Questions tagged [programming]

Programming is the act of issuing commands that a computer system executes, via certain interfaces called programming languages.

Filter by
Sorted by
Tagged with
1 vote
1 answer
163 views

Protection against different attack vectors, password manager

I'm a software dev working on an open-sourced password manager(dev lib, gui and cli) for educational and eventually usefulness purposes. There doesn't seem to be all that much information regarding ...
user avatar
  • 11
1 vote
0 answers
118 views

Attack on a string created by a developer

Go and Java have "compile time constants", and JavaScript will soon get a feature that allows "Distinguishing strings from a trusted developer from strings that may be attacker ...
user avatar
-1 votes
2 answers
163 views

Does programming in old languages still have high end usage?

I was talking to someone about it, and he claims that he is a programmer who still is able to program in old languages, because hackers these days aren't able to crack the code. He works for a ...
user avatar
  • 113
2 votes
0 answers
115 views

Why do security-sensitive APIs prefer char[] over String when handling pass-phrases even in Java? What threat are they protecting against?

Although What is the best way to store password in memory (RAM) in Java? covers the same territory, this question has the aspect of noticing what other people do and wondering why. The question on SO:...
user avatar
0 votes
1 answer
175 views

Can the sandboxing technique prevent a buffer overflow attack?

Buffer overflow Attack: Sample Authorization void A( ) { int authorized; char name [128]; authorized = check credentials (...); /* the attacker is not authorized, so returns 0 */ printf ("...
user avatar
  • 3
1 vote
1 answer
210 views

Using other programming languages for malware against EDR?

As an example, one of the most basic malware to inject into a process to get a C2 beacon goes like this: Get Handle of a process -> VirtualAllocEx -> WriteProcessMemory -> CreateRemoteThread ...
user avatar
1 vote
1 answer
249 views

Memory address problem in GNU Debugger

I'm new to gbd. I've wrote a simple program which will print hello world 10 times(I've listed the program in the screenshot). Then I've displayed the assembly language and set the break point to main ...
user avatar
-2 votes
1 answer
4k views

Write a Python or C program to guess the key [closed]

Key generation program in C: #include <stdio.h> #include <stdlib.h> #include <time.h> #define KEYSIZE 16 void main() { int i; char key[KEYSIZE]; printf("%lld\n", (long long) ...
user avatar
0 votes
0 answers
91 views

Counterintuitive remediation cost scale within SEI CERT Coding Guidelines for priority

The SEI CERT Coding Guidelines assign a priority to each rule, formed from the product of three factors: severity, likelihood, and remediation cost. Each of these three factors is assigned a value ...
user avatar
-1 votes
1 answer
297 views

Is Go good for malware programming [closed]

I read that Golang was used to create malware. Is it good? Will it stay undetected? What will be its performance?
user avatar
1 vote
1 answer
91 views

Do PHP redirect information disclosure also apply to other languages or framework?

When redirecting using header("Location MyPage.php"); in PHP, any code present after will be executed. So, if you're using this as a way to avoid user accessing pages where they should be logged in, ...
user avatar
  • 363
0 votes
3 answers
715 views

Why is programming skill required for cyber security job positions?

It is evident that programming knowledge such as Python, C, or bash scripting is required for most cybersecurity jobs. What makes it somehow mandatory to have knowledge in this area and how can it ...
user avatar
  • 1,607
3 votes
2 answers
2k views

Is there a way to safely run untrusted code on a local machine for a videogame

I want to create a simple videogame engine that can run untrusted custom code in order to add functionality to the game. I thought a about using an akka like concurrent actor system, so that the code ...
user avatar
0 votes
1 answer
109 views

Does compiling a program in Visual Studio (Windows Forms, VB.NET) leave a MAC address in the executable?

I am not making an installer. It is just a form as a portable .exe file. Asking because it's generating links to an external Web API (not mine) that is an openload crawler. Although technically legal (...
user avatar
1 vote
1 answer
211 views

Why it is difficult to write an application to protect 100% against keyloggers?

