Questions tagged [python]

High-level dynamic language developed by Guido van Rossum, particularly popular for server-side web programming and scripting.

Filter by
Sorted by
Tagged with
0 votes
0 answers
17 views

TLS Interception basics [closed]

I am trying to perform TLS interception in which I was given 2 containers: Host01 and Attacker with a br-intercept bridge. So every HTTP/HTTPS request from Host01 to the Internet passes through the ...
user avatar
1 vote
2 answers
68 views

Need help generating list with crunch

I am new to Kali Linux. I am trying to generate a wordlist of 6- whatever character words where: the first part is an English word that starts with a capital letter the last 5 characters are 8765. It ...
user avatar
  • 51
0 votes
0 answers
32 views

Input sanitization

Is unwanted characters removal enough to prevent most attacks (Python) ? Obviously the code should have more sophisticated rules (ex.remove more than one consecutive white spaces after a new line), ...
user avatar
  • 1
18 votes
6 answers
5k views

Do high level languages allow for buffer / heap overflow?

I'm learning about basic x86 overflows in C but normally I code with Python. Is there anyway that programs written in higher level languages can suffer from buffer/heap overflow?
user avatar
  • 205
1 vote
2 answers
83 views

What are the issues with running a seemingly trustworthy python script from a stranger?

For context: in Sweden, the "end" of COVID has caused a huge buildup in passport applications, as everybody wants to resume travelling. However, due to the poor performance and general UX of ...
user avatar
0 votes
0 answers
40 views

How do you lock down PyPI access?

Another question (Is it possible to block non-PyPI requests during pip install?) asked about locking down non-PyPI pip installs for security reasons. This doesn't deal with the problem of malicious ...
user avatar
  • 101
1 vote
0 answers
84 views

Lesser known security pitfalls in Python [closed]

I recently came across this article: https://blog.sonarsource.com/10-unknown-security-pitfalls-for-python, which describes security pitfalls in the python programming language that are less well known ...
user avatar
0 votes
0 answers
23 views

Can I import this exploit on metasploit or is better to use it in python? [duplicate]

I have tried to import this exploit: https://www.exploit-db.com/exploits/50539 and then use it in Metasploit (I'm following a walkthrough), but Metasploit cannot load it. Also I tried to use Python ...
user avatar
0 votes
1 answer
21 views

is client server model to do some root operations without asking everytime secure?

I'm writing a python application that will do some operations that will require root privileges.So instead of asking for user password every time i decided to use server client model. A python script ...
user avatar
0 votes
1 answer
43 views

Do WSGI servers connect to devices outside of the network?

I want to set up a plotly dashboard and view it from my browser. Plotly gets set up as a flask application. I'm of the understanding that I should use a WSGI server to host it. I'm looking at waitress ...
user avatar
  • 101
0 votes
0 answers
28 views

Failed to inject payload with Python requests library in DVWA forms

I have written a Python script to inject a payload through the requests library, but the payload is being added instead of injecting xsstestscript=html.unescape("<script>alert&#...
user avatar
  • 1
0 votes
1 answer
56 views

How to send JWT Access token with requests without being sniffed?

I'm trying to create a mobile app which helps to connect with my mobile app. While going through authentication I used JWT. While authenticating it, it returns access token and refresh token to the ...
user avatar
0 votes
0 answers
19 views

Should a wildcard cert. e.g. *.example.com, be accepted to authenticate the root domain not listed as SAN? [duplicate]

(This has been marked a duplicate of SSL Cert for sub.domain.com and www.sub.domain.com, but while it's correct that the answer to this question is present in the answers there, that question is ...
user avatar
  • 163
0 votes
0 answers
159 views

File encryption with Python and AES

I need to write a Python script to occasionally encrypt some small text files (~10 Kb) in order to store them in an insecure environment. Each file will be encrypted via unique symmetric key and AES ...
user avatar
  • 1
2 votes
1 answer
143 views

How to perform security analysis of jwt authentication libraries

I am working on security analysis of jwt python libraries. I want to analyze how the libraries work and how they were used in development. Not the source code. Also I have to check the jwt libraries ...
user avatar
  • 73
0 votes
0 answers
72 views

Captcha Bypass In-memory Session

I am testing captcha setups with Fastapi. Currently, I am using an in-memory session (stored in a dictionary. Seems to not be a problem as there is no load balancing, etc...). To fill out the contact ...
user avatar
0 votes
1 answer
97 views

Would it be useful from a security perspective to harden an interpreter like Python or NodeJS by removing support for unused features?

