Questions tagged [security]

Topics relating to application security and attacks against software. Please don't use this tag alone, that results in ambiguity. If your question is not about a specific programming problem, please consider instead asking it at Information Security SE: https://security.stackexchange.com

Filter by
Sorted by
Tagged with
-1
votes
0answers
9 views

“Breaking” into Samsung phone

one of my colleagues has recently passed away and I am left with a task to retrieve data (especially pictures) from his phone - Samsung Galaxy A3 (2017). Unfortunately, he set a numerical code to lock ...
0
votes
0answers
6 views

I found Google analytics tracking id in source code of a website. Is this a vulnerability?

I found this piece of code while viewing page source of a website. ga('create', 'UA-XXXXXX-Y', 'domain-name', {'allowLinker': true}); "UA-XXXXXX-Y" is the google analytics tracking id. I ...
3
votes
2answers
27 views

How do you save API keys without exposing them in the first place?

If I save API keys to Flutter_secure_storage, they must be exposed in the first place. How could they be pre-encrypted or saved to secure storage without exposing them initially? I want to add a ...
0
votes
0answers
7 views

OAuth2 flow with Authorization Code grant type in SPA and Spring Boot Rest Api application

I have read dozens of articles and inspect lots of projects on Github about OAuth2 with authorization code grant type but still think that I have some mistakes about it. I have the following scenario ...
0
votes
0answers
14 views

firestore snapshot of certain documents

Any suggestions on how to get a snapshot to only return certain documents in a collection? db.collection('locations-data').get().then(snapshot => { setupLocations(snapshot.docs); ...
-5
votes
0answers
27 views

How to go about writing a zero click android application? [closed]

Recent Pegasus snooping software got me thinking on how to create such a zero click app. Where should I start? I searched a lot on Google, but could not find any tutorial. I would like to know how can ...
0
votes
0answers
5 views

How to get my Biometric data from my android device and send it over [duplicate]

I want to do an iot based project. it goes like this in my project I will have a android application that will detect his/her biometric data(finger print) and send it over to my wifi router and the ...
0
votes
0answers
8 views

Detect same issues as Google Security ASI service during development phase

Currently google started analyzing apks before releasing and block new releases if your apk has some of the following vulnerabilities / bad practices which could end in a vulnerability. https://...
0
votes
0answers
13 views

Can't access HTTPS site on IIS 8

I have web server hosting a site with bindings to HTTP 80 and HTTPS 443. Some user can't access the HTTPS site and get stuck in the credentials screen, This sames users can access the HTTP site ...
-1
votes
0answers
7 views

I've given temporary access to my Paypal, I changed password afterward. Money is ok. Any other harm possible?

I've given temporary access to my Paypal to another person, I changed password afterward. Money is ok. Any other harm possible? I mean, possibly some subscription to a payed site. I think that's ...
0
votes
0answers
9 views

How to securely validate payment and send product

I am building a website for a masseur with VueJS + Strapi, and clients can buy a gift voucher. Right now I have the VueJS part set-up with a Paypal payment gateway. I am wondering how to set-up the ...
0
votes
0answers
14 views

Force external drive encryption when writing on Mac [closed]

My company would like to secure their outgoing files being written to external drives. I'm not sure the best way to achieve this on a Mac and hoping someones done this before. We do not use FileVault ...
0
votes
0answers
17 views

Making and Applying Linux Security Patches

Apologies in advance if this is off topic or posted in the wrong place Just started hosting my own media server (CentOS Stream 8) and I'm trying to learn how to secure it. How would you apply changes ...
0
votes
0answers
13 views

Rails app - get rid of NGINX password protection for webhook endpoint

I'm totally new if it comes to the NGINX thing. In my staging app I've got NGINX implementation of password protection (user must log in to access staging) but now I added a new endpoint that accepts ...
0
votes
1answer
19 views

update user session when user change locale in Symfony

In my Symfony 4.4 application i create the UserLocaleSubscriber which works fine but when user change your locale must logout ang login for change transaltion language. I try to use EqutableInterface ...
-2
votes
0answers
17 views

Send document to another computer with in shared WiFi [closed]

I have a laptop1 with limited sharing. google drive is blocked. Mail is blocked. USB access is read only. No network sharing access either. Only think I could do was add a printers and print ...
1
vote
1answer
22 views

