JWT tokens are self-contained. If a valid JWT token contains username and the token is valid, then the endpoint will think user is authenticated.
The token can be decoded and all fields seen.
What if I generate token on my side and fill it…
For SPA/frontend apps, you should be using PKCE these days for OAuth flow. But the backend apps have this additional complexity of having to have a secret key and use that key to talk to the token endpoint. Why not just use PKCE on the bac…
I am looking for a login security measure where it is keylog and screen capture proof. Is there some type of login security like a 2FA without the need of a second device, but remembering a pattern or a formula which is used to solve a dyn…
I have two sha256 hashes as hex strings
HASH1=b5bb9d8014a0f9b1d61e21e796d78dccdf1352f23cd32812f4850b878ae4944c
HASH2=7d865e959b2466918c9863afca942d0fb89d7c9ac0c99bafc3749504ded97730
now I want to create a new SHA256 that depends on these …
I have an exam next week. I need help.
This is my lab:
attacker machine (kali) : 192.168.1.81
1st hacked machine (Windows 10) : 10.10.10.130
target (Windows 7) : 10.10.10.135 (have an MS17-010 exploit)
Steps I foll…
I was testing Burp Suite Crawl on some old php sites I made and it found Sleepy User-Agent
SQL injection vulnerability
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64)
AppleWebKit/537.36 (KHTML, like Gecko) Chrome/69.0.3497.100
Safar…
I’m working on app that uses MySQL database on XAMPP Control Panel on Windows.
I am concerned about security part.
I received advice about connecting to MySQL through VPN so it won’t be accessible so easily.
As far as I understand it, VPN …
the purpose of adding trusted timestamps to signatures is so that they can be considered valid long beyond the validity of the signing certificate.
However, this is not so easy, since TSA’s signing certificate has an expiration date too or…
I am using a socks4 public proxy for more speed/bandwidth. I am currently using it for downloading files. Now I want to use it for social media or daily day usage. I know that they will get all my traffic. I use DNS over HTTPS in Firefox. …
How to use msfvenom elf approach for metasploitable 2?
I am reading a book that teaches how to make a msfvenom executable for Windows. But I am learning on metasploitable 2. I really did not want to skip this section without understanding …
