New answers tagged

0

That is Intentional behavior in their Web Application, The reason is PyPI is the official Third party Software Repository of the Python. It is just like catalog of all Open source Python Packages. The .htaccess Options -Indexes is not the problem here, as these are Open Source Packages and it's public faced so, anyone can go the Site and Download manually, ...


1

Most of the topics you address will be introduced briefly in the course. I wouldn't say there is anything you mandatorily need to know before you start the course. I think I knew closed to nothing about nmap when I started, for instance. I think the question "what do I need to know in order to start" misses the point. The point is "am I willing to learn and ...


0

Absolute statements regarding OSCP You DO NOT require coder kind of skills. (Therefore, one is wasting his time learning hardcore programming for OSCP. Although It's always a plus if you have some coding skills in your arsenal.) Basic scripting is needed. (It is also limited to python and shell scripting.) A complete Networking Nerd. (You should be able to ...


0

None of them are required. OSCP is not the kind of exam where your knowledge of a certain subject (like Python, Ruby or nmap) will be assessed. The only thing that matters is whether you're able to break into systems, and knowledge of Python, Ruby an nmap certainly helps with that. For example, let's say you have a low privilege shell on your target system....


2

Instead of blocking, you could allow users to run python in a "jail". They would be able to run commands, but in a safe sandbox.


3

You should be looking for a full sandbox, and not just preventing os from being imported. For instance, you can use RestrictedPython for blocking imports. Or you can set sys.modules['os']=None. Look at this related post for more options.


0

It sounds like the point is to discover if anti-forensic techniques leave their own distinctive, forensically-detectable evidence behind. In that case, you can probably choose to wipe the files with any method you want, regardless of how easy or difficult it is to recognize that wiping was performed, or what language is used to create the wiping routine. ...


4

Yes, this is a valid method of password verification. A disadvantage is that an attacker now knows that the plaintext "password_is_correct" corresponds to the last block in the ciphertext. Fortunately, AES is not vulnerable for known-plaintext attacks. PGP also checks the decrypted data, but it uses properties of a random block instead of a fixed string. ...


-1

What you're essentially doing here is deriving a key from a password manually and checking file integrity manually. The standard answer to this type of question is "don't do it". In short, try to use libraries to do both key derivation, encryption, and integrity checks. Password and file/encrypted file go in, encrypted file/decrypted file comes out. File ...


3

What the code does Lets look at what the code does. import cgi import Cookie First we just need to import some libraries to be used later. c = Cookie.SimpleCookie() This stores all the cookies sent in the clients request in the variable c. form = cgi.FieldStorage() This stores all the form values sent in the clients request in the variable form. ...


89

You could write some Python code to upload an SSH server binary and then run it, this will give you full SSH access under the privileges of the Apache user. From there you can easily read the Python app's config files and connect to the database using the credentials from there, which will allow you to grab confidential data (no exploits needed here as the ...



Top 50 recent answers are included