Skip to main content
OverflowAI is here! AI power for your Stack Overflow for Teams knowledge community. Learn more

Questions tagged [programming]

Programming is the act of issuing commands that a computer system executes, via certain interfaces called programming languages.

Filter by
Sorted by
Tagged with
2 votes
2 answers
138 views

Can and should a penetration test report include an informational note about not having used a (by-design) memory-safe programming language?

Firstly, a quote from a good article about the importance of memory safety by memorysafety.org: How common are memory safety vulnerabilities? Extremely. A recent study found that 60-70% of ...
Bob Ortiz's user avatar
  • 6,665
1 vote
0 answers
66 views

SrSecEng - how to optimize for future vision [closed]

I'd like to do Cloud, Security, and Programming, ideally in Python/Golang. To move from process automation towards asynchronous, distributed, autonomic systems. Security inspired by DevOps/SRE ...
just-doing-this-for-dark-mode's user avatar
0 votes
0 answers
80 views

Can Num2bits be used to guard against underflows?

In circom, Num2bits() from circomlib is primarily intended for converting an Integer into an array of bits. But because of it’s optional parameter, it can be used to prevent overflows such as : inp = ...
user2284570's user avatar
  • 1,472
0 votes
1 answer
116 views

Does the presence of an "unsafe" function in an object file pose a security risk

I've read that there are unsafe functions that we should try to avoid when writing C/C++ programs for example the gets() or strlen() functions. Let's say I compile a .cpp/.c file into an object file ...
KetDog's user avatar
  • 101
1 vote
0 answers
109 views

Error installing bassmaster 1.5.1 [closed]

Node version: v18.13.0 npm version: 8.19.3 I have my awae material and I want to install the vulnerable bassmasster version 1.5.1 on my computer Error: settings.routes = Config.enable(settings.routes);...
Sabyasachi Mitra's user avatar
0 votes
1 answer
291 views

How do I keep Python Sockets secure for Multiplayer Games?

I'm making a simple multiplayer game in Python. No personal/important data will be transferred between the server and client. I am using the Python sockets library to communicate between the client ...
Some Guy's user avatar
  • 115
10 votes
1 answer
2k views

What are some ways to ensure that a cryptography library is reliable in an ecosystem that is new to me?

Cryptography is a core security service, and is generally considered a specialty that is difficult to get right unless one knows what they are doing. Furthermore, cryptography API misuse is rampant ...
the_endian's user avatar
  • 1,169
1 vote
1 answer
262 views

Protection against different attack vectors, password manager

I'm a software dev working on an open-sourced password manager(dev lib, gui and cli) for educational and eventually usefulness purposes. There doesn't seem to be all that much information regarding ...
Rfc's user avatar
  • 11
1 vote
0 answers
160 views

Attack on a string created by a developer

Go and Java have "compile time constants", and JavaScript will soon get a feature that allows "Distinguishing strings from a trusted developer from strings that may be attacker ...
Craig Francis's user avatar
-1 votes
2 answers
201 views

Does programming in old languages still have high end usage?

I was talking to someone about it, and he claims that he is a programmer who still is able to program in old languages, because hackers these days aren't able to crack the code. He works for a ...
Sam B's user avatar
  • 113
2 votes
0 answers
155 views

Why do security-sensitive APIs prefer char[] over String when handling pass-phrases even in Java? What threat are they protecting against?

Although What is the best way to store password in memory (RAM) in Java? covers the same territory, this question has the aspect of noticing what other people do and wondering why. The question on SO:...
David Bullock's user avatar
0 votes
1 answer
289 views

Can the sandboxing technique prevent a buffer overflow attack?

Buffer overflow Attack: Sample Authorization void A( ) { int authorized; char name [128]; authorized = check credentials (...); /* the attacker is not authorized, so returns 0 */ printf ("...
Love's user avatar
  • 3
1 vote
1 answer
373 views

Using other programming languages for malware against EDR?

As an example, one of the most basic malware to inject into a process to get a C2 beacon goes like this: Get Handle of a process -> VirtualAllocEx -> WriteProcessMemory -> CreateRemoteThread ...
user153882's user avatar
2 votes
1 answer
672 views

Memory address problem in GNU Debugger

I'm new to gbd. I've wrote a simple program which will print hello world 10 times(I've listed the program in the screenshot). Then I've displayed the assembly language and set the break point to main ...
Abhirup Bakshi's user avatar
-3 votes
1 answer
6k views

Write a Python or C program to guess the key [closed]

Key generation program in C: #include <stdio.h> #include <stdlib.h> #include <time.h> #define KEYSIZE 16 void main() { int i; char key[KEYSIZE]...
Leonardo Jose's user avatar
0 votes
0 answers
127 views

Counterintuitive remediation cost scale within SEI CERT Coding Guidelines for priority

The SEI CERT Coding Guidelines assign a priority to each rule, formed from the product of three factors: severity, likelihood, and remediation cost. Each of these three factors is assigned a value ...
user2023370's user avatar
-1 votes
1 answer
367 views

Is Go good for malware programming [closed]

I read that Golang was used to create malware. Is it good? Will it stay undetected? What will be its performance?
ashwin vinod's user avatar
1 vote
1 answer
125 views

Do PHP redirect information disclosure also apply to other languages or framework?

