All Questions

Filter by
Sorted by
Tagged with
0
votes
0answers
4 views

How can I scrape the XSRF cookie value to bypass CSRF protection?

I'm learning about XSS attacks and need some assistance as I'm not that good with JavaScript or other ECMA-based syntax. My local server integrates anti-CSRF tokens via the XSRF cookie value. This ...
2
votes
1answer
27 views

What is the purpose of a targeted email without any meaningful content?

I received an email to my corporate email account from an external GMail account. The list of receipts clearly shows (an eventually successful) attempt to guess my email address based on my personal ...
0
votes
0answers
5 views

Security level of DSA when $q$ is a 224 bit prime? [migrated]

What is the security level of DSA algorithm when $q$ is a 224 bit prime? Is it always a simple rule that the security level is the bit length of $q$ divided by two ?
0
votes
1answer
31 views

URL shortener who does nothing according to the owner [closed]

I talk in a security forum, and sometimes a moderator share links to sources about things he talk about, but when I hover on these links, the link is different the the source it self. It is actually a ...
-1
votes
0answers
30 views

How does a YubiKey work? [duplicate]

How does a YubiKey key work? Are these essentially just OTP password generators? Is there anyway to just use a software OTP password generator to replace the YubiKey key entirely? My YubiKey key works ...
0
votes
0answers
20 views

I got a call from a contact on What'sApp and that person says they didn't call me even by accident. Should I be worried about using What'sApp?

I got a call from a contact on What'sApp, and when I picked up there was no audio. The person says they weren't even holding their phone when it happened, and it even took a minute for the call to ...
0
votes
3answers
55 views

HTTP access from a single IP

If I were to configure a server that would be configured to only be accessible (HTTP) from a single IP address via a port, is it safe from unauthorized access?
0
votes
0answers
17 views

Need to find domains in a TLD [closed]

I was wondering if it is possible to get all website domains for a specific country. For example, let's take UK. All the websites connected to the UK end with a .uk in their domain. I was wondering ...
0
votes
0answers
24 views

School monitoring incognito searches [closed]

My school sent me a brand new computer. It was sealed and everything. I signed in with my personal account and later added my school account. I have been caught watching Youtube normally, but I've ...
7
votes
1answer
180 views

Why is Webauthn not used as primary authentication method?

In theory, authenticating with a public key should be much simpler than with a password. There is nothing to remember for the end-user, and registration can be done just by clicking a button. For all ...
0
votes
0answers
13 views

How to determine what type of encoding/encryption has been used in this file? [duplicate]

I take this file from resource of game and I Want to know how to decrypt this , this is small line from the code : §ö ¨ö È)4Ì~u”]Èr L;Ùúe£¼’Q7ŠzY½¹Í„¶Qö¨¤s„³JØW rest of the file here : The Code
0
votes
0answers
15 views

Unknown user directory on Windows with funky file names [duplicate]

Poking around my machine today, realised there's an unknown user listed in there: tVA2uiJ14w First I thought it could be some IT account, but then again the filenames are too funky to be business ...
1
vote
1answer
28 views

GnuPG: Why is my Ed25519 signature 144 bytes long rather than 64?

according to https://tools.ietf.org/html/rfc8032 EdDSA uses small public keys (32 or 57 bytes) and signatures (64 or 114 bytes) for Ed25519 and Ed448, respectively; But if I sign using Ed25519 in ...
0
votes
1answer
13 views

openssl SubjectDN parameter, abbreviaton of argument keys and how to add extra ones

openssl command allows to create x509 certificates, and to add subjectDN using the -subj parameter. The parameter accepts a string of slash-delimited values in the form of: "/...
0
votes
1answer
47 views

Can you get virus from previewing email attachments in Gmail?

If an email attachment such as .docx, jpeg, .xls, .pdf, etc. contains virus/malware and if I open it for preview (not opening it in Google Docs or downloading it and opening it) then can I get ...
14
votes
2answers
1k views

Do you rather trust a widely adopted algorithm or an underdog if they're cryptoanalytically on a level playingfield?

