fading plaza Dec 3, 2020, 1:40 PM

#

or just modify the code

#

to print the values

#

also

#

you shouldnt be handling stuff that the user isn't supposed to access on the client side

#

that should be done server side

thorn obsidian Dec 3, 2020, 3:15 PM

#

how can i have csrf protection for my site i made in flask?

#

The form is submitted through post request

thorn obsidian Dec 3, 2020, 6:30 PM

#

🥺 😢 😭

last ivy Dec 3, 2020, 11:46 PM

#

Don't post lmgtfy links on this server. If you don't have anything to reply, don't reply anything.

spice ocean Dec 4, 2020, 12:33 AM

#

how about telling people to ask properly

#

but sure will stop posting the right anwsers with a little fun included

rose plover Dec 4, 2020, 1:07 AM

#

Wait so if I dont want to reply to someone's question I dont have to answer them hmm interesting.......... 🤔

thorn obsidian Dec 4, 2020, 3:38 PM

#

thorn obsidian how can i have csrf protection for my site i made in flask?

It can be enabled with the help of the Flask-WTF extension

thorn obsidian Dec 4, 2020, 4:16 PM

#

thorn obsidian It can be enabled with the help of the Flask-WTF extension

oh thanks, i think this is what i need

thorn obsidian Dec 4, 2020, 4:37 PM

#

No problem :)

sonic drum Dec 4, 2020, 10:10 PM

#

Can anyone guide me on the way to create a secure E2EE socket communication thing?

#

I wanna use the best SSL library

umbral finch Dec 5, 2020, 5:21 PM

#

From what I gather sha-1 requires a key but if I look up online sha 1 hash gen, it’s converts my plaintext to hash without a key?

#

Is it using a default key or what?

lapis radish Dec 5, 2020, 5:22 PM

#

umbral finch From what I gather sha-1 requires a key but if I look up online sha 1 hash gen, ...

Maybe you are using HMAC with SHA-1 because SHA-1 is not keyed algorithm

#

sha1(message) -> digest

fluid verge Dec 5, 2020, 5:23 PM

#

No cryptographic hash function I know that is not explicitly used for a HMAC has a key

steel ridge Dec 5, 2020, 11:37 PM

#

interesting

thorn obsidian Dec 6, 2020, 12:32 AM

#

steel ridge interesting

Agreed

umbral finch Dec 6, 2020, 3:01 PM

#

Is it true that there’s 16^32 md5 hashes? Since there’s 16 options for each character and 32 characters?

past pulsar Dec 6, 2020, 3:19 PM

#

2 ^ 128 if i am not wrong

#

cause the digest size is 128 bit

woven gazelle Dec 6, 2020, 3:23 PM

#

that's the same number :)

past pulsar Dec 6, 2020, 3:24 PM

#

yup

hard frost Dec 6, 2020, 10:51 PM

#

is there any good videos for learning python within a cyber security spectrum like automation scripting
Ik the fundmentals
and youtubers or udemy courses you guys suggest would be nice

thorn obsidian Dec 7, 2020, 4:39 PM

#

so im kinda new to py and i want to make something like an encryption key type thing where i can set 'a' to = 1 or something so when i type 'apples are great' it will be '1pples 1re gre1t'

plush nova Dec 7, 2020, 5:06 PM

#

ah

#

okay

#

read the docs xD

fading plaza Dec 7, 2020, 7:10 PM

#

!d str.translate

past starBOT Dec 7, 2020, 7:10 PM

#

`str.translate`

str.translate(table)```
Return a copy of the string in which each character has been mapped through the given translation table. The table must be an object that implements indexing via [`__getitem__()`](../reference/datamodel.html#object.__getitem__ "object.__getitem__"), typically a [mapping](../glossary.html#term-mapping) or [sequence](../glossary.html#term-sequence). When indexed by a Unicode ordinal (an integer), the table object can do any of the following: return a Unicode ordinal or a string, to map the character to one or more other characters; return `None`, to delete the character from the return string; or raise a [`LookupError`](exceptions.html#LookupError "LookupError") exception, to map the character to itself.

You can use [`str.maketrans()`](#str.maketrans "str.maketrans") to create a translation map from character-to-character mappings in different formats.... [read more](https://docs.python.org/3/library/stdtypes.html#str.translate)

fading plaza Dec 7, 2020, 7:10 PM

#

note that this scheme is completly unsecure

#

and barely even qualifies as "encryption"

thick yoke Dec 7, 2020, 8:54 PM

#

📎 unknown.png

#

does anyone know why kali linux in virtualbox is not working?

lapis radish Dec 7, 2020, 10:46 PM

#

thick yoke does anyone know why kali linux in virtualbox is not working?

It's not Kali related channel

eager haven Dec 8, 2020, 1:17 AM

#

it is because

#

you have hypervisor

#

enabled

#

you can try turn it off

#

you can turn it off

#

in windows

#

features

#

📎 unknown.png

#

📎 unknown.png

#

uncheck it

#

and press ok

#

and then after it is finished you can try

#

virtual box

#

it can even be enabled in your bios

#

i think

#

when i tried

#

getting it

#

i had the problem

#

when i accidentally

#

click the wrong thing

wicked raven Dec 8, 2020, 4:27 AM

#

Hi, I am looking for a way to fetch Windows AD user rights like CreateChild, GenericAll, etc. Any library available in python for doing that

