High-level dynamic language developed by Guido van Rossum, particularly popular for server-side web programming and scripting.

learn more… | top users | synonyms

0
votes
2answers
62 views

Website doesn't provide cookie (csrf token) when connecting over proxy. Why/how?

The Python code below should grab a "csrf token" cookie from Instagram.com, but I get an error message when running the program through any sort of https or socks5 proxy, informing me that the "csrf" ...
1
vote
1answer
39 views

Functions in common server-side languages which are used to execute code [closed]

I want to know the list of functions which are used to evaluate strings to code. For example: in PHP we have the eval function which evaluates a string to PHP code. Input passed into eval without ...
1
vote
1answer
99 views

How to handle password storage for my project?

We have NFC cards to keep track of presence, students scan their card to a terminal at the beginning of every lesson, we want to extend the cards usage to filter out who can access the Raspberry Pi's ...
0
votes
0answers
7 views

AES 128 CBC in Python, cannot generate same cipher text by decrypting and encrypting again [migrated]

I am reading binary data from a .db file. It consists of a master-key, IV and some values. The first encrypted value is (say enc_val) with hex of 0abd4e92a8986ee1ae234e51f0783c79 After decrypting ...
4
votes
0answers
21 views

How to reuse same .onion address with Tor ephemeral hidden services (python)? [migrated]

I'm establishing an ephemeral hidden service via Tor, but I wish to reuse the same .onion address. I know to do this I must presist the same private-key every time I run the hidden service, but how do ...
0
votes
0answers
21 views

idevicerestore installation trouble

Can anyone help me figure out what im doing wrong to install this software? ``` root@kali:~/libimobiledevice# sudo apt-get install libusbmuxd-dev libplist-dev libplist++ Reading package lists... Done ...
3
votes
1answer
65 views

What are some vulnerabilities of environment variables (on any platform)?

I am writing a small cross platform Python application (a package manager to be used internally by my corp), and I'm thinking of using something similar to this answer on Stack Overflow to check for ...
1
vote
3answers
60 views

Safe way to store credentials for an application

I want to use an API for one of the projects on which I am working. What's the good practice/way to store the credentials required for the API? For example, I don't want to later push the project into ...
0
votes
1answer
54 views

Verifying that a request is internal

I've got a web app that will only output safe code. It needs to pass this to a Python backend. The logical way to pass things between JavaScript and Python is to have a Flask server running. Then, the ...
1
vote
0answers
98 views

MQTT (Mosquitto) certificate SSL23_GET_CLIENT_HELLO:unknown protocol [closed]

I'm been desperately trying to get my MQTT clients to connect to my MQTT broker which is set up with a certificate from a CA. To be able to get the CA certificate, I've used the letsencrypt python ...
0
votes
0answers
33 views

What is a straightforward way to brute force CLI applications?

This is a question to maybe more CTF-experienced guys among you. I wonder how you generally brute force a simple CLI application. For example if you have an application which tells you a user's data ...
-1
votes
1answer
31 views

How can someone execute arbitrary code on Python's built in server module? [closed]

I'm not sure if this question could be consider inappropriate here. $ python -m http.server The source code tells: # https://hg.python.org/cpython/file/3.5/Lib/http/server.py#l21 SECURITY ...
1
vote
1answer
53 views

Protect against client-initiated renegotiation DoS in OpenSSL/Python

According to https://blog.qualys.com/ssllabs/2011/10/31/tls-renegotiation-and-denial-of-service-attacks, servers supporting SSL/TLS connections and allowing client-initiated renegotiations are ...
3
votes
1answer
57 views

OS fingerprinting [closed]

I have been asked to write a small tool that detects the running OS on a victim device. The tool should be able to fingerprint Linux versus Android versus iOS. Extra credit for version info. It needs ...
3
votes
1answer
42 views

Are there any risks to matching user-supplied regex against user-supplied inputs?

