Skip to main content
Search type Search syntax
Tags [tag]
Exact "words here"
Author user:1234
user:me (yours)
Score score:3 (3+)
score:0 (none)
Answers answers:3 (3+)
answers:0 (none)
isaccepted:yes
hasaccepted:no
inquestion:1234
Views views:250
Code code:"if (foo != bar)"
Sections title:apples
body:"apples oranges"
URL url:"*.example.com"
Saves in:saves
Status closed:yes
duplicate:no
migrated:no
wiki:no
Types is:question
is:answer
Exclude -[tag]
-apples
For more details on advanced search visit our help page
Results tagged with
Search options answers only not deleted user 53333

prevention of an attack vector (e.g. XSS, HPP, CSRF)

1 vote
Accepted

Attack Surface Analyzer report possible actions

For the files, calling icacls or - since you're using Powershell - implementing the change yourself using [System.Security.AccessControl.*] classes are both valid options. You could also use Windows E …
CBHacking's user avatar
  • 52.1k
91 votes

Why is the OS obfuscation defense against "It's a Unix system!" not widely implemented?

Mike's answer says basically everything I have to offer about why this is a bad idea from a development perspective (and, as Ghedipunk's comment says, an unusable security feature provides no security …
CBHacking's user avatar
  • 52.1k
1 vote

What are the security issues of being able to put anything into a website's URL and generate...

In general, no; it's a bad design but not in a directly insecure way. However, it is going to generate a LOT of headaches down the road for you, if you (or any future customers/partners) use automated …
CBHacking's user avatar
  • 52.1k
0 votes

What can a company do against insiders going rogue and negatively affecting essential infras...

Lots of good answers here, but one that seems to be missing is to embrace the Principle of Least Privilege (PoLP). If there's no legitimate use case for erasing the router config files, don't give any …
CBHacking's user avatar
  • 52.1k
3 votes

How to harden against credential stealing in EC2 via the http://169.254.169.254 API?

Since you're using Linux, you can do this using iptables. It's possible to block specific UIDs from making specific requests. See https://unix.stackexchange.com/questions/104830/block-specific-applica …
CBHacking's user avatar
  • 52.1k
4 votes
Accepted

Is this usage of AES-CBC dangerous

A "padding oracle" is an entity (usually some sort of server) that will decrypt an arbitrary message, verify whether the padding is correct, and return this information to the (arbitrary) submitter of …
CBHacking's user avatar
  • 52.1k
2 votes

How do attacks on web browsers succeed?

Without going into the details, I want to say: do not underestimate the ongoing risk from unpatched (and sometimes unknown, that is, true 0-days) vulnerabilities in browsers. Browsers are exceptionall …
CBHacking's user avatar
  • 52.1k
1 vote
Accepted

Is it possible to send data from an open-source program but make it impossible for a user wi...

In a word, no. The best option is to move all the actual game logic to the server, and have the client be a thin client that just displays state and sends input. That wouldn't prevent various types of …
CBHacking's user avatar
  • 52.1k
1 vote

What prevents a coder from brute forcing a wifi?

Only the size of the key/passphrase, really. Given long enough, it's always possible. An access point could theoretically have some rate limiting built into it, which would help against authentication …
CBHacking's user avatar
  • 52.1k