Questions tagged [python]

High-level dynamic language developed by Guido van Rossum, particularly popular for server-side web programming and scripting.

Filter by
Sorted by
Tagged with
0 votes
0 answers
42 views

Automatically check if a certificate matches specific ciphers

My nginx backend server supports the following ciphers: ssl_ciphers "TLS_AES_256_GCM_SHA384:TLS_CHACHA20_POLY1305_SHA256:TLS_AES_128_GCM_SHA256:DHE-RSA-AES256-GCM-SHA384:DHE-RSA-AES128-GCM-SHA256:...
Shahar G's user avatar
1 vote
0 answers
24 views

I'm not sure if my python deauth attack isn't working properly or if I can't capture deauthentication packages with wireshark? [closed]

I've been testing trying to deauthenticate my kindle from own wifi network. I created the following python script using scapy: from scapy.all import( RadioTap, Dot11, Dot11Deauth, ...
blondiefunk69's user avatar
0 votes
1 answer
26 views

Automatically enabling javascript in the browser using the link? [closed]

I need to create a link using Python or HTML. When I open this link in the browser, I want javascript to be enabled automatically in my browser's settings. How can I use HTML for this?
Nbn77's user avatar
  • 1
-1 votes
0 answers
19 views

Python: I am am having issues plotting graphs in notebook even after using matplotlib...What am i not doing right? [migrated]

I am new to cybersecurity. Doing a virtual internship on forage and I have been having issues in completing some of the questions. I will try to list them one after the other. I used import pandas as ...
Lateef Oyebanji's user avatar
0 votes
0 answers
43 views

How to embed a PE file to another PE files

So what I want to do basically is what BDFproxy does on the go, I want to modify a file (on the disk) to embed another PE in it and have both working, it does not matter if they work concurrently or ...
LuckyCoder3607's user avatar
11 votes
3 answers
4k views

Filter arbitrary code for blacklisted keywords except on commented lines

I have a Rust-app executing Python-scripts using PyO3. The Python-scripts are uploaded by users, so I need to check for unsafe code before executing it. The scripts should only be able to do ...
O'Niel's user avatar
  • 2,904
0 votes
0 answers
32 views

Assessing the Implications of Using msoffcrypto for Open Sourcing a Medical Data Processing Pipeline

I am in the process of creating a Python pipeline intended for reading and processing sensitive medical personal data from password-protected Excel files. The pipeline utilizes the msoffcrypto library,...
Eoin's user avatar
  • 1
1 vote
2 answers
78 views

Detecting if application connects remotely in linux

Consider me the average Linux user. I know the basics of shell scripting and intermediate Python. However, I have very limited knowledge of system admin or security related matters. Background: Say ...
ciru_4011's user avatar
1 vote
1 answer
70 views

how to communicate with an smtp serverusing socket library in python [closed]

i am trying to print the output of HELP command not the output of me connecting to the SMTP server that is how my code looks like **import socket s = socket.socket(socket.AF_INET,socket.SOCK_STREAM) s....
youssef blt's user avatar
2 votes
1 answer
104 views

Does Python in Excel have the same Security issues as VBS in Excel?

Microsoft Excel supports Python scripts (source). VBScript Macros within Excel are known to be a security risk (source). If I read this emotet article right, then VBScript macros allow arbitrary code ...
Martin Thoma's user avatar
  • 3,956
0 votes
1 answer
111 views

Burpsuite proxy does not get HTTP error 429 but vanilla python requests do?

When I make a normal python request to some site without any proxies I am getting a 429 response, too many requests. However when I open up burpsuite proxy and add proxies = { "http": &...
Lorde213423432e43434's user avatar
2 votes
1 answer
264 views

Python Code Injection With int()

I discovered reading the documentation for int() in python that I could execute operating system commands if something like the following were passed to the int() constructor: type('',(),{'a':5,'b':6,'...
elidibus's user avatar
1 vote
1 answer
194 views

Decrypt python source code at runtime [closed]

I'm wondering if it's possible to get the source code of some python program if the developer encrypted this source. We download a program in which the source is encrypted. But in order to translate ...
ushi YT-майнкрафт's user avatar
0 votes
2 answers
120 views

Python: Does pip install allow escalation of privileges, e.g. through setuid?

I've read that pip install foo allows the developers of foo to run arbitrary code on my machine. I don't mind, as long as I can use Linux user permissions to sandbox it. However, I worry that maybe ...
David Knipe's user avatar
0 votes
1 answer
173 views

Does pip-audit just search requirements.txt for known CVEs?

When looking for a way to shrink the attack surface for pypi package-typo-squatting, I came across a package called pip-audit on an article on the RedHat blog. I attempted to use it, but I'm quite ...
leeand00's user avatar
  • 1,431
0 votes
1 answer
112 views

Is exposing a bind shell to tor dangerous?