When you press keystrokes, I suppose you can intercept in low level code all applications that listen and record. Why it cannot be designed a software that protects 100% against keyloggers, simply ...
user avatar
4 votes
2 answers
247 views

Why malwares need to be light

I am learning about how malwares work and I read that a lot of them are written in assembly or C to keep the binary size as small as possible. In an example C++ source code, authors decided to remain ...
user avatar
0 votes
1 answer
96 views

print statements

Is it possible for a bad guy to read print statements done in the swift programming language? Ex. If I release an app to the Apple Appstore and it has following print line: print("my-secret-password"...
user avatar
0 votes
1 answer
187 views

Cybersecurity Career [closed]

I am considering going into Cybersecurity. I was wondering what is important in a program for getting a bachelor's? The one I am looking at doesn't have any software development in it, which I thought ...
user avatar
3 votes
0 answers
607 views

How is it possible that the Metasploit meterpreter can take pictures without "notifying" the user?

Im curious how the Meterpreter can take pictures from my webcam without turning on the webcam LED? Ive read that you have to write/change a driver, or a firmware, or you just change some DLLs, but ...
user avatar
  • 43
0 votes
2 answers
225 views

Secure algorithm for transferring data between users via QR Code

I'm building a mobile application that transfers points between users via QRCode. I'm concerned about security and am looking for effective simple yes secure algorithm to use. The scenario should be ...
user avatar
  • 103
0 votes
2 answers
212 views

Deploy verifiable webapp source code

Recently there have been quite some discussions about the security approach of ProtonMail. Since it do crypto stuff at client-side, loading the javascript code in the user's browser, as far as i know, ...
user avatar
2 votes
3 answers
24k views

Any hints for programming my own password manager? [closed]

I mostly want whatever help & suggestions you can give me about what I should avoid & what I should think about when making this. I'm a reasonable programmer & I want to make my own ...
user avatar
0 votes
2 answers
1k views

How to Verify Integrity of Transferred Files in a Client Server Protocol

How do I implement integrity verification using the checksum of files in a client-server protocol where the client sends multiple files to the server. I am using the following steps: The client ...
user avatar
2 votes
2 answers
338 views

Programming Metasploit

I try to make a Metasploit AutoRunScript for android. The First .rc file has this config use exploit/multi/handler set PAYLOAD android/meterpreter/reverse_tcp set LHOST xxx.xxx.xxx.xxx (my IP) set ...
user avatar
  • 21
0 votes
4 answers
308 views

Track who leaks your software

I'm releasing some software in python which is impossible to fully encrypt. I was thinking of changing the variable names slightly for every copy that I release. Is this a good way to figure out who ...
user avatar
132 votes
19 answers
47k views

Is it common to allow local desktop and/or active directory admin access and rights for developers in organizations?

I work at a company with a staff of about 1000+. We currently have programming development staff that work on web based projects (approx 50 people). Recently due to security concerns our IT and ...
user avatar
  • 1,309
9 votes
3 answers
414 views

Sealed Room Security - Possibility of writing assembled binary code

Assume the existence of a sealed room, containing a network with a single terminal. You are not allowed to bring in any electronic material into the room. The target machine is running default ...
user avatar
-1 votes
3 answers
374 views

While installing Go programming language trace.exe detected as virus by KAV

When I tried to install Go programming language, Kaspersky AV in my system detected a path to file: C:\Go\pkg\tool\windows_amd64\trace.exe as suspicious and triggered a virus alert. Shall I consider ...
user avatar
0 votes
1 answer
102 views

Working from a USB [closed]

I have a Mac for my work laptop and I would like to work on my xCode project, I can't work on the laptop directly and save the file to computer due to fears that it could one day be recovered & be ...
user avatar
  • 1
0 votes
0 answers
538 views

Pen testing, Windows: Using credentials to impersonate users from SYSTEM

Following simple scenario during pen test: I have remote code execution on a windows box and am SYSTEM (either because of the way I got onto the box or because of the persistence method I chose) I ...
user avatar
  • 1,111
81 votes
19 answers
16k views

Good analogy needed: Sec issues due to different coders implementing the same features in different ways for the same app

I have to give a school presentation about vulnerabilities found in the Moodle platform. Of course, they only apply to a legacy version which has since been patched. The catch is that the ...
user avatar
3 votes
1 answer
242 views

What is properly way to manage and remove symmetric key in C#

If I have a symmetric key in a byte[] array in C#, how can I erase it securely? for (int i = 0; i < array.Length; i++) { array[i] = 0; } Is this good enough?
user avatar
9 votes
1 answer
423 views

Is it worth it to fuzz Rust-written software?

