Hot answers tagged

86

Simple blacklists are about the worst way to patch a vulnerability. They'll create a lot of false positives and any determined attacker will usually find a way around them. Web Application Firewalls are a good example. The detection rules they employ are way more complicated than your simplistic blacklist, yet they don't catch everything, and every now and ...


84

You could write some Python code to upload an SSH server binary and then run it, this will give you full SSH access under the privileges of the Apache user. From there you can easily read the Python app's config files and connect to the database using the credentials from there, which will allow you to grab confidential data (no exploits needed here as the ...


69

Of course, you don't necessarily have to know C, or the given platform's Assembly (read: instruction set), but knowing them is a great help in figuring out many possible low-level vulnerabilities. It is not the C language itself that matters, but rather the fact that in order to know C, one must first understand many fundamental computer principles, which is ...


46

I sent a report for a similar vulnerability recently and got a similar response. Turns out most browsers and CLI http clients remove path traversal components from the URL. For instance if on Firefox you type the URL http://example.com/../../../etc/passwd the GET request that arrives at example.com will look like this: GET /etc/passwd HTTP/1.1 [Ommitted ...


41

As specified, the problem is completely impossible. You can not, and should not attempt to, make a program - much less a script - do something its user can't see. There are many ways the attacker could break this. They could just read and analyze your python scripts (even if compiled, .pyc is easy to decompile). They could debug the program as it runs. They ...


39

tl;dr: BCrypt is limited to 72 bytes, not 56. Background BCrypt is limited to 72 bytes. The original paper also mentions the use of a null terminator. This means you would generally limited to: 71 characters + 1 byte null terminator But the BCrypt 2a revision specifies the use of UTF-8 encoding (while the original whitepaper refers to ASCII). When using ...


30

First, Nobody pen-tested it. They ran a scanner and handed you the results. A pen-tester would have confirmed the vulnerability and explained how to recreate it. It is possible that the scanner mistakenly flagged the fact that it got your home page as a response to these payload as a positive finding. I also think, like Jesse, that the double question mark ...


29

It depends what you want to do. If you want to build tools that can be used to automate tasks that are often performed for ethical hacking (such as penetration testing, port scanning, SSL/TLS testing etc.), then Python can be used for this. If you want to analyze code to look for bugs in packages that are widely deployed such as the Linux kernel, openssl, ...


25

It depends on how the API encrypts the file, and there are a LOT of possible variants here: symmetric (block cipher and stream cipher), or asymmetric, and different implementations of each one. Some encryption modes employ something called random IV, and in practice it means that encrypting the same file multiple times with the same key will output different ...


21

Once an attacker already has access to the system it's already way too late. The main concern for not leaking the key is because it is often used as a seed for hashing and signing sessions. The idea is that your production SECRET_KEY needs to be completely different than your development or staging SECRET_KEY. You can actually randomly generate it every ...


21

Any program that, at some point, calls bash is affected. In particular the os.system function is vulnerable if the system has bash as /bin/sh, so any program calling it (or some equivalent) is vulnerable too. The popen functions can be vulnerable, depending on the arguments passed. Quoting from the documentation: Also, for each of these variants, on Unix,...


15

The $where operator in MongoDB is a feature which is best avoided. Its performance is abysmal, and not just because it doesn't benefit from indexes. Almost every common use-case can be solved much more efficiently with a common find-query or aggregation, especially one as trivial as this. But this is security stackexchange, not stackoverflow, so let's focus ...


15

Only 3 of 62 antivirus products detect this binary as malicious. And the MD5 and SHA-256 of the binary match the officially published hashes. This suggests that these antivirus reports are false positives.


14

The Python manual comes with a warning about the pickle module: Warning The pickle module is not secure against erroneous or maliciously constructed data. Never unpickle data received from an untrusted or unauthenticated source. This warning should be taken very seriously. If you unpickle untrusted data, an attacker will be able to exectue arbitrary code ...


12

Yes, malware exists in all sorts of languages. Often, though, some of the most critical fiddly bits of many exploits are written not in C or C++, but rather directly in machine code, carefully assembled often by hand. This may be the only want to get the sizing and alignment correct for what you're trying to do. The distance from the "metal" is a matter of ...


