Collaborate Disseminate
If there are multiple exploits, each not accomplishing anything significant on their own (but are still technically exploits),
but when used together in an exploit chain can achieve a meaningful result, would the entire chain… Continue reading Can A chain of exploits count as a CVE?
Let’s say I want to secure authentication on a web app or a mobile app or even a machine to machine app.
My first approach to secure the password is to enable HTTPS and some sort of client-side message-level encryption of da… Continue reading Can you avoid ever sending a password over the wire?
There are plenty of CVE. If they exist it means someone has already confirmed them at some point. But there are not necessarily exploits (for instance in exploit-db) for every CVE.
I was wondering what would be typical step… Continue reading Do people actually write exploit from CVE report? [on hold]
Can an organization have multiple pii/phi records of a single person that would each be considered an unique record, increasing the total amount of pii/phi records an organization has by 1 for each?
Or would each record be c… Continue reading How would i calculate total PII/PHI records for an organization?
I couldn’t really find this answer anywhere. If an ISP was to record every browsing, call and text we make/send, would it be expensive for them log and store this? Assume an ISP has 4 million devices accessing the internet.
… Continue reading Is it expensive for ISPs to store browsing, text and call logs?
I start with the fact that I understand how flash devices (pendrives) can be encrypted with software, for example Bitlocker. Simply, the encryption key is the password given during encryption and decryption by user, where the… Continue reading How is it possible that hardware-encrypted flash devices are safe?
I have an iMac on the same network as my Windows desktop. Both are on the local network at my university.
I am sharing a folder on the iMac using the built-in sharing utility (via SMB) with everyone set to no access and my a… Continue reading Files Accessed over macOS’s SMB Sharing Encryption
I was pen testing a java web application, I could upload a malicious JSP file which was generated using METASPLOIT, however, I could not put the JSP file in the server directory so that it can be executed and a web shell sess… Continue reading jsp malicious file upload is possible, but no exploit scenario, should I report it?
I use KeePassXC on a Linux distribution for managing my passwords.
For the sake of the argument, let’s assume that the file is publicly accessible, and the entire world’s number 1 priority for the next 100 years is to try to… Continue reading KeePassXC for managing passwords, threat model: Entire world actively trying to decrypt my password given the file
I’m planning to buy this Mini PC and on one of its Ethernet ports I would do sniffing with a tap, but at the same time I want that the PC is also normally connected to the router via its second LAN port. Is it possible?