Category "security"

Handling the token expiration in fastapi

I'm new with fastapi security and I'm trying to implement the authentication thing and then use scopes. The problem is that I'm setting an expiration time for t

Safe regex patterns from ReDos attack

I've recently faced with some redos attack issues. Explain in simple steps: Regex denial of services: it means the attacker can put some malicious/crafted input

Allow non-root user of container to execute binaries that need capabilities

I need to run a container as non-root user by default. However a specific process inside this container needs to execute a binary that needs cap_net_admin capab

Best practice: Generate email link to bypass authentication

I've got standard oAuth model for authenticating users via email/password combination. I would like to implement my own mechanism to generate one-time token, st

TFS 2018 - Set permissions for single dashboard

In TFS 2018 on-premises server, is it possible to set permissions for a single dashboard, separately from the other dashboards in that project? I have multiple

Asp.Net Client Certificate Authentication - Issue with website re-prompting for client PIN

I have an ASP.NET 5 web application that is setup to use client certificate authentication, specifically a DoD CAC. I followed Microsoft's guidance (here) to se

OAuth 2 can i use Post Form Response and PCKE at the same time?

I am trying to secure an SPA, now there is recommendations to use PCKE which is fine, there is also a lot of articles which suggest use post form response, howe

UEFI secure boot, how (or will) the PCIE device (firmware) are checked?

Recently I'm searching for info about if PCIe devices are involved in the uefi secure boot, and if so, how it is done. From the uefi specification, the main boo

Openvas Setup Won't connect to dl.greenbone.net

I'm a beginner here, I'm using a raspberry pi-4 running raspian OS. I'm trying to run sudo openvas-setup but it just fails to connect to dl.greenbone.net over a

Obscurify react code in production by automatically changing all the function and variable names

Are there any libs that help obscurify a react build for production? Something like: const MyComp = () = > { const {propa, propb} = useMyfunc() return(...)

OAuth clarification

I've followed a training in Go as an introduction to microservices architecture a while ago. Getting back to this project I realise that I need more context as

What is the point of X-CSRF-TOKEN or X-XSRF-TOKEN, why not just use a strict same site cookie?

Frameworks such as laravel and others require you place the csrf token in your HTML forms. However at the same time laravel comes by default with the VerifyCsrf

How to resolve External Control of File Name or Path (CWE ID 73)

I am working on fixing Veracode issues in my application. Veracode has highlighted the flaw "External Control of File Name or Path (CWE ID 73) " in below code.

How to protect PDF files from being downloaded or copied

I'm developing a new website with PHP & MySQL. The website is for an online eBook library that grant access to its books based on paid subscription plans.

How to bypass SSL Pinning of an Android App

I want to bypass the SSL pinning of an Android app using the Frida Server method. I have followed the whole process described in this (https://blog.it-securityg

JMeter performance plugin having XXE vulnerability. Any other alternatives?

JMeter performance plugin is listed with vulnerability: https://plugins.jenkins.io/performance/ So currently its not safe to use this plugin(https://www.jenkins

How to scan particular URL or page alone in owasp zap

I have installed OWASP ZAP 2.8.0 and scan our site fully. In result we got some SQL injection URL's or pages. So We have fixed that SQL injection issues in deve

How was a standard windows 7 user able to delete files under C:\Program Files?

In c++, the DeleteFile() function shouldn't allow standard users to delete files under C:\Program Files, but someone running the program was able to do this! H

Cypress Using security certificate in automation with cypress

With cypress I need to automate an application that currently uses a security certificate, I've never automated it this way. When I go to run cypress calling th

I see some big company using firefox version 45.x.x to connect to their vpn, is there any concern of doing this? [closed]

why not just use usual vpn tools? like outline or openvpn or any else, is there any security concern? and of course that's an old version of f