vale rose Dec 8, 2020, 8:43 AM

#

Hi, I have a very basic doubt, I am trying to host an application on the Uni servers but it shouldn't be limited to intranet. The application downloads daily data from an external third party host. Earlier I was trying to whitelist their IPs and allowed their requests but now they added loadbalancers and switched to dynamic IP so can't maintain the whitelist. What would be the best way to open a secure connection for this ?? PS : I don't know much about certificates so resources will be very helpful. TIA

woven gazelle Dec 8, 2020, 9:55 AM

#

why do you have to whitelist

#

is this a case of asking your network administrators to allow the IP

vale rose Dec 8, 2020, 10:46 AM

#

woven gazelle why do you have to whitelist

yes we have admins managing the requests that can bypass the intranet

#

so they mentioned to create a whitelist of IPs, but now it seems difficult

woven gazelle Dec 8, 2020, 10:48 AM

#

hmm yeah

#

maybe set up an external server with a fixed ip

#

outside the itnranet

#

whitelist its ip, then when it receives a request it forwards it to the third party host

vale rose Dec 8, 2020, 10:52 AM

#

vale rose Hi, I have a very basic doubt, I am trying to host an application on the Uni ser...

sorry for the cofusion but the third party now has the dynamic IPs so can't whitelist them

woven gazelle Dec 8, 2020, 10:52 AM

#

yeah, what i said is set up your own server

#

whitelist its ip

#

then the external server makes the request to the third party

vale rose Dec 8, 2020, 10:54 AM

#

oh so something like vpn

woven gazelle Dec 8, 2020, 10:54 AM

#

well not really

vale rose Dec 8, 2020, 10:54 AM

#

but that server that i set up is not secured

woven gazelle Dec 8, 2020, 10:54 AM

#

if you whitelist a vpn then anyone can access anything

#

i would suggest a VPS

vale rose Dec 8, 2020, 10:57 AM

#

okay so please mention if I am wrong somewhere, we set up extenal to intranet server, make request to third party get data and have an app to upload data to intranet since this IP will be static

#

so allowing all the ports on this external server

#

I don't want anyone else to access that data, guess in this approach anyone can interfere the external server

#

And one quick question as well if someone know the whitelist then can they do ddos attack using ip spoofing ?

woven gazelle Dec 8, 2020, 11:13 AM

#

well the external server would only allow requests to be forwarded to a specific service

#

and you'd give it whatever api token you want it to use

thick yoke Dec 8, 2020, 1:38 PM

#

eager haven you have hypervisor

cant find it

#

📎 unknown.png

thorn obsidian Dec 8, 2020, 1:57 PM

#

im looking for best way to run arbritrary python code submitted by a user securely, i feel the best way would be to use docker, however im having a hard time figuring out how to start new docker containers when a script is submitted, any resources that might be useful? thanks in advanced

vale rose Dec 8, 2020, 2:20 PM

#

thorn obsidian im looking for best way to run arbritrary python code submitted by a user secure...

not sure but can colab notebooks help here ?

#

if this is a one time job

thorn obsidian Dec 8, 2020, 2:21 PM

#

no, however i have found what i am looking for thank you
(in case anyone references this for some reason : https://github.com/python-discord/snekbox)

void aspen Dec 8, 2020, 2:23 PM

#

Hey, that’s our project :D

thorn obsidian Dec 8, 2020, 2:27 PM

#

PES_Blush

tender hatch Dec 8, 2020, 4:41 PM

#

I have never used python security

#

but ill try

#

Which system software can we use for Django? For Security like login etc..

fallen vine Dec 8, 2020, 4:44 PM

#

tender hatch Which system software can we use for Django? For Security like login etc..

How secure is Django -> Stackoverflow (That can help you)

tender hatch Dec 8, 2020, 4:45 PM

#

fallen vine How secure is Django -> Stackoverflow (That can help you)

ye

fallen vine Dec 8, 2020, 4:46 PM

#

🙂

fading basalt Dec 9, 2020, 2:10 AM

#

Hey so I made a port scanner and I'd like to run it, but I don't believe I know enough about infosec to run this. What are some things I should do before running it??

fading plaza Dec 9, 2020, 3:12 AM

#

dont run it on anything unless you have permission

#

first test on yourself

thorn obsidian Dec 9, 2020, 3:23 AM

#

@fading basalt I was just about to talk about a port scanner

#

My port scanner has a flaw in it though and Im confused

#

from socket import *
import sys, time
from datetime import datetime


host = ''
max_port = 5000
min_port = 1

def scan_host(host,port, r_code = 1):
    try:
        s = socket(AF_INET, SOCK_STREAM)
        
        code = s.connect_ex((host, port))
        
        if code == 0:
            r_code = code
        s.close()
    except Exception, e:
        pass
    
    return r_code

try:
    host = raw_input("[*] Enter Target Host Adress: ")
except KeyboardInterrupt:
    print("\n\n[*] User Requested An Intterupt.')
    print("[*] Application Shutting Down.")
    sys.exit(1)
    
hostip = gethostbyname(host)
print("\n[*] Host: %s IP: %s" % (host, hostip))
print("[*] Scanning Started At %s...\n" % (time.strftime("%H:%M:%S")))
start_time = datetime.now()

for port in range(min_port, max_port):
    try:
        response = scan_host(host, port)
        
        if response == 0:
            print("[*] Port %d: Open" % (port))
    except Exception, e:
        pass
    
stop time = datetime.now()
total_time_duration = stop_time - start_time
print("\n[*] Scanning Finished At %s ..." % (time.strftime("%H:%M:%S")))
print("[*] Scanning Duration: %s ..." % (total_time_duration))
print("[*] Everything is good here! ...")

