I'm building small website where I allow ppl to upload avatars (1MB, jpg, png files)

I want to scan them for malware.

it is free project, not commercial as for now, so looking for free solution.

Small quota like 1 per minute is good enough. 100 daily mroe than enough also.

Files small, 1 MB avatars, so easy.

BUT! Since I'm uploading file first to public place I do not want to download and upload such file, but give link to the tool and that tool will return response. Ideally synchronously, if not, well. Important, response within few seconds.

I was looking at cloudmersive but it doesn't look like they have API to send them url to file so they will scan it there.

I was looking at virustotal - same thing I believe.

Both of those systems require me to upload file to them directly, I really want to skip that.

Do you have any other solutions?

Not a promotion, but the closest video that I could find to describe my challenge: https://www.onespan.com/resources/e-sign-documents-digital-certificates-onespan-sign ...

Users are on Windows 10 machines. They use a smart card to access internal resources. When they logon to an internal website using Chrome or Edge, they are prompted with their smart card credentials. I'm guessing this software that allows a website to authenticate with a smart card is part of Windows 10 already. Is there a way I can use this same software to allow a user to sign a file generated on a web server?

One of the internal web apps collects project files from multiple users. The users uploads the files individually kind of like Dropbox. Once all the files are submitted, the app packages the files into one. We'd like the project manager to digitally sign this package via the web app using their smartcard. Is there a way to do this using software that is already part of Windows 10 without them having to install another software?

We have a vps and i can use it using openvpn. On my laptop. But i have no idea how to do that on a mobile phone , i tried one approach by opening a hotspot from my laptop and connecting to it by my mobile phone, but my IP didn’t change.

Any other approach please ?

Is try hack me ,effective and good for beginners without any knowledge for cybersecurity or pentester? To learn ?.

In mutual TLS, the client verifies the server’s certificate and the server verifies the client’s certificate. I want to white list the client’s certificate in the server, and the server’s certificate in the client. This will be similar to SSH public key authentication.

However in TLS certificates are verified by certificate authorities (CAs). It looks like that browsers don’t support certificate pinning. In Firefox, there is a tab Authorities to provide a CA certificate, but the actual server’s certificate will be refused. There is a tab Your Certificates, but these seem to be client’s certificates. There is a tab Server, but nothing can be uploaded here. I want to pin the client’s leaf certificate file not the root or intermediate CA certificate.

Does anyoneknow if this could be done?

I don’t know how the browsers verify the certificates.

Hello everyone,

I'm currently working on a project to build an insider threat-based intrusion detection system, but I’m relatively new to network security and would love some input from professionals or those with experience in using SIEM software.

I'm looking for SIEM solutions that are:

1. Flexible and Versatile: I need a platform that offers enough customization to tailor rules or integrate custom algorithms for insider threat detection.
2. Quick to Build Upon: Since my project timeline is only 6 months, it would be great if the software has presets or templates that can accelerate development without compromising on depth.
3. Suitable for Insider Threat Focus: While I’m aware of general SIEM software, I’m particularly interested in platforms that handle user behavior analytics, anomaly detection, and insider threat detection well.

As I’m still learning, any advice or suggestions would be greatly appreciated! If there are any questions or additional information needed, please don’t hesitate to ask.

Thanks in advance!

I'm assuming CVSS scores as used, of course. Can you for example, ignore vulnerabilities used in microservices that are not exposed to the public and only used internally?

Any and all comments are very welcome.

On my personal computer, I have chrome set up with my personal and school account. Can my school see what's on my peronal account threw there or not?

Is it possible to easily automate the exporting of netflow data from Solarwinds so it cold be fed into the SIEM or another analysis tool?

Work with a network arch that is really difficult to get changes made.

Are Pentesting Distros just Distros with prebuilt tools in. Is Kali (aside from default root) just Debian/Ubuntu with a tool kit preinstalled. Black Arch can be either a stand alone install or can be an added repo to a standered Arch install. Is there something that Black Arch does fundamentally differently? Parrot has Home and Security, is it just tools or something running deeper?

I am sure this breaks some sort of T&Cs, but is it lawful to host red team exercise payloads on third-party services? While I am sure it is with good intentions and authorized by the client, I am trying to answer a client asking "Is this OK/lawful to do that?".

For example, we are performing a red team exercise and find the client allows Google Drive sharing, we host our payload on the platform and use it against it. It probably breaks Google's T&Cs, is it against the law here? Can Google theoretically take action against us for using their platform to host payloads?

