Hot answers tagged

87 votes

Does blocking keywords prevent code injection inside this interactive Python file?

Simple blacklists are about the worst way to patch a vulnerability. They'll create a lot of false positives and any determined attacker will usually find a way around them. Web Application Firewalls ...
nobody's user avatar
  • 11.5k
84 votes

I have the ability to run arbitrary Python code on the 'apache' user. What damage can I do?

You could write some Python code to upload an SSH server binary and then run it, this will give you full SSH access under the privileges of the Apache user. From there you can easily read the Python ...
André Borie's user avatar
  • 12.8k
72 votes
Accepted

Filter arbitrary code for blacklisted keywords except on commented lines

This is not a secure approach for several reasons. First, using a simplistic search-and-replace approach instead of a Python parser means there's a huge risk that an attacker can take advantage of ...
Ja1024's user avatar
  • 4,258
69 votes
Accepted

Is it important for an ethical hacker to know the C language in-depth nowadays?

Of course, you don't necessarily have to know C, or the given platform's Assembly (read: instruction set), but knowing them is a great help in figuring out many possible low-level vulnerabilities. It ...
natiiix's user avatar
  • 616
50 votes

Does bcrypt have a maximum password length?

tl;dr: BCrypt is limited to 72 bytes, not 56. Background BCrypt is limited to 72 bytes. The original paper also mentions the use of a null terminator. This means you would generally limited to: 71 ...
Ian Boyd's user avatar
  • 2,274
46 votes
Accepted

Unable to understand why the web app is vulnerable to a Directory traversal attack

I sent a report for a similar vulnerability recently and got a similar response. Turns out most browsers and CLI http clients remove path traversal components from the URL. For instance if on ...
GnP's user avatar
  • 2,299
41 votes
Accepted

Securing API keys for a Twitter account for a program to be run on other PC's

As specified, the problem is completely impossible. You can not, and should not attempt to, make a program - much less a script - do something its user can't see. There are many ways the attacker ...
CBHacking's user avatar
  • 47.5k
30 votes

Unable to understand why the web app is vulnerable to a Directory traversal attack

First, Nobody pen-tested it. They ran a scanner and handed you the results. A pen-tester would have confirmed the vulnerability and explained how to recreate it. It is possible that the scanner ...
mcgyver5's user avatar
  • 6,874
29 votes

Is it important for an ethical hacker to know the C language in-depth nowadays?

It depends what you want to do. If you want to build tools that can be used to automate tasks that are often performed for ethical hacking (such as penetration testing, port scanning, SSL/TLS testing ...
mti2935's user avatar
  • 23.1k
25 votes

Can I compare 2 same encrypted files by checking it on binary mode?

It depends on how the API encrypts the file, and there are a LOT of possible variants here: symmetric (block cipher and stream cipher), or asymmetric, and different implementations of each one. Some ...
ThoriumBR's user avatar
  • 53.9k
22 votes
Accepted

Are there any Security Concerns to using Python F Strings with User Input

Python's f-strings are actually safer. Use them! String formatting may be dangerous when a format string depends on untrusted data. So, when using str.format() or %-formatting, it's important to use ...
Arminius's user avatar
  • 44.7k
17 votes

Safely load a pickle file?

The Python manual comes with a warning about the pickle module: Warning The pickle module is not secure against erroneous or maliciously constructed data. Never unpickle data received from an ...
Anders's user avatar
  • 65.6k
16 votes
Accepted

VirusTotal detects threats in Python Anaconda Build 3.6 - is it Reliable?

Only 3 of 62 antivirus products detect this binary as malicious. And the MD5 and SHA-256 of the binary match the officially published hashes. This suggests that these antivirus reports are false ...
Steffen Ullrich's user avatar
15 votes

Do high level languages allow for buffer / heap overflow?

"level" of a programming languages is not a particularly well-defined concept. C++ for example would generally be regarded as a higher-level language then C but it still leaves the user open ...
Peter Green's user avatar
  • 5,200
13 votes

Filter arbitrary code for blacklisted keywords except on commented lines

Try Lua If you just need to run user-supplied scripts and aren't too concerned about what language the scripts are written in, you might find Lua a better fit than Python. Lua is designed to allow you,...
Keiji's user avatar
  • 231
11 votes

Can anyone give feedback on this encryption program?

