Questions tagged [programming]
Programming is the act of issuing commands that a computer system executes, via certain interfaces called programming languages.
124
questions
0
votes
1
answer
41
views
Does the presence of an "unsafe" function in an object file pose a security risk
I've read that there are unsafe functions that we should try to avoid when writing C/C++ programs for example the gets() or strlen() functions.
Let's say I compile a .cpp/.c file into an object file ...
- 101
1
vote
0
answers
44
views
Error installing bassmaster 1.5.1 [closed]
Node version: v18.13.0
npm version: 8.19.3
I have my awae material and I want to install the vulnerable bassmasster version 1.5.1 on my computer
Error:
settings.routes = Config.enable(settings.routes);...
0
votes
1
answer
189
views
How do I keep Python Sockets secure for Multiplayer Games?
I'm making a simple multiplayer game in Python. No personal/important data will be transferred between the server and client. I am using the Python sockets library to communicate between the client ...
- 115
10
votes
1
answer
2k
views
What are some ways to ensure that a cryptography library is reliable in an ecosystem that is new to me?
Cryptography is a core security service, and is generally considered a specialty that is difficult to get right unless one knows what they are doing. Furthermore, cryptography API misuse is rampant ...
- 1,139
1
vote
1
answer
201
views
Protection against different attack vectors, password manager
I'm a software dev working on an open-sourced password manager(dev lib, gui and cli) for educational and eventually usefulness purposes. There doesn't seem to be all that much information regarding ...
- 11
1
vote
0
answers
131
views
Attack on a string created by a developer
Go and Java have "compile time constants", and JavaScript will soon get a feature that allows "Distinguishing strings from a trusted developer from strings that may be attacker ...
- 111
-1
votes
2
answers
172
views
Does programming in old languages still have high end usage?
I was talking to someone about it, and he claims that he is a programmer who still is able to program in old languages, because hackers these days aren't able to crack the code.
He works for a ...
- 113
2
votes
0
answers
128
views
Why do security-sensitive APIs prefer char[] over String when handling pass-phrases even in Java? What threat are they protecting against?
Although
What is the best way to store password in memory (RAM) in Java?
covers the same territory, this question has the aspect of noticing
what other people do and wondering why. The question on SO:...
- 542
0
votes
1
answer
242
views
Can the sandboxing technique prevent a buffer overflow attack?
Buffer overflow Attack: Sample Authorization
void A( ) {
int authorized;
char name [128];
authorized = check credentials (...); /* the attacker is not authorized, so returns 0 */
printf ("...
- 3
1
vote
1
answer
322
views
Using other programming languages for malware against EDR?
As an example, one of the most basic malware to inject into a process to get a C2 beacon goes like this:
Get Handle of a process -> VirtualAllocEx -> WriteProcessMemory -> CreateRemoteThread
...
- 773
1
vote
1
answer
411
views
Memory address problem in GNU Debugger
I'm new to gbd. I've wrote a simple program which will print hello world 10 times(I've listed the program in the screenshot). Then I've displayed the assembly language and set the break point to main ...
- 177
-3
votes
1
answer
5k
views
Write a Python or C program to guess the key [closed]
Key generation program in C:
#include <stdio.h>
#include <stdlib.h>
#include <time.h>
#define KEYSIZE 16
void main()
{
int i;
char key[KEYSIZE]...
0
votes
0
answers
101
views
Counterintuitive remediation cost scale within SEI CERT Coding Guidelines for priority
The SEI CERT Coding Guidelines assign a priority to each rule, formed from the product of three factors: severity, likelihood, and remediation cost. Each of these three factors is assigned a value ...
- 101
-1
votes
1
answer
319
views
Is Go good for malware programming [closed]
I read that Golang was used to create malware. Is it good? Will it stay undetected? What will be its performance?
1
vote
1
answer
99
views
Do PHP redirect information disclosure also apply to other languages or framework?
When redirecting using header("Location MyPage.php"); in PHP, any code present after will be executed. So, if you're using this as a way to avoid user accessing pages where they should be logged in, ...
- 363
0
votes
3
answers
768
views
Why is programming skill required for cyber security job positions?
It is evident that programming knowledge such as Python, C, or bash scripting is required for most cybersecurity jobs.
What makes it somehow mandatory to have knowledge in this area and how can it ...
