Information Security Questions, Problems & Solutions : TransWikia.com ~ Page 15

LFI php://input returning initial argument?

TLDR: Trying to execute commands on site thats got a LFI vuln. So I am making my post request to my vulnerable site andimport requestsheader = { ...

Asked on 02/27/2021 by RFIx

3 answer

if computer is compromised, does hardware key still protect in ssh?

Let's say I sign into my local pc with a hardware key (eg yubicon). Let's say I further sign into a sensitive server (as root) via ssh using yubicon hardware...

Asked on 02/24/2021 by AwokeKnowing

1 answer

Is it easy to create persistent programs that run before Android's boot? (in firmware maybe)

I've been wondering about which level of trust I can apply to a used phone bought from someone else. I can easily unlock the bootloader and flash a brand new...

Asked on 02/21/2021 by Paprika

1 answer

Solutions for accessing webapp from inside and outside the corporate perimeter by same users?

I'm looking for solutions that could best address the following requirements.We plan to develop a webapp and deploy it in the cloud.Corporate users must be able to access the webapp...

Asked on 02/19/2021 by Aleph

2 answer

Cookie-to-Header CSRF protection vs CORS

What advantages does a Cookie-to-header technique give over CORS in a cross-origin request scenario? Example scenario:A rest API called api.com provides data to good.com. api.com has allowlisted cross-origin requests...

Asked on 02/19/2021 by Karlis Filipsons

2 answer

Key handling for shared-key encryption with sodium

Being not a cryptography expert, I am having some basic questions on how to manage keys wrt. sodium-plus. Let me briefly explain the context: the use case involves sending data...

Asked on 02/17/2021 by schaueho

0 answer

Hydra http-post-form based on length of the response

is there any way for hydra to understand the correct combination ^USER^ and ^PASS^ in a http-post-form authentication attack based on the length of the body response? Like in Burpsuite...

Asked on 02/13/2021 by Riccardo D

1 answer

Podman: What if user is member of docker group?

From a security perspective: Is it necessary that a user, that runs OCI containers with Podman, is not at the same time a member of the docker...

Asked on 02/13/2021 by dotcs

1 answer

Case sensitive logins

Why does owasp recommend using case insensitive logins ?Make sure your usernames/user IDs are case-insensitive. User 'smith'and user 'Smith' should be the same user.What's the security...

Asked on 02/12/2021 by bobif

2 answer

Why would modern OS allocate static addresses or why is ASLR still needed?

I have a question about ASLR which allocates randomized addresses for things. Based on my understanding (which might be wrong), a modern OS has pretty complicated memory management mechanisms and...

Asked on 02/11/2021 by ios learner

1 answer

Ask a Question

Get help from others!

Information Security : Recent Questions and Answers (Page 15)

Ask a Question