All Questions

So many websites seem to rely on free letsencrypt certificates for their TLS, wouldn't it cause a major disruption? Isn't this a "single point of failure" problem in the modern web?

I was curious about setting SHA-3 as the preferred hashing algorithm for GPG but that looks like it is not yet supported and the documentation states this: SHA-3: SHA-3 is a completely new hash ...

we are working on an web application in which users needs to be able to switch easily between user accounts while working on the same computer. The idea is to have: a strong login (email,password) ...

All the references I have found https://en.wikipedia.org/wiki/IEEE_802.11i-2004 https://www.wifi-professionals.com/2019/01/4-way-handshake https://www.hitchhikersguidetolearning.com/2017/09/17/eapol-4-...

First of all I would like to state that my question occurs in a context of EU laws and EU citizen. I found a vulnerability in a product distributed in a few companies of EU countries. This ...

We have an admin web portal that we use to configure and monitor our system We recently had a security consultant scan our servers for vulnerabilities. Our admin portal is secured with username and ...

I want to enable client-certificate authentication in my AKS cluster and I have a basic question which I just don't seem to understand. As per the docs, ingress requires the CA certificate to be ...

I'm trying to set hydra to work on http post form: Please enter your username to login. Then enter your password and press the button "Login to system". form id="loginForm" ...

My server is under attack on an specific port but I am confused whether is a DDoS attack or a DoS attack (if it requires a botnet or is using some kind of trick). The entire server is available (...

Is there app that can find the correct sequence of the debit card data when using msr606 with data numbers and expiration dates given?

This question is related to this question with more related info. A friend of mine asked me to help him clean up his phone after some unusual activity happened, like random apps got deleted, whatsapp ...

If I run an exploit like EternalBlue with Metasploit on whonix to a remote machine, do I remain anonymous? I think I do because it goes over tor but I am not sure. Am I right?

My code is that if (in_array($file_ext, $extensions)) { $finfo = finfo_open(FILEINFO_MIME_TYPE); $mime = finfo_file($finfo, $file_tmp); if ($mime == '...

I'm new to this, I'm trying to run a BruteSploit attack, I'm pretty sure the files are where I specified them to be, but I get the error, check your word list path. What could have gone wrong ?

I wondering if XSS is still possible with modern version of angular I that the older version have some sandbox bypass but what of the newer versions.

What is the process of validating that a ssl certificate I try to validate is really signed by CA I trust? What is the part of the certificate (The one I try to validate) is the one cant be faked? ...

I have dvwa set up and i am using the command: hydra -IV -t 1 -l admin -P rockyou.txt localhost http-get-form "/vulnerabilities/brute/index.php:username=^USER^&password=^PASS^&Login=Login:...

Cloudfront supports adding external origins, i.e. domains that are not S3 buckets or ALBs. This led me to wonder whether adding domains that are not owned by the entity as an origin could allow for ...

Is there a way to detect fileless kernel compromise in Linux? The only one way to analyze this kind of attack is by volatility. Volatility is a very good product, but not often updated especially with ...

Android overclocking is possible?. If any android users know how to do, replay to me. I need to overclock my android smartphone. I want to run some heavy games on my android smartphone. I read many ...

I've looked at various ways of logging in users and I'm wondering if I should write my own. There are a lot of third party solutions that make it easy and cheap to get started, like Amazon Cognito and ...

I know reflected xss can be dangerous but how can we exploit it more rather than just a popup. For example, I got a popup with this payload <IMG SRC=# onmouseover="alert('abc');"> Now ...

Our team is looking to either integrate or develop a physical security solution for a rather large campus. Requirements: Ability to either integrate (with reader/electronic lock hardware) from our ...

Please correct me if I'm mistaken, but I've reached the conclusion that CA-signed certificates in the current Internet Public Key Infrastructure do not add any more security compared to servers ...

I don't really understand most concepts of cryptography all that well, I admit that. I've been reading through this 4 parts question and Why improvising your own Hash function out of existing hash ...

