All Questions

I'm learning about XSS attacks and need some assistance as I'm not that good with JavaScript or other ECMA-based syntax. My local server integrates anti-CSRF tokens via the XSRF cookie value. This ...

I received an email to my corporate email account from an external GMail account. The list of receipts clearly shows (an eventually successful) attempt to guess my email address based on my personal ...

What is the security level of DSA algorithm when $q$ is a 224 bit prime? Is it always a simple rule that the security level is the bit length of $q$ divided by two ?

I talk in a security forum, and sometimes a moderator share links to sources about things he talk about, but when I hover on these links, the link is different the the source it self. It is actually a ...

How does a YubiKey key work? Are these essentially just OTP password generators? Is there anyway to just use a software OTP password generator to replace the YubiKey key entirely? My YubiKey key works ...

I got a call from a contact on What'sApp, and when I picked up there was no audio. The person says they weren't even holding their phone when it happened, and it even took a minute for the call to ...

If I were to configure a server that would be configured to only be accessible (HTTP) from a single IP address via a port, is it safe from unauthorized access?

I was wondering if it is possible to get all website domains for a specific country. For example, let's take UK. All the websites connected to the UK end with a .uk in their domain. I was wondering ...

My school sent me a brand new computer. It was sealed and everything. I signed in with my personal account and later added my school account. I have been caught watching Youtube normally, but I've ...

In theory, authenticating with a public key should be much simpler than with a password. There is nothing to remember for the end-user, and registration can be done just by clicking a button. For all ...

I take this file from resource of game and I Want to know how to decrypt this , this is small line from the code : §ö ¨ö È)4Ì~u”]Èr L;Ùúe£¼’Q7ŠzY½¹Í„¶Qö¨¤s„³JØW rest of the file here : The Code

Poking around my machine today, realised there's an unknown user listed in there: tVA2uiJ14w First I thought it could be some IT account, but then again the filenames are too funky to be business ...

according to https://tools.ietf.org/html/rfc8032 EdDSA uses small public keys (32 or 57 bytes) and signatures (64 or 114 bytes) for Ed25519 and Ed448, respectively; But if I sign using Ed25519 in ...

openssl command allows to create x509 certificates, and to add subjectDN using the -subj parameter. The parameter accepts a string of slash-delimited values in the form of: "/...

If an email attachment such as .docx, jpeg, .xls, .pdf, etc. contains virus/malware and if I open it for preview (not opening it in Google Docs or downloading it and opening it) then can I get ...

If it comes to the security a hashing or encryption algorithm provides, we never know the full story. There's that part that we (respectively the public research) understand and can reason about, but ...

I read the audit docs on GoCryptFS website (https://nuetzlich.net/gocryptfs/threat_model/). There dragon has full information about the read write done in the gcfs partition, what does this mean and ...

https://tools.ietf.org/html/rfc6637 defines ECDSA for OpenPGP and https://wiki.gnupg.org/ECC lists elliptic curve support in GnuPG since version 2.1 I have version 2.2.25 and it lists ECDSA as ...

Recently, there has been an absolute massive flood of scammers on YouTube videos related to Bitcoin. Their "trick" is to use the exact same username and profile picture as the person who ...

Guys I need to install jdk 8 for my programs to work better, many programs do not support the version higher than Java 8 so I want to install Java 8 to run better, I tried to install via apt-get, but ...

I'm looking for the "best practice" to use in Certificate Pinning or an Alternative. Scenario:  I have a native mobile app and I have pinned the certificate so that the app can validate ...

So far, I have reCAPTCHA setup in the "submit" button for my login form with v2 Invisible recAPTCHA. But, I have a feeling that the token that I retrieve from Google needs to be sent to my ...

I am looking into M.2 docking stations such as the Maiwo K3016S as shown below. Is it possible to use such docking stations optionally in combination with a USB- or software write-blocker, in order ...

Pretty straightforward question. Take the image here: https://i.imgur.com/oEdf6Rl.png Does it come with a checksum, which I can verify against after I have fully downloaded the file? This question ...

i am using burpsuite pro v2020.6. i have installed "JSON Web Tokens" extension , but it is displaying in tabs not displaying in repeater tab and proxy tab also , see the image below. this is ...