If it comes to the security a hashing or encryption algorithm provides, we never know the full story. There's that part that we (respectively the public research) understand and can reason about, but ...
2
votes
0answers
20 views

GoCryptfs on cloud

I read the audit docs on GoCryptFS website (https://nuetzlich.net/gocryptfs/threat_model/). There dragon has full information about the read write done in the gcfs partition, what does this mean and ...
2
votes
1answer
20 views

GnuPG: How to create ECDSA signature?

https://tools.ietf.org/html/rfc6637 defines ECDSA for OpenPGP and https://wiki.gnupg.org/ECC lists elliptic curve support in GnuPG since version 2.1 I have version 2.2.25 and it lists ECDSA as ...
1
vote
1answer
75 views

How is it possible for scammers on YouTube to use the same exact username as the author of the video? [closed]

Recently, there has been an absolute massive flood of scammers on YouTube videos related to Bitcoin. Their "trick" is to use the exact same username and profile picture as the person who ...
1
vote
0answers
29 views

How to install Java 8 on Kali Nethunter [closed]

Guys I need to install jdk 8 for my programs to work better, many programs do not support the version higher than Java 8 so I want to install Java 8 to run better, I tried to install via apt-get, but ...
5
votes
1answer
77 views

Certificate Pinning Best Practice or Alternative

I'm looking for the "best practice" to use in Certificate Pinning or an Alternative. Scenario:  I have a native mobile app and I have pinned the certificate so that the app can validate ...
1
vote
1answer
34 views

for reCaptcha, the token needs to be sent to backend for validation right?

So far, I have reCAPTCHA setup in the "submit" button for my login form with v2 Invisible recAPTCHA. But, I have a feeling that the token that I retrieve from Google needs to be sent to my ...
1
vote
1answer
45 views

Can M.2 docking stations be used to make forensic images of (Bitlocker encrypted) M.2 disks?

I am looking into M.2 docking stations such as the Maiwo K3016S as shown below. Is it possible to use such docking stations optionally in combination with a USB- or software write-blocker, in order ...
1
vote
1answer
61 views

Do all files downloaded from the web, come with a checksum to verify the file?

Pretty straightforward question. Take the image here: https://i.imgur.com/oEdf6Rl.png Does it come with a checksum, which I can verify against after I have fully downloaded the file? This question ...
0
votes
0answers
30 views

Burpsuite Extention issue [closed]

i am using burpsuite pro v2020.6. i have installed "JSON Web Tokens" extension , but it is displaying in tabs not displaying in repeater tab and proxy tab also , see the image below. this is ...
1
vote
0answers
38 views

call http-webpage in local browser, where the webserver is only reachable through proxychains (as it sits in a different network)

I have the following proxychains.conf [...] [ProxyList] # add proxy here ... # meanwile # defaults set to "tor" #socks4 127.0.0.1 9050 # <ip_prox_1> http 10.10.10.100 3128 # ...
1
vote
1answer
60 views

Can I safely disable and re-enable Secure Boot when Bitlocker is used in order to make a Forensic Image?

I am about to make a forensic image (using dc3dd from OSFClone) of two laptops and in this specific case I'd like to startup using an bootable USB stick with OSFClone and image the disk to an external ...
1
vote
0answers
35 views

Identify crash-inducing NVT in OpenVAS

I'm currently scanning a network using openVAS / Greenbone Security Assistant installed on Kali Linux. During the scan, multiple targets have crashed. This is obviously something I want to investigate....
3
votes
1answer
46 views

Does CORS interact with WebAssembly the same way it does with Javascript?

Anyone in the WebAppSec world is familiar with CORS as a mechanism to specify policy for when javascript is allowed to make API calls to different domains. As WebAssembly ("Wasm" - a binary ...
1
vote
1answer
45 views

Tracing MAC addresses found in router logs [duplicate]

How can I trace the following MAC addresses and find out who they are or belong to: 68:B9:D3:73:00:2F 98:E2:34:05:BD:8E When checking my router, these MAC addresses were in the drop-down menu.
1
vote
1answer
57 views

Is it safe to distribute the server's certificate file with the client?

I've been working on making an SSL server/client on C++ using Boost. To load the certificates, I use the following code for each side: server.cpp boost::asio::ssl::context ssl_context(boost::asio::ssl:...
1
vote
0answers
30 views

Send popup alert message based on ip address [closed]

How can I send a message to any device, especially mobile phones, that are within my WiFi network? The message has to be a pop-up message or forcing to pop-up a web page.
1
vote
0answers
26 views

Does Windscribe VPN keep logs even when disconnected?

