Stack Exchange Network

Stack Exchange network consists of 175 Q&A communities including Stack Overflow, the largest, most trusted online community for developers to learn, share their knowledge, and build their careers.

Visit Stack Exchange

Questions tagged [programming]

Programming is the act of issuing commands that a computer system executes, via certain interfaces called programming languages.

0
votes
1answer
64 views

Does compiling a program in Visual Studio (Windows Forms, VB.NET) leave a MAC address in the executable?

I am not making an installer. It is just a form as a portable .exe file. Asking because it's generating links to an external Web API (not mine) that is an openload crawler. Although technically legal (...
20
votes
5answers
3k views

Timing Safe String Comparison - Avoiding Length Leak

Let's say that we're building a generic timing-safe comparison function for general purpose use. Making it so that it is safe when both strings are equal length is pretty well known. However, what I'm ...
1
vote
2answers
167 views

Programming Metasploit

I try to make a Metasploit AutoRunScript for android. The First .rc file has this config use exploit/multi/handler set PAYLOAD android/meterpreter/reverse_tcp set LHOST xxx.xxx.xxx.xxx (my IP) set ...
1
vote
2answers
144 views

Why it is difficult to write an application to protect 100% against keyloggers?

When you press keystrokes, I suppose you can intercept in low level code all applications that listen and record. Why it cannot be designed a software that protects 100% against keyloggers, simply ...
4
votes
2answers
190 views

Why malwares need to be light

I am learning about how malwares work and I read that a lot of them are written in assembly or C to keep the binary size as small as possible. In an example C++ source code, authors decided to remain ...
-1
votes
3answers
173 views

While installing Go programming language trace.exe detected as virus by KAV

When I tried to install Go programming language, Kaspersky AV in my system detected a path to file: C:\Go\pkg\tool\windows_amd64\trace.exe as suspicious and triggered a virus alert. Shall I consider ...
119
votes
19answers
32k views

Is it common to allow local desktop admin access and rights for developers in organizations?

I work at a company with a staff of about 1000+. We currently have programming development staff that work on web based projects (approx 50 people). Recently due to security concerns our IT and ...
0
votes
1answer
53 views

print statements

Is it possible for a bad guy to read print statements done in the swift programming language? Ex. If I release an app to the Apple Appstore and it has following print line: print("my-secret-password"...
0
votes
0answers
37 views

is it to possible to programmatically destroy a PC? [duplicate]

is it possible to totally destroy the PC with use of code only, if possible how? i mean like: frying the RAM frying the GPU overclocking the CPU till its dead In a TV series called MR ROBOT there ...
7
votes
3answers
12k views

Methods for determining if a file is encypted?

I am working on a anti-ransomware project. It simply monitors the filesystem, and watches for files being created, and deleted. (also monitors for known ransomware file extensions.) Basic Operation: ...
0
votes
1answer
85 views

Cybersecurity Career [closed]

I am considering going into Cybersecurity. I was wondering what is important in a program for getting a bachelor's? The one I am looking at doesn't have any software development in it, which I thought ...
3
votes
0answers
124 views

How is it possible that the Metasploit meterpreter can take pictures without “notifying” the user?

Im curious how the Meterpreter can take pictures from my webcam without turning on the webcam LED? Ive read that you have to write/change a driver, or a firmware, or you just change some DLLs, but ...
8
votes
5answers
2k views

What is a buffer overflow?

I'm learning C in a tutorial and have reached the point where the term "buffer" s being mentioned regularly. It has also mentioned how certain bad programming practises involving memory can be "...
0
votes
2answers
129 views

Deploy verifiable webapp source code

Recently there have been quite some discussions about the security approach of ProtonMail. Since it do crypto stuff at client-side, loading the javascript code in the user's browser, as far as i know, ...
0
votes
2answers
286 views

How to Verify Integrity of Transferred Files in a Client Server Protocol

How do I implement integrity verification using the checksum of files in a client-server protocol where the client sends multiple files to the server. I am using the following steps: The client ...
0
votes
2answers
83 views

