If you really want to get all traffic of all apps and services you need a VPN solution with traffic interception similar the way Mitmproxy works on PC. As you have root you could https://android.stackexchange.com/a/232051/2241 (see second half of the linked answer) and then decrypt all outgoing TLS traffic, get the URL check if it white-listed and continue or abort the request. Unfortunately I don't know an app that works like Mitmproxy without saving all the data. Most apps that do traffic interception do this for capturing the data like https://play.google.com/store/apps/details?id=app.greyshirts.sslcapture or https://play.google.com/store/apps/details?id=com.egorovandreyrm.pcapremote . But the latter is partly open source so this could be a starting point, assuming you have the necessary development skills. Even after installation of your root CA certificate some apps won't work anymore as they use certificate pinning. So you have to test if the apps you want to white-list URLs from are affected. If you would be content with a filtering on domain level you could simply use an app like https://blokada.org/ . For domain filtering you don't need traffic interception, hence you could skip the custom root CA installation and so on.

There are lots of reasons for this: a misconfigured client that is sending traffic to your site meant for something else a mapping technique to try to find 'hidden' or non-obvious resources on your site sending known exploit strings to your server to see if your server has a vulnerability

utm_ is not a start since that's too common to use as a differentiator. And you have not provided nearly enough detail to determine which tool might have been used to create the emails. The simplest method is to search the Subject field for "LinkedIn" and compare it to the sender domain. If the subject mentions "LinkedIn" and the sender is not LinkedIn, then block. Same for Reddit and shipping companies. But frankly, it sounds like you need to get a commercial email security tool. There are lots of factors to consider, and you will end up trying to reinvent the wheel if you do it on your own. I don't normally suggest that people should just buy their way to a solution, but having designed my own email security filters, and having procured commercial solutions, this is one area where you will end up saving a ton of time, avoiding headaches, and ultimately getting a better outcome if you go commercial.

The reason it looks off is that it's a tracking link (as indicated by /track). This is not entirely uncommon. You can sometimes see it in marketing emails, where every link is automatically rewritten to point to some tracking server (which tracks the opening of the link and then redirects to the real target). Just based on these being tracking links, we can't answer if it's safe to click on or not. In addition to any other link you receive via email - which could be safe or unsafe - there are a couple additional things to consider: your click will be tracked. Tracked info will likely include: when you clicked the link, which link you clicked, the email the link was in, your PII (from the looks of it at least your email address), probably your IP, etc. the target of the link is obfuscated. So you can't hover over it to see the target domain to decide if you want to click on it or not. So you should take the usual precautions when clicking on an unknown link from a semi-trusted (I assume) source: if you are worried about drive-by-download issue (malware, browser exploits etc), don't click the link. Or at least use a dedicated VM or similar. if you are worried about downloaded files (viruses, etc), don't download anything (esp. no malicious files; executables, doc/docm and other macro formats, etc). Or at least use a dedicated VM or similar. if you are worried about client-side attacks (XSS, CORS, CSRF, etc), open the links in a dedicated browser profile to separate them from your authenticated sessions on relevant websites. if you are worried about phishing, don't enter any personal information on the linked sites.