- 1,627
4
votes
3
answers
3k
views
Is there a way to safely run untrusted code on a local machine for a videogame
I want to create a simple videogame engine that can run untrusted custom code in order to add functionality to the game. I thought a about using an akka like concurrent actor system, so that the code ...
- 155
0
votes
1
answer
114
views
Does compiling a program in Visual Studio (Windows Forms, VB.NET) leave a MAC address in the executable?
I am not making an installer. It is just a form as a portable .exe file. Asking because it's generating links to an external Web API (not mine) that is an openload crawler. Although technically legal (...
- 3
1
vote
1
answer
216
views
Why it is difficult to write an application to protect 100% against keyloggers?
When you press keystrokes, I suppose you can intercept in low level code all applications that listen and record. Why it cannot be designed a software that protects 100% against keyloggers, simply ...
- 11
4
votes
2
answers
256
views
Why malwares need to be light
I am learning about how malwares work and I read that a lot of them are written in assembly or C to keep the binary size as small as possible.
In an example C++ source code, authors decided to remain ...
- 41
0
votes
1
answer
101
views
print statements
Is it possible for a bad guy to read print statements done in the swift programming language?
Ex. If I release an app to the Apple Appstore and it has following print line:
print("my-secret-password"...
- 21
1
vote
1
answer
220
views
Cybersecurity Career [closed]
I am considering going into Cybersecurity. I was wondering what is important in a program for getting a bachelor's? The one I am looking at doesn't have any software development in it, which I thought ...
3
votes
0
answers
844
views
How is it possible that the Metasploit meterpreter can take pictures without "notifying" the user?
Im curious how the Meterpreter can take pictures from my webcam without turning on the webcam LED? Ive read that you have to write/change a driver, or a firmware, or you just change some DLLs, but ...
- 43
1
vote
1
answer
217
views
Transforming keystroke dynamics raw data
I'm writing keystoke dynamics identifcation as an assignment and I'm having trouble with storing data. I was instructed only to "don't keep raw data" as it should've been transformed. I wasn't told ...
- 71
0
votes
2
answers
272
views
Secure algorithm for transferring data between users via QR Code
I'm building a mobile application that transfers points between users via QRCode. I'm concerned about security and am looking for effective simple yes secure algorithm to use.
The scenario should be ...
- 103
0
votes
2
answers
229
views
Deploy verifiable webapp source code
Recently there have been quite some discussions about the security approach of ProtonMail. Since it do crypto stuff at client-side, loading the javascript code in the user's browser, as far as i know, ...
- 3
2
votes
3
answers
29k
views
Any hints for programming my own password manager? [closed]
I mostly want whatever help & suggestions you can give me about what I should avoid & what I should think about when making this.
I'm a reasonable programmer & I want to make my own ...
- 169
0
votes
2
answers
2k
views
How to Verify Integrity of Transferred Files in a Client Server Protocol
How do I implement integrity verification using the checksum of files in a client-server protocol where the client sends multiple files to the server. I am using the following steps:
The client ...
2
votes
2
answers
382
views
Programming Metasploit
I try to make a Metasploit AutoRunScript for android. The First .rc file has this config
use exploit/multi/handler
set PAYLOAD android/meterpreter/reverse_tcp
set LHOST xxx.xxx.xxx.xxx (my IP)
set ...
- 21
0
votes
4
answers
323
views
Track who leaks your software
I'm releasing some software in python which is impossible to fully encrypt. I was thinking of changing the variable names slightly for every copy that I release. Is this a good way to figure out who ...
- 105
136
votes
19
answers
51k
views
Is it common to allow local desktop and/or active directory admin access and rights for developers in organizations?
I work at a company with a staff of about 1000+. We currently have programming development staff that work on web based projects (approx 50 people).
Recently due to security concerns our IT and ...
- 1,349
9
votes
3
answers
425
views
Sealed Room Security - Possibility of writing assembled binary code
Assume the existence of a sealed room, containing a network with a single terminal. You are not allowed to bring in any electronic material into the room. The target machine is running default ...
- 193
-1
votes
3
answers
414
views
While installing Go programming language trace.exe detected as virus by KAV
When I tried to install Go programming language, Kaspersky AV in my system detected a path to file: C:\Go\pkg\tool\windows_amd64\trace.exe as suspicious and triggered a virus alert.
