All Questions

Filter by
Sorted by
Tagged with
-1
votes
1answer
18 views

how many network adapters does an evil twin attack require

what is the difference between performing an evil twin attack with 2 wireless adapters or with just on or is it even possible to perform this attack with just one adapter? i am using Kali Linux
0
votes
0answers
17 views

How does JCEKS Password Based Encryption work

I want to get my hands on some recent documentation or an explanation on how Password based encryption works inside of JCEKS KeyStores Some questions I am looking to get answers to are What is the ...
0
votes
0answers
19 views

Is Microsoft Forms adequately secure to collect personal health information? [closed]

I want to make a survey on a website using Microsoft Forms. Patients would input personal health information into this form, so I want it to be secure. The Microsoft website indicates that Microsoft ...
0
votes
0answers
24 views

Text message clickbait attack from g4svc.info [closed]

Recently I received a text message like this: "xxx, we're trying to get a hold of you about your Costco receipt UUIB-LPZ. Please claim your overcharge reimbursement here g4svc.info/6Jp1UwFdf." ...
0
votes
0answers
25 views

What type of cybersecurity jobs can't be replaced by AI? [closed]

It looks like AI is out to get some of us. The button pushers. One click on vulnerability scanner or zenmap etc... I was wondering what kind to cybersecurity obs could not be easily replaced by AI. ...
0
votes
0answers
26 views

What security benefit is there in 2020 to block outbound Ping [duplicate]

I've researched this and found the following on StackExchange and ServerFault, but they're very old. https://serverfault.com/questions/55889/why-block-outbound-icmp Is it a bad idea for a firewall ...
0
votes
2answers
28 views

Monitoring laptop activity while logged into school's Microsoft account [duplicate]

I logged into my school-based Microsoft account on my personal laptop. But is it possible that somehow my school is monitoring my Google searches and other browsing history through the school ...
0
votes
1answer
21 views

How to find vulnerable PHP parameter such as `.php?id=` as found in Kioptrix 3?

This is part of my preparation for OSCP. According to https://www.vulnhub.com/entry/kioptrix-level-12-3,24/, Kioptrix 3 is vulnerable to SQL Injection. However, I found that SQLi challenge on ...
0
votes
1answer
23 views

How to detect passwords in wiki pages?

Is it possible to use any automated scanning tool in order to detect stored passwords in our internal wiki pages?
0
votes
0answers
15 views

Weird whatsapp number transfer without its related account files transfer [closed]

Several months ago, in an old cellphone that I used in the past, I created a WhatsApp account with a fake US number that can be obtained with one of those apps that can be downloaded from the Play ...
1
vote
1answer
50 views

If someone steals my unencrypted, password protected laptop, would they be able to get into my Google account?

I have a laptop with Ubuntu 20.04 operating system. I am logged into my Chrome browser using my Google account. This means, every time I open my browser, I am already logged into all the Google ...
0
votes
0answers
25 views

Persistent backdoor for android using windows meterpreter

I want to create a persistent backdoor for Android using the .sh file. But when I am trying to use the sh filename.sh on the meterpreter session shell then i get the following error : not found6]: I ...
0
votes
1answer
33 views

Why make it difficult to disable MFA tokens?

Some websites make it easy to enrol multiple TOTP apps at the same time but make it difficult to disable these apps. For instance, the user would have to completely reset the MFA settings instead of ...
0
votes
0answers
16 views

Modify APK and recompile [closed]

Instead of changing my Android device id, I decompiled an APK and manually set a fake device id string and recompiled it as a signed APK to use it in my device. APKs use APIs to transfer/show ...
0
votes
0answers
22 views

Adding paygate buttons to HTTP-only website?