If you have a cryptographically secure random number generator, that usually gives you a 128-bit sequence at very low cost. The question becomes, why use a shorter sequence? That only makes sense if you type the code manually. A clicked code could be any length allowed by the server (some softwares enforce a limit on GET size). And, in that case - if you need to accommodate URL-typers - you might be better served by those libraries that transform a bit sequence into words (also called CHBS from https://xkcd.com/936/ ). For example there are, if I remember correctly, 2048 four-letter words in the English language; which means that using a 8K string, you can transform 12 bits at a time into an English word, thus 128 bits into 11 words (or 120 into 10). "jane-full-date-mite-rote-fake-toll-mark-pony-gaze-risk" is only marginally longer than a hex sequence (12 bits per quadruple against 16, so 10-11 quadruples instead of 8), but it's easier to read out and type for most people. As for the validity period, the only realistic scenario is that someone will find the link and test it later: because if you believe that one day more is going to compromise security, that means that your code can be bruteforced in a matter of days. Which you should avoid by forcing link verification attempts to be, say, at least thirty seconds apart. If someone is clicking a link, the code will be correct. If they're typing it, it will take more than thirty seconds. Fast incorrect codes can only mean automated bruteforcing (or network gremlins). So, up to a week might be okay. And of course an already-activated link should become harmless and useless for authentication (it should give you an ambiguous "expired or countermanded" message, without specifying whether activation succeeded or not - that if you're really mean on privacy matters). There may be other tunables to your scenario (for example... how likely it is that someone might want to jam someone else's verification by flooding your server with intentionally incorrect attempts for their code? If that's the case you might want to add some bits as anti-jamming: attempts with those bits wrong will be rejected out of hand and not counted in the anti-bruteforcing backoff time).

As long as the bad randomness could be exploited in any meaningful way by any attacker, you should use a cryptographically secure source. This is obviously true for user activation tokens, since it could allow an attacker to bypass other security measures (like email verification).

Unless a site is on the HSTS preload list, browsers usually default to http instead of https when no protocol is provided by the user. So when a user types reddit.com in the url bar, the browser navigates to http://reddit.com. Reddit will then tell the browser to redirect to https://reddit.com. This is done because some sites do not support https and the browser has no way of knowing before hand whether any particular site supports https or not. Of course, this means the initial request is not encrypted and visible to anybody sniffing your traffic. However, given the increasing prevalence of TLS, this behavior is changing. Starting from v90, https://blog.chromium.org/2021/03/a-safer-default-for-navigation-https.html and will fall back to http only if the https connection is unsuccessful.

This is a https://support.google.com/mail/thread/16878288/gmail-is-opening-and-caching-urls-within-emails-without-user-intervention-how-and-why?hl=en in gmail, and https://who.is/whois-ip/ip-address/94.101.43.5 seems to be associated with Google. Google probably does this to check URLs for scammyness and malware, so they can provide more reliable spam and phishing filtering to their users. There's no way to have your e-mail hosted with Google and at the same time avoid Google reading your e-mails. It's also worth remembering that encryption for SMTP ( https://en.wikipedia.org/wiki/Opportunistic_TLS ) only encrypts the content in transit between e-mail servers. It does not hide the content while stored in queues on the mail server.

They are just too many domains to register. The domain name steamcommunity has 14 characters. Users could: Leave out one letter (+14 domains) Miss a key and type the letter left or right from it instead (+28 domains) Miss a key half-way and hit the key next to it as well (hsappens to mre all the timew). This can be the left one or the right one, and either the intended or the additional character can be first, so +56 domains Switch the order of two letters, for which there are 12 possibilities in this case. Intentional replacement of similar characters as frequently done by phishers, like in the example. Replace o with 0 or rn with m or adding a -. There are 5 places where one could do that in the above domain name, and they would need to cover all possible combinations. So 2 to the power of 5 minus 1 = 31 additional domains. And I haven't even talked about punycode yet. So we got not one but 142 domains to manage now. Oh, and of course we don't just need the .com. We also need all the other top level domains. We need all the country-codes, the generic TLDs .com, .net, .org, and I heard they added a couple new TLDs in the past years. How many are there now? Can't be that many, right? https://en.wikipedia.org/wiki/List_of_Internet_top-level_domains ONE THOUSAND FIVE HUNDRED AND TWO?!? Please, IANA, you guys got to learn how to say "No". And domains are not entirely self-managing. Making sure all those domains work, are paid for, are securely configured and have up-to-date certificates is a job which takes several person-hours each year. And for some of these domains there might be a legitimate use-case of someone else. Perhaps I want to create a community for scientists and enthusiasts in the STEM field called stemcommunity.com? Too bad, I can't have it, because Valve wants it (actually, https://www.hugedomains.com/domain_profile.cfm?d=stemcommunity&e=com ). That means Valve would need to constantly negotiate for domains which are similar enough to theirs. Another money-sink and time-sink, and time is money. So bottom line, it's simply not practical. Especially considering that most users no longer type in domain names completely. They just enter the approximate name of the website into their browser address bar, and let their default search engine add the rest. So the most efficient measure against typosquatting is something any decent tech company is going to do anyway: Good search engine optimization.