#

Here is th error:

#

  File "C:\Users\pchaf\Downloads\New folder\Security\portscanner.py", line 19
    except Exception, e:
                    ^
SyntaxError: invalid syntax```

tulip holly Dec 9, 2020, 5:31 AM

#

Check for inconsistent quotation marks

#

User requested an interrupt'

#

The problem is there

vivid frost Dec 9, 2020, 6:34 AM

#

is bcrypt good?

#

or should I be using any other hashing algo

quasi steppe Dec 9, 2020, 6:36 AM

#

thorn obsidian ```py from socket import * import sys, time from datetime import datetime host...

except Exception as e

fading plaza Dec 9, 2020, 7:34 AM

#

that's py2 except syntax

#

py3 syntax is what penoqo posted

#

I hear that argon2 is a better choice for hashing these days

lapis radish Dec 9, 2020, 12:30 PM

#

vivid frost is bcrypt good?

It depends on your needs

vivid frost Dec 9, 2020, 12:31 PM

#

was just making a simple login system and wanted to store hashed passwords

lapis radish Dec 9, 2020, 12:32 PM

#

Argon2 should be enough like @fading plaza said

#

In Argon2 specs you have recommended parameters for authentication system

#

You can use them

vivid frost Dec 9, 2020, 12:33 PM

#

argon2 okay

#

thx for the suggestion appreciate it

lapis radish Dec 9, 2020, 12:33 PM

#

Your welcome!

vivid frost Dec 9, 2020, 12:57 PM

#

is it pip install argon2-cffi or pip install argon2?

#

nvm figured it out

fading basalt Dec 9, 2020, 2:52 PM

#

thorn obsidian <@!262808077957332992> I was just about to talk about a port scanner

So I'm still pretty darn green to programming, so take this with a grain of salt, but I don't see the purpose of doing a try, except statement. What do you want your exception to do? I don't know about the e there.

fading basalt Dec 9, 2020, 2:53 PM

#

fading plaza dont run it on anything unless you have permission

haha I'm not even sure I can/am allowed to do that

fading plaza Dec 9, 2020, 3:18 PM

#

@thorn obsidian i just took a closer look at your code

#

you're trying to run python2 code

#

using python3

#

dont use py2

#

or rather

thorn obsidian Dec 9, 2020, 3:19 PM

#

Already fixed it

#

Someone helped me already.

#

Me and a friend made it a while back

umbral finch Dec 9, 2020, 3:42 PM

#

windows stops you accessing some files due to security reasons but if you boot lets say linux from a USB drive, surely its a security risk since you can do whatever?

woven gazelle Dec 9, 2020, 4:11 PM

#

Well yeah you can always just take the hard drive out and look at the files

#

Windows does support bitlocker which encrypts your hard drive

umbral finch Dec 9, 2020, 4:43 PM

#

so if (and this is just theory) i code/find a distro that i put on a usb that dumps the windows SAM and SYSTEM files from windows then i could extract passwords

lapis radish Dec 9, 2020, 4:44 PM

#

umbral finch so if (and this is just theory) i code/find a distro that i put on a usb that du...

Yes, it's easy to even remove user's password if disk is not encrypted

umbral finch Dec 9, 2020, 4:45 PM

#

lapis radish Yes, it's easy to even remove user's password if disk is not encrypted

just from a USB drive? wow there goes my sense of security

lapis radish Dec 9, 2020, 4:45 PM

#

Any

#

You can run different OS from USB/CD, you can attach hard drive to different machine

#

As far as disk is not encrypted you can read and manipulate data

umbral finch Dec 9, 2020, 4:47 PM

#

damn, theres a cyber security project i wouldnt mind starting:
a USB that extracts windows hashes
i mean... urr... totally not doing that... educational purposes and whatnot

woven gazelle Dec 9, 2020, 4:55 PM

#

Well they will be hashes of the password

#

And at that point you're probably better off just copying all the files off then

umbral finch Dec 9, 2020, 4:59 PM

#

I mean I’ve used hashcat to crack my friend NTLM passwords (that they gave me for my project) but surely passwords even in the form of hashes would be more beneficial since many people use the same password everywhere

Also if you have a USB, storing all their files might not be an option due to size restrictions and sending them over the victims connection might alert the victim

woven gazelle Dec 9, 2020, 5:13 PM

#

sounds sensible to me

umbral finch Dec 9, 2020, 7:14 PM

#

can anyone explain to me how PwdumpX works

#

in detail?

thorn obsidian Dec 9, 2020, 7:33 PM

#

I made a sample ddoser to use on my router and its not really working

#

import socket

target = input("Enter your router ip: ")

for i in range(1,100):
    s = socket.socket(socket.AF_INET,socket.SOCK_STREAM)
    s.connect((target,80))
    data = b"GET / HTTP 1.1\r\n"*1000
    s.send(data)
    s.close()

#

But when I put the ip in

#

s.connect((target,80)) socket.gaierror: [Errno 11001] getaddrinfo failed

woven gazelle Dec 9, 2020, 7:37 PM

#

what did you put as the ip

thorn obsidian Dec 9, 2020, 7:37 PM

#

my ip adress

woven gazelle Dec 9, 2020, 7:37 PM

#

local or remote

#

like is it 192.168.1.x or something else

thorn obsidian Dec 9, 2020, 7:38 PM

#

yeah my IPv4

#

wait nevermind

#

I used the wrong one before XD

#

I thought I used my ipv4

woven gazelle Dec 9, 2020, 7:42 PM

#

ah right does it work now

#

and just a heads up i'm only helping because this is a very impractical way of DOSing

