Newest Questions
69,776 questions
0
votes
0
answers
9
views
Editor for Tenable DISA STIG files [closed]
We want to use Tenable to scan our assets for DISA STIG-compliance. Since we use DISA STIG just as a baseline and are not required to strictly comply, we would like to tailor it to our needs. Since ...
- 193
-1
votes
0
answers
22
views
AH00526: Syntax error - Invalid command 'SecDefaultAction [closed]
I'm getting the error below with the default config
AH00526: Syntax error on line 97 of /etc/crs4/crs-setup.conf:
Invalid command 'SecDefaultAction', perhaps misspelled or defined by a module not ...
2
votes
1
answer
220
views
Is there a reason to not send signed FIDO2/WebAuthn session data to the client rather than storing it server side?
Every WebAuthn implementation I've seen stores the session data server side, but that just seems pointless to me, since what seems to be essentially all the same data is already sent to the client in ...
- 123
-3
votes
0
answers
53
views
Should I be concerned that Let's Encrypt uses a Ukrainian certificate server? [closed]
I was looking through my Firefox browser Certificate Manager list of servers and came across this one:
Server: xn--80aealdk(a-dozen-more-characters):443
Certificate Name: tr-vs.com.ua
Lifetime: ...
0
votes
0
answers
39
views
How to apply code signing
I have a client-server on prem application.
If I want to provide code signing, what are the files that should be signed (exe or jar or cmd or ...) ?
Also should both files on server and on client be ...
- 187
5
votes
1
answer
48
views
Can a nonconformity be raised against a control - for ISMS audit based on ISO 27001?
I read a LinkedIn article by Chris Hall (Post 1, Post 2), who states that Certification Auditors cannot and should not raise nonconformity against the controls and should only raise nonconformity ...
0
votes
0
answers
47
views
Altered Android app icon, indication of spyware?
While setting up and debugging a VPN connection on an Android device with the “Net Analyzer” app, I spotted by
chance a suspicious icon in the application as shown in the screenshot below (shows the ...
- 1
1
vote
1
answer
59
views
Trouble Extracting Hash from PKCS#8 Encrypted Private Key for Cracking - OpenSSH
I have an encrypted private key for OpenSSH that I need to crack the passphrase for. However, tools like ssh2john.py and openssl2john.py fail to parse the key. Here’s what I’ve tried so far:
Key ...
0
votes
0
answers
19
views
Cybersecurity Strategy for a VSCode extension
I am working on an internal project which involves the creation of a VSCode extension like Github Copilot for internal projects.
I have to do the security strategy for this project. I thought of ...
0
votes
0
answers
6
views
Keymaster Rollback Resistance in Google Pixel 8 [migrated]
I am new to Android development and am trying to understand some of the security features of my Pixel 8 phone. I collected some attestation information and printed it to the screen. I realized that ...
- 101
0
votes
0
answers
6
views
There is a tiny windows opening and closing in every reboot. How can I find this process? [migrated]
Every time I power on my laptop, there appears this tiny windows for a split second and it disappears. It is highly likely that there is a virus on my pc. How can I find which process is opening and ...
- 1
4
votes
3
answers
2k
views
How does a TLS client certificate prove the identity of the client?
About TLS Client Certificates
How does a TLS client certificate prove the identity of the client? Yes, only the client has the private key so a client-key handshake can be completed. But how does that ...
- 41
0
votes
0
answers
4
views
Detect what applications call MD5 in SCHANNEL on Windows [migrated]
We plan on disabling MD5 through the registry on an important sample of servers.
Before doing it, we would like to know if any applications are using MD5 (at least based on the windows SCHANNEL ...
0
votes
0
answers
24
views
How do I ensure that my web application’s accessibility features do not introduce security vulnerabilities? [closed]
I am currently working on a web application where accessibility is a high priority. We’ve implemented several accessibility features, such as:
ARIA (Accessible Rich Internet Applications) attributes ...
0
votes
0
answers
34
views
Can I perform security testing in an environment without affecting production? [closed]
A practical question about how to test the security of a live web app or system without negatively impacting its availability or functionality.
5
votes
1
answer
2k
views
Is there a security benefit from adding a dedicated router to a network of 1 PC?
If I have a single computer with a direct connection to the Internet (and a real external IP address from the ISP), does it make sense security-wise to put a dedicated router between the computer and ...
- 1,102
-2
votes
0
answers
40
views
Seeking Hacking Tips and Free Resources [closed]
I'm starting to get interested in hacking and would like to learn more about the subject in a responsible and safe way. I know it's a vast field with many important concepts, so I'm looking for tips ...