Most of the link shortening providers also offer a possibility to preview the URL a short link will redirect to. Most times, it is sufficient to modify a little detail of the short link: Bitly Add a + sign to the short link ( https://support.bitly.com/hc/en-us/articles/230650447-Can-I-preview-a-link-before-clicking-on-it- https://bit.ly/3kwQV20 -> https://bit.ly/3kwQV20+ Cuttly Add a @ symbol to the short link: https://cutt.ly/YEh65VC -> https://cutt.ly/YEh65VC@ is.gd Add a - (hyphen) sign to the short link: https://is.gd/vzC7mi -> https://is.gd/vzC7mi- TinyURL Add a + sign to the short link: https://tinyurl.com/3yw559cj -> https://tinyurl.com/3yw559cj+ Or add preview as a subdomain to the short link: https://tinyurl.com/3yw559cj -> https://preview.tinyurl.com/3yw559cj If the link shortening provider does not offer a way to preview the URL, you can also use the following tools to get the URL to which a short link will redirect to. They all have in common that they will only download the headers of the short link and will not follow the URL the short link points to. Be aware that your access may be logged by the link shortening provider and it also may be added to the statistics of the short link usage. curl https://curl.se/ does not follow redirects by default. The option -I tells it to only download the headers: curl -sI https://bit.ly/3kwQV20 | grep -i Location Output: location: https://security.stackexchange.com/q/255448/230952 wget Alternative with https://www.gnu.org/software/wget/ : wget -S --spider --max-redirect=0 https://bit.ly/3kwQV20 2>&1 | grep -i Location wget will follow redirections by default, so you have to limit it by --max-redirect=0. Furthermore, it will write to the error stream, so you have to redirect that to be able to grep it. The output will be: Location: https://security.stackexchange.com/q/255448/230952 If the target looks like another redirection, then you can re-run the command, changing --max-redirect=0 to --max-redirect=1. This makes wget stop before the second redirect, etc. PowerShell Alternative with https://docs.microsoft.com/en-us/powershell/module/microsoft.powershell.utility/invoke-webrequest : (Invoke-WebRequest -Uri https://bit.ly/3kwQV20 -Method Head -MaximumRedirection 0 -ErrorAction SilentlyContinue).Headers.Location Or more abbreviated: (iwr https://bit.ly/3kwQV20 -Me H -Ma 0 -EA Si).Headers.Location Output: https://security.stackexchange.com/q/255448/230952 URL Checkers If you don't have access to the above tools, you can also use online services to do it for you. Be aware that you probably don't know how exactly they work. So they might even access the target URL, which might be undesirable in some threat models. Example websites: https://getlinkinfo.com/ https://unshorten.it/ https://unshorten.me/ http://urlxray.com/

There is nothing here to suggest a compromise of anything. If he operated the servers you connected to, then he would know the browser you used and the audio hardware you used (because the browser announces itself and the available hardware). The captchas are likely to get more audio information (because of the audio option for most captchas) So, there is nothing in what you have explained that suggests he knows anything more than what you broadcast to any site. There is no reason to assume anything more than that from what you have said. The links could have exploited a vulnerability in your browser, and therefore know everything about you, but we can't assess that. If you are running a fully-updated browser, the chance is very low. And since all he talked about was what was already public, we can assume that he doesn't have any further info.