#

and you've said it's only for using on your router

#

it's against the rules to ask for help with things that break the law

#

so

#

experimenting is good but

#

ya know

#

be careful

#

also in some countries developing hacking tools is illegal

thorn obsidian Dec 9, 2020, 7:46 PM

#

Yeah this is a bad script for ddosing anything other then my own router

#

And I dont intend to use it for anything other then that. Thank you for your help

thorny tide Dec 9, 2020, 8:54 PM

#

what doi do if someone token logged my discord

quasi steppe Dec 9, 2020, 8:58 PM

#

I think changing your password resets your account token if that was your question

#

dont see how this is related to python but ok

thorn obsidian Dec 9, 2020, 11:53 PM

#

So im making a ddos for my own website/router (not for unethical use) and I thought it would be nice to implement it into a GUI. This is not working when I use it ```py
import PySimpleGUI as sg
import socket

sg.theme('DarkAmber') # Add a touch of color

All the stuff inside your window.

layout = [ [sg.Text('A DDOS tool to use on your own website and or router.')],
[sg.Text('Enter IP'), sg.InputText()],
[sg.Button('Attack'), sg.Button('Cancel')] ]

Create the Window

window = sg.Window('DDOS For Personal Use.', layout)

Event Loop to process "events" and get the "values" of the inputs

while True:
event, values = window.read()
if event == sg.WIN_CLOSED or event == 'Cancel': # if user closes window or clicks cancel
break

window.close()

for i in range(1,100):
s = socket.socket(socket.AF_INET,socket.SOCK_STREAM)
s.connect((values[0],80))
data = b"GET / HTTP 1.1\r\n"*100000
s.send(data)
s.close()

When I click the attack button it doesnt seem to do anything. If I X out of it after It gives me this traceback:Traceback (most recent call last):
File "C:\Users\pchaf\Downloads\Python Scripts\Cyber Security\DDOS_GUI.py", line 22, in <module>
s.connect((values[0],80))
TypeError: 'NoneType' object is not subscriptable```

thorn obsidian Dec 10, 2020, 12:19 AM

#

Can anyone help me fix the error?

inland yoke Dec 10, 2020, 3:54 PM

#

Hello, my friend got infected with IGDM Ransomware, all he files are encrypted.. can anyone help ??

#

Just some suggestions

long hemlock Dec 10, 2020, 7:53 PM

#

Hey guys, If i set a passphrase with rsa_keygen, how secure is it if i loose my privatekey?

#

In theory they shouldn't be able to do anything without the passphrase, right?

wicked raven Dec 11, 2020, 5:58 AM

#

Hi, Is there a library to convert nTSecurityDescriptor object from ldap to a more human readable format?

lusty flare Dec 11, 2020, 12:06 PM

#

no.

#

is the short answer.

#

passworded keys are the right thing to just in the event they're lost, yes

#

sometimes common ransomwares do have freely available decrypt software made available by security researchers

#

but don't just download and install stuff, you could end up making it worse

#

"oh no i have malware i better google how to get malware removed oh i guess i'll just download this program off this shady looking page."

woven gazelle Dec 11, 2020, 1:40 PM

#

Isn't that the first step in the pydis incident response plan 🤔

lusty flare Dec 11, 2020, 1:48 PM

#

oh i thought it was this

#

https://tenor.com/view/spongebob-squarepants-fire-panic-blow-gif-4531289

Tenor

#

¬_¬

astral briar Dec 11, 2020, 9:25 PM

#

I need some help with RSA encryption, anyone who can?

fluid verge Dec 11, 2020, 9:25 PM

#

what do you want help with?

astral briar Dec 11, 2020, 9:26 PM

#

I can't understand how to calculate "d" the last component for the private key

#

everything else makes sense, but the damn "d" lmao

fluid verge Dec 11, 2020, 9:27 PM

#

right, do you understand the use of d, at least?

astral briar Dec 11, 2020, 9:27 PM

#

Yeah

#

I understand everything, just can't caculate it, everytime I try I get a failed result

#

I would like to narrow it down to d = "equation" but it doesn't seem to be that simple

fluid verge Dec 11, 2020, 9:29 PM

#

okay, so, when you have c^d mod n, what you actually compute is c^{d mod \phi(n)} mod n

#

where \phi(n) is Euler's totient function (the number of numbers less than n that are coprime with n)

astral briar Dec 11, 2020, 9:30 PM

#

Why mod phi(n) all of a sudden

#

shouldn't m = c^d mod n

#

Not with a phi(n)

fluid verge Dec 11, 2020, 9:32 PM

#

It is

#

But the problem is finding d such that for any m, m^{ed} mod n = m

astral briar Dec 11, 2020, 9:33 PM

#

oh

#

How do i find that d then?

fluid verge Dec 11, 2020, 9:34 PM

#

which means that you need to find d such that m^{ed mod \phi(n)} mod n = m

#

thus, d is the modular inverse of e mod \phi(n)

astral briar Dec 11, 2020, 9:36 PM

#

Can you join me in off topic vc?