To asses your encryption method, you must assume that an adversary knows everything except the key. In your case, the adversary knows that every letter is substituted with one of two possible digraphs....
Hagen von Eitzen's user avatar
11 votes

Is it important for an ethical hacker to know the C language in-depth nowadays?

In ethical hacking (and hacking in general), the more you know about software and hardware in general, the better off you are - keep in mind there's a lot of different solutions written in lots of ...
Tylon Foxx's user avatar
11 votes

Can I compare 2 same encrypted files by checking it on binary mode?

"I have been working on testing whether same encrypted files are same without decrypting it" In general, it will not work. The more secure encryption schemes explicitly use a "non-...
LSerni's user avatar
  • 22.8k
10 votes

Securing API keys for a Twitter account for a program to be run on other PC's

Obviously, I need a way to encrypt they keys so they're not accessible to the user running the program Obviously, this is impossible. Keys are just data. Software is just data. Everything is just ...
Brian Drake's user avatar
9 votes

Write a Python or C program to guess the key

I agree with multithr3at3d that this question smells like a homework problem. But, it's a fun exercise - and more importantly, it highlights the reason that strong random number generators are so ...
mti2935's user avatar
  • 23.1k
8 votes
Accepted

Are there any risks to matching user-supplied regex against user-supplied inputs?

Regex can become an incredibly slow operation in Python 3 because python's re module doesn't build a DFA in the background and instead uses recursive backtracking. This means that the regular ...
sethmlarson's user avatar
  • 1,507
8 votes
Accepted

What does `&==;` mean with regard to Python Django and bypassing WAFs?

Read it as: & == ; This bullet point just means that the Django framework for Python parses both an ampersand (&) and a semicolon (;) equally as valid separators of query parameters in a ...
Arminius's user avatar
  • 44.7k
8 votes
Accepted

Ken Thompson's compiler hack

No, because the source you can see doesn't necessarily match up with the binary you're using. The specific attack described in that paper involves multiple compiler source versions: there is a ...
Matthew's user avatar
  • 27.4k
8 votes

Python's http.server library "basic security checks"

The problem isn't that there are known security vulnerabilities. The problem is that there is not really an effort to address less common but critical vulnerabilities. For example, many web servers ...
Ghedipunk's user avatar
  • 6,050
7 votes
Accepted

Proving the need to upgrade Django

I use Django a good deal and I did need to migrate 1.6 to 1.7 (although it was some 2-3 years ago). During that time the most important difference in terms of security was django.contrib.messages, ...
grochmal's user avatar
  • 5,867
7 votes
Accepted

SSRF Attack Exploitation Scenario

In a server-side request forgery (SSRF) attack, the attacker forces a vulnerable server to issue malicious requests on their behalf. Your linked video shows a typical scenario: Many community ...
Arminius's user avatar
  • 44.7k
7 votes
Accepted

Web App Pentesting: When enumerating website directories and files, how to tell if HTTP 200 is a valid page, or a failure page?

Web Applications and HTTP Status Codes If it's returning 200 on both an unauthorized page (302 Redirects to 200 login page), and an authorized page (discovered authorized page), there are some things ...
Mark Buffalo's user avatar
  • 22.6k
7 votes
Accepted

ARP spoofing with Scapy. How does Scapy reroute traffic?

Scapy does not route the traffic, nor does it touch the traffic at all in this scenario. When you enable IP forwarding on a host, it becomes a router. When the host receives a packet not destined for ...
multithr3at3d's user avatar
7 votes

Can anyone give feedback on this encryption program?

Welcome to security.stackexchange! First of all, I should start by quoting the Schneier's Law: Anyone, from the most clueless amateur to the best cryptographer, can create an algorithm that he ...
Ángel's user avatar
  • 18.8k

Only top scored, non community-wiki answers of a minimum length are eligible