I have a bind shell written in python: s = socket.socket(socket.AF_INET, socket.SOCK_STREAM) s.bind(("127.0.0.1", "710")) s.listen(1) conn, addr = s.accept() print(f"[*] ...
johnrollins's user avatar
0 votes
0 answers
155 views

Encoding shellcode to hide in filename / directory

Working on a CTF challenge and the coordinators hint suggests that one of the vectors to inject shellcode is via pathing. Looking at debugging prints does show the cwd and filename are passed onto the ...
TKC's user avatar
  • 1
0 votes
0 answers
124 views

Wireshark can't decrypt TLS from a specific python library

I have a problem. I'm using Wireshark 4.0.8. I created my ssl file to store my "(pre)-master-secrets". I can thus decrypt TLS from my browser or from different python libraries without ...
Big BG's user avatar
  • 1
0 votes
1 answer
78 views

Is deploying a web application to a customer's encrypted drive a secure solution against code theft?

I have developed a web service for customer. The web service is written in Python and running in Docker containers. It is managed by docker compose. The customer wants my web service to run on their ...
harry_tums's user avatar
2 votes
1 answer
121 views

Where to query for CVEs present in a version of a software project like npm packages of python modules?

In node, I can run npm audit and it will show me known vulnerabilities for the versions my dependencies are using. That's cool and all, but I'd like to be able to do the following, on some website or ...
KoenDG's user avatar
  • 21
0 votes
0 answers
121 views

Bearer JWT session token value

I am working on a personal project, I am now working on the authentication. My back-end is written in Python (fast-API) and I am generating a JWT bearer token that I put on my cookies for my front end....
Pierre-Alexandre's user avatar
3 votes
1 answer
417 views

How do I prevent user from accessing docker image content?

I have a SaaS web application. One of my clients needs the app to be installed on his infrastructure (meaning physically on servers only they can access). The application stack is 2 docker images: one ...
Moen's user avatar
  • 31
0 votes
1 answer
111 views

Working of .pem file

I wanted to know that if I make an application and need to use ssl to encrypt the TCP connection then is it necessary to save the keys in .pem file, like what if malicious software just steals that ....
Harshit singh's user avatar
2 votes
0 answers
85 views

Using API key as public key and IP address as private key to WASM application

I'm trying to offer a service to users that allows them to write Python via pyodide or R code via webR in their browser against my own data. I've been thinking of ways to go about this and I'm curious ...
S3AN556's user avatar
  • 21
0 votes
1 answer
210 views

With Response header having content-type: application/json, is it still possible to trigger XSS?

The application is responding using the user supplied request but the content type is set as application/json. Is it possible to trigger still XSS? This is a language neutral question, it can be Java,...
warrior-oo7's user avatar
0 votes
1 answer
84 views

clkhash - why is secret secret?

The documentation for clkhash (https://clkhash.readthedocs.io/en/stable/tutorial_api.html) states that "knowledge of this secret is sufficient to reconstruct the PII information from a CLK". ...
jgeoirgnlsfnv's user avatar
2 votes
1 answer
134 views

Which security measures are implemented by cloud platforms that permit submitting Python code to be executed remotely?

Which security measures are implemented by cloud platforms that permit submitting Python code to be executed remotely? I can think of a few examples: user access control resource allocation job queue ...
Radu M.'s user avatar
  • 123
0 votes
0 answers
719 views

Arbitrary File Upload Vulnerability

I have found an arbitrary file upload vulnerability on a flask application that I was playing with that essentially allows me to append to any file (and create new ones) in the file system. The code ...
João Andreotti's user avatar
0 votes
0 answers
64 views

Does Google Colaboratory save code on local computer when using local runtime?

When running Python code from Google Colab on local computer (local runtime), is it saved on the local computer or not?
Yuqi's user avatar
  • 1
0 votes
0 answers
1k views

Is format string still an issue in Python?

I am not familiar with Python. I found lots of places talking about the format string issue in python. To understand its impact, I created a very simple test code: # assume this CONFIG holds sensitive ...
user1024888's user avatar
0 votes
1 answer
931 views

Not able to see server response when making request using python

Using the requests library, I am trying to make request to a url. I've set the target to the specific url and checked, "And URL Is in Target Scope" in both Request interception rules and ...
Karan Bakshi's user avatar
0 votes
1 answer
2k views

Volatility: AutoMagic Symbol Table error

I am trying to analyze the .vmem file from HoneyNet challenge 3: Banking Troubles (HoneyNet) using volatility3. But I can't seem to get past this error: PS C:\Users\<user>\Desktop\HoneyNet\...
Varghese George's user avatar
0 votes
0 answers
145 views

store strings in db with asymmetric encryption for a python app keeping the data secure

I'm designing an app that receives sensitive data input from a user and that data needs to be saved securely in a database. As far as I understand it needs asymmetric encryption but since this app has ...
mic f's user avatar
  • 1
2 votes
1 answer
554 views

Metasploit Python module: "Unknown datastore option: CMD."