When hardening a system you want to remove any features that you do not need. I have been thinking about this concept from the perspective of interpreters like Python, NodeJS, PHP etc. and am ...
user avatar
  • 3
0 votes
1 answer
229 views

How do I properly secure my login using bcrypt in react and a python-flask backend?

I want to store the passwords of accounts hashed into a database that can be accessed through a python-flask application. When you would login, this python application is supposed to provide you with ...
user avatar
0 votes
0 answers
101 views

Ignore blacklist characters and keywords in SSTI exploit payload

I'm exploiting an SSTI (server-side template insertion) vulnerability in a website written in flask-python. My problem is that payload for RCE is being limited by blacklist. I tried everything with a ...
user avatar
  • 1
0 votes
2 answers
201 views

How do I secure SQL passwords when distributing executables?

Environment I am creating a python application which writes to SQL. It is compiled into an .exe and distributed to other computers in the business. (Edit: The SQL server is hosted by our business, ...
user avatar
0 votes
1 answer
238 views

Intercepting responses using mitmproxy in Python. Problem in decryption

I have set up MitmProxy with a Python script to intercept network responses from one domain, used by a Desktop App. However, when I start up the App, I get the following series of transactions { &...
user avatar
0 votes
1 answer
206 views

Flask XSS prevention

I'm trying to fix a possible XSS vulnerability in WebApp (Flask) and I'm not sure what is the best way to prevent XSS without breaking functionality. For example, I have the following code block: ... ...
user avatar
1 vote
2 answers
479 views

What if a browser does not honor the "expires" directive of a cookie

I am currently using the Python Flask framework's default session function to manage user login. My understanding is that, session function essentially is an encrypted cookie stored in a client's ...
user avatar
2 votes
2 answers
208 views

About vulnerability in the dependency

I have read many articles about the vulnerability in the program dependency, either direct or transitive. Here are two questions come out of my mind. If a dependency A has a vulnerability (Maybe has ...
user avatar
  • 133
1 vote
2 answers
239 views

How to secure containerized python source code deployed at client side cloud

How can we secure a source code which is deployed at client side cloud and is difficult to reverse engineer just like a licensed product The major difference is that I have a service to protect and do ...
user avatar
  • 23
0 votes
1 answer
887 views

Python SSL - No Shared Ciphers

I am using a custom Python build, with the liboqs-openssl which is encapsulating pq-algorithms. I generated the certificates using the provided dilithium2 algorithm and wanted to create a simple SSL ...
user avatar
0 votes
1 answer
338 views

How to check if my ports are exposed to the internet

[Crossposting from SO] I am trying to make a port scanner in Python and trying to list which all ports are accessible by anyone remotely. Using the socket.connect_ex package, I was able to check which ...
user avatar
  • 115
2 votes
3 answers
1k views

Application to detect SSL certificate fingerprint differences

My project is to find out how to detect HTTPS interception/mitm and create some sort of application using detection techniques. One of the ways I was thinking of is a active desktop application to ...
user avatar
  • 442
0 votes
2 answers
355 views

Storing a key in a symmetric encryption for password manager using cryptography module

I am making a password manager and generator. The user creates the login information, and then I hash their password. After that, I generate the password and encrypt the password with a key stored ...
user avatar
9 votes
3 answers
3k views

Securing API keys for a Twitter account for a program to be run on other PC's

I've created a method to allow my project EditVideoBot to be 'decentralised', where rather than the program processing and uploading all video editing requests on my own central server, users can ...
user avatar
0 votes
1 answer
209 views

Python desktop application: storing cloud database passwords

I am currently building a Python desktop application in PyQt/PySide which will be compiled to .exe. I am planning to use the Azure SQL database and a remote file storage (like S3). An issue arises ...
user avatar
8 votes
3 answers
6k views

Does blocking keywords prevent code injection inside this interactive Python file?

We recently had issues with people messing around inside our system. To prevent code injections within my python code, I implemented the following if block: #! /usr/bin/python3 #-*- coding:utf-8 -*- ...
user avatar
6 votes
6 answers
5k views

Can I compare 2 same encrypted files by checking it on binary mode?

I have been working on testing whether same encrypted files are same without decrypting it. I have a test file provided to me one with normal data and another encrypted version of it. I need to check ...
user avatar
1 vote
0 answers
84 views

On python installation, does the setup write any private information on any of the files from the installation folder?