Let's say that I have a website where I want to sell homemade goods. I want customers to be able to pay for the goods without too much hassle. A common option is to use buttons provided by a payment ...
0
votes
0answers
22 views

What is this file and how to remove it [closed]

should I even try and open it? is it safe? no idea how I got this
0
votes
0answers
25 views

What are the TLS libraries used by the most popular browsers? [closed]

I'm trying to find a list of the used TLS libraries by the different browsers. I made a search and I didn't find such a list. Can anyone help me?
1
vote
3answers
173 views

Discord server doxing people

I was on Discord, and someone sent me an invite to a server called "Operation: Pridefall". I didn't know what it was, the link is http://discord.gg/xxxxxxxxx - and the invite was legit. I thought it ...
0
votes
0answers
14 views

Open redirection (DOM-based) on ASP.NET 4.7 Web Forms

A scan with Burp Suite has reported a possible vulnerability on all the pages of my application, which is based on ASP.NET 4.7 WebForms. the issue is: The application may be vulnerable to DOM-based ...
0
votes
0answers
19 views

2-weekly cell phone (android) browsing to columbus . shortest-route . com

Last month I resetted my cell phone, also immediately installed Malwarebytes and Avast. Every scan until now was/is safe. But I also have a virus scanner which is included in my ISP safety package (...
2
votes
1answer
42 views

How to find out where CNAME had resolved to in the past?

Are there any tools for this? I am doing some research into pentesting and subdomain takeovers with cloud providers like AWS and Azure. I have a list of subdomains (A records) that could be used for ...
0
votes
2answers
37 views

How to “trust” data that is posted from one application to other

We have a use case where a bunch of data needs to be posted from our application to a partner site where the end user takes some actions and then returns back to our site. On the return, the partner ...
1
vote
1answer
45 views

Breaking Wifi password knowing its length of 8 [A-Z] alpha (upper-case) characters using Hashcat

I got the WPA handshake, now it's turn to crack the password using Hashcat. First, I wanted to make a wordlist of passwords [A-Z] the length of 8, but Crunch (the tool in Kali Linux) said it will take ...
0
votes
1answer
43 views

Is Windows Sandbox a viable alternative to conventional VM solutions considering its design?

The idea of having a fast, disposable VM at the palm of my hand appeals to me very much. It makes adding an extra layer of security to any thing I want to do so easy - just launch the sandbox ...
0
votes
0answers
18 views

How do I go about decoding this malicious PHP script? [duplicate]

I came upon this script just by luck, actually. Ironically, it's stored in a protected folder on my website and I don't think <? $catches ='r'; $comforter ='$r)ciEVi'; $heroin = 'SgD'; $...
0
votes
1answer
31 views

Course of actions after finding security flaw [duplicate]

I've found what I believe is a significant security flaw on quite a big platform. It can be exploited to obtain on the orders of millions of email addresses with some additional data. They're big ...
-1
votes
0answers
29 views

Asset/Host Management with Comments [closed]

I have searched and cant seem to find a good asset management tool.  What I am looking for is something like NMAP where I can do ping sweeps but store those results in a database and add details to ...
10
votes
6answers
2k views

Protect API from being tampered?

I'm building an API with websocket that serializes data through JSON. The App itself is a chat application. I came up with the following structure to send my data: {date: '2020-05-31', time: '14:28:...
0
votes
0answers
29 views

Metasploit: Issue with upgrading a low privilege shell (sessions -u)

Setup info: I don't believe this is the issue as I regularly update my system. I'll add one piece of information as an example. If you would really like to the rest then I can add more in later ...
0
votes
0answers
39 views

Modern Honeypot Network not captured my attacks [closed]

I have installed Modern Honeypot Network (MHN) by pwnlandia successfully in Ubuntu 16. On the attack report, it shows an attack that comes from others but not from mine. I'm using nmap to scan the ...
-1
votes
2answers
55 views

Do I need to turn on monitor mode while doing MITM attack and ARP spoofing?

I want to attack my old PC by ARP spoofing and do some MITM attacks. So I was wondering if I need to turn on monitor mode or can I do those attacks in managed mode?
1
vote
2answers
85 views

Develop and test a vulnerable login system

I'm a beginner on course to be an expert (hopefully) and I've been set assignments to test security systems on the web. The whole assignment is to prepare, test and document the results to correlate ...
2
votes
0answers
43 views

ZAP Error [java.net.ConnectException]: Connection refused (Connection refused)

I am trying to connect to http://challenge01.root-me.org/web-serveur/ch10/ in Firefox with FoxyProxy and OWASP ZAP and I got this error message ZAP Error [java.net.ConnectException]: Connection ...
0
votes
1answer
64 views

Can BIOS virus/malware be used to steal data?

