Hot answers tagged

10

To asses your encryption method, you must assume that an adversary knows everything except the key. In your case, the adversary knows that every letter is substituted with one of two possible digraphs. In spite of the variance introduced, this still makes it a substitution cipher. Those can be attacked by simple statistics: Given a long enough crypto text, ...


7

Welcome to security.stackexchange! First of all, I should start by quoting the Schneier's Law: Anyone, from the most clueless amateur to the best cryptographer, can create an algorithm that he himself can't break. It's not even hard. What is hard is creating an algorithm that no one else can break, even after years of analysis. This is valid for you, me,...


5

tl/dr: Whether or not you have a reflected XSS vulnerability depends on the exact method you use to append the data. Therefore you should specifically check your chosen method to make sure it is safe. Modern javascript frameworks typically take care of these things automatically for you, but jQuery doesn't, so attention to detail is critical. You don't ...


4

I agree with multithr3at3d that this question smells like a homework problem. But, it's a fun exercise - and more importantly, it highlights the reason that strong random number generators are so critical in cryptography. It also illustrates how easy it is for a hacker to brute-force an encryption key, given a small amount of known plaintext and some ...


4

Your website may be vulnerable to a reflected XSS attack (It depends upon how you are setting that value and how the data is interpreted). For example, imagine if I access the following URL: mysite.com?p="></a><script>malicious_code()</script><a href=" If your site converts this: <a href="secondurl.com">Link </a> into ...


4

Sort of... Firstly, Pypi includes a hash of the file being downloaded, so that any modifications/errors between server and client will be spotted. Secondly, pip has support for a hash-checking mode where you can specify the required hash for the requested package in requirements.txt in the form: Foo==1.2.3 --hash=sha256:xxxxxxx pip will then verify that ...


4

The short answer is: pip always uses TLS, which is actually fairly useful here. It means that as long as no-one's managed to compromise PyPI itself or steal the site certificate, then you can be certain that the packages you download are the ones that the PyPI admins think are correct. And it's hard to do better than that: after all, the PyPI admins are the ...


3

In true end-to-end encryption you'd generate keys for authentication on the client. The actual encryption is usually done using an algorithm which supports forward secrecy, like Diffie-Hellmann. The web is a bad form factor for this, as local storage can usually be deleted at any time. As for your last question: there is an implementation of the Signal ...


2

Use $( ) The $( ) construct is equivalent to the backticks, executing the inner command: $ python -c 'import os; import sys; os.system("ping " + sys.argv[1])' '$(cat /etc/passwd > /dev/stderr)' root:x:0:0:root:/root:/bin/bash ...


2

If a package has been discovered to be malicious, it will be taken down. The npm advisories link for malicious npm packages is mostly a history if you're looking at packages to download. There isn't a need for a service to tell you whether a package you're about to download is malicious (because it would not exist). On the other hand, when looking at ...


2

Is it a good counter-measure for this kind of a situation? No. Unfortunately what you're planning to do won't address this specific threat. Here, the attackers compromised the package on PyPI itself, hence it was downloaded from the original source, so limiting downloads only to PyPI would have no effect. In most cases, these compromised packages come in ...


2

Using Java or Python instead of C or C++ does indeed (almost) completely remove the risk of buffer overflows and similar. That does not automatically make such services safe or even safer - there are whole classes of vulnerabilities (check out OWASP top 10) completely unrelated to memory safety. So would writing an OS in Python of Java be a good idea? It's ...


2

The problem isn't that there are known security vulnerabilities. The problem is that there is not really an effort to address less common but critical vulnerabilities. For example, many web servers will display error messages. Until quite recently, Apache Httpd would include some of the request data in the error pages, which allowed cross-site scripting ...


2

openssl req -in foo.csr -pubkey -noout gives you directly the public key as PEM: $ openssl req -in foo.csr -pubkey -noout -----BEGIN PUBLIC KEY----- MIIBIjANBgkqhkiG9w0BAQEFAAOCAQ8AMIIBCgKCAQEA8+To7d+2kPWeBv/orU3L VbJwDrSQbeKamCmowp5bqDxIwV20zqRb7APUOKYoVEFFOEQs6T6gImnIolhbiH6m 4zgZ/CPvWBOkZc+c1Po2EmvBz+AD5sBdT5kzGQA6NbWyZGldxRthNLOs1efOhdnW ...