4
votes
1
answer
799
views
Secure Boot and HDD Firmware Viruses
Does secure boot stop the boot process if you have firmware on your HDD that has been tampered with? In other words, do HDD firmware viruses get detected with secure boot?
- 75
3
votes
2
answers
1k
views
Gmail's DMARC policy
I'm trying to understand how large email providers handle their DMARC records.
I've taken a look at Gmail, and I'm a bit confused as to why they don't have a policy set for the main domain (p=none). ...
- 229
0
votes
0
answers
44
views
Are there any known BIOS that clear a TPM on disabling secure boot?
I noticed that when the secure boot options is disabled on a Bitlocker enabled Windows laptop with TPM, in order to boot into a forensic live OS like Kali in Forensic Mode or Parrot OS that the TPM is ...
- 7,607
0
votes
0
answers
33
views
Is booting into the Windows (advanced) startup menu without a write-blocker forensically safe?
I wonder if entering the Windows (advanced) startup menu changes or logs anything on the disk itself. Where does this exactly happen in the boot sequence? If for example, a laptop was to be ...
- 7,607
1
vote
0
answers
8
views
Blocking YouTube without blocking other Google services [migrated]
I'm trying to block YouTube entirely from my network. I'm in full control of routing and DNS (Linux: ipfilter/dnsmasq). The issue I am having is that I am unable to block YouTube without blocking ...
0
votes
0
answers
39
views
In a dual boot system, can infected windows partition infect linux partition? [duplicate]
My windows system was infected sometime ago, and they installed some sort of RAT, or spyware which allowed them to essentially view my entire computer screen and see everything I do. I used a lot of ...
- 1
0
votes
0
answers
13
views
Change TLS version apache server [migrated]
I need to use a payment service for my project, so I created an API with the GET method. I sent it to the provider, and it told me everything worked. However, our system can't work with this API ...
- 1
0
votes
0
answers
43
views
Is this backup method safe using Macrium Reflect with Veracrypt. Does this method make sure there are no data leaks?
I want to use veracrypt with my main OS hard drive on Windows 10. I just want to make sure if I have to restore the OS hard drive with the partition that there are no data leaks.
This is my process:
...
0
votes
0
answers
41
views
Need help with Query String parameters - GET Request
I have impletemed modsecurity/owasp in my Kubernetes environment. Most of it works but I am facing issue whenever there are query parameters in the URL. Even though the page and request is/looks valid,...
- 1
0
votes
1
answer
60
views
Angular's recommended CSP doesn't make sense to me
I am trying to implement a CSP policy for our Angular 18 application based on Angular's CSP recommendation and I have found that their recommendation does not make sense to me.
Specifically their use ...
- 105
0
votes
0
answers
43
views
Bigger wordlist for diceware passphrases [closed]
I like the idea of using diceware or diceware-like passphrases to generate human-memorizable strong passwords that you know exactly what the entropy is. The only problem i have with it is that the ...
- 151
0
votes
0
answers
6
views
FreeRadius PAM authentiation [migrated]
I am using a newly installed freeRadius (v3.2.1) on Raspberry Pi.
My wireless users currently authenticate fine with users in 'users' file. I want them to authenticate using local Linux credentials ...
2
votes
0
answers
15
views
Enabling Null/Anonymous Enumeration on Server 2022 [migrated]
I've set up a test domain for a demo that I'm working on, and need to enable enumerating users using netexec/rpcclient, etc. using an anonymous login.
I've created a GPO with these settings, set it to ...
-2
votes
0
answers
33
views
I have created custom policies in Blackduck. I want my CI pipeline to break if the policy is violated [closed]
I have created custom policies in Blackduck. I want my CI pipeline to break if the policy is violated.
I am running Detect with parameters such as
--detect.wait.for.results
--detect.policy.check....
- 117
-4
votes
0
answers
62
views
Sound intercepted smartphone, pc and tv 2 year and 24 hours [closed]
I've been going through the following situation for over 2 years and 24 hours. They intercept the sound from my computer, smartphone and even the TV, and there's no internet. They can also copy people'...
3
votes
1
answer
702
views
Intercepting HTTPS traffic with a trusted root cert and packet capture from the WiFi AP
I have an application in Android (version 6, so quite old) whose communication I want to monitor. I have installed my own root certificate in the user store and Android warns me correctly that data ...
- 509
1
vote
3
answers
92
views
Why does PEM Base64 created by `openssl pgen` not match the DER file passed in?
In experimenting with openssl on the Linux command line with elliptic curve secp256k1 I encountered a strange situation where on converting a DER private key file to PEM format using openssl pgen the ...