When redirecting using header("Location MyPage.php"); in PHP, any code present after will be executed. So, if you're using this as a way to avoid user accessing pages where they should be logged in, ...
user96649's user avatar
  • 363
0 votes
3 answers
800 views

Why is programming skill required for cyber security job positions?

It is evident that programming knowledge such as Python, C, or bash scripting is required for most cybersecurity jobs. What makes it somehow mandatory to have knowledge in this area and how can it ...
R1W's user avatar
  • 1,627
4 votes
3 answers
3k views

Is there a way to safely run untrusted code on a local machine for a videogame

I want to create a simple videogame engine that can run untrusted custom code in order to add functionality to the game. I thought a about using an akka like concurrent actor system, so that the code ...
user2741831's user avatar
0 votes
1 answer
140 views

Does compiling a program in Visual Studio (Windows Forms, VB.NET) leave a MAC address in the executable?

I am not making an installer. It is just a form as a portable .exe file. Asking because it's generating links to an external Web API (not mine) that is an openload crawler. Although technically legal (...
Sci00213's user avatar
1 vote
1 answer
239 views

Why it is difficult to write an application to protect 100% against keyloggers?

When you press keystrokes, I suppose you can intercept in low level code all applications that listen and record. Why it cannot be designed a software that protects 100% against keyloggers, simply ...
human being's user avatar
3 votes
2 answers
281 views

Why malwares need to be light

I am learning about how malwares work and I read that a lot of them are written in assembly or C to keep the binary size as small as possible. In an example C++ source code, authors decided to remain ...
protoneight's user avatar
0 votes
1 answer
124 views

print statements

Is it possible for a bad guy to read print statements done in the swift programming language? Ex. If I release an app to the Apple Appstore and it has following print line: print("my-secret-password"...
skovanden's user avatar
1 vote
1 answer
274 views

Cybersecurity Career [closed]

I am considering going into Cybersecurity. I was wondering what is important in a program for getting a bachelor's? The one I am looking at doesn't have any software development in it, which I thought ...
Andy Meza III's user avatar
3 votes
0 answers
998 views

How is it possible that the Metasploit meterpreter can take pictures without "notifying" the user?

Im curious how the Meterpreter can take pictures from my webcam without turning on the webcam LED? Ive read that you have to write/change a driver, or a firmware, or you just change some DLLs, but ...
tester's user avatar
  • 43
1 vote
1 answer
243 views

Transforming keystroke dynamics raw data

I'm writing keystoke dynamics identifcation as an assignment and I'm having trouble with storing data. I was instructed only to "don't keep raw data" as it should've been transformed. I wasn't told ...
Naan's user avatar
  • 71
0 votes
2 answers
309 views

Secure algorithm for transferring data between users via QR Code

I'm building a mobile application that transfers points between users via QRCode. I'm concerned about security and am looking for effective simple yes secure algorithm to use. The scenario should be ...
Abozanona's user avatar
  • 103
0 votes
2 answers
259 views

Deploy verifiable webapp source code

Recently there have been quite some discussions about the security approach of ProtonMail. Since it do crypto stuff at client-side, loading the javascript code in the user's browser, as far as i know, ...
hwktest's user avatar
2 votes
3 answers
31k views

Any hints for programming my own password manager? [closed]

I mostly want whatever help & suggestions you can give me about what I should avoid & what I should think about when making this. I'm a reasonable programmer & I want to make my own ...
Sebastian Norr's user avatar
0 votes
2 answers
2k views

How to Verify Integrity of Transferred Files in a Client Server Protocol

How do I implement integrity verification using the checksum of files in a client-server protocol where the client sends multiple files to the server. I am using the following steps: The client ...
Shamminuj Aktar's user avatar
2 votes
2 answers
414 views

Programming Metasploit

I try to make a Metasploit AutoRunScript for android. The First .rc file has this config use exploit/multi/handler set PAYLOAD android/meterpreter/reverse_tcp set LHOST xxx.xxx.xxx.xxx (my IP) set ...
jnass's user avatar
  • 21
0 votes
4 answers
346 views

Track who leaks your software

I'm releasing some software in python which is impossible to fully encrypt. I was thinking of changing the variable names slightly for every copy that I release. Is this a good way to figure out who ...
Noah Cristino's user avatar
135 votes
19 answers
52k views

Is it common to allow local desktop and/or active directory admin access and rights for developers in organizations?

