How do you securely give access to a Java App interactive console (Linux/GNU)?

I have a Java App running, which prints out messages into STDOUT and also has an active interactive console (also accepts STDIN), when the server has started up.

How do I securely give access to an external person (outside the network) to… Continue reading How do you securely give access to a Java App interactive console (Linux/GNU)?

Are the developers of WordPress avoiding security by obscurity or there some reason to expose plugin and login names?

Tools like wpscan are out there in the open, which make the scanning of any WordPress website plugins without any authentication and receive sensitive data like wp-admin login names (which usually contain PII), plugins used, etc.

Is this… Continue reading Are the developers of WordPress avoiding security by obscurity or there some reason to expose plugin and login names?

How to analyze a USB device of having possibly malicious capabilities?

So I recently ordered a chinese external USB card and I would like to find out whether it has some hidden functionality, which might become malicious. It has buttons integrated in it so Linux using libusb -vv displays it of h… Continue reading How to analyze a USB device of having possibly malicious capabilities?

Is there any danger from leaving your Ethernet plugged in/WiFi left on during boot?

Since my research came up with nothing I decided to post here.

Were these any cases of boot-up internet viruses? That means early in the boot sequence in the startup of networking something bad happens (exploits, viruses, w… Continue reading Is there any danger from leaving your Ethernet plugged in/WiFi left on during boot?

Does the HTML password field include any protection against XHR/AJAX exfiltration?

In HTML when we describe a certain field as a password field is it somehow secured against sending out the data via XHR/AJAX/similar technologies?

This is relevant in case we have to deal with script injection and similar at… Continue reading Does the HTML password field include any protection against XHR/AJAX exfiltration?