Hide API key in Get Request

I have set up a secured Azure Function with AD authentication to be consume in the React app. This involves sending the following GET request with the an API key as the parameter. https://{domain_name}...
0
votes
1answer
50 views

How to secure the Eval Function in VBS [closed]

I want to make an Application where Users can write VBS function in a Textbox and retrive the Results. For this purpose I will use the Eval function in VBS. Now I want to Limit the Number of Functions ...
0
votes
0answers
9 views

im trying to use hashcat on a hash from hackthebox with rule and i get the output of Exhausted every time

The hash is an SHA1 hash that i need to append 2020 to the end of each password: The rule.txt file input is: "$2 $0 $2 $0" The command: hashcat -a 0 -m 100 hash.txt /opt/useful/SecLists/...
0
votes
0answers
17 views

Difference in terms of security when using Hosted UI vs Amplify Pre-built UI component when using Amazon Cognito User pool as identity provider?

I am using Amazon Cognito User Pools as Identity Provider and access management in Web Application (react) and have no plans to use Social IDP or other external IDP. Amazon Cognito User pools will ...
-1
votes
0answers
36 views

Post Api not working with spring security

Can anyone tell me what is the mistake in following approach get api is working but not post api. I have added the code snippet and screen shot for the code. Can anyone tell me what is the mistake in ...
1
vote
0answers
13 views

can my environment variables been looked up in the frontend?

I know how to define .env variables in react, etc.. and then use them with process.env.someVar in the frontend (e.g to configure your database and so on..). Now, my question is, when I put those ...
-1
votes
0answers
43 views

Can a program decompile a dll file with read-only permission?

There is a program that has its own scripting language that can call external .dll files (.NET) for extra functionality and algorithms. The program connects back to its server for DRM on a regular ...
-1
votes
0answers
34 views

Using ajax or using php echo with HTML user's input. Security and performance points of view [closed]

I need to allow my website users to use html to format the input posts they send to me. Off course such data needs validation and security checks before being shown online to other users. I think I ...
0
votes
1answer
41 views

One function of my webpage has been blocked by CORS policy: No 'Access-Control-Allow-Origin' header is present on the requested resource

One function of my webpage has been blocked by CORS policy: No 'Access-Control-Allow-Origin' header is present on the requested resource. What should I do with this error, thanks? Webpage code: <...
0
votes
0answers
17 views

Fix fail2ban Number of jail always return 0

how can i fix fail2ban please this is my settings. systemctl status fail2ban â fail2ban.service - Fail2Ban Service Loaded: loaded (/usr/lib/systemd/system/fail2ban.service; enabled; vendor preset: ...
-2
votes
0answers
37 views

How do i hash my password in php in this particular case [duplicate]

Hi I've been trying to add password protection to my code, first time using PHP but tutorials I've found online doesn't work, here's the login part : <?php $conn = mysqli_connect('localhost', '...
0
votes
0answers
8 views

NodeJs + i18n : server restarting because bot try to access random URL for hacking

I have a NODEJS+i18n website and I have my website in english (/en/). My language parameter is in url so if you access : mydomain.com/en/ You will get language from ./locales/en.json But there are ...
0
votes
0answers
17 views

how to validate a file based on upload?

I have allowed three types of extensions csv, txt and xlsx. Now if I modify the name of my file from 'something.html' to 'something.csv', my code is allowing this. How to apply validation for this?
-1
votes
1answer
14 views

Using AccessCHK with pipe

Can anyone post an example of using accesschk with \pipe. I'm running process with -s param and getting a lot of files listed, but only folders are needed. Tried to run with *findstr /vi ".[a-z]$&...
0
votes
0answers
7 views

How can I setup secure websocket with nginx and geth ethereum client

I would like to access a the server sustainabilitychain.ch that runs an ethereum node using a geth client with secure websockets like so:: wscat -c wss://rpc.sustainabilitychain.ch:8546/ws/ but I get ...
0
votes
1answer
45 views

Run jar file with file in memory

I created an app that encrypts and decrypts a jar file. I would like that this application decrypt the file, and without having to write the file to disk, run the application. It is possible? I ...
-4
votes
0answers
31 views

Lambdas should be replaced with method references [closed]

I want to use a method reference instead of lamda expression for creating new instance e.g in return new org.springframework.security.core.userdetails.User( username, employee.getPassword(), ...
0
votes
0answers
16 views

How to securely store strings in a desktop Windows Forms app

I'm developing a Windows Forms app (C++) in order to collect data (and other functionalities) from machines which are installed in customers' warehouses. The app displays the information that is been ...
2
votes
1answer
29 views

Why are there two distinct AWS keys?