I have the following proxychains.conf [...] [ProxyList] # add proxy here ... # meanwile # defaults set to "tor" #socks4 127.0.0.1 9050 # <ip_prox_1> http 10.10.10.100 3128 # ...

I am about to make a forensic image (using dc3dd from OSFClone) of two laptops and in this specific case I'd like to startup using an bootable USB stick with OSFClone and image the disk to an external ...

I'm currently scanning a network using openVAS / Greenbone Security Assistant installed on Kali Linux. During the scan, multiple targets have crashed. This is obviously something I want to investigate....

Anyone in the WebAppSec world is familiar with CORS as a mechanism to specify policy for when javascript is allowed to make API calls to different domains. As WebAssembly ("Wasm" - a binary ...

How can I trace the following MAC addresses and find out who they are or belong to: 68:B9:D3:73:00:2F 98:E2:34:05:BD:8E When checking my router, these MAC addresses were in the drop-down menu.

I've been working on making an SSL server/client on C++ using Boost. To load the certificates, I use the following code for each side: server.cpp boost::asio::ssl::context ssl_context(boost::asio::ssl:...

How can I send a message to any device, especially mobile phones, that are within my WiFi network? The message has to be a pop-up message or forcing to pop-up a web page.

Does Windscribe (or generally any VPN service) keep traffic logs even when they are disconnected? (Disconnected here means when the 'power-button' like button in the VPN's app is switched off). Some ...

I get quite a few emails from valid companies and organisations in my inbox. Unfortunately most of these emails are marketing-type emails which don't have any value for me. As a result I tend to ...

How to exploit a program that has this line: Process.Start(user_input + "calc.exe") It's a .NET function and nothing has worked so far ("mal.exe &&", "mal.exe;", ...

Recently I noticed that every few days, at (almost) the same time, one host is querying the Domain Controller for group members using SAMR calls. I am trying to understand why its happening ...

I am looking for some java applications (other than Manage Engine) vulnerable to Blind SQL Injection attacks for Authentication Bypass. I explored exploitdb and others but didn't find anything ...

Obviously a host can modify a virtual machine in any way and has full control over it, but in practice perhaps most viruses wouldn't have the complexity to search for virtual machines and modify them. ...

I'm learning about Metasploit. I tried to use create a payload and use it but this always happens. I don't know why is this happening. I looked for info but I couldn't find anything that could help ...

I'm playing with nc for the file transfer function. On a CentOS6 machine, If I put nc on the listening mode, it returns a help message instead. It seems nc with older visions needs different ...

I'm testing for privilege escalations on a Ubuntu 18.04 host, and after running sudo -l , I've discovered a couple of root NOPASSWD commands for a standard user (w/unknown password). These commands ...

This occurred to me when looking at the security model wireguard is using. Instead of relying on users credentials and Radius authenticating central server each user has a private key used to ...

I have a friend who is something of a public figure within a small sphere. She has been an object of negative attention recently in this sphere and has noticed that her emails are suddenly all going ...

This is about a semi decentralized full open source casino running on the Ethereum blockchain. For me when I audited the code as for the staff, everything was clear: the gambling games being run ...

When I join an organization or create a Gmail account, I am given an identity. What does the organization do to create my identity? Does it just create new pair of public key and private key? I tried ...

I am having trouble understanding the concept of X509 encryption and its application to web service communication. The situation is that I (client) would like to communicate with another party (server)...

Consider the following scenario. A company has several computers for each users on the same domain. They purchase an RSA certificate from a recognized authority which will be deployed with private / ...

What to do when someone's pc has been hit by a ransomware which has .lezp extension and how to decrypt the files that have been compromised

I'm doing a questionnaire for PCI compliance and one of the questions (Yes / No / Not Applicable) is as follows: All custom application code changes are reviewed (either using manual or automated ...

I would like to verify that the input from the user complies to the format of email address (in Java application). On the following page there is verbose regex that should properly validate the email ...