Since a BIOS isn't connected to the internet, even if your BIOS is infected with a malware (say you used a usb to flash it but with files that wasn't from the official motherboard manufacturer's site)...
0
votes
0answers
41 views

How can your BIOS be infected or hacked and Can a BIOS virus be used to “steal data”?

I know that BIOS can get virus but it's very rare, but it seems to me it's pretty impossible or improbable for a virus to creep into your BIOS via normal computer use. Let's say I'm using windows 10, ...
0
votes
1answer
45 views

How to connect to a wifi network that shuts down connections [closed]

Our school's wifi shuts down after 12 am, and although we are still connected to the network, our connections are closed, and the computer says "no internet". However, we can somehow manage to stay ...
0
votes
1answer
50 views

New gateway results in Google and Amazon security lockout, “device not recognized”

The cable company recently replaced my old gateway/wireless router. After the new gateway was installed (a "Touchstone TG1682G Telephony Gateway", if it matters), both Google and Amazon required ...
0
votes
0answers
31 views

Brute Force HIGH DVWA with Python Script [closed]

I'm new using python and I'm trying to BruteForce DVWA in High Level, I found this script from https://medium.com/@dannybeton/dvwa-brute-force-tutorial-high-security-456e6ed3ae39 . But this error ...
0
votes
0answers
27 views

macOS + malware + root password

I entered my macOS admin details (root password) into an application I think was malicious. Suspicious, I checked the keychain and my tokens had modified passwords. What else could have this ...
-1
votes
1answer
57 views

Is it Possible XSS in <h1> tags without using “<”

In example website "<" character is filtered.Is it possible to find XSS in h1 XSS h1
0
votes
0answers
39 views

How to use Wordlist to crack a password which have “ ”(space) in it?

I am new to this forum and this is the first time I try "John the Ripper". Currently I forget a password but I remember that there is a space inside it like John-+the Ripper@putty I would like to ...
1
vote
1answer
49 views

How can I be attacked by opening a corrupt MS Office document?

When opening a corrupt Microsoft Office document, I get a prompt that says something along the lines of: Excel [or Word/PowerPoint/etc] has found unreadable content on 'filename.xslx'. Do you wish ...
0
votes
1answer
63 views

AES encryption (in Java) of different JSON strings always produce same encrypted string as result. Why? [closed]

I have a program written in Java which takes JSON string as argument, encrypts it using AES then encodes it using Base64. JSON string is like: {"a": "b"} or {"a": "n"} or {"a": "k"} I.e related ...
2
votes
2answers
54 views

Are password managers still effective on a cloud PC (virtual machine)?

I have recently started using a cloud gaming service. It provides me with control of a 'remote PC' (actually a virtual machine running in their data centre) accessed through an app or VNC console. The ...
0
votes
0answers
38 views

How to secure our organization when our employees using different collaboration SaaS services? [closed]

Our employees use few SaaS collaboration applications (e.g project management). I was wondering what controls we should controls on the vendor we should put? Example: Asana is a web and mobile ...
0
votes
0answers
17 views

MDC and MAC in cryptographic hash function [closed]

What is the difference between MDC and MAC in cryptographic hash function
9
votes
3answers
2k views

HTTPS connection to specific sites fail with cURL on macOS

On my Mac, HTTPS connnections to certain sites fail using the built-in curl binary of macOS 10.14. They work fine with different browsers, as well as other builds of cURL on the same system. One of ...
1
vote
1answer
36 views

Use linux firewall rules for windows too [closed]

I'd like to improve security on my home network. I have a PC and a laptop with Microsoft Windows as well as a PC and a laptop with Linux There are a few HTTP services installed in the network. The ...
-1
votes
1answer
39 views

LinkedIn connection marked unsafe

From time to time my LinkedIn connection gets marked as unsafe: no green lock next to the URL. First, I believed this was a browser issue, but after I switched to another browser, the warning did not ...
0
votes
0answers
33 views

Are metasploit exploits always Port specific (smb-samba)?

So I was trying a machine on vulnhub i found port 139 open and also found its service and version on nmap scan that was samba-4.3.11 i also ran auxiliary scan module to confirm the version and service ...

15 30 50 per page
1
2 3 4 5
1167