#

Wait i can't speak apparently

fluid verge Dec 11, 2020, 9:36 PM

#

I don't really like voice chats :/

#

also, I'm probably not allowed to speak as well, so...

astral briar Dec 11, 2020, 9:37 PM

#

Yeah I found out

#

Can you do an example, with like p=5 q=7 maybe, cause I'm still having a hard time understanding exactly how I find "d", once I understand I'm golden, but till then it ain't that fun lmao

fluid verge Dec 11, 2020, 9:40 PM

#

ok, now I am, but back to the point.
Once you know that for every coprime integers m and n, \phi(m * n) = \phi(m) * \phi(n), and that for every prime p, \phi(p) = p - 1, I think you can understand what you need to do to find d

#

coprime meaning they don't share a factor other than 1

astral briar Dec 11, 2020, 9:42 PM

#

m is the message you want encrypted right?

fluid verge Dec 11, 2020, 9:43 PM

#

In the last message, m and n are any integers greater than or equal to 1

astral briar Dec 11, 2020, 9:45 PM

#

I think I understand, I'll try working on that

#

RSA encryption is easy, but "d" sucks till you get it

#

then it's fun

fluid verge Dec 11, 2020, 9:47 PM

#

RSA relies on quite elementary, but non-trivial number theory

eager steppe Dec 11, 2020, 10:06 PM

#

how to setup tails with whonix

hexed jungle Dec 12, 2020, 4:49 AM

#

what's is the purpose of tails on whonix

lusty flare Dec 12, 2020, 9:49 AM

#

uhhhh

#

i mean don't both whonix and tails have their own branded browsers?

#

i mean they both utilise tor so i can't see there being a vast difference

#

https://www.whonix.org/wiki/Comparison_with_Others#General

Whonix

Comparison with Others

Comparison of Whonix ™, Tails, Tor Browser Bundle, QubesOS TorVM and corridor. About anonymity, privacy, security, circumvention, attacks, fingerprinting, usability, features, etc.

#

interesting round up with references

#

although whonix may be tooting their own horn a little

tacit turret Dec 12, 2020, 4:15 PM

#

hi, I would like to start with security in python but I am not sure what to learn or where. Any recommendation?

winged crest Dec 12, 2020, 4:39 PM

#

security as in cyber security?

tacit turret Dec 12, 2020, 5:12 PM

#

yes

lapis radish Dec 12, 2020, 6:31 PM

#

tacit turret hi, I would like to start with security in python but I am not sure what to lear...

What do you want to do? Attack? Defense?

past starBOT Dec 12, 2020, 6:32 PM

#

Rules

6. No spamming or unapproved advertising, including requests for paid work. Open-source projects can be shared with others in #python-general and code reviews can be asked for in a help channel.

honest otter Dec 12, 2020, 7:28 PM

#

tacit turret hi, I would like to start with security in python but I am not sure what to lear...

Well security is a big topic. There is Red teaming and blue teaming/Attack and Defense. Attack in the sense that you are trying to break into systems to test its security i.e Penetration Testing and Defense in the sense that you are trying to defend an information system in order to prevent attackers from getting into it.

#

@tacit turret There is a lot you can do in cyber security.(I have been doing it for about a year now) There is Reverse engineering, Cryptography, mobile security, wireless hacking, Social engineering, Forensics, hardware-hacking and much more. It depends on what your passionate with.

winged crest Dec 12, 2020, 7:46 PM

#

@tacit turret People usually start off with overthewire challenges.
https://overthewire.org/wargames/ if you know your way around linux you may try pico ctf.

umbral finch Dec 12, 2020, 11:09 PM

#

📎 unknown.png

#

oof

thorn obsidian Dec 13, 2020, 6:04 AM

#

why i cant install stmplib in python using pip

#

pls dm anyone know it

leaden crater Dec 13, 2020, 9:52 AM

#

Quick Security question
When doing a application. And you need to sign in
Obviously the "keep me signed in button" works with cookies on websites.
With an App instead of using a cookie could you use a "random" (using os.urandom or secrets.random of course) to generate a code. That you send the client. And they can just send that to the server each time they connect instead of needing to login every single time? (unless stated of course)

thorn obsidian Dec 13, 2020, 10:37 AM

#

@leaden crater

#

clarify "With an App instead of using a cookie could you use a "random" (using os.urandom or secrets.random of course) to generate a code"

leaden crater Dec 13, 2020, 10:38 AM

#

So with a cookie. It obviously has a token inside it? That your browser sends to the server

Could you do something similar with an app sending the token to a server? Just not a cookie. 🤔

thorn obsidian Dec 13, 2020, 10:39 AM

#

with an app

#

you want an app to communicate with the server

#

a python program?

#

so not a browser?

woven gazelle Dec 13, 2020, 10:56 AM

#

leaden crater Quick Security question When doing a application. And you need to sign in Obviou...

you've basically invented the login token

#

which is pretty clever but since it's already a thing unfortunately you get to read a load of best practices rather than share your invention with the world

leaden crater Dec 13, 2020, 10:58 AM

#

thorn obsidian a python program?

Python yes

leaden crater Dec 13, 2020, 10:59 AM

#

woven gazelle which is pretty clever but since it's already a thing unfortunately you get to r...

Ahh fair enough.
Speaking of best practises got any links?

thorn obsidian Dec 13, 2020, 12:02 PM

#

@leaden crater sorry i was away

#

browsers use Cookies as an alternative to variables

#

its just how they store information about sessions

#

browsers are "limited" in a way

#

so if you want to use a python application instead of a browser then you can definitely do so without cookies

#

since python has more freedom

woven gazelle Dec 13, 2020, 12:04 PM

#

but cookies are also sent when a page is visited

#

to the webserver

thorn obsidian Dec 13, 2020, 12:04 PM

#

thats correct

woven gazelle Dec 13, 2020, 12:04 PM

#

you type insanely quickly btw

thorn obsidian Dec 13, 2020, 12:04 PM

#

@leaden crater you can just store the the data about session in regular python variables and then pass them via GET parameters

#

I would make a bet you already saw a similar pattern to "https://www.site.com?sessionid=52153" in the past

#

while browsing the web

leaden crater Dec 13, 2020, 12:06 PM

#

Yeah

#

The "app" as such connects to a socket server its a chat app but (communicates over SSL dw) 🤔 But I am glad this is easy to do

thorn obsidian Dec 13, 2020, 12:07 PM

#

Cookies are also easy to use

#

are you just afraid of them?