I always wondered: Why does AWS provide both an ACCESS_KEY_ID and a AWS_SECRET_KEY ? I could never see any usecase where we could use one key without the other, so why keeping them separate, as ...
0
votes
0answers
10 views

Microservice Architecture - Security Fined Grained Access Control per transactions

This question is more on the architecture side than programming. The example is as follows: Let's say john smith is part of the procurement role, who can initiate sales orders however john can only ...
0
votes
1answer
10 views

How to deny access to the registration page for authorized users? Symfony 5

I want to restrict access for authorized users to the registration page. But so far all that I have found on this topic is the ability to restrict access to some controller for unregistered users. $...
0
votes
0answers
8 views

How to associate an api token with a user account

So, I created a little note taking app which is secured by JWTs (The user logs in, receives a token which is then used to authenticate the user on every request to the api) In order to allow access to ...
-1
votes
0answers
20 views

Keycloak-JS client and confidential clients [closed]

The keycloak-js client no longer supports the ability to add a keycloak clientSecret, this means for Front End JS Apps, you can only use a Public keycloak client. Public keycloak clients do not allow ...
0
votes
0answers
25 views

How i can change implementation of method of dynamically loaded class in java im using frida

im using frida , and would like to know how to change the (implementation) of sayHi method if the banana class is loaded dynamically Class banan_dynamically_loaded { Public void sayHi() { ...
-1
votes
0answers
15 views

Denial of Service in react-svg-loader version 3.03 due to css-what?

React solution is showing one high vulnerability in npm-audit due to Denial of Service in react-svg-loader version 3.03 due to css-what. What is the possbile solution of the issue? Issue is as shown ...
-2
votes
0answers
17 views

How to implement passwordless signup/register in nodejs and graphql server? [closed]

Is it possible to implement passwordless register/signup without using auth0 or any other third party services, if it is possible then how can i implement it? Also is it safe and secure? My tech stack ...
0
votes
0answers
16 views

How to securely send the list of permissions and accesses to my web application?

I have a web application where I want to obtain in a dynamic way the permissions and accesses of the role-based application, the API has its respective validations but I would like to know what are ...
0
votes
1answer
27 views

How can a Callgraph detect malicious code?

In Wikipedia I found out, that a Call Graph can obvisiously detect malicious code. Could someone explain how this exactly works? In Wikipedia only the following is written: "Call graphs can also ...
1
vote
1answer
35 views

Is it safe to keep Credentials likes Username and password in swift file

In my iOS app i'm using a web service that have some username and password for accessing the endpoints. For now I've kept the username and password of the web service inside my swift file and when i ...
0
votes
0answers
17 views

How can i apply custom filter to specific urls?

I have a jwt filter. For the time being i have three end points: /profile, /signup, signin. The jwt filter checks for a token in the request's header and if something is wrong (no token, expired, ...
1
vote
0answers
12 views

Codeigniter 3.1.11 / Jquery (AJAX) doesnot pick up the value of csrf_cookie_name using $.cookie

I have read several threads here on stackoverflow and other articles through google. I tried everything suggested but CSRF things are not working for me when I hit an AJAX request via Jquery. ...
0
votes
0answers
9 views

Firewall logs query

I am a beginner in cybersecurity. I have a huge firewall log file(14GB). I have to find out which are all the source IP have sent maximum bytes (accumulated) to (destination IP) and tabulate the top ...
1
vote
1answer
46 views

Find decryption formula with already known encryption formula in block cipher operation mode context

I have this formula for encryption phase of a block cipher mode of operation using AES or DES encoder: So the question is how can find decryption formula for this. And what is the general workflow to ...
0
votes
0answers
10 views

How to get file hash of OfficeActivity schema in Azure Sentinel?

I have checked thoroughly for the answer for this question but haven't had much luck. It appears it isn't possible to get the file hash of any algorithm from OfficeActivity schema. Although, I am ...

1
2 3 4 5
1061