If your microservice architecture responds with error codes revealing which microservice had an error, doesn’t this reveal to the caller information on how your microservice architecture is designed?
Caller -> Service A -> Service B …
During an engagement, I found a potential XSS vulnerability on a page. There is an HTML form that is submitted to this page (POST method) and sent parameters are reflected (without encoding) in the response.
If I use a proxy tool (e.g. Bur…
I set up Thunderbird to use PGP a while ago, so I can sign and decrypt messages now. But I have forgotten my private passphrase for my private key, but since Thunderbird can do it anyway, it has it stored somewhere. How can I get it?
I a…
I am studying spanning tree protocol attacks and I would like to understand a thing. The root is on the "top" of the tree, how can we exploit this to put in place an attack? We can, in some way, become the root, but what privileg…
How much video uploading could be trackable for some person who uses the Tor Browser for uploading video on YouTube or other video hosting services with low authorization and sign-up processing, like Vimeo?
And which group (hackers or …) h…
If you decrypt ciphertext to the terminal like this:
gpg –output – –armor –encrypt –recipient 23642351 message.txt.pgp
..does it touch the hard drive / ssd or only live in RAM?
What about when Thunderbird decrypts a message – does the…
Is it conceptually possible to allow in the server a specific self signed client certificate for mutual TLS?
If possible but not recommended. Why?
I have a client to who I have to provide a server that does mutual TLS auth. But they say th…
While reading about authentication protocols, I saw on Wikipedia on Burrows-Abadi-Needham logic:
In some cases a protocol was reasoned as secure by the BAN analysis
but were in fact insecure.[3] This has led to the abandonment of
BAN-fami…
I (mostly) understand how a scammer can send an email from a spoofed account, all you need is an unsecured SMTP server.
But how is it possible, for a scammer to RESPOND and maintain an email conversation with the victim from the spoofed ad…
Type: Threat AnalysisLV RansomwareLearn how Secureworks CTU researchers investigated reports that the LV ransomware had the same code structure as REvil.
