Skip to main content

Questions tagged [nonce]

a random number that is only used once. It is generated at the beginning of a communication by one communication partner and has to be sent back by the other one in order to prevent replay attacks.

8 questions with no upvoted or accepted answers
Filter by
Sorted by
Tagged with
3 votes
0 answers
254 views

Shopify OAuth: State parameter useful when the auth server also returns a signed shop id?

Background: I think I understand how the state parameter is used in oAuth to prevent CSFR attacks against the redirect_uri. Situation: I am looking at this in the context of implementing a Shopify App ...
Domi's user avatar
  • 131
2 votes
0 answers
80 views

How to obtain "wp_rest" nonce for WP Statistics plugin manually?

During my pentest of a client's websites I stumbled upon the WP with vulnerable WP Statistics plugin installed. To exploit this vulnerability, I should send a JSON-API request to endpoint /json-api/wp-...
skavans's user avatar
  • 121
1 vote
0 answers
218 views

Web authentication, replay, nonce and KEK

I am trying to figure out how to build a secure, playback-proof, web authentication scheme and at the same time be able to use a KEK at the server. After a lot of reading it seems that a reasonable ...
Michael Seifert's user avatar
1 vote
0 answers
442 views

Does using both a counter and a random nonce make sense for the purpose of reducing the likelihood of replay attacks?

I am aware that using a counter or a random value are both acceptable ways of generating nonces, depending on the circumstances. The tradeoff with using a counter is the necessity to keep state and ...
elemetrics's user avatar
1 vote
2 answers
298 views

Bloom filter to prevent replay attacks in signed HTTP requests

I'm thinking about an authentication sheme of a REST API in a setting where the only thing the server stores about a client, is their public key (the asymmetric encryption scheme should not matter). ...
Rafael Korbas's user avatar
1 vote
0 answers
149 views

Re-using the hash value of password to server by malicious actor

Let's say Alice logged into https://www.facebook.com with her email and password: Email: [email protected] Password: correctHorseShoeBattery Nonce given by ...
Killney's user avatar
  • 403
0 votes
0 answers
151 views

Using predictable incrementing nonces

I need validation / feedback please with the implementation of a web based client-server application that I am building. I need to make sure that a client's cookies can't be hijacked and therefore I ...
Michael Seifert's user avatar
0 votes
0 answers
247 views

nonce encryption in https

I am thinking about using nonce and secure request to API Server. Is this the right implementation for using nonce? PURPOSE Protect API Server from Replay attack Protect API Server from MITM attack ...
ostrichegret's user avatar