Questions tagged [python]
High-level dynamic language developed by Guido van Rossum, particularly popular for server-side web programming and scripting.
364
questions
0
votes
0
answers
17
views
TLS Interception basics [closed]
I am trying to perform TLS interception in which I was given 2 containers: Host01 and Attacker with a br-intercept bridge. So every HTTP/HTTPS request from Host01 to the Internet passes through the ...
1
vote
2
answers
68
views
Need help generating list with crunch
I am new to Kali Linux.
I am trying to generate a wordlist of 6- whatever character words where:
the first part is an English word that starts with a capital letter
the last 5 characters are 8765. It ...
- 51
0
votes
0
answers
32
views
Input sanitization
Is unwanted characters removal enough to prevent most attacks (Python) ? Obviously the code should have more sophisticated rules (ex.remove more than one consecutive white spaces after a new line), ...
- 1
18
votes
6
answers
5k
views
Do high level languages allow for buffer / heap overflow?
I'm learning about basic x86 overflows in C but normally I code with Python. Is there anyway that programs written in higher level languages can suffer from buffer/heap overflow?
- 205
1
vote
2
answers
83
views
What are the issues with running a seemingly trustworthy python script from a stranger?
For context: in Sweden, the "end" of COVID has caused a huge buildup in passport applications, as everybody wants to resume travelling. However, due to the poor performance and general UX of ...
- 111
0
votes
0
answers
40
views
How do you lock down PyPI access?
Another question (Is it possible to block non-PyPI requests during pip install?) asked about locking down non-PyPI pip installs for security reasons. This doesn't deal with the problem of malicious ...
- 101
1
vote
0
answers
84
views
Lesser known security pitfalls in Python [closed]
I recently came across this article: https://blog.sonarsource.com/10-unknown-security-pitfalls-for-python, which describes security pitfalls in the python programming language that are less well known ...
- 53
0
votes
0
answers
23
views
Can I import this exploit on metasploit or is better to use it in python? [duplicate]
I have tried to import this exploit:
https://www.exploit-db.com/exploits/50539
and then use it in Metasploit (I'm following a walkthrough), but Metasploit cannot load it.
Also I tried to use Python ...
0
votes
1
answer
21
views
is client server model to do some root operations without asking everytime secure?
I'm writing a python application that will do some operations that will require root privileges.So instead of asking for user password every time i decided to use server client model.
A python script ...
0
votes
1
answer
43
views
Do WSGI servers connect to devices outside of the network?
I want to set up a plotly dashboard and view it from my browser.
Plotly gets set up as a flask application. I'm of the understanding that I should use a WSGI server to host it. I'm looking at waitress ...
- 101
0
votes
0
answers
28
views
Failed to inject payload with Python requests library in DVWA forms
I have written a Python script to inject a payload through the requests library, but the payload is being added instead of injecting
xsstestscript=html.unescape("<script>alert&#...
- 1
0
votes
1
answer
56
views
How to send JWT Access token with requests without being sniffed?
I'm trying to create a mobile app which helps to connect with my mobile app. While going through authentication I used JWT. While authenticating it, it returns access token and refresh token to the ...
- 1
0
votes
0
answers
19
views
Should a wildcard cert. e.g. *.example.com, be accepted to authenticate the root domain not listed as SAN? [duplicate]
(This has been marked a duplicate of SSL Cert for sub.domain.com and www.sub.domain.com, but while it's correct that the answer to this question is present in the answers there, that question is ...
- 163
0
votes
0
answers
159
views
File encryption with Python and AES
I need to write a Python script to occasionally encrypt some small text files (~10 Kb)
in order to store them in an insecure environment.
Each file will be encrypted via unique symmetric key and AES ...
- 1
2
votes
1
answer
143
views
How to perform security analysis of jwt authentication libraries
I am working on security analysis of jwt python libraries. I want to analyze how the libraries work and how they were used in development. Not the source code. Also I have to check the jwt libraries ...
- 73
0
votes
0
answers
72
views
Captcha Bypass In-memory Session
I am testing captcha setups with Fastapi. Currently, I am using an in-memory session (stored in a dictionary. Seems to not be a problem as there is no load balancing, etc...).
To fill out the contact ...
0
votes
1
answer
97
views
Would it be useful from a security perspective to harden an interpreter like Python or NodeJS by removing support for unused features?