2

What the processor sees when it is executing is never the source code - it sees machine code, which in its human-readable format is called assembly code. When you compile a program, in any compiled language (more on that later), the compiler takes the high level code, performs operations on it, links it all together and turns all of that into machine ...


2

If there's serious money at stake, obfuscation definitely won't be good enough. Run the code as a service on your own server instead, and sell access to that, so that people who would want to steal it don't even have access to the binary at all.


1

You need to be able to distinguish between the trusted client and the untrusted third party in order to block the third party. This means that you somehow need to find out when the trusted client connected and when the connection does not come from the trusted client. This means you need some form of authentication but it does not need to be some setup with ...


1

A proxy forwards all traffic and therefore has the possibility to also modify the traffic and thus also to modify the traffic in a malicious way, including making the client download malware or exploiting bugs in the client processing the traffic. This is definitely true for plain HTTP but is also true for HTTPS if the client does not properly check the ...


1

It sounds like what you are wanting to implement is a signed URL, similar to Amazon S3 URLs. As long as your secret is strong and secure it sounds like a reasonable way to verify the email address in a stateless fashion. At the moment you are only signing/hasing the PIN and this is an issue with your code. If I get a valid PIN/PIN_HASH combination for ...


1

It appears the code you are using doesn't check or set the wireless channel for either transmitter or receiver. If they are not on the same channel, they cannot communicate. Since you have success some of the time, there could be other daemons that are hopping channels (e.g. scanning for available networks). For your code to work, you will need to kill ...


1

Well, unsure for Java, but the standard Python implementation is called C-Python and is written in C language. So (if it was even possible) an OS written in Python would ultimately be built using C. Moreover, when we think of programming languages, most are targetted at writing applications, not OS and programmers rely on the language implementation to ...


1

Memory safety is very common source of vulnerabilities and completely avoidable. Clearly it should go. However, there are many other ways to make software unsafe that memory-safety does not directly address. 100% Pure Java was a Sun trademark and marketing campaign. It required applications to be unusably platform independent. Clearly there is a need for at ...


1

I would suggest rethinking your approach. Hashes are not virus signatures; they only serve as a fingerprint to identify files. With most conventional hash algorithms (e.g. SHA256), modifying the input slightly results in an entirely different hash output. Thus there is no correlation between malicious features in your virus files and their hashes. ...


1

There's nothing wrong with your code there. What you're getting is a code compile error, and your code is syntactically fine. I'm running your code just dumping the variables rather than trying to send an email: <?php $to = 'nobody@example.com'; $subject = 'the subject'; $message = 'hello'; $headers = 'From: webmaster@example.com' . "\r\n"; ...


1

Thats the shell code generated in python, you execute that on the target/vulnerable machine in general. Thats are the opcodes in assembler and python dont know nothing about it in general. What you can do is to convert your shell code in assembler with any disassembler(capstone, distorm, etc...) python lib and then check this link https://stackoverflow.com/...


1

What is starti? Is this a wrapper script around gdb/peda? By what means is the string being generated by python3 being passed to the vulnerable application? Is the shell involved in the middle? We expect: python -c 'print("\x48\x49\x90\x84\xe3\xe9")' |xxd 0000000: 4849 9084 e3e9 0a HI..... But instead python3 gives us: python3 ...


1

Yes, 6 months is indeed a very long time because if the token gets stolen by an unauthorised third party, that party would be able to use the token for a very long time (unless detected). This is not very secure. As you said, a slightly more secure way to do it is just as you mentioned - use refresh tokens. The way this works is that you’d have two tokens -...


1

Sanitizing input is (most of the times) not enough on it's own - on top of what JimmyJames wrote, I'll also add Output Escaping & Encoding. Many developers I come across think sanitizing user input is sufficient but it is not. I recommend you read more about XSS attack mitigation. OWASP can be a great starting point. In addition, I want to make sure you ...


1

Alright, let's do this step-by-step. As you said, you have to fill the buffer with junk data until you overwrite the instruction pointer. First, you need to find out how many bytes you have to send in order to completely fill the buffer. You have to try with various length junk data, until the program crash with a segfault. /task2/vuln "$(python -c "...


1

One of the requirements of Pypi is that the URI contains "api/pypi" on the path, so with a good firewall you can put a rule that only allows your domain that you trust pip and you can reject the rest with a regular expression that contains the api/pypi.


Only top voted, non community-wiki answers of a minimum length are eligible