I'm trying to develop some tools to share with people made with a custom python installation. I've copied the python installation folder into a .zip with the purpose to share with friends and others ...
user avatar
  • 11
1 vote
0 answers
90 views

Is hosting your own website safe? [closed]

So I made this website on python with Flask. I want to host this website on a rasberry pi on my own home network which everybody in my family uses. Should I? Is it safe?
user avatar
1 vote
2 answers
416 views

Is adding a default context to Python's Urllib necessary security-wise? And is it enough?

I've been messing around with Python to automatize downloading webpages and images when needed, and for that I'm using urllib.request, usually authenticated to the sites with my login. As someone ...
user avatar
  • 11
1 vote
0 answers
77 views

Implications of Python fmtstr injection without secrets passed to the formatter

There are two ways I can think of to format strings in Python where user input may make its way into the format string input: >>> a = input() >>> print(a % ()) >>> a = ...
user avatar
0 votes
1 answer
100 views

Is creating asymmetric keys dynamically and storing in memory safe?

I want to make an application that uses oauth2 and JWT as access tokens for securing some apis and providing authentication mechanisms. The application is a microservice architecture and wirtten in ...
user avatar
  • 125
0 votes
1 answer
196 views

I mistyped a `pip install` command. Could my system have been compromised?

While working on packaging my Python app, I attempted to install it locally from the parent directory by typing the following command: pip install cms/ However, I instead typed the following command: ...
user avatar
0 votes
2 answers
1k views

Making My Own Custom Payload [closed]

I have tried many different tools to avoid being detected by an AV while using meterpreter exploit. Here is a list of tools I have tried: Shellter, Posh C2, Hack the World, Veil, Fat Rat, and many ...
user avatar
  • 7
2 votes
0 answers
69 views

How to Get full PLT Entry of a function and not the offset?

I am trying to leak libc's base address by first leaking the address of gets(). However, using Pwntools to get the PLT and GOT (and pretty much anything) entries only gives me their offsets as ...
user avatar
1 vote
0 answers
113 views

Snort doesn't capture raw packets

I have a python code on Linux to create a raw packet: import socket s = socket.socket(socket.AF_INET, socket.SOCK_RAW, socket.IPPROTO_TCP) s.setsockopt(socket.IPPROTO_IP, socket.IP_HDRINCL, 1) ...
user avatar
  • 113
0 votes
1 answer
170 views

Allowing the execution of arbitrary code in python

Let's say the user has installed a python interpreter on their machine/browser, for example, using something like https://github.com/iodide-project/pyodide. I understand not allowing someone to enter ...
user avatar
  • 111
2 votes
1 answer
524 views

Is Python's `secrets` module using the same code as the `random` module?

The secrets module is marketed as a safe alternative to random for things that are meant to be secret. But what's the actual difference? Looking at their code, in some cases these libraries actually ...
user avatar
  • 21
2 votes
1 answer
484 views

Python generated RSA keys looks the same

I'm working on a sharing protocol, and the handshake, authentication etc. is done with RSA keys. By default I use 4096 bit keys, but it seems the beginning and end of any key generated are the same, ...
user avatar
  • 123
1 vote
0 answers
86 views

Cryptographic libraries raising an exception vs. returning a boolean

In several Python libraries, I have seen validation functions that raise exceptions upon failure, instead of returning a boolean result. Examples include: various verify functions in the Cryptography ...
user avatar
0 votes
2 answers
2k views

how to use hashcat in python?

Basically, I want to crack hashes programatically using hashcat python without having to install hashcat binaries. Python seem to have a module called hashcat (https://pypi.org/project/hashcat/) but I ...
user avatar
0 votes
1 answer
139 views

script encoder for IDS test

Encoding a payload is a means of evading antivirus or IDS. With regard to scripts is there a way to do the same thing? For instance, is it possible to encode a python script in order test intrusion ...
user avatar
  • 39
23 votes
6 answers
9k views

Is it important for an ethical hacker to know the C language in-depth nowadays? [closed]

I'm interested in becoming an ethical hacker someday. I've been reading articles saying the Python language is very popular in hacking activity because of the extent of its modules (including network)....
user avatar
  • 233
0 votes
0 answers
279 views

Strange get request to my web server [duplicate]

I recently set up a python-bottle web server for a school project to essentially open my Garage Door remotely over the internet. Recently I saw the logs had a strange get request and was wondering if ...
user avatar

1
2 3 4 5
8