I work at a company with a staff of about 1000+. We currently have programming development staff that work on web based projects (approx 50 people). Recently due to security concerns our IT and ...
TroySteven's user avatar
  • 1,339
9 votes
3 answers
448 views

Sealed Room Security - Possibility of writing assembled binary code

Assume the existence of a sealed room, containing a network with a single terminal. You are not allowed to bring in any electronic material into the room. The target machine is running default ...
DarkDestry's user avatar
-1 votes
3 answers
473 views

While installing Go programming language trace.exe detected as virus by KAV

When I tried to install Go programming language, Kaspersky AV in my system detected a path to file: C:\Go\pkg\tool\windows_amd64\trace.exe as suspicious and triggered a virus alert. Shall I consider ...
PentestLover's user avatar
0 votes
1 answer
126 views

Working from a USB [closed]

I have a Mac for my work laptop and I would like to work on my xCode project, I can't work on the laptop directly and save the file to computer due to fears that it could one day be recovered & be ...
Anno's user avatar
  • 1
0 votes
0 answers
683 views

Pen testing, Windows: Using credentials to impersonate users from SYSTEM

Following simple scenario during pen test: I have remote code execution on a windows box and am SYSTEM (either because of the way I got onto the box or because of the persistence method I chose) I ...
manduca's user avatar
  • 1,111
81 votes
19 answers
16k views

Good analogy needed: Sec issues due to different coders implementing the same features in different ways for the same app

I have to give a school presentation about vulnerabilities found in the Moodle platform. Of course, they only apply to a legacy version which has since been patched. The catch is that the ...
SuperSpitter's user avatar
3 votes
1 answer
284 views

What is properly way to manage and remove symmetric key in C#

If I have a symmetric key in a byte[] array in C#, how can I erase it securely? for (int i = 0; i < array.Length; i++) { array[i] = 0; } Is this good enough?
adrianobruno's user avatar
9 votes
1 answer
489 views

Is it worth it to fuzz Rust-written software?

If a program is written in C, then it is worth it to fuzz it with something like afl since it might have memory-related bugs. But how about software written in Rust? Would a fuzzer still find bugs? Or ...
user164700's user avatar
0 votes
1 answer
4k views

How can hackers get 1 billion passwords per second?

So I'm interested in Brute Force attacks and I have made them with Python 3 and C++. However, those only reached a max of about 20 million passwords per second. I know for a fact that 1 billion ...
J. Doe's user avatar
  • 11
2 votes
1 answer
3k views

stdin does not wait for next input after ROP chain

I was trying to exploit a vulnerability in a ctf but I can not make fgets() reopen stdin to put my second stage ROP chain. I am using pwntool but the problem is more socket oriented. I recreated ...
ItsYou's user avatar
  • 23
-1 votes
1 answer
229 views

Iwant to learn programming but i dont know where to start from [closed]

I'm really into hacking and security aspects. But I'm wondering about several things that is stopping me from pursuing this passion for the time being. One of the them is actually Programming language....
Neo Vamp's user avatar
1 vote
0 answers
358 views

Having trouble installing zxcvbn [closed]

I'm a high school student conducting a science fair project that analyzes the strength of the average person's password. I've decided to use the Java version of zxcvbn, nbvcxz, to estimate password ...
StudentEleanor's user avatar
3 votes
1 answer
2k views

Does it matter in which programming language you write the shellcode?

I have been searching a lot and I didn't find anything. I still wonder: does it matter in which language you write shellcode? Will shellcode in Assembly, C, etc. work everywhere they can be used and ...
Zlatomir Zhelev's user avatar
1 vote
0 answers
254 views

I want to know if exist a vulnerability in using sp_send_dbmail of SQL Server?

I'm using the next stored procedure sp_send_dbmail in SQL Server 2012, the DBA ask me if it possible make SQL Injection using this SP, or SMTP Injection? In the configuration of the Database ...
csuazo's user avatar
  • 11
1 vote
1 answer
275 views

How does the ipv4 option "record route" work? [closed]

As written in the RFC 791 this option is useful to record the addresses of the routers that an ip datagram goes through. I'm sending an ip datagram with an ICMP echo message, i've set the option type (...
Paradox's user avatar
  • 11
-4 votes
1 answer
211 views

Capture location over ip? [closed]

I want to ask you is it possible to programm a programm (in python) that can track people over their ip adress. Or do you know a programm that can do it.
Flajt's user avatar
  • 29
1 vote
1 answer
854 views

How do I securely store a API key in a PC program? [duplicate]

I have a PC program which uses a API. I have the API key stored in the code, because there is no other way I can think of. Since I have no code/string obfuscator, how do I secure the API key, so no ...
danielk's user avatar
  • 11