I have found out, that my Router firewall has never blocked ICMP traffic. There is a lot of opinions online regarding ICMP, and whether it should be disabled or limited. So far I have found out, that ...

I currently have two domains that I use for my app: Ex: backend-app.example.com and api.example.com In both domains the access-control-allow-origin header is *. This configuration is this way because ...

What is the security impact of a Reflected XSS vulnerability on a state website involved in financial relations? There are no user profiles on this page and it serves as an information board and a ...

I was reading an article describing how CSRF works. The article did a pretty good job but it started to talk about how to protect against CSRF and one of the methods that the article has mentioned is ...

Lets say you use SELECT * FROM ($query) sub where you can swap $query to any query you wish. Is there a way to escape this select and run a command that modifies data in the database?

Imagine that a hacker is cloning Twitter or Facebook. The attacker uses his own website, but it is going to be HTTP, right? So can he have the certificates that ensure that his website is "secure&...

Today I noticed something strange. I got an email containing a link that links to another site than the text says. In (Simple) HTML, the review is visible when hovering over the link. However, in ...

In my ~/.aws/credentials I have the following: [default] aws_access_key_id = <something> aws_secret_access_key = <something-else> This file has permissions 0600 but doesn't ...

I came across this website and suddenly I got worried. What worries me is apart from the system update threat mentioned I have been visiting so many sites, clicked on pop-ups, downloaded apps from ...

$_FILES['userfile']['type'] == "image/gif" There is a problem to choose not only image.gif but whatever name is, such as *.gif . And, if it is possible, can you share some regex expressions ...

I have a computer from which I have removed the wi-fi card, antenna, all software/firmware to wi-fi and Bluetooth. My info is that CMOS can be used to hack a computer via telephone. Is there any way ...

In the book "Introduction to the Theory of Computation", Michael Sipser writes The field of cryptography, as this area is known, now extends well beyond secret codes for private ...

Recently I had installed two apps from third party websites to my android smartphone and now I am going paranoid about what if the apps contained malicious codes and my private photos are accessed ...

How do you execute a payload with a base64 format in a webpage I tried to host it on a local server so that when a victim gets redirected to the link the payload gets executed Generating a payload ...

I'm thinking about the way to build encryption mechanism for 'peer-2-peer' communication. This is a mechanism I had a thought of: Alice wants to communicate with Bob First of all, Alice and Bob must ...

I would like to check validity of x509 certificates of my clients. I would like to trust the certificates what big companies trust. For example I would like to trust what Microsoft Edge, Chrome ...

i have a friend whos'e daughter downloaded a lot of "games" from the play store since then the phone acts strange. Phone Contacts automatically disappered. He uses is phone for work, and ...

Say I have Tor running and am browsing the dark web with the Tor browser. If I were to save a local copy of a web page and render it into another browser, like Chrome (with JS enabled), would I then ...

I have gone through many posts here but did not find the right solution. I want to decrypt a value encrypted in c# .net from Android. I have successfully decrypted in .net platform using the following ...

I made a database table of emoji country codes. I exported the data via mysqldump into a file called countries.sql. I want to share it because it was a hassle finding anything like this, so I want to ...

Due to several customer reasons our product needs to support Basic Auth as primary authentication mechanism with client's service account. We are using Bcrypt to store customer's password in our DB, ...

I want to know whether or not facebook messenger calls can be intercepted and listened to by hackers. I would also like to know if my exact location can be found by hackers through them knowing my ...

This just happens recently while I browsing a subreddit, there was supposedly a comment pointing to an image I'd like to see, but upon clicking it I got redirected to what it seemed to be .onion link, ...

If I receive an incoming TLS encrypted message from another email provider like outlook/hotmail, will my reply in transit from gmail to outlook/hotmail be encrypted by default as well?

I'm new to DUKPT, so I'm not entirely clear about DUKPT and HSM. Right now, I'm trying to decrypt data (PAN number) from terminal. So far, when I receive KSN and encrypted data, I understand that I ...