Collaborate Disseminate
I’m running an Apache server on an Ubuntu EC2 instance for some online friends, but they don’t want me to be able to identify them in real-life. The hosted webapps require login, so it’d be easy for me to associate their username with thei… Continue reading How can I prevent visitors from exposing their personal IP addresses to my server?
There are some HTTP security headers in the world of cyber security of web applications. These are e.g.:
X-Content-Type-Options
X-Frame-Options
Content-Security-Policy
Referrer-Policy
Strict-Transport-Security
Expect-CT
X-XSS-Protection (… Continue reading Are HTTP security headers only for web browsers?
Recently, I noticed several resources that may be in danger, but I did not find a feedback form or email or another way to contact the owner and warn. How can I notify the owners?
DoS seems to me a noticeable, but in a very rude way to pay… Continue reading How to inform the owner of a site about a vulnerability if there is no feedback form? [closed]
This really doesn’t seem safe to me, and I am wondering if there is a MITM attack happening or if this is somehow legit. I am worried something might be happening with my company’s payroll data. Here is my investigation so far:
I plugged in a wireless mouse receiver while browsing its manufacturer’s website. Browser settings that allowed sites access to USB devices were turned off.
The manufacturer’s website, upon the plugging of the receiver, displayed a new web… Continue reading How does a device’s manufacturer’s webpage know that I just plugged in one of their products
On a Windows 10 Home machine (21H2 19044.1741), I noticed one of my applications failed to listen on port 1000, because something was already using that port. That struck me as peculiar, because I wasn’t familiar with any applications that… Continue reading Windows IP Helper service listening on port 1000 [closed]
My goal is to analyze the traffic of an Android application, to check if it contacts any IPs not associated with the server it is meant to contact.
Using PCAPRemote I created a connection log file and transferred it to the PC, where I am a… Continue reading How to know what IPs are associated with an authorised server?
Whilst signing up for a free trial on a web site, I noticed that it sent a post request with the following payload that includes captcha code.
What would be the purpose and benefits of sending it to the backend?
{
"captcha": … Continue reading Purpose of sending captcha code in Post request
I’m guessing uploading to IPFS also uploads some metadata, which gets shared as well, does this assumption hold any truth? According to this only content identifiers and node identifiers are in the public.
Does uploading a file leak any o… Continue reading What metadata could be stored in the IPFS network and what could be collected by modified nodes?
Could it be practical to authenticate API request through digital signature (based on headers and message body)? This would be asymmetric instead of something like HMAC which is not a signature. Are there performance or other constraint… Continue reading Digital signature for API authentication feasible?