#

@leaden crater

#

i might have misunderstood you

leaden crater Dec 13, 2020, 12:09 PM

#

thorn obsidian are you just afraid of them?

No I just can't use them

thorn obsidian Dec 13, 2020, 12:09 PM

#

does the server belong to you?

#

the one you are connecting to

leaden crater Dec 13, 2020, 12:09 PM

#

Oh yeah yeah

#

I have total control over the script for the sockets and the machine

thorn obsidian Dec 13, 2020, 12:09 PM

#

well then you should be good to go if you control the both ends

#

you can make the server retrieve the session data either from cookies or GET parameters

leaden crater Dec 13, 2020, 12:09 PM

#

Ahhh good good

thorn obsidian Dec 13, 2020, 12:09 PM

#

and then send those from a client

#

i thought for a second you didn't have access to the server, in which case you would have to follow the rules set by that server

#

and either place the data in Cookie part

#

or GET parameters

#

as server instructs

thorn obsidian Dec 13, 2020, 12:11 PM

#

leaden crater No I just can't use them

how so

leaden crater Dec 13, 2020, 12:11 PM

#

Because its a socket server not web server 🤣

#

Sorry for being a little crpytic I wasn't quite sure what information you needed

thorn obsidian Dec 13, 2020, 12:12 PM

#

leaden crater Because its a socket server not web server 🤣

thats what i needed

#

thought it was a web server

#

even wrote examples with requests

#

import requests

cookies = {
  "sessionid": 123
   }
r = requests.get("https://www.google.com", cookies=cookies)

import requests
r = requests.get("https://www.google.com?sessionid=123")

leaden crater Dec 13, 2020, 12:12 PM

#

thorn obsidian thats what i needed

Now I feel like a dick 🤣 Sorryyyyyyyyyyy

thorn obsidian Dec 13, 2020, 12:13 PM

#

could pass that value of sessionid either way

#

@leaden crater if its not a web server

#

why even ask a question about cookie

#

just curious

#

cookie is solely a web thing

leaden crater Dec 13, 2020, 12:13 PM

#

It was an example.
The "cookie" inside it has a login token?
That login token I was wondering if it is a randomally generated and then if that would be something I could use in my app
So the app sends the token instead of asking the user to login every single time...

#

I was special I structured my question poorly.

thorn obsidian Dec 13, 2020, 2:30 PM

#

@leaden crater cookies can contain absolutely any data not just login token, and they are created by the web server and sent to the clients

#

and when clients receive them, they are stored on their machines, and then sent out with every request to the server

leaden crater Dec 13, 2020, 3:42 PM

#

👍 Thank you for clearing it up for me @thorn obsidian

thorn obsidian Dec 13, 2020, 3:43 PM

#

np

#

@leaden crater just as a last note, i would suggest sending data from a client to a server in a json format

leaden crater Dec 13, 2020, 3:44 PM

#

Oooh. Thank you

thorn obsidian Dec 13, 2020, 9:50 PM

#

import PySimpleGUI as sg
import socket
#For PERSONAL ROUTER AND WEBSITE USE ONLY.
sg.theme('DarkAmber')   # Add a touch of color
# All the stuff inside your window.
layout = [  [sg.Text('Simple Python DDOS Attack tool for your own website/router.')],
            [sg.Text('Enter IP'), sg.InputText()],
            [sg.Button('Attack'), sg.Button('Cancel')] ]

# Create the Window
window = sg.Window('DDOS Python.', layout)
# Event Loop to process "events" and get the "values" of the inputs
while True:
    event, values = window.read()
    if event == sg.WIN_CLOSED or event == 'Cancel': # if user closes window or clicks cancel
        break

window.close()

for i in range(1,100):
    s = socket.socket(socket.AF_INET,socket.SOCK_STREAM)
    s.connect((values[0],80))
    data = b"GET / HTTP 1.1\r\n"*1000
    s.send(data)
    s.close()
    ``` Ill send the error message

#

  File "C:\Users\pchaf\Downloads\Python Scripts\Cyber Security\DDOS_GUI.py", line 22, in <module>
    s.connect((values[0],80))
TypeError: 'NoneType' object is not subscriptable
> ```

lapis radish Dec 13, 2020, 10:16 PM

#

thorn obsidian ```py import PySimpleGUI as sg import socket #For PERSONAL ROUTER AND WEBSITE US...

How is it related with security? I think that #user-interfaces is better channel

fading plaza Dec 14, 2020, 1:09 AM

#

!rule 5

past starBOT Dec 14, 2020, 1:09 AM

#

Rules

5. Do not provide or request help on projects that may break laws, breach terms of services, be considered malicious or inappropriate. Do not help with ongoing exams. Do not provide or request solutions for graded assignments, although general guidance is okay.

fading plaza Dec 14, 2020, 1:09 AM

#

@thorn obsidian

#

also thats not even a ddos

thorn obsidian Dec 14, 2020, 1:10 AM

#

It is not illegal since I was given permission, by myself...

