a problem to choose not only image.gif but whatever name is, such as *.gif . And, if it is possible, can you share some regex expressions ...
0
votes
0answers
34 views

can disconnect all phone contact to computer via cmos script? [closed]

I have a computer from which I have removed the wi-fi card, antenna, all software/firmware to wi-fi and Bluetooth. My info is that CMOS can be used to hack a computer via telephone. Is there any way ...
0
votes
0answers
13 views

Transparent Voting and Advance Secret Code [migrated]

In the book "Introduction to the Theory of Computation", Michael Sipser writes The field of cryptography, as this area is known, now extends well beyond secret codes for private ...
0
votes
0answers
46 views

What are the chances that my private photos are accessed remotely using malicious software? [closed]

Recently I had installed two apps from third party websites to my android smartphone and now I am going paranoid about what if the apps contained malicious codes and my private photos are accessed ...
0
votes
0answers
40 views

How do you execute a base64 payload [closed]

How do you execute a payload with a base64 format in a webpage I tried to host it on a local server so that when a victim gets redirected to the link the payload gets executed Generating a payload ...
0
votes
1answer
40 views

Is this scenario of static ECDH public key exchange right?

I'm thinking about the way to build encryption mechanism for 'peer-2-peer' communication. This is a mechanism I had a thought of: Alice wants to communicate with Bob First of all, Alice and Bob must ...
0
votes
0answers
27 views

x509 validation check service

I would like to check validity of x509 certificates of my clients. I would like to trust the certificates what big companies trust. For example I would like to trust what Microsoft Edge, Chrome ...
0
votes
0answers
38 views

I think someone hacked into the Android of my friend but not sure [closed]

i have a friend whos'e daughter downloaded a lot of "games" from the play store since then the phone acts strange. Phone Contacts automatically disappered. He uses is phone for work, and ...
1
vote
1answer
89 views

Is saving a dark web page locally and reloading it in another browser a security risk?

Say I have Tor running and am browsing the dark web with the Tor browser. If I were to save a local copy of a web page and render it into another browser, like Chrome (with JS enabled), would I then ...
1
vote
0answers
31 views

Decrypt RSA encrypted value generated from .net in Android [migrated]

I have gone through many posts here but did not find the right solution. I want to decrypt a value encrypted in c# .net from Android. I have successfully decrypted in .net platform using the following ...
0
votes
3answers
50 views

Is it secure to put a mysqldumped file online?

I made a database table of emoji country codes. I exported the data via mysqldump into a file called countries.sql. I want to share it because it was a hassle finding anything like this, so I want to ...
0
votes
0answers
30 views

Best secure approach with Basic Auth

Due to several customer reasons our product needs to support Basic Auth as primary authentication mechanism with client's service account. We are using Bcrypt to store customer's password in our DB, ...
0
votes
1answer
80 views

Can someone intercept my messenger calls

I want to know whether or not facebook messenger calls can be intercepted and listened to by hackers. I would also like to know if my exact location can be found by hackers through them knowing my ...
0
votes
0answers
35 views

Accidentally entering .onion link without any protection, am I at risk? [closed]

This just happens recently while I browsing a subreddit, there was supposedly a comment pointing to an image I'd like to see, but upon clicking it I got redirected to what it seemed to be .onion link, ...
0
votes
1answer
39 views

On Gmail I received an Incoming TLS Encrypted Message. Will my reply be encrypted by default to different email provider?

If I receive an incoming TLS encrypted message from another email provider like outlook/hotmail, will my reply in transit from gmail to outlook/hotmail be encrypted by default as well?
0
votes
0answers
40 views

How to get Future Keys (Session Key) from IPEK for decryption data?

I'm new to DUKPT, so I'm not entirely clear about DUKPT and HSM. Right now, I'm trying to decrypt data (PAN number) from terminal. So far, when I receive KSN and encrypted data, I understand that I ...

15 30 50 per page
1
2 3 4 5
1248