Another one, like a waterhole attack, say the client use a public cloud-hosted Confluence server, we managed to get credentials from phishing/leaked creds, and then place a URL or even upload our payload on there to perform internal phishing. Is this against Confluence T&Cs, are we breaking the law?

Another one, what about using subdomain takeover? I could think of a million. What protections do we have as the vendor conducting the red team and is it lawful?

Hi, I've got a bit of a personal curiosity.

My university has a WPA2 Enterprise WiFi network available on campus. The authentication is done through university email as the login and a user set password. There are no certificates being handed out at all (that's what prompted me to try and make sense of the matter, as my phone simply won't connect to the network with no solution). Upon connecting, you're greeted with a simple HTTP hotspot login where you put in the same password with university SSO login as the login.

My question is, can all of that process be snooped on by a rogue AP? Can someone just put a network with an identical SSID and steal all of those credentials? Should I notify the IT department/start complaining about it?

im 17M, i am planning to do bug bounty in my college years just for fun and make a lil extra money. But for the job which is the best role for me? ive done some late night research and find out that bug bounty is kind of useful for application security as its almost the same work, just bug bounty is finding bugs and application security is to resolve the bugs and it might increase my knowledge in area of bug bounty which i always gonna do no matter how old i become. application security also requires burp suite which i will cover in bug bounty. But cloud security engineer has a better payout overall than application security and the job market in cloud is just better than appsec. my question is which job role is better for me? appsec or cloud? will my knowledge increase in bug bounty if i take cloud? or bug bounty is useless for cloud. also can i have some recommended certs for application security and cloud security engineer(azure).

Could I reach out in a personal capacity and donate to the people who found the vulnerability? I want to keep my job but also I don't think my org will pay attention to the disclosure. By the way, it's since been fixed.

This might be more of a forensics question, but I have a (unknown) process that’s periodically making HTTP POST requests to an IP.

How would I go about tracking that process down on Linux? I tried tcpdump and running netstat in continuous mode but it’s not doing anything

I have access to Linux, windows, and iOS apps to help find where this is. Thanks.

I was thinking of Starting An online 2 years Masters Program in Finance. But i changed to want to start in IT/ Cybersecurity, then eventually do Certs while working during or after my Master’s. I have no history in Tech/Cybersecurity? What do you guys think of my plan to break into Tech & Cybersecurity?

ZpsOmlRQV6y907TI0dKBHq9Md29nnaEIPlkf84rnaERnq6zvWvPUqr2ft8M1aS28oN72PdrCzSjY4U6VaAw1EQ==

Recently, I checked out the perks of having a DeviantArt Core membership, and one of the advertised perks was two-factor-authentication.
I bought a subscription to Core Pro but did not get access to the feature; when I inquired to DeviantArt about the matter, they essentially told me that accounts created using GMail don't get access to the factor, but justified it with "since you used a social login, that is considered your 2FA for you".

Now, most times when you use Google's GMail sign-in pane, you are usually automatically logged in if you have unexpired cookies for being logged-in.

The question at play here is:
  is signing in *only* through the use of the GMail sign-in pane considered SFA or 2FA?

Is there a little bit too much information given away in this promotional video for a firewall company?

Seattle Kraken Brings on WatchGuard (youtube.com)

Hi,

so I'm currently staying at a hotel in Greece, they have some, let's say interesting services they provide to customers via various QR codes spread around the place.

Long story short, I found an API-endpoint leaking a ton of information about hotel guests, including names, phone numbers, nationalities, arrival and departure dates and so on.

Question is, what do I do with this information? Am I safe to report this to the hotel directly? Should I report to some third party? I don't want to get in trouble for "hacking"...

Edit: Some info

The data is accessible via a REST-API, accessible from the internet, not only their internal network. You GET /api/guests/ROOMNO and get back a json object with the aforementioned data.

No user authentication is required apart from a static, non-standard authentication header which can be grabbed from their website.

The hotel seems not to be part of a chain, but it's not a mom-and-pop operated shop either, several hundred guests.

Good morning fellow security friends!

I'm in a bit of a pickle here. I'm working with a dev team on enhancing security of their application while maintaining ease of use.

So the people that use this application may have never used a computer for anything in their entire life. That's the first problem. So these people don't seem to be capable of creating a single good password.

Product team isn't really interested in increasing pasword requirements in addition to adding MFA for fear of customers running for the hills.

So... I'm considering passwordless options that are secure and easy to use for the most computer illiterate users that probably have a cellphone.

Any good tools or solutions out there that anyone here has any experience with?

