Hot answers tagged

87 votes

Does blocking keywords prevent code injection inside this interactive Python file?

Simple blacklists are about the worst way to patch a vulnerability. They'll create a lot of false positives and any determined attacker will usually find a way around them. Web Application Firewalls ...
  • 11.3k
84 votes

I have the ability to run arbitrary Python code on the 'apache' user. What damage can I do?

You could write some Python code to upload an SSH server binary and then run it, this will give you full SSH access under the privileges of the Apache user. From there you can easily read the Python ...
  • 12.7k
69 votes
Accepted

Is it important for an ethical hacker to know the C language in-depth nowadays?

Of course, you don't necessarily have to know C, or the given platform's Assembly (read: instruction set), but knowing them is a great help in figuring out many possible low-level vulnerabilities. It ...
  • 616
46 votes
Accepted

Unable to understand why the web app is vulnerable to a Directory traversal attack

I sent a report for a similar vulnerability recently and got a similar response. Turns out most browsers and CLI http clients remove path traversal components from the URL. For instance if on ...
  • 2,299
43 votes

Does bcrypt have a maximum password length?

tl;dr: BCrypt is limited to 72 bytes, not 56. Background BCrypt is limited to 72 bytes. The original paper also mentions the use of a null terminator. This means you would generally limited to: 71 ...
  • 2,125
41 votes
Accepted

Securing API keys for a Twitter account for a program to be run on other PC's

As specified, the problem is completely impossible. You can not, and should not attempt to, make a program - much less a script - do something its user can't see. There are many ways the attacker ...
  • 40.3k
30 votes

Unable to understand why the web app is vulnerable to a Directory traversal attack

First, Nobody pen-tested it. They ran a scanner and handed you the results. A pen-tester would have confirmed the vulnerability and explained how to recreate it. It is possible that the scanner ...
  • 6,807
29 votes

Is it important for an ethical hacker to know the C language in-depth nowadays?

It depends what you want to do. If you want to build tools that can be used to automate tasks that are often performed for ethical hacking (such as penetration testing, port scanning, SSL/TLS testing ...
  • 19.9k
25 votes

Can I compare 2 same encrypted files by checking it on binary mode?

It depends on how the API encrypts the file, and there are a LOT of possible variants here: symmetric (block cipher and stream cipher), or asymmetric, and different implementations of each one. Some ...
  • 50.6k
21 votes
Accepted

Are python's popen (and similar) functions affected by Shellshock?

Any program that, at some point, calls bash is affected. In particular the os.system function is vulnerable if the system has bash as /bin/sh, so any program calling it (or some equivalent) is ...
  • 429
18 votes
Accepted

Are there any Security Concerns to using Python F Strings with User Input

Python's f-strings are actually safer. Use them! String formatting may be dangerous when a format string depends on untrusted data. So, when using str.format() or %-formatting, it's important to use ...
  • 43.9k
16 votes
Accepted

VirusTotal detects threats in Python Anaconda Build 3.6 - is it Reliable?

Only 3 of 62 antivirus products detect this binary as malicious. And the MD5 and SHA-256 of the binary match the officially published hashes. This suggests that these antivirus reports are false ...
15 votes
Accepted

MongoDB Nosql injection in python code

The $where operator in MongoDB is a feature which is best avoided. Its performance is abysmal, and not just because it doesn't benefit from indexes. Almost every common use-case can be solved much ...
  • 48.9k
14 votes

Safely load a pickle file?

The Python manual comes with a warning about the pickle module: Warning The pickle module is not secure against erroneous or maliciously constructed data. Never unpickle data received from an ...
  • 64.4k
14 votes

Do high level languages allow for buffer / heap overflow?

"level" of a programming languages is not a particularly well-defined concept. C++ for example would generally be regarded as a higher-level language then C but it still leaves the user open ...
  • 4,918
11 votes

Can anyone give feedback on this encryption program?

To asses your encryption method, you must assume that an adversary knows everything except the key. In your case, the adversary knows that every letter is substituted with one of two possible digraphs....
11 votes

Is it important for an ethical hacker to know the C language in-depth nowadays?

In ethical hacking (and hacking in general), the more you know about software and hardware in general, the better off you are - keep in mind there's a lot of different solutions written in lots of ...
11 votes

Can I compare 2 same encrypted files by checking it on binary mode?

"I have been working on testing whether same encrypted files are same without decrypting it" In general, it will not work. The more secure encryption schemes explicitly use a "non-...
  • 22.5k
10 votes

Securing API keys for a Twitter account for a program to be run on other PC's

Obviously, I need a way to encrypt they keys so they're not accessible to the user running the program Obviously, this is impossible. Keys are just data. Software is just data. Everything is just ...
9 votes
Accepted

Writing keylogger and viruses in python

About writing tools like this SYNFlood, python is as good as any other language you feel comfortable with. There is an excellent book called "Violent Python" where you will learn to write security ...
  • 1,523
8 votes

MongoDB Nosql injection in python code

Can anyone give me an example like what input may cause the issues For your concrete piece of code this should work: '; while(1);var foo='bar '; is used to escape the string and the statement, ...
  • 29k
8 votes
Accepted

Is this sanitizer vulnerable to XSS?

The class attribute could be used for redressing the UI to make untrusted elements and text appear to be authoritative text coming from the website itself. See the Google Browser Security Handbook ...
8 votes
Accepted

Are there any risks to matching user-supplied regex against user-supplied inputs?

Regex can become an incredibly slow operation in Python 3 because python's re module doesn't build a DFA in the background and instead uses recursive backtracking. This means that the regular ...
  • 1,479
8 votes
Accepted

What does `&==;` mean with regard to Python Django and bypassing WAFs?

Read it as: & == ; This bullet point just means that the Django framework for Python parses both an ampersand (&) and a semicolon (;) equally as valid separators of query parameters in a ...
  • 43.9k
8 votes

Write a Python or C program to guess the key

I agree with multithr3at3d that this question smells like a homework problem. But, it's a fun exercise - and more importantly, it highlights the reason that strong random number generators are so ...
  • 19.9k
7 votes

Are python's popen (and similar) functions affected by Shellshock?

Yes, popen is affected by ShellShock. However, I do not have a comprehensive list to provide you - anything that is backed by a call to /bin/bash (such as a call to /bin/sh which links to /bin/bash - ...
  • 2,936
7 votes
Accepted

Proving the need to upgrade Django

I use Django a good deal and I did need to migrate 1.6 to 1.7 (although it was some 2-3 years ago). During that time the most important difference in terms of security was django.contrib.messages, ...
  • 5,677
7 votes
Accepted

SSRF Attack Exploitation Scenario

In a server-side request forgery (SSRF) attack, the attacker forces a vulnerable server to issue malicious requests on their behalf. Your linked video shows a typical scenario: Many community ...
  • 43.9k
7 votes
Accepted

Web App Pentesting: When enumerating website directories and files, how to tell if HTTP 200 is a valid page, or a failure page?

Web Applications and HTTP Status Codes If it's returning 200 on both an unauthorized page (302 Redirects to 200 login page), and an authorized page (discovered authorized page), there are some things ...
  • 22.5k

Only top scored, non community-wiki answers of a minimum length are eligible