Unanswered Questions
4,511 questions with no upvoted or accepted answers
15
votes
2answers
832 views
Fully transparent proxy
By default mitmproxy will use its own local IP address for its server-side connections. What I want instead is mitmproxy to use the client’s IP address for server-side connections.
The following ...
12
votes
2answers
2k views
Openid connect nonce replay attack
The openid connect specification adds a nonce parameter to the authorize endpoint, which must be echoed back as a claim in the id_token. It claims that the purpose of this parameter is to prevent ...
9
votes
1answer
434 views
Pin required for accessing (smartcard) Card Authentication Slot
So let me set the stage:
I have created an Intermediate Signing Certificate by way of the Yubico walkthrough: https://developers.yubico.com/PIV/Guides/Certificate_authority.html
I made a couple ...
9
votes
2answers
2k views
dnsspoof not spoofing (requests and forwards real DNS packet)
I was trying to use dnsspoof but it did not work as expected. These are the steps I followed:
Set IP forward in kernel to 1
arpspoof -i eth0 -t 192.168.1.39 -r 192.168.1.1 and arpspoof -i eth0 -t 192....
9
votes
0answers
411 views
Is there any merit to the RFC 3414 (SNMPv3 User Security Model) password-to-key method?
RFC 3414 (published 2002) specifies a method of generating keys based on password in its Appendix, which essentially takes any "passphrase", and keeps on repeating it until there is a 1MB string, at ...
9
votes
2answers
1k views
What unique fingerprinting information can an iOS 10 app collect?
As a follow-on to these questions:
What unique fingerprinting information can an iOS7 app collect?
What unique device fingerprinting information can an iOS8 app collect?
What unique device ...
8
votes
1answer
246 views
XSS with escaped equal sign inside jQuery selector
Web-site uses jQuery 1.8.3 which has known XSS vulnerability in selector. (https://snyk.io/vuln/npm:jquery:20120206).
It passes filtered and urldecoded document.location.hash (val2 below) value ...
8
votes
1answer
691 views
Are Authy's tokens insecure?
I've been trying out Authy, a Google Authenticator alternative with an optional feature of being able to back up your tokens. They have two types of tokens: Authy-generated tokens and the regular OTP ...
7
votes
0answers
331 views
Can SRP be implemented using libsodium
I am using libsodium for cryptography and I want to use SRP for key exchange. The wikipedia page lists a python example, but I am not sure if and how I could convert this to libsodium function calls.
...
7
votes
0answers
2k views
TPM PCR value unchanged with BIOS configuration changes
I have been experimenting with the TPM on a Dell R710 (BIOS version 6.3.0). My goal was to detect changes to BIOS settings through TPM PCRs. The research I have done leads me to believe that BIOS ...
7
votes
1answer
2k views
Mac OS hacked via Bluetooth?
I was working from Starbucks today on my Macbook Air running OS X 10.11.5, and a strange thing happened.
I was in Chrome and browsing the web, when a Bluetooth connection request popped up from an ...
6
votes
1answer
195 views
How could I block or at least detect the use of ultrasonic side channels or Google Nearby Messages API on my smartphone?
My question is about the use of ultrasonic messages that are part of the modern advertising ecosystem and are also used by the Google Nearby Messages API.
When it comes to advertising, the type of ...
6
votes
2answers
248 views
Non Confidential OAuth2 flow
I've been going through some documents regarding OAuth2 confidential and non-confidential authorisation flows, namely this and the RFC.
From my understanding, the non-confidential flow does not ...
6
votes
0answers
322 views
Android verified boot within the boot sequence
I'm interested in understanding the verified boot process in Android, yet I was unable to find insights about some properties of the process.
From what I gathered so far I get that in Android devices ...
6
votes
0answers
181 views
Using instruction set architecture (ISA) to stop stack overflows
I have been learning about using stack overflows to get arbitrary code execution, one of the tricks used is overwriting the return address to make control flow go the way you want it. Assuming our ...
