Which between the two encryption algorithms AES(Twofish(Serpent)) and Serpent(Twofish(AES)) is most secure and which hash algorithm to use between SHA-512, Whirlpool, SHA-256 , and Streebog?
To secure an OpenLDAP environment I’m investigating what the security best practices are with regards to authenticating users with passwords (e.g. no Kerberos or SSL Client Certificate authentication).
From what I understand, there are tw…
How can I hide metasploit APK after first launch? I know there is a command for it in meterpreter but I want it to hide itself when it is first launched. Before adding hide_app_icon command to meterpreter app used to be hidden automaticall…
From time to time, I perform a scan with clamscan. I’m on Archlinux. Clamscan database is updated before each scan.
Today clasmscan reported 19 infected files:
./.cache/mozilla/firefox/qyq0onej.default/cache2/entries/3BCF117A4E950F91D6EB…
I encountered a particularly weird situation where I have an SQL Injection vulnerability in the ORDER BY clause. The query is forged on backend and the injection payload is converted to upper case with the strtoupper() PHP function as can …
So I was trying to download an arcade game, everything seemed legit and I guess I was too excited to play it I started running it – only after clicking it I decided to run a scan on both Avira and Malwarebytes. As it was running Malwarebyt…
Due to a security scan, I was told to not use TLS1.0. I found a link that gave me commands to use to check if a specific protocol is used/enabled. The command I ran (with output is)
(Output from TLS1.0 disabled)
$ openssl s_client -conne…
I recently had a discussion with a Docker expert about the security of Docker vs. virtual machines. When I told that I’ve read from different sources that it’s easier for code running within a Docker container to escape from it than for a …
During development we added to error logs details of http requests, including headers, to have better understanding for error investigation. Our architect pointed that we should not place sensitive information in logs. My question was shou…
Is it possible to inject a payload inside <a> tag such that the script runs without user interaction?
The injection is inside the href attribute. I can inject onmouseover or onclick attributes, but user interaction is required.
Th…