Does Windscribe (or generally any VPN service) keep traffic logs even when they are disconnected? (Disconnected here means when the 'power-button' like button in the VPN's app is switched off). Some ...
1
vote
3answers
96 views

Does unsubscribing from an email actually remove my details? [closed]

I get quite a few emails from valid companies and organisations in my inbox. Unfortunately most of these emails are marketing-type emails which don't have any value for me. As a result I tend to ...
2
votes
0answers
48 views

Process.Start() Command Injection

How to exploit a program that has this line: Process.Start(user_input + "calc.exe") It's a .NET function and nothing has worked so far ("mal.exe &&", "mal.exe;", ...
2
votes
0answers
26 views

What legitimate services uses SAMR queries? And how to verify?

Recently I noticed that every few days, at (almost) the same time, one host is querying the Domain Controller for group members using SAMR calls. I am trying to understand why its happening ...
1
vote
1answer
53 views

Blind SQL Injection POC in Java

I am looking for some java applications (other than Manage Engine) vulnerable to Blind SQL Injection attacks for Authentication Bypass. I explored exploitdb and others but didn't find anything ...
1
vote
1answer
40 views

Does running a virtual machine provide a small layer of protection against an infected host in practice

Obviously a host can modify a virtual machine in any way and has full control over it, but in practice perhaps most viruses wouldn't have the complexity to search for virtual machines and modify them. ...
0
votes
0answers
37 views

Metasploit not working propertly [closed]

I'm learning about Metasploit. I tried to use create a payload and use it but this always happens. I don't know why is this happening. I looked for info but I couldn't find anything that could help ...
0
votes
0answers
19 views

nc Won't Listen on a Port on CentOs6 [migrated]

I'm playing with nc for the file transfer function. On a CentOS6 machine, If I put nc on the listening mode, it returns a help message instead. It seems nc with older visions needs different ...
2
votes
1answer
36 views

Possible to inject in the middle of a ROOT NOPASSWD command with a wild card?

I'm testing for privilege escalations on a Ubuntu 18.04 host, and after running sudo -l , I've discovered a couple of root NOPASSWD commands for a standard user (w/unknown password). These commands ...
1
vote
0answers
40 views

How roaming works with ssh private keys?

This occurred to me when looking at the security model wireguard is using. Instead of relying on users credentials and Radius authenticating central server each user has a private key used to ...
3
votes
1answer
78 views

Is it possible to “hack” an email account so that the emails always go to Spam?

I have a friend who is something of a public figure within a small sphere. She has been an object of negative attention recently in this sphere and has noticed that her emails are suddenly all going ...
-1
votes
0answers
97 views

How that guy is currently robbing the dice2win casino? (ongoing attack) [closed]

This is about a semi decentralized full open source casino running on the Ethereum blockchain. For me when I audited the code as for the staff, everything was clear: the gambling games being run ...
1
vote
1answer
52 views

How is identity implemented?

When I join an organization or create a Gmail account, I am given an identity. What does the organization do to create my identity? Does it just create new pair of public key and private key? I tried ...
2
votes
1answer
48 views

X509 certification and communication

I am having trouble understanding the concept of X509 encryption and its application to web service communication. The situation is that I (client) would like to communicate with another party (server)...
1
vote
1answer
62 views

Use the public key of a certificate as the key for HMAC SHA

Consider the following scenario. A company has several computers for each users on the same domain. They purchase an RSA certificate from a recognized authority which will be deployed with private / ...
0
votes
0answers
11 views

How to decrypt files infected with .lezp extension ransomware? [duplicate]

What to do when someone's pc has been hit by a ransomware which has .lezp extension and how to decrypt the files that have been compromised
2
votes
1answer
65 views

is there a two developer minimum for companies seeking PCI compliance?

I'm doing a questionnaire for PCI compliance and one of the questions (Yes / No / Not Applicable) is as follows: All custom application code changes are reviewed (either using manual or automated ...
3
votes
1answer
43 views

Email pattern ReDoS

I would like to verify that the input from the user complies to the format of email address (in Java application). On the following page there is verbose regex that should properly validate the email ...

15 30 50 per page
1
2 3 4 5
1233