I was debating this with a friend. Is Browser Exploitation Framework https://github.com/beefproject/beef aka beef still used for xss exploitation in pentesting in 2024?

So I'm new to this, but a Coworker of mine (salesman) has setup a wireless router in his office so he can use that connection on his phone rather than the locked company wifi (that he is not allowed to access)

Every office has 2 ethernet drops one for PC and one for network printers he is using his printer connection for the router and has his network printer disconnected.

So being the nice salesman that he is I've found that he's shared his wifi connection with customers and other employees.

So that being said, what would be the best course of action outside of informing my immediate supervisor.

Since this is an illegal (unauthorized )connection would sniffing their traffic be out of line? I am most certain at the worst (other than exposing our network to unknown traffic) they are probably just looking at pr0n; at best they are just saving the data on their phone plans checking personal emails, playing games.

Edit: Unauthorized not illegal ESL

The place I work for are looking to integrate an externally-hosted SaaS application, where users authenticate thru SSO with SAML, and Microsoft Authenticator for 2FA. However the matter of a local account for break glass is raised

Given that break-glass accounts typically are excluded from MFA requirements for quick access during emergency circumstances, what are some best practices to manage such local account? (one suggestion raised was to use the company's current PAM solution)

Hi everyone,

I previously made this post regarding the Office 365 Business Premium 5-PC license. I'm seeking some clarification from a security perspective:

1. Device Management and Security: Since the license allows installations on 5 different PCs, are there any risks or vulnerabilities associated with sharing the license across multiple devices, especially in business environments?
2. Security Protocols: What additional security measures would you recommend when managing Office 365 installations across multiple PCs under one license, particularly with regard to user access and data protection?

Any insights or recommendations would be greatly appreciated. Thanks!

I just set up my qidi 3d printer and had to install the Qidi (prusa)slicer. Im wondering if any one has scanned the software or has found any imbedded surveillance hardware?

Hi all,

I'm currently preparing for the SecOps Certified AppSec Practitioner (SCAP) certification, and I was wondering if anyone here has taken it and can share some advice or resources to help me out.

I have a background in cybersecurity (CompTIA Security+, ISC2 CC, and some hands-on projects with tools like Burp Suite, Wazuh, Suricata, and Splunk), but I’m fairly new to the application security side of things. I’m hoping to get insights on a few points:

1. What are the core topics I should focus on for SCAP?
2. What hands-on labs or projects can I work on to reinforce my learning?
3. Are there any good free/affordable resources (videos, articles, or labs) that helped you with preparation?

4.Any tips on tackling the exam or key areas I should not overlook?

I want to ensure I’m covering all the important aspects and would really appreciate any tips or guidance from those who've passed the SCAP or are familiar with it.

Thanks in advance!

Got an email just now with my name, an address, a phone number and a social security number. There’s also a pdf attachment. The only correct info is that can be publicly found for anyone.

Pretty sure it’s a phishing attempt, trying to get me to open the attachment. Is there a safe way to open the attachment? Or should I forgot about it and delete it.

What I have understood (I guess):

1. Cross-origin Cookies:
   Cookies set with Domain="example.com" are not sent with fetch requests from origins like hello.example2.com to mywebsite.example.com because they are different domains. However, I am aware there might be a malicious workaround for this via <form>(point 3).

2. Fetch Requests and SameSite Behavior:
   With SameSite="Strict", cookies set with Domain="example.com" are included in fetch requests from subdomains like frontend.example.com, but not from unrelated domains like hello.test.example.com. With SameSite="None", cookies should be sent even from different subdomains if they belong to the same domain.

3. Form Submissions and Cookies:
   Form submissions from different domains, like hello.example2.com, include cookies when SameSite="None", but not when SameSite="Strict". HTML forms bypass CORS restrictions since they directly open the target URL.

Questions:

1. How do companies like Google and Amazon manage to track users across multiple external domains?
   Given that EVEN if Google set their cookies with SameSite=None, the requests made by fetch from a website.com (which uses google adsense and has a google.com/trackme url) cannot include the Google cookie since it's another domain, how do these companies effectively use cookies to track users across various external domains and websites?

2. Why does setting domain: "frontend.example.com" cause the cookie not to be set properly?
   When I put in my backend the setting domain: "frontend.example.com" for a cookie to be used specifically by the frontend website, the cookie is not set in frontend as expected and the frontend stops working. How can I ensure that frontend.example.com can use the cookie while preventing test3.example.com from accessing it? What should I configure to achieve this?