All Questions

So this fixer that I asked to fix my busted front audio ports injected my PC with KMS-R@in in order to get rid of the activate windows watermark without my consent/knowledge, and it gave me Floxif.E ...

 THIS IS A REPOST OF MY ORIGINAL QUESTION THAT GOT PUT ON HOLD BECAUSE IT WAS NOT RELATED TO NETWORK SECURITY OR PENTESTING? LIES I have a wireless card (Alfa AWUS036H) that I use for pen-testing ...

For a HTTP(S) API, which is better (/ which is better under which circumstances)? Hawk authentication (a secret key is used to create a signature which is transmitted with the request: similar to AWS ...

I have a wireless card (Alfa AWUS036H) that I use for pen-testing on my test network. Due to my recent interest in network hacking, I picked up this card and put it into monitor mode. While it scanned ...

This question is partially inspired by this video. In case I find a suspicious device somewhere in a public space. What should I do with the device? Take the device I've found to my home/lab to ...

LVM on LUKS is the only secure option for encrypting a Linux/Ubuntu USB system. If someone gets access to an unencrypted USB that's not LVM on LUKS they know what it is and what's on it. However LVM ...

I don't know the theoretical background for 2FA so I'm asking here. I've used a few 2FA apps before including Duo Mobile and Steam Mobile (Guard). When Duo is opened, it will display your tokens as ...

I’m expecting some information from a governmental organisation, they claim that they already send the info via email, but I have never received anything. They also have an automatic reply email, ...

So I have created a website and it is being hosted in Amazon AWS and leveraging AWSELB. I am teaching myself web application security as I am learning development so I went ahead and ran some checks ...

If I connect to a WIFI AP and it wants to install a root cert. They read my HTTPS traffic, Right? Does using OpenSSH on my cell phone to my home router help protect me? Or can this traffic be ...

Is it possible to generate a PKCS12 keystore that will be FIPS compliant? In regular mode, I'm using "1.2.840.113549.1.12.1.3" - pbeWithSHAAnd3-KeyTripleDES-CBC(3) algorithm to encrypt private keys, ...

I need to develop my web of trust. I don't live in or near a metropolitan area and as such it is a bit difficult to find possible local people to sign. I assume I must not be alone in that context. ...

I am trying to understand session hijacking, and read that to avoid session fixation, the id should be regenerated on authentication completion, and so I have implemented in my application. Playing ...

In a recent execution of a spider, Burp reported cleartext submission of a password CWE-319, but the evidence in the report is merely the preceding GET request of a non-existant page, redirected via ...

I draw a custom network (I would use that for developing and testing, my ISP does not support IPv6), there IPv4 and IPv6 are present. 'A' device has firewall: incoming blocked, only accept access (SSH)...

I have noticed our website, which is Wordpress based, gets frequent daily requests from other sites where the user agent is Wordpress and the other site is obviously an already hacked Wordpress ...

Are the tools and services (esp. cloud based) that help with data security compliances (PCI, HIPPA etc) themselves need to be compliant?

I am trying to figure out if using the Website "files.mycloud.com" is exposing my files to being intercepted at a central point. I see that there is an HTTPS connection with valid cert for *.mycloud....

I want to learn about Windows Forensics. Any softwares or tutorials or any material would be helpful. Thank you.

Is there a recommended, forensically sound method of acquiring virtual hard drives on VMWare using Autopsy? Or is it a simple copy and paste? I’ve used other software like Caine in the past, where ...

Are there any services provided by CDN or others which hunt for fake bank pages cached in CDNs and scrub these pages - based on closely matching names, CSS styles, colors, etc.?

I'm exporting a certificate and private key into .pfx file with: openssl pkcs12 -export -out export.pfx -in public.crt -inkey private.key -nodes However despite encrypting private key with provided ...

Situation: I want to set up some home servers that can store my files. Currently in the planning stage of the setup. Problem: Security and stuff comes to mind when doing such things, especially ...

$smarty->assign("action", $_SERVER["PHP_SELF"]); PHP_SELF is set client side by the browser so it can be modified by an attacker. Is Smarty "action" assigned to the form action field? So can an ...