#

I know it's more of a DoS then ddos

fading plaza Dec 14, 2020, 1:11 AM

#

well, we can't confirm that

#

plus "be considered malicious"

hard frost Dec 14, 2020, 3:17 AM

#

does python verison 3.9 come pip pre installed

#

I am having issues running it

wicked raven Dec 14, 2020, 3:24 AM

#

try py -3.9 -m pip install --upgrade pip

thorn obsidian Dec 14, 2020, 9:18 AM

#

hello, im member of a group where we try to help people finding their cybersecurity path for free. If you are interested tell me to post more information. Thanks!

thorn obsidian Dec 14, 2020, 10:43 AM

#

Guys, can u help me

#

Im tryin to make a port scanner

#

As u guys can see, its giving me error

#

NameError: target not defined

void aspen Dec 14, 2020, 10:45 AM

#

Hey, we won’t help you with a port scanner is this is usually used for malicious intends, sorry

thorn obsidian Dec 14, 2020, 10:45 AM

#

Ah ok then

#

Ill delete message @void aspen

void aspen Dec 14, 2020, 10:46 AM

#

Thank you 👍

thorn obsidian Dec 14, 2020, 10:46 AM

#

Np

undone carbon Dec 14, 2020, 10:46 AM

#

I recently used a piece of code that detected if a port is in use so it would open the socket on another port @void aspen. I needed that in case I open my program multiple times it still needs to work, didn't know you can use this in a malicious way

thorn obsidian Dec 14, 2020, 10:47 AM

#

socket.connect_ex()

void aspen Dec 14, 2020, 10:47 AM

#

Yeah, it is usually used to see the opened ports on a target machines, for finding backdoors

thorn obsidian Dec 14, 2020, 10:47 AM

#

@void aspen u saw my code?

void aspen Dec 14, 2020, 10:48 AM

#

Yes

thorn obsidian Dec 14, 2020, 10:49 AM

#

Off topic, sorry

thorn obsidian Dec 14, 2020, 4:21 PM

#

@thorn obsidian you can claim any channel as mentioned there #❓｜how-to-get-help

thorn obsidian Dec 14, 2020, 5:45 PM

#

Can u guys help me, im making proxy chain

#

If is that legal on server

#

oh sorry

#

If is that legal

#

Can someone help me

#

I have proxys, and i need just to make chain

woven gazelle Dec 14, 2020, 6:51 PM

#

why

rose plover Dec 14, 2020, 7:09 PM

#

yeah it's legal why?

sonic drum Dec 14, 2020, 9:07 PM

#

My program takes in an email and password and then stores them in a database. The password is hashed in argon2 and the email is stored in plaintext, is that okay?

#

email@email.com $argon2i$v=19$m=102400,t=2,p=8$PeEEYPsgpSfTKngWQROfXw$tvdrXxUbqvKcY2v9+i8qkgthis is how it looks like

#

but imagine having more rows

mortal perch Dec 14, 2020, 9:23 PM

#

that looks ok to me - i havent checked whether the argon2 parameters are suitable though

halcyon path Dec 14, 2020, 10:27 PM

#

Anyone here that wants to try and crack my encryption?

woven gazelle Dec 14, 2020, 10:37 PM

#

is it competently implemented

sonic drum Dec 14, 2020, 11:18 PM

#

wait so I need more information

#

that looks ok to me - i havent checked whether the argon2 parameters are suitable though
do I not include them?

fading plaza Dec 15, 2020, 4:33 AM

#

@halcyon path can you post it?

#

also keep in mind that "rolling your own crypto" should only be done for educational purposes and never be used in production

pulsar jacinth Dec 15, 2020, 4:34 AM

#

I've got a theory that might not be plausible but I'll still ask if it is possible. It's in password cracking. Let's say I know the length of a password ie 12 digits long and only contains mixed alphanumeric characters and the algorithm used to encrypt the password, is it possible for one to find some sort of relation between the algorithm used and the password and use some sort of binary search algorithm attack where one can know on what end of the list(of a sorted list of all possible password combinations) of passwords is the password😅 cause if you consider the time complexity of Binary Search is O(logn) ? Thus if this can be done the password could be cracked in log(12^62)...... I might just be cooking up my own things, what do you think?

fading plaza Dec 15, 2020, 4:37 AM

#

nope

#

any good hashing/encryption alg has no correlation whatsoever between plaintext and hash/ciphertext

#

so binary search won't work

#

https://en.m.wikipedia.org/wiki/Avalanche_effect

Avalanche effect

In cryptography, the avalanche effect is the desirable property of cryptographic algorithms, typically block ciphers and cryptographic hash functions, wherein if an input is changed slightly (for example, flipping a single bit), the output changes significantly (e.g., half the output bits flip). In the case of high-quality block ciphers, such a ...

thorn obsidian Dec 15, 2020, 6:35 AM

#

halcyon path Anyone here that wants to try and crack my encryption?

I think that its just base64 enc

halcyon path Dec 15, 2020, 8:59 AM

#

No it's not lmao

#

I made it myself without modules

thorn obsidian Dec 15, 2020, 9:10 AM

#

Ez decode

#

🤣

dense walrus Dec 15, 2020, 12:50 PM

#

can someone help me i always get incorrect padding this is the code ```python
def aes_ecb_dec(key, enc_msg):
cipher = AES.new(key, AES.MODE_ECB)
ct = cipher.decrypt(enc_msg)
return unpad(ct, AES.block_size, style='pkcs7')

lapis radish Dec 15, 2020, 12:51 PM

#

dense walrus can someone help me i always get incorrect padding this is the code ```python de...

