Hot answers tagged

5

$(whoami) should bypass the filter and executes whoami.


5

In general, flask-admin is not different to any other web app and you need to follow general application security guidelines. The OWASP Top 10 is a good introduction and there are more detailed guides too. If you've written your own controller code it could be vulnerable to flaws like SQL injection. To configure flask-admin securely, enable CSRF protection ...


5

can't we just go through the compiler's source code and check for any backdoor, what was the article's point? The whole point of the article is that can't do that because the backdoor is not in the compiler's source code. Thompson explains this in various steps: You put a backdoor in the source code of the login program. Obviously, when you examine the ...


4

After checking the link you provided on comments to the exploit you are trying to import on Metasploit, I must say that it is not compatible to Metasploit. I mean, the script you are trying to import never is going to work on Metasploit. This is the link you provided on the comments: https://www.exploit-db.com/exploits/40136/ Metasploit now has the feature ...


4

No, because the source you can see doesn't necessarily match up with the binary you're using. The specific attack described in that paper involves multiple compiler source versions: there is a malicious one, which contains the code to inject backdoors into anything compiled using this compiler, and a clean one, which doesn't contain this code. The attacker ...


3

In true end-to-end encryption you'd generate keys for authentication on the client. The actual encryption is usually done using an algorithm which supports forward secrecy, like Diffie-Hellmann. The web is a bad form factor for this, as local storage can usually be deleted at any time. As for your last question: there is an implementation of the Signal ...


3

A compiler creates a binary from source code. For a normal compiler, the binary is just another representation of the source code, and the behavior of the program is fully specified in the source. However, a malicious compiler can add extra functionality in the binary, functionality that is not present in the source and thus can not be detected by reading ...


2

Use a backslash as the last character in user. For example, for the inputs user\ and or 1=1 -- the following query is run: select * from users where username = 'user\' and password = ' or 1=1 -- ' Where the string input is interpreted like this: select * from users where username = 'user\' and password = ' or 1=1 -- '


2

If you are able to inject username I believe you will inject into SELECT * FROM users WHERE username='admin' that username part so we only need to return a password which we write to password input. The payload for the username input: nobodyhavethisusername' UNION SELECT 1 as id, 'myuser' as username, 'mypassword' as password -- And the payload for ...


2

ZAP supports HTTP basic authentication natively, so you wont need to use Zest in this case. If you know that an app uses basic auth then you can set that up via the API. However I recommend that you start by using the ZAP desktop as this is much easier to use when debugging issues. For specific help with this its probably quicker to ask on the ZAP User Group:...


2

If a package has been discovered to be malicious, it will be taken down. The npm advisories link for malicious npm packages is mostly a history if you're looking at packages to download. There isn't a need for a service to tell you whether a package you're about to download is malicious (because it would not exist). On the other hand, when looking at ...


2

Use $( ) The $( ) construct is equivalent to the backticks, executing the inner command: $ python -c 'import os; import sys; os.system("ping " + sys.argv[1])' '$(cat /etc/passwd > /dev/stderr)' root:x:0:0:root:/root:/bin/bash ...


1

I would not use Selenium as there is an entire class of scripts called Grease Monkey scripts that automate repetitive user task. See TamperMonkey for one of many examples.


1

All my github repos have requirements.txt files in them, and GitHub will email you a warning if there are security issues. (it appears that GitHub will scan any file named requirements.txt anywhere in your repo) The dependency graph will also display some information. As a previous commenter mentioned synk which is a nice tool, I found that for python, ...


1

You can't do that with a single hashcat mask, but you can make multiple masks. You need to use a multiset permutation for this. There are 132 possibilities, so need to generate a .hcmask file with 132 lines like this (in Python with sympy): from sympy.utilities.iterables import multiset_permutations import os contents = os.linesep.join(list(map(lambda b: ""...


1

One simple way I can think of is to sanitize user input using a blacklist which contains the commands you do not want to allow, such as the ones you have mentioned. OWASP provides very good explanation about White/Black lists HERE


1

ImportError: No module named posix Is the problem here. You can either attempt to drop to a bash shell and use pip install posix Or the best solution is to just remove import posix and replace it with import os


1

Don't create your own custom algorithms. This is a trap that novices fall for again and again and again. If you do, you will fail, because you are not an expert. Good algorithms are designed by people who spent decades on this very material, and the results again are checked by hundreds of cryptoanalysts, trying to find any imaginable flaw. Your student, ...


1

YARA allows you to specify multiple rules files to be used (as the latest version). yara64.exe path/rule/file1 path/rule/file2 path/rule/file3 malwareFile I don't know what the limit to the number of rule file paths you can specify is in a single YARA invocation, but this should make it considerably easier to script.


1

HTTP basic auth is prone to be bruteforced. Flask-HTTPAuth with digest mode could be a better solution, but there are also several security concerns to be resolved, as well as additional password and lockout policies. Another approach colud be integration with trusted Oauth provider like Google. This way you just shift authentication-related ...


1

No this does not mean it doesn't accept http requests. What's happening is that your browser (or python) is requesting the website on http (port 80) and it was redirected to https (port 443). Redirection means that the server responded with http response of status code 301 or 302. You can view this by viewing the response.history within your response from ...


1

Python requests almost certainly does not use an https preload list, so the server must be responding to the http request with a redirect. Does the server "accept http:// requests"? That's a trick question. I could answer: yes, because if the server did not respond to http requests at all, then it would not receive your request and could not respond with a ...


1

Sanitizing input is (most of the times) not enough on it's own - on top of what JimmyJames wrote, I'll also add Output Escaping & Encoding. Many developers I come across think sanitizing user input is sufficient but it is not. I recommend you read more about XSS attack mitigation. OWASP can be a great starting point. In addition, I want to make sure you ...


1

No one will be able to tell if this is secure. All I can offer is some advice on other things to consider: path traversal - If you have any support for loading files or templates you need to consider this. For example: verify that things like .. cannot be used to move up the file directory towards root templates - if you are using templates, anything that ...


1

According to man enc: All the block ciphers normally use PKCS#5 padding also known as standard block padding PKCS#5 padding (technically PKCS#7 here) is done by adding N bytes of value N to the plaintext so that it is evenly divisible by the block size. If you don't specify -nopad, enc will expect that, for example, a 30 byte plaintext would be encrypted ...


1

IMHO, there are two different problems here. The former one is technical and resumes to how can I securely store secret information. If it must be used by an application, the best you can do is to encrypt the information. But whatever you do, the application will have to access the plain text information, so if its is hacked, the attacker will have it. At ...


1

Like any beginner, I made this more complicated that it needed to be, and didn't read the documentation properly. The key must be read as bytes ('rb'), and the passphrase must also be bytes-like, as per the documentation. import SecretString from cryptography.hazmat.backends import default_backend from cryptography.hazmat.primitives.serialization import ...


1

The encoding of the content is irrelevant; an attacker can simply use the same encoding. In fact, base64 is a common encoding format for binary serialised data. Here's an example of some vulnerable code that uses base64: class SearchQuery(object): def __init__(self, term, archived, page): self.searchTerm = term self.includeArchived = ...


1

If you take untrusted data, re-encode it another format (doesn't matter which), it's still untrusted data. So yes, there's still a possibility of a vulnerability being exploited.


1

You control two inputs. That means you can end the first one with an escape character, effectively extending it to the start of the second input, and then put arbitrary SQL in the second one. To avoid an unmatched quote at the end of the second input, you'll need to comment out the rest of the query.


Only top voted, non community-wiki answers of a minimum length are eligible