Is it possible to trigger an antivirus program to alarm by playing a video? I don’t want to run malware, I only want the AV to do something. Can I put EICAR in the metadata?
The video file shoudn’t be corrupted.
If I’m using subresource integrity on a web page and a script that I import then itself imports a further script, will the CSP ‘require-sri-for’ also include those subsequent, nested, imported scripts?
For example, if a .js file is pulled…
I was reading a paper about ‘HTTP verb tampering’ here:
https://blog.jeremiahgrossman.com/2008/06/what-you-need-to-know-about-http-verb.html
The author said:
HTTP verb tampering is generally used in conjunction with syntactic
(XSS, SQLi,…
As an example, the US no-fly list is commonly referred to as a security theater given that it is easy to work around. However blurring license plates when posting a picture online is not considered a security theater, even though license p…
I am doing a bunch of test/data scraping projects across a few different platforms that consume read-only and not really important API keys. I can only foresee minimal damage if they were to get out.
With that said, I cant see any glarin…
I have seen that most OTPs are 6 digits in length. That means at most 1000000 OTPs can be generated by a system. But what if at a certain point of time more than 1,000,000 OTPs are required?
I know that one OTP should be generated only onc…
JWTs typically include an audience claim. I’ve read in many places (articles, code examples, the spec itself) that you must check that the token is intended for you and not another audience.
I’m happy enough to accept that. I’m not plann…
I use google drive’s OAuth Credentials (client_secrets, credentials, settings.yaml etc), to enable access of my google drive account to my python scripts. I only upload files to my google drive account. But I was wondering what else could …
I found an open port on a “Kartina Quattro” (https://www.kartina.tv/article/247-kartina-quattro). It’s a device for watching russian TV channels.
The port number is 31337 and the Service is called Elite.
After some research I found out …
In early 2019, FireEye Threat Intelligence identified a spear
phishing email targeting government entities in Ukraine. The spear
phishing email included a malicious LNK file with PowerShell script to
download the second-stage payload from the com…