Secure algorithm for transferring data between users via QR Code

I'm building a mobile application that transfers points between users via QRCode. I'm concerned about security and am looking for effective simple yes secure algorithm to use. The scenario should be ...
1
vote
3answers
2k views

Any hints for programming my own password manager? [closed]

I mostly want whatever help & suggestions you can give me about what I should avoid & what I should think about when making this. I'm a reasonable programmer & I want to make my own ...
0
votes
4answers
245 views

Track who leaks your software

I'm releasing some software in python which is impossible to fully encrypt. I was thinking of changing the variable names slightly for every copy that I release. Is this a good way to figure out who ...
8
votes
3answers
283 views

Sealed Room Security - Possibility of writing assembled binary code

Assume the existence of a sealed room, containing a network with a single terminal. You are not allowed to bring in any electronic material into the room. The target machine is running default ...
32
votes
8answers
48k views

What defines a programming language as useful for hacking?

I know that scripting languages (Perl, Ruby, Python, javascript, and even Lua!!!) are most suitable for hacking and penetration testing. My question is: What is it that makes those languages suitable?...
0
votes
1answer
70 views

Working from a USB [closed]

I have a Mac for my work laptop and I would like to work on my xCode project, I can't work on the laptop directly and save the file to computer due to fears that it could one day be recovered & be ...
3
votes
1answer
193 views

What is properly way to manage and remove symmetric key in C#

If I have a symmetric key in a byte[] array in C#, how can I erase it securely? for (int i = 0; i < array.Length; i++) { array[i] = 0; } Is this good enough?
81
votes
19answers
16k views

Good analogy needed: Sec issues due to different coders implementing the same features in different ways for the same app

I have to give a school presentation about vulnerabilities found in the Moodle platform. Of course, they only apply to a legacy version which has since been patched. The catch is that the ...
0
votes
0answers
274 views

Pen testing, Windows: Using credentials to impersonate users from SYSTEM

Following simple scenario during pen test: I have remote code execution on a windows box and am SYSTEM (either because of the way I got onto the box or because of the persistence method I chose) I ...
2
votes
1answer
817 views

stdin does not wait for next input after ROP chain

I was trying to exploit a vulnerability in a ctf but I can not make fgets() reopen stdin to put my second stage ROP chain. I am using pwntool but the problem is more socket oriented. I recreated ...
14
votes
3answers
12k views

Simple string comparisons not secure against timing attacks [duplicate]

As I learned in a comment for How to encrypt in PHP, properly?, I was told using a string comparison like the following in PHP is susceptible to timing attacks. So it should not be used to compare two ...
9
votes
1answer
301 views

Is it worth it to fuzz Rust-written software?

If a program is written in C, then it is worth it to fuzz it with something like afl since it might have memory-related bugs. But how about software written in Rust? Would a fuzzer still find bugs? Or ...
2
votes
1answer
6k views

Example Seed and Key Algorithm

I am attempting to design a seed and key algorithm for an Engine Control Unit. This is used to secure resources such as the ability to reprogram the ECU. The idea is that I request a seed from the ...
3
votes
2answers
235 views

Would the Cloudbleed have been prevented if Rust was used?

Would the Cloudbleed have been prevented if Rust was used? I know it is not the same as Heartbleed, but Rust would probably have prevented Heartbleed.
0
votes
1answer
1k views

How can hackers get 1 billion passwords per second?

So I'm interested in Brute Force attacks and I have made them with Python 3 and C++. However, those only reached a max of about 20 million passwords per second. I know for a fact that 1 billion ...
-1
votes
1answer
151 views

Iwant to learn programming but i dont know where to start from [closed]

I'm really into hacking and security aspects. But I'm wondering about several things that is stopping me from pursuing this passion for the time being. One of the them is actually Programming language....
1
vote
0answers
173 views

Having trouble installing zxcvbn [closed]

I'm a high school student conducting a science fair project that analyzes the strength of the average person's password. I've decided to use the Java version of zxcvbn, nbvcxz, to estimate password ...
37
votes
6answers
3k views

Teaching a loved one about secure coding practices

This might be far too narrow, but it is a unique problem to ITSec professionals. A loved one is just starting out in a new programming career and I get the joy of watching her learn the most basic ...
3
votes
1answer
406 views

Does it matter in which programming language you write the shellcode?

