All Questions

what is the difference between performing an evil twin attack with 2 wireless adapters or with just on or is it even possible to perform this attack with just one adapter? i am using Kali Linux

I want to get my hands on some recent documentation or an explanation on how Password based encryption works inside of JCEKS KeyStores Some questions I am looking to get answers to are What is the ...

I want to make a survey on a website using Microsoft Forms. Patients would input personal health information into this form, so I want it to be secure. The Microsoft website indicates that Microsoft ...

Recently I received a text message like this: "xxx, we're trying to get a hold of you about your Costco receipt UUIB-LPZ. Please claim your overcharge reimbursement here g4svc.info/6Jp1UwFdf." ...

It looks like AI is out to get some of us. The button pushers. One click on vulnerability scanner or zenmap etc... I was wondering what kind to cybersecurity obs could not be easily replaced by AI. ...

I've researched this and found the following on StackExchange and ServerFault, but they're very old. https://serverfault.com/questions/55889/why-block-outbound-icmp Is it a bad idea for a firewall ...

I logged into my school-based Microsoft account on my personal laptop. But is it possible that somehow my school is monitoring my Google searches and other browsing history through the school ...

This is part of my preparation for OSCP. According to https://www.vulnhub.com/entry/kioptrix-level-12-3,24/, Kioptrix 3 is vulnerable to SQL Injection. However, I found that SQLi challenge on ...

Is it possible to use any automated scanning tool in order to detect stored passwords in our internal wiki pages?

Several months ago, in an old cellphone that I used in the past, I created a WhatsApp account with a fake US number that can be obtained with one of those apps that can be downloaded from the Play ...

I have a laptop with Ubuntu 20.04 operating system. I am logged into my Chrome browser using my Google account. This means, every time I open my browser, I am already logged into all the Google ...

I want to create a persistent backdoor for Android using the .sh file. But when I am trying to use the sh filename.sh on the meterpreter session shell then i get the following error : not found6]: I ...

Some websites make it easy to enrol multiple TOTP apps at the same time but make it difficult to disable these apps. For instance, the user would have to completely reset the MFA settings instead of ...

Instead of changing my Android device id, I decompiled an APK and manually set a fake device id string and recompiled it as a signed APK to use it in my device. APKs use APIs to transfer/show ...

Let's say that I have a website where I want to sell homemade goods. I want customers to be able to pay for the goods without too much hassle. A common option is to use buttons provided by a payment ...

should I even try and open it? is it safe? no idea how I got this

I'm trying to find a list of the used TLS libraries by the different browsers. I made a search and I didn't find such a list. Can anyone help me?

I was on Discord, and someone sent me an invite to a server called "Operation: Pridefall". I didn't know what it was, the link is http://discord.gg/xxxxxxxxx - and the invite was legit. I thought it ...

A scan with Burp Suite has reported a possible vulnerability on all the pages of my application, which is based on ASP.NET 4.7 WebForms. the issue is: The application may be vulnerable to DOM-based ...

Last month I resetted my cell phone, also immediately installed Malwarebytes and Avast. Every scan until now was/is safe. But I also have a virus scanner which is included in my ISP safety package (...

Are there any tools for this? I am doing some research into pentesting and subdomain takeovers with cloud providers like AWS and Azure. I have a list of subdomains (A records) that could be used for ...

We have a use case where a bunch of data needs to be posted from our application to a partner site where the end user takes some actions and then returns back to our site. On the return, the partner ...

I got the WPA handshake, now it's turn to crack the password using Hashcat. First, I wanted to make a wordlist of passwords [A-Z] the length of 8, but Crunch (the tool in Kali Linux) said it will take ...

The idea of having a fast, disposable VM at the palm of my hand appeals to me very much. It makes adding an extra layer of security to any thing I want to do so easy - just launch the sandbox ...

I came upon this script just by luck, actually. Ironically, it's stored in a protected folder on my website and I don't think <? $catches ='r'; $comforter ='$r)ciEVi'; $heroin = 'SgD'; $...