I have an IRC bot written in python3 that parses user requests for search and replace. Is there any risk of DoS or other attack by doing this?
-3
votes
1answer
58 views

How long would this take to hack [closed]

Messing around in python3 and i am wondering how safe/ how long would this take to hack/crack? code Here output when password is "admin" and hash amount is 100 Paste bin
3
votes
1answer
67 views

Sending a token with a request from one app to another

Say I have an application written in some language and framework (Python + flask, for instance), and have a great deal of the functionality requiring login, and authentication via JWT. Now I want to ...
1
vote
1answer
301 views

Python Requests SSL Verification

I'm currently messing around with the Requests module in python, which allows you to specify a SSL cert to use in your request, using the following command url = r'https://www.google.com' cert_path = ...
4
votes
1answer
61 views

How do I use a directory of YARA files?

I'm going through the Malware Cookbook PEScanner and they want a path to my YARA files to search on. I currently have a directory full of YARA rules for known pieces of malware. What would be the ...
0
votes
0answers
85 views

iSniff-GPS: Certificate Verification

iSniff-GPS I came across an interesting sounding project on GitHub, called iSniff-GPS. I decided to check it out, but i experienced some issues when trying to use the web interface. Instructions ...
4
votes
1answer
79 views

Unable to get correct base for cracking Crypt3 SHA-512 on Linux with Python

I am reading a book and it gives me a simple Python script to crack /etc/shadow passwords that were encrypted with the crypt() function. It then challenges you to amend the Python program to work with ...
4
votes
1answer
79 views

How should I start security testing of python standalone application?

I'm looking for an answer specific to Windows/Linux standalone applications, for instance Dropbox has Windows Application written purely (I think so) in python, What steps should I follow? What are ...
1
vote
2answers
103 views

How to encrypt data in email body sent by (offline) app and decrypt on server

I've build an (offline)app (HTML/JS). The app allows the user to write a report (event when he is offline). The data from the report is sent via the body of an email to the companies special email ...
0
votes
2answers
33 views

What is the security measure that prevents me from posting using script and I must use browser to execute HTTP POSTs successfully [closed]

I'm using python to log into kijiji.ca with cookies enabled. The login is successful and passes (verified). I then use python to post an ad, however the ad posting keeps failing and redirects me to ...
3
votes
1answer
88 views

Is recursively encrypting files inside containers of increasingly stronger or equivalent algorithm encryption worth it?

I'm wondering if inserting a container within a container based approach like a recursive TrueCrypt or VeraCrypt container would provide a more secure protection against brute force attacks, I/O ...
3
votes
1answer
2k views

Why does the tool 'codesign' in OS X 10.11 (El Capitan) report every Python process as “code object is not signed at all”?

If you start any Python process on OS X 10.11 (10.11.0 or 10.11.1) El Capitan, and run the OS built-in tool 'codesign' to verify the process, you will receive an error saying "code object is not ...
1
vote
0answers
196 views

Converting Metasploit module to standalone Python script [closed]

How easy is to convert Ruby code to Python code and to change Metasploit module into standalone Python script for Linux?
0
votes
0answers
118 views

Any recent IOS Monitor Mode Projects?

There was a project back for IOS 5 that created a sudo-moniter mode using tcpdump, python, and libpcap. It does require a jailbreak. It is located here: Ios Monitor Mode Are there any projects for ...
1
vote
2answers
421 views

Is this sanitizer vulnerable to XSS?

To have a simple and secure editor for text fields of a django app, I have this snippet to sanitize input html into django code: from bs4 import BeautifulSoup def sanitize_html(value): ...
3
votes
2answers
133 views

Securely saving credentials for later plain-text authentication

I am developing a Django application where a user logs in with Kerberos, and then has accesses to a number of internal applications. One of these is a file application that connects to a server over ...
1
vote
1answer
261 views

Brute force attack [closed]

I'm trying to make a simple script (brute force attack) on Joomla to try if it works. #! /usr/bin/python import re #regex import urllib import urllib2 x = ...
3
votes
1answer
51 views

Question about email app in Python and security

I've managed to get my tiny little app to send an email with a click of a button using this code (this is just the email part): http://pastebin.com/nR5g28ct But to avoid some error, I had to allow ...
0
votes
0answers
40 views

Using UUIDs for non-guessable URLs [duplicate]

How safe is using UUIDs as URL identifier for non-guessable IDs? Specifically UUIDs generated by Python's uuid4() function, using base64 encoding. E.g. ...
6
votes
1answer
319 views

What are the pros and cons of using sha256 to hash a password before passing it to bcrypt?