In a Python Metasploit module that I'm developing, I am trying to use CMD as one of the options: 'options': { 'RHOST': {'type': 'address', 'description': 'Target address', 'required': True, '...
Aaron Meese's user avatar
1 vote
1 answer
110 views

Need help deciphering these logs regarding YASSL attack on MySQL [closed]

I am getting the occasional message from our Fortigate Fortinet firewall, indicating that there is a yaSSL.Buffer.Overflow attack. The log from the Fortinet is: Description: Subject: attack:MySQL....
Zak's user avatar
  • 113
0 votes
1 answer
578 views

How long would this take to bruteforce?

I am working on the following war game from Defend The Web, which requires me to do a source code review to login as the user memtash. The code is on GitLab here. Having inspected the source code ...
user5623335's user avatar
1 vote
1 answer
73 views

Is my Jupyter notebook on EC2 secure?

I have a product I am making available to some users that runs via a Jupyter notebook. I deploy Jupyter inside of a docker container to an EC2 host. Each user gets an instance I'll send to them. For ...
achyrd's user avatar
  • 115
-1 votes
1 answer
78 views

Recommended way to merge a security feature with the rest of the software? [closed]

I am searching for the best way to merge two parts of software together, so it would be as hard as possible to separate them again through reverse engineering. At the moment are both parts python, but ...
127 001's user avatar
  • 56
0 votes
1 answer
63 views

Would XerXes be effective without sending anything over the connections it opens?

From what I gathered, the gist of XerXes is doing this (snippet in Python): with socket(AF_INET, SOCK_STREAM) as s: s.connect((host, port)) s.send(b"0") simultaneously, i.e. ...
John Smith's user avatar
9 votes
3 answers
1k views

What makes chopping RSA payloads into constant size chunks unsafe?

I am encrypting chat messages with RSA thus speed is no issue. It was working fine before I tried transmitting a long message. Now I need to cope with the fact RSA is block, instead of stream, based. ...
Vorac's user avatar
  • 1,917
0 votes
1 answer
267 views

Malicious python packages and antivirus

I just learnt that in PyPi you can find malicious python packages. For example, you could install a package and in the setup.py there could be code that search for your ssh or aws keys and send them ...
alepic's user avatar
  • 1
0 votes
2 answers
276 views

Asymmetric encryption and data sharing

I have a web application created with Flask in python that uses asymmetric encryption using RSA, the private key is generated from the user's password and is only stored in a cookie on the user's ...
user avatar
1 vote
3 answers
92 views

Authenticating a request from a valid application (unshadowed)

I am working on an application which has an architectural description as below, There is a docker container, lets say Microservice-A, in which multiple processes are running. Each process is ...
HelloWorld's user avatar
1 vote
0 answers
135 views

Implement Replay attacks in python [closed]

For an assignment I have to implement a proof of concept and (optionally attack it). The part of OCSP is working so far. I have a client that sends the request to a server, the server verifies if the ...
Z123's user avatar
  • 11
2 votes
1 answer
149 views

Is it safe to use Python's secrets module in a fresh docker container?

If I create a new Docker container based on a recent Debian image, and if use this container to generate a cryptographic key using Python's secrets module, then is that key safe to use? My ...
MiniQuark's user avatar
  • 123
0 votes
1 answer
291 views

bash: how to securely source a script from an environment variable

Say I want to do source $VIRTUAL_ENV/bin/activate in my bashrc whenever the VIRTUAL_ENV is defined. In general, the idea of running a script pointed by an environment variable seems a bit fishy as it ...
salmin's user avatar
  • 103
0 votes
1 answer
218 views

Can malware override and execute any memory location or it has to be specific?

Rather primitive Malware using Python3 and similar already available software on the victim's machine (which can also be compiled using PyInstaller/pycom if not) has the capability to override the ...
Sir Muffington's user avatar
0 votes
1 answer
139 views

Is this python package safe? I wrongly executed it with admin privileges and would like to know what steps to take to ensure my computer/data is safe

Before anything, please excuse my clear confusion over what is probably a non-issue. Computer security is definitely not my expertise, so any and all help is appreciated. I recently installed a Python ...
rare-quorum's user avatar
1 vote
2 answers
174 views

Encryption method for file that can only be read by program

I have a Python 3 program, and I’m having trouble finding an encryption method that will suit my needs. Suppose the program is on a thumb drive. I would give the thumb drive to someone else, and they ...
Cannabijoy's user avatar
0 votes
0 answers
42 views

What all steps can we take to check the security of Python Packages? [duplicate]

I am new to SOC team and have been given the task to check Python packages from the security standpoint for any vulnerabilities or if that python package is safe to install on our laptop or not. So, ...
Sujit_Singh's user avatar

1
2 3 4 5
9