I have been searching a lot and I didn't find anything. I still wonder: does it matter in which language you write shellcode? Will shellcode in Assembly, C, etc. work everywhere they can be used and ...
1
vote
0answers
157 views

I want to know if exist a vulnerability in using sp_send_dbmail of SQL Server?

I'm using the next stored procedure sp_send_dbmail in SQL Server 2012, the DBA ask me if it possible make SQL Injection using this SP, or SMTP Injection? In the configuration of the Database ...
1
vote
1answer
143 views

How does the ipv4 option “record route” work? [closed]

As written in the RFC 791 this option is useful to record the addresses of the routers that an ip datagram goes through. I'm sending an ip datagram with an ICMP echo message, i've set the option type ...
-4
votes
1answer
103 views

Capture location over ip? [closed]

I want to ask you is it possible to programm a programm (in python) that can track people over their ip adress. Or do you know a programm that can do it.
1
vote
1answer
353 views

How do I securely store a API key in a PC program? [duplicate]

I have a PC program which uses a API. I have the API key stored in the code, because there is no other way I can think of. Since I have no code/string obfuscator, how do I secure the API key, so no ...
0
votes
1answer
275 views

Are some programming languages more secure than others? [duplicate]

I'm going to write a program that stores passwords and was wondering which language would be good for this. Do languages really have an inherent security? People speak as if they do, for example: .....
0
votes
0answers
156 views

Detecting duplicate encrypted strings without iterating over entire data structure

I have a long list of a specific data structure, each entry contains an encrypted string (uses AES-GCM). I want to be able to detect duplicates efficiently, without iterating over the entire list. ...
1
vote
2answers
790 views

How to prevent malicious DLL from getting used in LoadLibrary or DllImport (.NET) calls

I have a situation where malicious files are being copied to the installation directory of some software and the software will load those files when making a call to LoadLibrary or DllImport (in .NET ...
3
votes
3answers
4k views

Is this integer overflow vulnerability exploitable?

Is this integer overflow exploitable and if the answer is yes, how can i exploit it? char buffer[20]; int len = atoi(argv[1]); if(len < 20) memcpy(buffer,argv[2],len); If I set len to -1 the ...
-2
votes
2answers
1k views

How to encrypt a file with code? [closed]

How can I encrypt a file using my own programming code? I am a beginner, I want to learn encryption.
0
votes
0answers
29 views

Retrieve information about “memory protection”

I read in Wikipedia that there were two ways to achieve "memory protection" Access control lists "Traits" where a SUN processor used traits for pointer and the memory. That particular processor had ...
1
vote
1answer
214 views
0
votes
3answers
205 views

Why is security generally overlooked in application code until it's too late? [closed]

Programmers do not receive security training, is it due to costs? How can we overcome the externality problem?
2
votes
0answers
155 views

Secure user logins in applications

We wish to create a Java GUI desktop application for our authorised helpdesk staff to perform their normal operations. For e.g. they often have to check log files for errors if a user called or verify ...
1
vote
0answers
185 views

Libraries, functions, and tools that help with secure C/C++ programming on Linux [closed]

When writing software in a language such as C/C++, what tools/libraries/functions are available to help make the program more secure from exploitation on Linux? For example: one can use chroot() and ...
3
votes
1answer
170 views

Are there any IoT Systematic Creation Security Checklists?

Are you aware of any publicly available documents that would help IoT/Connected product creators develop a systematic/programmatic approach and/or process to securing such new age devices?
0
votes
1answer
276 views

Learning how to code advanced Windows malware [closed]

I often see advanced malware on Windows platform - rootkits, bootkits, web injection, formgrabbers, injecting into other processes etc... Some of this looks so difficult to understand. If you knew ...