87
votes
Does blocking keywords prevent code injection inside this interactive Python file?
Simple blacklists are about the worst way to patch a vulnerability. They'll create a lot of false positives and any determined attacker will usually find a way around them.
Web Application Firewalls ...
- 11.6k
74
votes
Accepted
Filter arbitrary code for blacklisted keywords except on commented lines
This is not a secure approach for several reasons.
First, using a simplistic search-and-replace approach instead of a Python parser means there's a huge risk that an attacker can take advantage of ...
- 22.9k
69
votes
Accepted
Is it important for an ethical hacker to know the C language in-depth nowadays?
Of course, you don't necessarily have to know C, or the given platform's Assembly (read: instruction set), but knowing them is a great help in figuring out many possible low-level vulnerabilities.
It ...
- 616
54
votes
Does bcrypt have a maximum password length?
tl;dr: BCrypt is limited to 72 bytes, not 56.
Background
BCrypt is limited to 72 bytes. The original paper also mentions the use of a null terminator. This means you would generally limited to:
71 ...
- 2,374
41
votes
Accepted
Securing API keys for a Twitter account for a program to be run on other PC's
As specified, the problem is completely impossible. You can not, and should not attempt to, make a program - much less a script - do something its user can't see. There are many ways the attacker ...
- 52.1k
29
votes
Is it important for an ethical hacker to know the C language in-depth nowadays?
It depends what you want to do.
If you want to build tools that can be used to automate tasks that are often performed for ethical hacking (such as penetration testing, port scanning, SSL/TLS testing ...
- 24k
25
votes
Can I compare 2 same encrypted files by checking it on binary mode?
It depends on how the API encrypts the file, and there are a LOT of possible variants here: symmetric (block cipher and stream cipher), or asymmetric, and different implementations of each one.
Some ...
- 55.5k
22
votes
Accepted
Are there any Security Concerns to using Python F Strings with User Input
Python's f-strings are actually safer. Use them!
String formatting may be dangerous when a format string depends on untrusted data. So, when using str.format() or %-formatting, it's important to use ...
- 45.1k
17
votes
Safely load a pickle file?
The Python manual comes with a warning about the pickle module:
Warning The pickle module is not secure against erroneous or maliciously constructed data. Never unpickle data received from an ...
- 65.8k
16
votes
Accepted
VirusTotal detects threats in Python Anaconda Build 3.6 - is it Reliable?
Only 3 of 62 antivirus products detect this binary as malicious. And the MD5 and SHA-256 of the binary match the officially published hashes. This suggests that these antivirus reports are false ...
- 208k
15
votes
Do high level languages allow for buffer / heap overflow?
"level" of a programming languages is not a particularly well-defined concept.
C++ for example would generally be regarded as a higher-level language then C but it still leaves the user open ...
- 5,406
13
votes
Filter arbitrary code for blacklisted keywords except on commented lines
Try Lua
If you just need to run user-supplied scripts and aren't too concerned about what language the scripts are written in, you might find Lua a better fit than Python.
Lua is designed to allow you,...
- 231
11
votes
Can anyone give feedback on this encryption program?
To asses your encryption method, you must assume that an adversary knows everything except the key. In your case, the adversary knows that every letter is substituted with one of two possible digraphs....
- 1,158
11
votes
Is it important for an ethical hacker to know the C language in-depth nowadays?
In ethical hacking (and hacking in general), the more you know about software and hardware in general, the better off you are - keep in mind there's a lot of different solutions written in lots of ...
- 211
11
votes
Can I compare 2 same encrypted files by checking it on binary mode?
"I have been working on testing whether same encrypted files are same without decrypting it"
In general, it will not work. The more secure encryption schemes explicitly use a "non-...
- 23k
11
votes
What's a good way to append a nonce to ciphertext in Python for AES GCM in Python?
Just to add to Ja1024's very good answer, Google Tink's wire format is a good example of the sort of format suggested. It uses Protocol Buffers instead of JSON / base64 so might be a good option if ...
- 1,305
10
votes
Accepted
Ken Thompson's compiler hack
No, because the source you can see doesn't necessarily match up with the binary you're using. The specific attack described in that paper involves multiple compiler source versions: there is a ...
- 27.4k
10
votes
Securing API keys for a Twitter account for a program to be run on other PC's
Obviously, I need a way to encrypt they keys so they're not accessible to the user running the program
Obviously, this is impossible.
Keys are just data. Software is just data. Everything is just ...
- 352
10
votes
Securing HTTP File Transfer over local network
For security, you need authentication. If Alice wants to sends a file to Bob's computer, Alice's app needs a way to verify that it's Bob's computer it's talking to, and not an attacker's computer. So ...
- 34.4k
10
votes
Accepted
What's a good way to append a nonce to ciphertext in Python for AES GCM in Python?
The output format doesn't matter for security as long as it's unambiguous, and there is no standard practice. If you want to use this in production over a long period of time, I recommend you add an ...
- 22.9k
9
votes
Accepted
ARP spoofing with Scapy. How does Scapy reroute traffic?
Scapy does not route the traffic, nor does it touch the traffic at all in this scenario. When you enable IP forwarding on a host, it becomes a router. When the host receives a packet not destined for ...
- 13.2k
9
votes
Write a Python or C program to guess the key
I agree with multithr3at3d that this question smells like a homework problem. But, it's a fun exercise - and more importantly, it highlights the reason that strong random number generators are so ...
- 24k
8
votes
Accepted
What does `&==;` mean with regard to Python Django and bypassing WAFs?
Read it as: & == ;
This bullet point just means that the Django framework for Python parses both an ampersand (&) and a semicolon (;) equally as valid separators of query parameters in a ...
- 45.1k
8
votes
Python's http.server library "basic security checks"
The problem isn't that there are known security vulnerabilities.
The problem is that there is not really an effort to address less common but critical vulnerabilities.
For example, many web servers ...
- 6,130
7
votes
Accepted
Proving the need to upgrade Django
I use Django a good deal and I did need to migrate 1.6 to 1.7 (although it was some 2-3 years ago). During that time the most important difference in terms of security was django.contrib.messages, ...
- 5,897
7
votes
Accepted
SSRF Attack Exploitation Scenario
In a server-side request forgery (SSRF) attack, the attacker forces a vulnerable server to issue malicious requests on their behalf.
Your linked video shows a typical scenario: Many community ...
- 45.1k
7
votes
Accepted
Web App Pentesting: When enumerating website directories and files, how to tell if HTTP 200 is a valid page, or a failure page?
Web Applications and HTTP Status Codes
If it's returning 200 on both an unauthorized page (302 Redirects to 200 login page), and an authorized page (discovered authorized page), there are some things ...
- 22.6k
7
votes
Ken Thompson's compiler hack
can't we just go through the compiler's source code and check for any backdoor, what was the article's point?
The whole point of the article is that can't do that because the backdoor is not in the ...
- 1,290
7
votes
Can anyone give feedback on this encryption program?
Welcome to security.stackexchange!
First of all, I should start by quoting the Schneier's Law:
Anyone, from the most clueless amateur to the best cryptographer, can create an algorithm that he ...
- 19.1k
Only top scored, non community-wiki answers of a minimum length are eligible