Collaborate Disseminate
Currently, I develop a frontend for a simple REST API. I use Angular 18 with its material components and Transloco for localization.
A friend sent me a screenshot today, where a menu item with a localization key like "common.add"… Continue reading Website shows unexpected message instead of localised text [closed]
Let’s assume:
I have a piece of software (with a webUI) that has access to a USB device.
The software itself can’t be changed.
The software has the ability to perform a firmware flash on the USB device, also remotely when uploaded through… Continue reading Is it possible to proxy USB and disconnect when a certain sequence is intercepted before it is (fully) passed to the real USB device?
Background:
There are a lot of self-hosted web applications these days, and often, more than one for the same purpose. In my case I am looking for a replacement for GitHub or other big tech/cloud git platforms. But I am stack at: security…. Continue reading Evaluating Self-Hosted Web Applications
How to gather the csrf token on a login page and analyze the vulnerabilities on csrf token using Burp?
How can websites know if I had expired the evaluation period on them?
There are several websites on internet, which offer good services, like realistic voices. I was on a random one and tried out a text-to-speech service. This website had … Continue reading Determining if user has expired 30 days on free-trial websites? [closed]
We are currently implementing an envelope encryption scheme in order to securely store PII data in our database. That means we will have a user- specific DEK (data encryption key), and a KEK, which will get derived from the user’s password… Continue reading Envelope Encryption: KEK management in Auto- Login case
I am doing some security research on an application and I am wondering where it is based on.
It appears to be changing each request (so not bound to a user session). Is it just a random value, which should exists within the system or even … Continue reading Where is the .NET __RequestVerificationToken based on?
I have an offline app that serves a localhost server while it is running. Other computers on the same local network can access this server through 192.168.x.xxx
.
I want to block them from accessing this localhost server. I am thinking of … Continue reading How can I block localhost access from other computers on the same local network?
I’m reading Alice and Bob Learn Application Security and I came across this sentence:
To protect highly sensitive data, it is recommended that you flush
the memory when your program exits, logs out, or is otherwise ended.
Considering a w… Continue reading Flush the memory when the application is ended
I am testing a graphql endpoint that uses POST requests with persisted queries, I tried the following query:
{
"query":"query{signedUser}"
}
The graphql endpoint returns an error that signedUser doesn’t exist on the qu… Continue reading graphql POST request returns 404 not found [closed]