0
votes
0
answers
26
views
Snort Not Detecting SQL Injection Attempts on Mutilidae [closed]
I have set up a virtual lab using VMware with the following machines:
Ubuntu (Running Snort for intrusion detection)
Kali Linux (Used as the attacking machine)
Metasploitable 2 (Hosting Mutilidae, a ...
- 1
0
votes
0
answers
15
views
Could there not be a practical half step to Quantum? [migrated]
While I have read a number of articles/papers etc on Quantum, I wonder if the only answer is 10 or if 3 or 5 will be a practical way forward as an interim measure?
While most advocate a transition ...
- 1
0
votes
0
answers
32
views
Is it possible to run an active scan against a website with Burpsuite, ZAP, or another tool that excludes form submission for a single form? [closed]
I am trying to run an unauthenticated active scan of a website as part of a penetration test, and there is one form on the website on a contact page that looks like it will send emails to a singular ...
- 183
0
votes
1
answer
45
views
(nginx) ssl_certificate_key in Handshake of TLS 1.2 and 1.3
I am confused about the TLS handshake process in TLS 1.2 and TLS 1.3.
When configuring Nginx with SSL enabled, does the ssl_certificate_key play a role in the TLS handshake itself, or is it only used ...
- 21
0
votes
2
answers
87
views
Session token shown in the log file
I'm working on a JAVA web application running on Tomcat. A session token is generated and stored in a cookie when a user authenticates.
Unfortunately, when tracing is enabled, Tomcat dumps the value ...
- 111
1
vote
0
answers
49
views
Lists of blocked certificates on various platforms
This webpage by Apple appears to list the certificates that their products automatically treat as untrusted by default. Are there similar resources for other platforms and/or browsers?
On this site, ...
- 111
0
votes
0
answers
31
views
Snort not detecting SQL injection alerts despite proper configuration [closed]
I’m trying to configure Snort (version 2.9.20) to detect SQL injection attempts. I’ve set up Apache2, PHP (8.3.6), MySQL (8.0.40), and Mutillidae to simulate SQL injection attacks via a form. While ...
- 1
0
votes
0
answers
1k
views
Can local LLMs like DeepSeek R1 potentially send prompts or data to servers in China? [closed]
I'm exploring the use of local large language models (LLMs) like DeepSeek R1 for my projects. However, I'm concerned about data privacy and security, particularly regarding whether these models could ...
- 126
-1
votes
0
answers
98
views
What damage can a malicious site cause with JavaScript? [duplicate]
People say that JavaScript is potentially dangerous, but are there any good examples of how harmful a site can be for its visitors when JavaScript is enabled?
- 171
20
votes
6
answers
7k
views
Is it viable to defend against brute force attacks by rejecting correct passwords?
(found on reddit)
[translation: the website is programmed to reject the login if it is the correct password and if it is the first login attempt]
Assume that the scheme is to reject the first correct ...
- 6,821
2
votes
1
answer
71
views
+50
What is the risk of lenient CORS header for a webapplication that stores tokens in sessionStorage and not in cookies?
Let's assume we have a web-application that stores its auth token in the browser's sessionStorage/localStorage and does not use cookies. If I'm not completely mistaken, such a web application is not ...
- 347
13
votes
3
answers
3k
views
Should expired (root) certificates be deleted from the certificate store?
I noticed that on Windows systems many expired certificates are listed in the certificate store certmgr. Should they be deleted when expired and if so why or why not?
If they should be deleted why isn'...
- 7,607
2
votes
1
answer
200
views
How to make sure a used custom-ROM phone isn't malicious?
I am (hypothetically!) thinking about buying a used phone for sustainability reasons. I am also thinking about this being a non-Google phone for ethical reasons. There are some people in my country ...
- 123
-4
votes
0
answers
48
views
Google accounts, Facebook, phone hacked [closed]
So all my accounts are hacked, have been for about 3 years that I know of,one IT guy said most of the apps on my phone are fake, all of my files, photos get deleted or locked, so I can't view them, ...
-2
votes
0
answers
86
views
Bros i got hacked by phishing, and hacker access my Gmail.. but something very stranger happened [closed]
i was drunk after new year party, got phishing, and hacker access my Gmail.. firt time he used a IPV6 device, like a mobilephone, he got my SEED, and stolen 2 ETH... it my fault leave SEED in email, ...
1
vote
0
answers
251
views
Has anyone audited Deepseek for spyware? [closed]
As per the title. It's Open Source. Probably a lot of code, so a lot to audit; but if I use the self-hosted version, am I giving my data to China? Normally, if you are not paying for the product, you ...
- 1,420