Skip to main content

Questions tagged [nonce]

a random number that is only used once. It is generated at the beginning of a communication by one communication partner and has to be sent back by the other one in order to prevent replay attacks.

8 questions with no upvoted or accepted answers
Filter by
Sorted by
Tagged with
3 votes
0 answers

Shopify OAuth: State parameter useful when the auth server also returns a signed shop id?

Background: I think I understand how the state parameter is used in oAuth to prevent CSFR attacks against the redirect_uri. Situation: I am looking at this in the context of implementing a Shopify App ...
Domi's user avatar
  • 131
2 votes
0 answers

How to obtain "wp_rest" nonce for WP Statistics plugin manually?

During my pentest of a client's websites I stumbled upon the WP with vulnerable WP Statistics plugin installed. To exploit this vulnerability, I should send a JSON-API request to endpoint /json-api/wp-...
skavans's user avatar
  • 121
1 vote
0 answers

Web authentication, replay, nonce and KEK

I am trying to figure out how to build a secure, playback-proof, web authentication scheme and at the same time be able to use a KEK at the server. After a lot of reading it seems that a reasonable ...
Michael Seifert's user avatar
1 vote
0 answers

Does using both a counter and a random nonce make sense for the purpose of reducing the likelihood of replay attacks?

I am aware that using a counter or a random value are both acceptable ways of generating nonces, depending on the circumstances. The tradeoff with using a counter is the necessity to keep state and ...
elemetrics's user avatar
1 vote
2 answers

Bloom filter to prevent replay attacks in signed HTTP requests

I'm thinking about an authentication sheme of a REST API in a setting where the only thing the server stores about a client, is their public key (the asymmetric encryption scheme should not matter). ...
Rafael Korbas's user avatar
1 vote
0 answers

Re-using the hash value of password to server by malicious actor

Let's say Alice logged into with her email and password: Email: [email protected] Password: correctHorseShoeBattery Nonce given by ...
Killney's user avatar
  • 403
0 votes
0 answers

Using predictable incrementing nonces

I need validation / feedback please with the implementation of a web based client-server application that I am building. I need to make sure that a client's cookies can't be hijacked and therefore I ...
Michael Seifert's user avatar
0 votes
0 answers

nonce encryption in https

I am thinking about using nonce and secure request to API Server. Is this the right implementation for using nonce? PURPOSE Protect API Server from Replay attack Protect API Server from MITM attack ...
ostrichegret's user avatar