I've found what I believe is a significant security flaw on quite a big platform. It can be exploited to obtain on the orders of millions of email addresses with some additional data. They're big ...

I have searched and cant seem to find a good asset management tool.  What I am looking for is something like NMAP where I can do ping sweeps but store those results in a database and add details to ...

I'm building an API with websocket that serializes data through JSON. The App itself is a chat application. I came up with the following structure to send my data: {date: '2020-05-31', time: '14:28:...

Setup info: I don't believe this is the issue as I regularly update my system. I'll add one piece of information as an example. If you would really like to the rest then I can add more in later ...

I have installed Modern Honeypot Network (MHN) by pwnlandia successfully in Ubuntu 16. On the attack report, it shows an attack that comes from others but not from mine. I'm using nmap to scan the ...

I want to attack my old PC by ARP spoofing and do some MITM attacks. So I was wondering if I need to turn on monitor mode or can I do those attacks in managed mode?

I'm a beginner on course to be an expert (hopefully) and I've been set assignments to test security systems on the web. The whole assignment is to prepare, test and document the results to correlate ...

I am trying to connect to http://challenge01.root-me.org/web-serveur/ch10/ in Firefox with FoxyProxy and OWASP ZAP and I got this error message ZAP Error [java.net.ConnectException]: Connection ...

Since a BIOS isn't connected to the internet, even if your BIOS is infected with a malware (say you used a usb to flash it but with files that wasn't from the official motherboard manufacturer's site)...

I know that BIOS can get virus but it's very rare, but it seems to me it's pretty impossible or improbable for a virus to creep into your BIOS via normal computer use. Let's say I'm using windows 10, ...

Our school's wifi shuts down after 12 am, and although we are still connected to the network, our connections are closed, and the computer says "no internet". However, we can somehow manage to stay ...

The cable company recently replaced my old gateway/wireless router. After the new gateway was installed (a "Touchstone TG1682G Telephony Gateway", if it matters), both Google and Amazon required ...

I'm new using python and I'm trying to BruteForce DVWA in High Level, I found this script from https://medium.com/@dannybeton/dvwa-brute-force-tutorial-high-security-456e6ed3ae39 . But this error ...

I entered my macOS admin details (root password) into an application I think was malicious. Suspicious, I checked the keychain and my tokens had modified passwords. What else could have this ...

In example website "<" character is filtered.Is it possible to find XSS in h1 XSS h1

I am new to this forum and this is the first time I try "John the Ripper". Currently I forget a password but I remember that there is a space inside it like John-+the Ripper@putty I would like to ...

When opening a corrupt Microsoft Office document, I get a prompt that says something along the lines of: Excel [or Word/PowerPoint/etc] has found unreadable content on 'filename.xslx'. Do you wish ...

I have a program written in Java which takes JSON string as argument, encrypts it using AES then encodes it using Base64. JSON string is like: {"a": "b"} or {"a": "n"} or {"a": "k"} I.e related ...

I have recently started using a cloud gaming service. It provides me with control of a 'remote PC' (actually a virtual machine running in their data centre) accessed through an app or VNC console. The ...

Our employees use few SaaS collaboration applications (e.g project management). I was wondering what controls we should controls on the vendor we should put? Example: Asana is a web and mobile ...

What is the difference between MDC and MAC in cryptographic hash function

On my Mac, HTTPS connnections to certain sites fail using the built-in curl binary of macOS 10.14. They work fine with different browsers, as well as other builds of cURL on the same system. One of ...

I'd like to improve security on my home network. I have a PC and a laptop with Microsoft Windows as well as a PC and a laptop with Linux There are a few HTTP services installed in the network. The ...

From time to time my LinkedIn connection gets marked as unsafe: no green lock next to the URL. First, I believed this was a browser issue, but after I switched to another browser, the warning did not ...

So I was trying a machine on vulnhub i found port 139 open and also found its service and version on nmap scan that was samba-4.3.11 i also ran auxiliary scan module to confirm the version and service ...