My apologies if this has already been asked. I recently became aware of the fact that bcrypt truncates passwords to 72 characters. Practically speaking my intuition is that this does not pose any ...
1
vote
2answers
170 views

Security concerns with user Python scripts

I am generating dynamic images in a web service. The current setup is: Request image.py image.py does a database lookup to determine what data to use to generate the image image.py calls a ...
0
votes
1answer
86 views

Can I tell if a python script is secure from transmitting sensitive data by analyzing its imports?

A thought experiment My goal is to know whether, and how, a 3rd party python script that may be entrusted with sensitive information, can be trusted on a fundamental level. Basically this question ...
-4
votes
1answer
141 views

Is there an exploit for python hash collision? [closed]

Is there an exploit for this vulnerability? EDIT Python DoS via hash algorithm collision - oCERT advisory 2011-003. Affected numerous languages. No CVE for Python but CVEs for other languages.
4
votes
1answer
399 views

Secure Connection between two mobile (Android and/or iOS) devices

I've a Device A which will communicate with multiple devices on a network (BLE and/or NFC). All the devices will be handled a Token upon authentication which somehow needs to be transferred over to ...
0
votes
3answers
350 views

How does Nessus send remote commands on Windows without RDP? [closed]

I would like to know how Nessus sends remote commands on Windows. I have a scan with credentials launched on a Windows machine without RDP enabled, and Nessus can launch commands (.audit with the item ...
3
votes
1answer
131 views

Double socket connection

I'm busy experimenting with TCP socket connnections. I have made a client SOCK_STREAM socket andi've got a few questions: Is there any way that a streaming(TCP) socket can get data from another ...
-1
votes
2answers
88 views

How can I detect mode interface of other machine is promiscuous [closed]

I have a project that is to protect my box from attack man in the middle arp poison. I should detect if interface mode of other machine is promiscuous. I must write script python or command linux.
5
votes
2answers
2k views

MongoDB Nosql injection in python code

Here is the code snippet for accessing to MongoDB. client = MongoClient() db = client.test_database collection = db.test # Get data from fields condition = form.getvalue('name') if condition: ...
-3
votes
1answer
185 views

Timsort python exploit [closed]

Is there an exploit for this bug for python's sort implementation? http://envisage-project.eu/proving-android-java-and-python-sorting-algorithm-is-broken-and-how-to-fix-it/
2
votes
1answer
106 views

How to fuzz service with sending bad data?

I am reading a post about fuzzer in Python, here is the code: # Import the required modulees the script will leverage # This lets us use the functions in the modules instead of writing the code from ...
5
votes
1answer
399 views

How to to make a file private by securing the url that only authenticated users can see

I was wondering if there is a way to secure an image or a file to be hidden when it is not authenticated. Suppose there is an image in my website which can only be seen if that user is authenticated. ...
1
vote
1answer
156 views

HMAC + AES to guarantee secrecy and integrity?

As an exercise, I am writing some code that accepts a list of possibly secret properties (e.g. user ID, password, IP address), adds a timestamp, encrypts it, and signs it. Here's a high-level ...
-1
votes
2answers
322 views

Python 2 or 3 for offensive security? [closed]

I have decided to set my sights on the OSCP Certification and, after reading multiple reviews I've decided to take Abraham's advice to heart and sharpen my axe. I have experience with Shell ...
0
votes
1answer
325 views

what are potential security risks of a python script outside public_html folder

I would like to know the risks of a python script that is outside of public_html application/scripts/myscript.py public_html This script is called by the php application asynchronously. it receives ...
-1
votes
1answer
6k views

Writing keylogger and viruses in python [closed]

So recently I have been working on some projects one of them is keylogger and the second is SYNflood (both in python). I want to know if ,is it a good practice to use python language for such ...
3
votes
2answers
443 views

Python security hardening

I’m working for a large organization which is using some Windows products that require python to work. Python is used to execute built in utility scripts and the user never recognizes that python is ...