First, your calculations are way off. 6217 is about 1030. at a rate of 10 million attempts per second Here is another problem. You cannot throw 10 million requests per second at Google without being blocked even before the first second ends. Google will surely find the behavior strange and throw in a Captcha for you. And good luck solving 10 million Captcha challenges per second. And even if you could achieve that rate, you would need 2.2*1017 years to guess them all. To do that in 3 years you would need to ramp up the rate to a little bellow 1024 requests per second. I hope you have unlimited bandwidth and free electricity.

To open the picture, you need to download it first and then show it.A library can be used to download the image. urllibto show the image of the library 'PIL'.Function print You wouldn't have helped because it's used to get text information into the console, not to paint images.This is a simple example:from PIL import Image from urllib.request import urlopen url = "http://risovach.ru/upload/2014/02/mem/muzhik-bleat_43233947_orig_.jpg" image = Image.open(urlopen(url)) image.show()

from kivy.app import App from kivy.uix.image import AsyncImage from kivy.lang import Builder Builder.load_string(''' <CenteredAsyncImage>: size: self.texture_size size_hint: None, None pos_hint: {'center_x': 0.5, 'center_y': 0.5} ''') class CenteredAsyncImage(AsyncImage): pass class TestAsyncApp(App): def build(self): return CenteredAsyncImage( source='URL') if __name__ == '__main__': TestAsyncApp().run() And using Kivy only to remove the image, it's like to hit the nails with microscopes! You would have tried the OpenCV. ♪ ♪

Try doing that in the file.RewriteEngine On # если после расширения .php идет слэш и потом может встретиться подстрока .png RewriteCond %{REQUEST_URI} \.php/.*\.png [NC] # то вернем стандартую 404 ошибку сервера RewriteRule ^ - [R=404,L] Better.RewriteEngine On # если после расширения .php идет слэш, а такого не должно быть RewriteCond %{REQUEST_URI} \.php/ [NC] # то вернем стандартую 404 ошибку сервера RewriteRule ^ - [R=404,L]

Depends on the menu and customers. We can use it. http://htmlbook.ru/samhtml/yakorya and if there's any way to rent all the menu points on the content server, then the client scruples won't even be necessary and enough to cross the menu with the menu. display: fixedand the content of the vehicle will be covered to the anchor link. Full handling involves an analysis of the facility window.location AJAX.

1 print_r($_SERVER['HTTP_HOST']);2 create a profile folder, in it index.php with profile contents.php

If all the pages except the front page is 404, it's about htaccess-- look for what it is. Maybe the name's wrong, maybe the apache is wrong. Either you turn off the friendly urns in the first place - it's gonna be enough for a local test and it's gonna work around htaccess.

Try this:RewriteEngine On RewriteCond %{QUERY_STRING} \bstart=[^&]+ RewriteRule ^$ /? [R=301,L] Regular ^$ to respond only to queries of type site.com/?start=16that's the site that goes to the root.

No, use "-" in the name of the function(s) or the properties of the class - No.!The function/method/ownership of the object/replaceable may begin with the letter/emphasis [A-Za-z_\x7f-\xff] and may contain figures [0-9]♪UPD: as correctly noted in the commentaries: the name may also contain the Bates of 127 to 255, but may be used. I don't think so.We can try to circumvent the restriction (for properties, not for methods):class test { function __construct() { $this->{'have-dash'} = ''; } } $test = new test(); $test->{'have-dash'} = ':D'; IMHO, It's all stupid at least.He and I have a big debate about the use of defis.In the url, you can use php, you can't use the names of the folders, etc. - undesirable. ^1: provided that this is necessary (for CPU, for example) and is then converted into the right type(i.e. not used as for the names in php). UPD: UPU meant: There's still a lot of disputes about SEO and url with defis or signature. ♪ ♪Spread two people and help us find a proper solution to this problem. More grateful. Use "_"That's what he thinks. rule of good tone(in js, for example, camelCase).PS. I'd rather use a smart rolling, and then it's gonna fall off.