11

To asses your encryption method, you must assume that an adversary knows everything except the key. In your case, the adversary knows that every letter is substituted with one of two possible digraphs. In spite of the variance introduced, this still makes it a substitution cipher. Those can be attacked by simple statistics: Given a long enough crypto text, ...


11

In ethical hacking (and hacking in general), the more you know about software and hardware in general, the better off you are - keep in mind there's a lot of different solutions written in lots of different languages, running on lots of different hardware. As most operating systems are written in C, it can definitiely be advantageous to at least be able to ...


11

"I have been working on testing whether same encrypted files are same without decrypting it" In general, it will not work. The more secure encryption schemes explicitly use a "non-deterministic" (actually they endeavour to be "truly random", not just use a crypto-level PRNG, by collecting entropy through various means) approach, ...


10

Python's f-strings are actually safer. Use them! String formatting may be dangerous when a format string depends on untrusted data. So, when using str.format() or %-formatting, it's important to use static format strings, or to sanitize untrusted parts before applying the formatter function. In contrast, f-strings aren't actually plain strings, but more ...


10

Obviously, I need a way to encrypt they keys so they're not accessible to the user running the program Obviously, this is impossible. Keys are just data. Software is just data. Everything is just data, and if the data is in someone else’s computer, you cannot prevent them from accessing the data! (It is just like writing something on a piece of paper and ...


9

About writing tools like this SYNFlood, python is as good as any other language you feel comfortable with. There is an excellent book called "Violent Python" where you will learn to write security auditing tools and malwares. From network scanners, login bruteforcers, FastFlux behavior to mimicking botnet functionalities, you will learn a lot about them. ...


8

Can anyone give me an example like what input may cause the issues For your concrete piece of code this should work: '; while(1);var foo='bar '; is used to escape the string and the statement, then follows the actual attack while(1); (DOS attack), and then the still standing ' is transformed to valid syntax via var foo='bar. Up to version 2.4 of MongoDB,...


8

The class attribute could be used for redressing the UI to make untrusted elements and text appear to be authoritative text coming from the website itself. See the Google Browser Security Handbook for more information. Instead of writing your own, use an established HTML sanitiser such as Google Caja. These are hard to write because there are so many ways ...


8

Regex can become an incredibly slow operation in Python 3 because python's re module doesn't build a DFA in the background and instead uses recursive backtracking. This means that the regular expression will take exponential time rather than linear time when applied to a string. An attacker could construct a regular expression that takes the maximum amount ...


8

Read it as: & == ; This bullet point just means that the Django framework for Python parses both an ampersand (&) and a semicolon (;) equally as valid separators of query parameters in a given URL. Consequently, the following URLs would be treated identically: https://example.com/foo/bar?x=y&name=peter&debug=1 https://example.com/foo/bar?x=...


7

Yes, popen is affected by ShellShock. However, I do not have a comprehensive list to provide you - anything that is backed by a call to /bin/bash (such as a call to /bin/sh which links to /bin/bash - which is assumed in the below quote) is vulnerable. A range of web apps written in PHP, Python, C++ or Java could be vulnerable if they use calls to ...


7

I use Django a good deal and I did need to migrate 1.6 to 1.7 (although it was some 2-3 years ago). During that time the most important difference in terms of security was django.contrib.messages, which was not aware of HTTPS only cookies in Django 1.6. In other words, if you had something like: MESSAGE_STORAGE = 'django.contrib.messages.storage.cookie....


7

In a server-side request forgery (SSRF) attack, the attacker forces a vulnerable server to issue malicious requests on their behalf. Your linked video shows a typical scenario: Many community websites give you the ability to provide a link to a resource, e.g. the URL to a profile picture you want to upload (StackExchange does that, too). The web server ...


7

Web Applications and HTTP Status Codes If it's returning 200 on both an unauthorized page (302 Redirects to 200 login page), and an authorized page (discovered authorized page), there are some things you can do: You can look for what happens on a successful login. Make a fake account, log in. See what does not get included on the real page, and what doesn'...


7

Scapy does not route the traffic, nor does it touch the traffic at all in this scenario. When you enable IP forwarding on a host, it becomes a router. When the host receives a packet not destined for one of its own addresses, its kernel will route the packet per its routing table. Since the traffic from the victim has a destination IP address not matching ...


Only top voted, non community-wiki answers of a minimum length are eligible