I have come across a CTF challenge that has a part with an SQL injection (MySQL DB). I have completed it, but I do not know why or how the injection works.
The query in the PHP application would probably be like this:
SELECT * FROM users…
I have the following command:
patator ssh_login host=<ip> port=<port> user=<user> password=FILE0 0=<path to pwdlist>
I would like to output the success result only and not output every attempt. Is this possible…
I have a REST API that is used by 2 separate application and is authenticating them by M2M OAuth2 Client Credential Flow.
One of the two application is an automation service without user context. The second one is a REST API where users…
I am building web applications for my customer’s company. At the server side, there will be 2 kinds of server to server network communication.
Separated REST API servers making requests among each other.
Communication from application lo…
When making a SASL/GSSAPI bind to an LDAP server over port 389 (ldap:///), after the authentication is finished is the resulting LDAP traffic encrypted? If so, is there a document or RFC that describes this?
Assume that no STARTLS comman…
Lots of articles on the net describes how you can join a Linux box to a Windows Active Directory domain, some using “realmd”, some using samba and so forth. Others describe how you can do things manually without using realm join or net ads…
What is the difference between a certificate and a private key?
In answering another question on this site, I wanted to point to a canonical answer to this question, but to my surprise I don’t see one.
Users can be forgiven for getting t…
I have a desktop application written in Python. The application is connects with an external SAP HANA service and pulls data. There are couple of configuration files where several connection string are stored unencrypted as of now.
I want…
I have to maintain a java application with security code I am not sure is really useful and the original purpose is not clear (and the original developer is long gone).
Basically, the code will check some security parameters before allowi…
I know that it’s possible to do a passive scan on all channels to see if an access point sends a beacon. However, is it also possible to listen to general Wifi traffic on that channel and assemble a list of all active devices – both “clien…
