I’m creating this admin dashboard, and I have a question wich I have been stuck on for a while now.
And I’m starting to question what kind of data the admin should be able edit/view on the other registered users.
Should the admin users be …
I use these commands to create a self-signed certificate, subject’s key and CSR, and subject’s signed certificate:
Root CA:
openssl req -new -sha256 -x509 -days 7300 -out ca.crt -keyout ca.key.pem -nodes
Server CSR:
openssl req -new -sha2…
I am trying to make a rule to alert when downloading a .jpg file less than certain size. I used the parameter dsize:<500.
But it is not alerting when I tried to run a .pcap file containing a jpg less than 500MB.
Did I use the parameter …
I am aware of other questions asking similar things as this one, but I believe this design addresses many of the issues raised in those questions. I’m also not concerned with making sure there’s no database to store, only that the database…
A friend of mine, let’s call her Alice, had an Instagram account that was hacked. She uses an iPhone. The scenario looks like this:
Alice gets a link from a Business Account via WhatsApp, and clicks it
The page was simulating the Instagra…
When I read Multi VERB Single Request:
This Attack is also a variation of the Excessive Verb Attack
strategy. The attacking BOT creates multiple HTTP requests, not by issuing them one after
another during a single HTTP session, but by for…
We are using Jenkins Freestyle Project to push the changes on the remote server. We are executing shell script on remote host using ssh for it. To pull the changes on the remote server, we are using origin url with git username and git pas…
I’m working with a client that, in order to use their OAuth 2.0 web API, requires me to provide them with a JSON Web Key (JWK) that contains an embedded X.509 certificate. Then, when I’m requesting information from the API, they say I nee…
I’m reading this blog and it says:
If the /proc/self/environ file can be accessed through LFI, then in this case “RCE” can be achieved by requesting the file in combination with the payload written into the HTTP User-Agent field.
Then, i…
We are writing a pure javascript front-end (in angular) for an API that still uses OAuth 1 for legacy reasons. Being pure javascript means the consumer secret is part of the code that gets downloaded at the start, before authentication, an…
