For research purposes, I’m conducting an ethical phishing attack in my institution. I have permission from the institution for the same. I’ve created the phishing site and the email content, and I’ll be recording who and how many users vis…
What is the difference between an IT security policy, an information security policy and a cyber security policy?
I am trying to exploit a Windows VM on a different subnet behind a dual home Linux VM where I already have a shell. To keep it simple, I have a meterpreter reverse_tcp shell on the Linux VM (192.168.47.144) and the Windows VM (192.168.128….
I’m currently testing a site where the host header is used for creating a recovery email link. However, when I try to manipulate the host header in Burp I get an HTTP 400 message saying I’m using an invalid hostname. I get this error even …
The Microsoft Security Response Center (MSRC) receives reports about potential vulnerabilities in our products and it’s the job of our engineering team to assess the severity, impact, and root cause of these issues. In practice, a significant proportio…
Which between the two encryption algorithms AES(Twofish(Serpent)) and Serpent(Twofish(AES)) is most secure and which hash algorithm to use between SHA-512, Whirlpool, SHA-256 , and Streebog?
To secure an OpenLDAP environment I’m investigating what the security best practices are with regards to authenticating users with passwords (e.g. no Kerberos or SSL Client Certificate authentication).
From what I understand, there are tw…
How can I hide metasploit APK after first launch? I know there is a command for it in meterpreter but I want it to hide itself when it is first launched. Before adding hide_app_icon command to meterpreter app used to be hidden automaticall…
From time to time, I perform a scan with clamscan. I’m on Archlinux. Clamscan database is updated before each scan.
Today clasmscan reported 19 infected files:
./.cache/mozilla/firefox/qyq0onej.default/cache2/entries/3BCF117A4E950F91D6EB…
I encountered a particularly weird situation where I have an SQL Injection vulnerability in the ORDER BY clause. The query is forged on backend and the injection payload is converted to upper case with the strtoupper() PHP function as can …
