All Questions

I have a client who does payroll and taxes and is looking for a web app to easily communicate and transfer tax related documents for clients. I would assume that the IRS or someone would have some ...

As per Bitwarden's FAQ If you don’t have your Recovery Code saved somewhere outside of your Vault, there is unfortunately no way for the team to recover the account or data therein. You’ll need to ...

On https://tls.ulfheim.net/ there is an example showing how to compute a signature in the section of " Server Key Exchange ". https://i.ibb.co/Y7fbkDw/1.jpg (This image shows the Server Key ...

Question: Assuming that passwords are made up using only upper case characters (A-Z), compare the strength of a password made from two words randomly drawn from an 8192 word dictionary versus a ...

When I used grabify I got numerous IP addresses. What does this mean and which IP address is the right address?

https://goteleport.com/blog/how-to-ssh-properly/ I'm following this guide on setting up SSH certificates, and it says to NOT put a passphrase on keys, or that it's "my choice" whether to do ...

I was learning to use wireshark when I noticed that opening a reddit url (reddit.com/r/privacy) sent a GET request for r/privacy over HTTP. Is this visible to the ISP or network sniffers? I was under ...

When thinking of encrypting a file (also how I implemented it in a program of mine), I think of getting the data of a file, encrypting it, and writing it back into the file (overwriting the file). But ...

Let's say I visited a malicious website and it downloaded malware that registered my phone to a C&C server And after realizing what happened I uninstalled the malware from my device Will my phone ...

I've read a lot of advice against storing your 2FA codes in your password manager and I don't understand why. Isn't a file on your computer something you have? There is the added benefit that you don'...

I am looking for some help on how to get the best out of sqlmap. I am practising on a web application that runs the following query when the login form is submitted: SELECT * FROM Users WHERE username ...

Stop recoding keep us privacy for our laptop cameras stop hacking cameras

I am researching information regarding locker ransomware. I did a search for "Locker ransomware github". I clicked on the link in GitHub and found the link to view code and clicked that link ...

I’ve seen estimations that the NSA is capable of at least 1 trillion (PGP pass phrase) guesses per second, which would mean a password with 80 bits of entropy would take, on average, over 15,000 years ...

An application uses RSA to encrypt small texts before persisting in database, using public key of the end node of the application. Only these end nodes must be able to decrypt thge ciphers and only ...

Example from Wikipedia: In November 2012, The FreeBSD Security Team announced that hackers gained unauthorized access on two of the project's servers. These servers were turned off immediately. More ...

I installed Metasploit on my Windows machine a while ago. And on the first use, it worked. Trying to use it the next time shows errors saying ruby is not recognised as an internal or external command. ...

It's the first time I'm using encryption in MariaDB, so I need to assure that I'm getting it right. I need to simply store some identifiers in an encrypted way, and am wondering if I'm doing it ...

I have recently begun studying NMap. It offers a variety of options, each having clear advantages and disadvantages as to what information is disclosed and chance of being detected by possible layers ...

Our Active Directory logins are currently e.g. john.smith@mycompany.com (i.e. the same as our email addresses). A friend said his company uses numbers for login (e.g. 90210@mycompany.com) for security ...

I'm a professional web developer, but not a security professional. Tonight, I was selling an item on Facebook Marketplace, and I received a message saying, Hey is this the same item as [link] I did ...

Question: It appears that somebody can intercept and read emails that I send from my server, although I have set up 2-Factor authentification for sudo-access I log all logins on my server (Did not ...

I'm forming a start up and want to make sure my COMPUSEC/COMSEC is airtight. We work with a lot of sensitive customer information (think SSNs, bank accounts, etc.), NDAs, and government contracts. At ...

I was learning about TLS 1.3 recently, and I was wondering if there are any reasons not to use it. (Rather stay at TLS 1.2). Are there are any factors that refrain users or products from making the ...