When hardening a system you want to remove any features that you do not need. I have been thinking about this concept from the perspective of interpreters like Python, NodeJS, PHP etc. and am ...
- 3
0
votes
1
answer
229
views
How do I properly secure my login using bcrypt in react and a python-flask backend?
I want to store the passwords of accounts hashed into a database that can be accessed through a python-flask application. When you would login, this python application is supposed to provide you with ...
- 3
0
votes
0
answers
101
views
Ignore blacklist characters and keywords in SSTI exploit payload
I'm exploiting an SSTI (server-side template insertion) vulnerability in a website written in flask-python.
My problem is that payload for RCE is being limited by blacklist.
I tried everything with a ...
- 1
0
votes
2
answers
201
views
How do I secure SQL passwords when distributing executables?
Environment
I am creating a python application which writes to SQL.
It is compiled into an .exe and distributed to other computers in the business.
(Edit: The SQL server is hosted by our business, ...
0
votes
1
answer
238
views
Intercepting responses using mitmproxy in Python. Problem in decryption
I have set up MitmProxy with a Python script to intercept network responses from one domain, used by a Desktop App. However, when I start up the App, I get the following series of transactions
{
&...
0
votes
1
answer
206
views
Flask XSS prevention
I'm trying to fix a possible XSS vulnerability in WebApp (Flask) and I'm not sure what is the best way to prevent XSS without breaking functionality. For example, I have the following code block:
... ...
- 3
1
vote
2
answers
479
views
What if a browser does not honor the "expires" directive of a cookie
I am currently using the Python Flask framework's default session function to manage user login. My understanding is that, session function essentially is an encrypted cookie stored in a client's ...
2
votes
2
answers
208
views
About vulnerability in the dependency
I have read many articles about the vulnerability in the program dependency, either direct or transitive.
Here are two questions come out of my mind.
If a dependency A has a vulnerability (Maybe has ...
- 133
1
vote
2
answers
239
views
How to secure containerized python source code deployed at client side cloud
How can we secure a source code which is deployed at client side cloud and is difficult to reverse engineer just like a licensed product The major difference is that I have a service to protect and do ...
- 23
0
votes
1
answer
887
views
Python SSL - No Shared Ciphers
I am using a custom Python build, with the liboqs-openssl which is encapsulating pq-algorithms. I generated the certificates using the provided dilithium2 algorithm and wanted to create a simple SSL ...
- 3
0
votes
1
answer
338
views
How to check if my ports are exposed to the internet
[Crossposting from SO]
I am trying to make a port scanner in Python and trying to list which all ports are accessible by anyone remotely.
Using the socket.connect_ex package, I was able to check which ...
- 115
2
votes
3
answers
1k
views
Application to detect SSL certificate fingerprint differences
My project is to find out how to detect HTTPS interception/mitm and create some sort of application using detection techniques. One of the ways I was thinking of is a active desktop application to ...
- 442
0
votes
2
answers
355
views
Storing a key in a symmetric encryption for password manager using cryptography module
I am making a password manager and generator. The user creates the login information, and then I hash their password. After that, I generate the password and encrypt the password with a key stored ...
9
votes
3
answers
3k
views
Securing API keys for a Twitter account for a program to be run on other PC's
I've created a method to allow my project EditVideoBot to be 'decentralised', where rather than the program processing and uploading all video editing requests on my own central server, users can ...
- 670
0
votes
1
answer
209
views
Python desktop application: storing cloud database passwords
I am currently building a Python desktop application in PyQt/PySide which will be compiled to .exe. I am planning to use the Azure SQL database and a remote file storage (like S3).
An issue arises ...
8
votes
3
answers
6k
views
Does blocking keywords prevent code injection inside this interactive Python file?
We recently had issues with people messing around inside our system. To prevent code injections within my python code, I implemented the following if block:
#! /usr/bin/python3
#-*- coding:utf-8 -*-
...
- 145
6
votes
6
answers
5k
views
Can I compare 2 same encrypted files by checking it on binary mode?
I have been working on testing whether same encrypted files are same without decrypting it. I have a test file provided to me one with normal data and another encrypted version of it. I need to check ...
1
vote
0
answers
84
views
On python installation, does the setup write any private information on any of the files from the installation folder?