I've been building a web app (rails api + react SPA) for learning / fun and have been researching authentication. The most commonly recommended approach for authenticating SPAs that I have read is to ...

A bank claims that its customer login pages cannot be cached - apparently because there's some unique number associated with each instance of a page rendered on the client browser. Supposedly, a ...

How to hack Facebook? How can I hack me ex's Facebook account? Can someone hack my wife/husband's Facebook for free? As I go through several Facebook groups which accommodate total newbies, ...

a 1024-bit private key is generated using the openssl genrsa privateKey.pem 1024 command. we extract the public key from the private key using the command openSSl rsa -in privatekey.pem -pubout -...

This is with regards to a Netcat based script running on a Debian based distribution, specifically the Proxmox hypervisor (see here if unknown https://en.wikipedia.org/wiki/...

So I am supposed to create a UDP server that is supposed to verify the checksums of packets being sent, and then log failures. The packets have the structure of: 4 bytes - Packet ID 4 bytes - ...

So I started to learn reverse engineering, and I came across the ret2libc exploit. I tried to understand how it works and I got a bit confused. They say that when you return to the address of system ...

This question was primarily inspired by this (related) question, but is about the other side of the equation. I'm a security engineer at Medium Sized Company, Inc. We recently hired John for a ...

Currently, I have 2 computers COMP1.local and COMP2.local. When going to RDP to COMP2.local it takes me to COMP1.local. Now, When I try to log into COMP1.local I get a connection error and have to ...

When using the OAuth authorization code flow in web applications, after successful authentication of the resource owner, the authorization server usually responds with a browser redirect to pass the ...

Is it safe to append the user's username to the session ID? The session ID is 32 bytes long generated using a secure PRNG. I encode it using base64 URL to save it in a HttpOnly cookie. The cookie ...

I created a let's encrypt certificate for my domain and install my SSL certificate in the nginx reverse proxy. Now, I want to secure the communication between the proxy and the backend server using ...

Is it possible to capture packets on Wireshark using a HTTPS filter? I’ve noticed on Wireshark only has the HTTP filter. Was wondering if there’s another way around this?

I had lost a phone once and I was more upset with the idea of the bad guy having access to my Micro SD memory card/personal data than losing the phone itself. After getting a new phone, Samsung S9 ...

Suppose you lose the bag containing your laptop along with its accessories or while travelling the police confiscate all your computer devices, can you safely use all the devices again if you format ...

I'm running on linux and I am using a SQL Server database server on some other machine. My python code has to sit in a directory that many other users have read access to. I also have a "...

What concepts should a newbie(someone who doesn't have too much knowledge about computer architecture, user/kernel space, memory etc.) understand if he wants to know how Metldown/Spectre works? I ...

I'm trying to reverse engineer a linux kernel module (kernel version 4.19). Ghidra does recognize correctly all function names such as: open, misc_register etc, but it cannot determinate their exact ...

I have two accounts, an administrator and a simple user. I can capture the administrator's cookie and use it in a simple user request, I find myself logged in with the administrator user and then log ...

To summarize: CSRF is an attack where a page in a different window/tab of the browser sends nonconsensual request to an authenticated web app, that can typically be prevented from server-side by ...

I can find the benchmark for Windows Server 2008 R2. However, are there different benchmarks for the standard vs enterprise?

We are trying to implement the SAML 2.0 protocol and I stumbled upon a problem related to passing the token from the API to the client SPA application. The authentication flow goes like this, the ...

Got this situation where we are forced due to security reasons to only be allowed to connect through VPN to our network - which is fine when you are in Germany (GER) where the main office is located, ...

How can I save an encrypted backup my Dropbox folder to my NAS drive?

What WiFi hacking method connects to router, disconnects all devices connected there, and connect to Fake Made up wifi, and once connected get the information from the connected device (get password) ...

We're having a website to host a big event with reCAPTCHA enabled on it in order to prevent spammers from registering the event. However, we've received numerous spam form registration recently. An ...