I need to decrypt (using Python libs) a base64 encoded string that was encrypted using AES256/CBC/PKCS7: MIAGCSqGSIb3DQEHA6CAMIACAQIxggEwMIIBLAIBAoAUWwUA8cj6Bdcph9HPtFRinZS+...

I have recently added 2FA for my Google account using an authenticator installed on my mobile phone. After doing this, I have realized that it would be nice to also have the authenticator installed in ...

I am working on building a malware classifier that works by using gray-scale images of the dissasembly files. This method has been outlined in multiple research papers, here is one: https://ieeexplore....

Back in 2016, reputed sources reported NIST's plan to stop recommending SMS as a channel to deliver one time passwords out of band. Fewer (and to my eyes rather unexpected) sources reported the ...

Next step to below command to get the second row data, ID = ColumnName and employee_details = TableName ‘ and 1=convert(int,(select top 1 ID from employee_details))-- -

Linus mentioned in 2009 that "Signing each commit is totally stupid". Has the common view evolved on this subject since then ? Doesn't it protect against someone usurping your identity to ...

Background information: I have a client application that communicates with a server through a web API. The data being communicated is not personally sensitive (no passwords, credit card details, ...

I need to set up a small network as shown below. Is it really required that the "switch should also host a firewall" when all the communication between the "computers" is over TLS?

I would like to perform a few basic tests on a few of OSSEC's capabilities and be able to document them. I have no experience with HIDS and I am not really sure where I could start or which tests with ...

I'm writing a canary for monitoring which will be deployed to the same host as the monitored application. The underlying application validates certificates for incoming requests and validates that the ...

If I have a security key (U2F key) like yubikey and use it on websites A and B and the owner of these two websites is the same, can the website owner know that I am the same user?

There was a website I discovered a while back called "spur.us". The site collects information on IP addresses. Some of the information they collect is somewhat easy to find: If the IP is ...

I am sending Bearer token in IE in React js.But A is appended with Bearer in IE. This issue is there only in IE Example : Authorization : BearerA ewtewyetwytewyt; A should not be added after Bearer ...

I'm building an app that uses Braintree for processing payments. According to the documentation, I need a server-side endpoint that returns the clientToken, which is then used to manage a user's vault ...

I have been looking at risk assessments lately and I am looking for a way to practically estimate likelihood. Most people recommend assessing based on historical precedent which sounds great to me, ...

I routinely access www.email-provider-of-my-choice.com via browser over Tor. My browser enforces https-only mode and I opt for never saving my credentials with this provider. I tend to use the domain ...

If I started with “password”, then change it to “password2”, “password3” etc, is that easier to crack the hashes of the set of passwords than if I used only the original password? Does having the ...

CIS has published a list of container vulnerabilities that should be addressed to complete the hardening process. Are there separate sets of tools that only point out the vulnerabilities and then ...

I had to renew my eID card. Possessing an EAL-4+ certified card reader (cyberJack RFID komfort by REINER SCT) I tried to activate the ID function by replacing the transport PIN with a personal PIN. ...

I need to decrypt a password. I have the ciphertext for this however, I have many plain text and encrypted equivalents. This device can only be given passwords with a maximum of 8 characters from the ...

I have a video file on my Drive which is very old but I am not sure whether it's infected or not. Is it safe to view this MP4 on Google Drive (no downloading only viewing it in the Drive app)?

In my current project i have few ESP32's connected to server over TCP. These ESP's are distributed across a range of 300 meters. Once per hour server requests (randomly) selected ESP's to beacon a ...

For school I need to use the buffer overflow in the program below to get the shell to launch. For this exercise we need to perform a data-only attack, i.e. the stack is non-executable and stack ...

Wonder if secure boot can protect my computer from usb drives with infected firmware after Debian os is booted ?

Wonder about if it is possible for an android device with infected firmware and fully controlled by hacker to compromise my computer remotely (assuming hacker has already locally flashed a different ...

If a virus added itself to windows defender exclusions, it will never be scanned. However would windows defender still remove its startup registry keys and scheduled tasks? Windows defender is the ...