If a program is written in C, then it is worth it to fuzz it with something like afl since it might have memory-related bugs. But how about software written in Rust? Would a fuzzer still find bugs? Or ...
user avatar
0 votes
1 answer
3k views

How can hackers get 1 billion passwords per second?

So I'm interested in Brute Force attacks and I have made them with Python 3 and C++. However, those only reached a max of about 20 million passwords per second. I know for a fact that 1 billion ...
user avatar
  • 11
2 votes
1 answer
2k views

stdin does not wait for next input after ROP chain

I was trying to exploit a vulnerability in a ctf but I can not make fgets() reopen stdin to put my second stage ROP chain. I am using pwntool but the problem is more socket oriented. I recreated ...
user avatar
  • 23
-1 votes
1 answer
204 views

Iwant to learn programming but i dont know where to start from [closed]

I'm really into hacking and security aspects. But I'm wondering about several things that is stopping me from pursuing this passion for the time being. One of the them is actually Programming language....
user avatar
1 vote
0 answers
311 views

Having trouble installing zxcvbn [closed]

I'm a high school student conducting a science fair project that analyzes the strength of the average person's password. I've decided to use the Java version of zxcvbn, nbvcxz, to estimate password ...
user avatar
3 votes
1 answer
1k views

Does it matter in which programming language you write the shellcode?

I have been searching a lot and I didn't find anything. I still wonder: does it matter in which language you write shellcode? Will shellcode in Assembly, C, etc. work everywhere they can be used and ...
user avatar
1 vote
0 answers
209 views

I want to know if exist a vulnerability in using sp_send_dbmail of SQL Server?

I'm using the next stored procedure sp_send_dbmail in SQL Server 2012, the DBA ask me if it possible make SQL Injection using this SP, or SMTP Injection? In the configuration of the Database ...
user avatar
  • 11
1 vote
1 answer
191 views

How does the ipv4 option "record route" work? [closed]

As written in the RFC 791 this option is useful to record the addresses of the routers that an ip datagram goes through. I'm sending an ip datagram with an ICMP echo message, i've set the option type (...
user avatar
  • 11
-4 votes
1 answer
172 views

Capture location over ip? [closed]

I want to ask you is it possible to programm a programm (in python) that can track people over their ip adress. Or do you know a programm that can do it.
user avatar
  • 29
1 vote
1 answer
639 views

How do I securely store a API key in a PC program? [duplicate]

I have a PC program which uses a API. I have the API key stored in the code, because there is no other way I can think of. Since I have no code/string obfuscator, how do I secure the API key, so no ...
user avatar
  • 11
0 votes
1 answer
349 views

Are some programming languages more secure than others? [duplicate]

I'm going to write a program that stores passwords and was wondering which language would be good for this. Do languages really have an inherent security? People speak as if they do, for example: .....
user avatar
0 votes
0 answers
211 views

Detecting duplicate encrypted strings without iterating over entire data structure

I have a long list of a specific data structure, each entry contains an encrypted string (uses AES-GCM). I want to be able to detect duplicates efficiently, without iterating over the entire list. ...
user avatar
-2 votes
2 answers
2k views

How to encrypt a file with code? [closed]

How can I encrypt a file using my own programming code? I am a beginner, I want to learn encryption.
user avatar
3 votes
2 answers
316 views

Would the Cloudbleed have been prevented if Rust was used?

Would the Cloudbleed have been prevented if Rust was used? I know it is not the same as Heartbleed, but Rust would probably have prevented Heartbleed.
user avatar
5 votes
1 answer
13k views

Example Seed and Key Algorithm

I am attempting to design a seed and key algorithm for an Engine Control Unit. This is used to secure resources such as the ability to reprogram the ECU. The idea is that I request a seed from the ...
user avatar
  • 187
0 votes
0 answers
66 views

Retrieve information about "memory protection"

I read in Wikipedia that there were two ways to achieve "memory protection" Access control lists "Traits" where a SUN processor used traits for pointer and the memory. That particular processor had ...
user avatar
1 vote
1 answer
254 views

What are some tactics to overcome the externality problem of developers not getting enough security training? [closed]

What are some 'pitches' to management to overcome security training issues?
user avatar
0 votes
3 answers
251 views

Why is security generally overlooked in application code until it's too late? [closed]

Programmers do not receive security training, is it due to costs? How can we overcome the externality problem?
user avatar