Shall I consider ...
- 77
0
votes
1
answer
106
views
Working from a USB [closed]
I have a Mac for my work laptop and I would like to work on my xCode project, I can't work on the laptop directly and save the file to computer due to fears that it could one day be recovered & be ...
- 1
0
votes
0
answers
609
views
Pen testing, Windows: Using credentials to impersonate users from SYSTEM
Following simple scenario during pen test:
I have remote code execution on a windows box and am SYSTEM (either because of the way I got onto the box or because of the persistence method I chose)
I ...
- 1,111
81
votes
19
answers
16k
views
Good analogy needed: Sec issues due to different coders implementing the same features in different ways for the same app
I have to give a school presentation about vulnerabilities found in the Moodle platform. Of course, they only apply to a legacy version which has since been patched.
The catch is that the ...
- 833
3
votes
1
answer
262
views
What is properly way to manage and remove symmetric key in C#
If I have a symmetric key in a byte[] array in C#, how can I erase it securely?
for (int i = 0; i < array.Length; i++) {
array[i] = 0;
}
Is this good enough?
- 39
9
votes
1
answer
452
views
Is it worth it to fuzz Rust-written software?
If a program is written in C, then it is worth it to fuzz it with something like afl since it might have memory-related bugs. But how about software written in Rust? Would a fuzzer still find bugs? Or ...
- 93
0
votes
1
answer
4k
views
How can hackers get 1 billion passwords per second?
So I'm interested in Brute Force attacks and I have made them with Python 3 and C++. However, those only reached a max of about 20 million passwords per second.
I know for a fact that 1 billion ...
- 11
2
votes
1
answer
2k
views
stdin does not wait for next input after ROP chain
I was trying to exploit a vulnerability in a ctf but I can not make fgets() reopen stdin to put my second stage ROP chain. I am using pwntool but the problem is more socket oriented.
I recreated ...
- 23
-1
votes
1
answer
207
views
Iwant to learn programming but i dont know where to start from [closed]
I'm really into hacking and security aspects. But I'm wondering about several things that is stopping me from pursuing this passion for the time being. One of the them is actually Programming language....
- 1
1
vote
0
answers
332
views
Having trouble installing zxcvbn [closed]
I'm a high school student conducting a science fair project that analyzes the strength of the average person's password. I've decided to use the Java version of zxcvbn, nbvcxz, to estimate password ...
3
votes
1
answer
2k
views
Does it matter in which programming language you write the shellcode?
I have been searching a lot and I didn't find anything. I still wonder: does it matter in which language you write shellcode? Will shellcode in Assembly, C, etc. work everywhere they can be used and ...
1
vote
0
answers
227
views
I want to know if exist a vulnerability in using sp_send_dbmail of SQL Server?
I'm using the next stored procedure sp_send_dbmail in SQL Server 2012, the DBA ask me if it possible make SQL Injection using this SP, or SMTP Injection?
In the configuration of the
Database ...
- 11
1
vote
1
answer
227
views
How does the ipv4 option "record route" work? [closed]
As written in the RFC 791 this option is useful to record the addresses of the routers that an ip datagram goes through.
I'm sending an ip datagram with an ICMP echo message, i've set the option type (...
- 11
-4
votes
1
answer
184
views
Capture location over ip? [closed]
I want to ask you is it possible to programm a programm (in python) that can track people over their ip adress.
Or do you know a programm that can do it.
- 29
1
vote
1
answer
784
views
How do I securely store a API key in a PC program? [duplicate]
I have a PC program which uses a API. I have the API key stored in the code, because there is no other way I can think of. Since I have no code/string obfuscator, how do I secure the API key, so no ...
- 11
0
votes
1
answer
415
views
Are some programming languages more secure than others? [duplicate]
I'm going to write a program that stores passwords and was wondering which language would be good for this. Do languages really have an inherent security? People speak as if they do, for example:
.....
- 283
0
votes
0
answers
239
views
Detecting duplicate encrypted strings without iterating over entire data structure
I have a long list of a specific data structure, each entry contains an encrypted string (uses AES-GCM).
I want to be able to detect duplicates efficiently, without iterating over the entire list. ...
-2
votes
2
answers
2k
views
How to encrypt a file with code? [closed]
How can I encrypt a file using my own programming code?
I am a beginner, I want to learn encryption.