I'm trying to develop some tools to share with people made with a custom python installation.
I've copied the python installation folder into a .zip with the purpose to share with friends and others ...
- 11
1
vote
0
answers
90
views
Is hosting your own website safe? [closed]
So I made this website on python with Flask. I want to host this website on a rasberry pi on my own home network which everybody in my family uses.
Should I?
Is it safe?
- 11
1
vote
2
answers
416
views
Is adding a default context to Python's Urllib necessary security-wise? And is it enough?
I've been messing around with Python to automatize downloading webpages and images when needed, and for that I'm using urllib.request, usually authenticated to the sites with my login. As someone ...
- 11
1
vote
0
answers
77
views
Implications of Python fmtstr injection without secrets passed to the formatter
There are two ways I can think of to format strings in Python where user input may make its way into the format string input:
>>> a = input()
>>> print(a % ())
>>> a = ...
- 278
0
votes
1
answer
100
views
Is creating asymmetric keys dynamically and storing in memory safe?
I want to make an application that uses oauth2 and JWT as access tokens for securing some apis and providing authentication mechanisms. The application is a microservice architecture and wirtten in ...
- 125
0
votes
1
answer
196
views
I mistyped a `pip install` command. Could my system have been compromised?
While working on packaging my Python app, I attempted to install it locally from the parent directory by typing the following command:
pip install cms/
However, I instead typed the following command:
...
- 605
0
votes
2
answers
1k
views
Making My Own Custom Payload [closed]
I have tried many different tools to avoid being detected by an AV while using meterpreter exploit. Here is a list of tools I have tried: Shellter, Posh C2, Hack the World, Veil, Fat Rat, and many ...
- 7
2
votes
0
answers
69
views
How to Get full PLT Entry of a function and not the offset?
I am trying to leak libc's base address by first leaking the address of gets(). However, using Pwntools to get the PLT and GOT (and pretty much anything) entries only gives me their offsets as ...
- 21
1
vote
0
answers
113
views
Snort doesn't capture raw packets
I have a python code on Linux to create a raw packet:
import socket
s = socket.socket(socket.AF_INET, socket.SOCK_RAW, socket.IPPROTO_TCP)
s.setsockopt(socket.IPPROTO_IP, socket.IP_HDRINCL, 1)
...
- 113
0
votes
1
answer
170
views
Allowing the execution of arbitrary code in python
Let's say the user has installed a python interpreter on their machine/browser, for example, using something like https://github.com/iodide-project/pyodide. I understand not allowing someone to enter ...
- 111
2
votes
1
answer
524
views
Is Python's `secrets` module using the same code as the `random` module?
The secrets module is marketed as a safe alternative to random for things that are meant to be secret. But what's the actual difference? Looking at their code, in some cases these libraries actually ...
- 21
2
votes
1
answer
484
views
Python generated RSA keys looks the same
I'm working on a sharing protocol, and the handshake, authentication etc. is done with RSA keys.
By default I use 4096 bit keys, but it seems the beginning and end of any key generated are the same, ...
- 123
1
vote
0
answers
86
views
Cryptographic libraries raising an exception vs. returning a boolean
In several Python libraries, I have seen validation functions that raise exceptions upon failure, instead of returning a boolean result. Examples include:
various verify functions in the Cryptography ...
0
votes
2
answers
2k
views
how to use hashcat in python?
Basically, I want to crack hashes programatically using hashcat python without having to install hashcat binaries.
Python seem to have a module called hashcat (https://pypi.org/project/hashcat/) but I ...
0
votes
1
answer
139
views
script encoder for IDS test
Encoding a payload is a means of evading antivirus or IDS.
With regard to scripts is there a way to do the same thing?
For instance, is it possible to encode a python script in order test intrusion ...
- 39
23
votes
6
answers
9k
views
Is it important for an ethical hacker to know the C language in-depth nowadays? [closed]
I'm interested in becoming an ethical hacker someday. I've been reading articles saying the Python language is very popular in hacking activity because of the extent of its modules (including network)....
- 233
0
votes
0
answers
279
views
Strange get request to my web server [duplicate]
I recently set up a python-bottle web server for a school project to essentially open my Garage Door remotely over the internet. Recently I saw the logs had a strange get request and was wondering if ...