What library are you using?

dense walrus Dec 15, 2020, 12:51 PM

#

pycryptodome

#

from Crypto.Cipher import AES
from binascii import hexlify, unhexlify
import base64
from pwn import xor
from Crypto.Util.number import long_to_bytes
from Crypto.Util.Padding import pad, unpad
from Crypto.Random import get_random_bytes
``` all the imports

#

enc func works though

lapis radish Dec 15, 2020, 12:56 PM

#

Can you show me your aes_ecb_enc?

dense walrus Dec 15, 2020, 12:57 PM

#

def aes_ecb_enc(key, msg):
    msg = pad(msg, AES.block_size, style='pkcs7')
    cipher = AES.new(key, AES.MODE_ECB)
    ct = cipher.encrypt(msg)
    return hexlify(ct)

lapis radish Dec 15, 2020, 12:58 PM

#

You need to use unhexlify before decrypt

mortal perch Dec 15, 2020, 12:59 PM

#

sonic drum > that looks ok to me - i havent checked whether the argon2 parameters are suita...

the format is fine, i just havent checked whether it's difficult enough to compute (memory size, iterations etc)
for example, shouldnt you be using argon2id instead of argon2i

dense walrus Dec 15, 2020, 1:00 PM

#

@lapis radish binascii.Error: Non-hexadecimal digit found

lapis radish Dec 15, 2020, 1:00 PM

#

dense walrus <@!690641855045697653> binascii.Error: Non-hexadecimal digit found

Show me please code when you are calling aes_ecb_enc and aes_ecb_dec

dense walrus Dec 15, 2020, 1:06 PM

#

def aes_cbc_enc(iv, key, msg):
    enc_msg = b""
    
    for i in range(0, len(msg), 16):
        if i == 0:
            xor_text = xor(msg[i:i+16], iv)
            enc_msg += unhexlify(aes_ecb_enc(xor_text, key))
        else:
            xor_text = xor(enc_msg[i-16:i], msg[i:i+16])
            enc_msg += unhexlify(aes_ecb_enc(xor_text, key))
        
    return enc_msg

sonic drum Dec 15, 2020, 1:37 PM

#

mortal perch the format is fine, i just havent checked whether it's difficult enough to compu...

I used argon2-cffi module to hash them, i dont know what argon2id is

#

But it is still secure right??

mortal perch Dec 15, 2020, 1:41 PM

#

im not a cryptographer, so im not the person to ask. but according to my limited knowledge, the id variant is preferred for better security. maybe read the wikipedia page

#

also, read the docs for the specific module you are using

#

in this case, it's point #1

#

📎 unknown.png

sonic drum Dec 15, 2020, 2:00 PM

#

ah okay

sacred furnace Dec 15, 2020, 3:24 PM

#

pycryptodome

silver fable Dec 15, 2020, 6:46 PM

#

help pls lol

#

def hasNumbers(inputString):
return any(char.isdigit() for char in inputString)

username = input("Create your username: ")

if len(username) < 5:
print("Your name must be more than 4 characters. Please try again.")
if len(username) > 15:
print("Your name must be less than 15 characters. Please try again.")

password = input("Create your password: ")

if len(password) < 7:
print("Your password must exceed 6 letters. Try again.")
if len(password) > 30:
print("Your password must be less than 30 letters. Try again.")
if not hasNumbers(password):
print("You must include a number in your password.")

#

trying to figure out how to resend
password = input("Create your password")

if i do not fit any of the criteria
if len(password) < 7:
print("Your password must exceed 6 letters. Try again.")
if len(password) > 30:
print("Your password must be less than 30 letters. Try again.")
if not hasNumbers(password):
print("You must include a number in your password.")

woven gazelle Dec 15, 2020, 7:43 PM

#

put it in a while loop

#

while username_insufficient:

#

or something

#

then change to

#

username = input("Create your username: ")

if len(username) < 5:
    print("Your name must be more than 4 characters. Please try again.")
elif len(username) > 15:
    print("Your name must be less than 15 characters. Please try again.")
else:
    username_insufficient = False

thorn obsidian Dec 15, 2020, 8:01 PM

#

Bruhhhhh

robust glade Dec 15, 2020, 10:14 PM

#

silver fable def hasNumbers(inputString): return any(char.isdigit() for char in inputStri...

Hope this helps


while True:
    username = input("Enter your username: ")
    if 5 >= len(username) or len(username) >= 15:
        print("Username must be between 5 and 15 characters. Your username was {} characters. "
              "Please try again".format(len(username)))
    else:
        print("Username \"{}\" has been accepted".format(username))
        break

vital lintel Dec 15, 2020, 11:29 PM

#

??

📎 image0.png

#

Can someone help with this

#

It is showing error while downloading kali linux

fading plaza Dec 15, 2020, 11:32 PM

#

where are you downloading from

#

and what are you running

vital lintel Dec 15, 2020, 11:32 PM

#

From the kalilinux site

fading plaza Dec 15, 2020, 11:32 PM

#

uhhh

#

link?

#

because i've never had to run any "*aszip.exe"

#

no like

#

which one are you downloading

vital lintel Dec 15, 2020, 11:34 PM

#

64 bit

#

Installer

#

Anyone??

#

Hey anyone up

cursive furnace Dec 16, 2020, 12:22 AM

#

im pretty sure thats not the installer; the real installer would be an iso image

#

@vital lintel

viral jetty Dec 16, 2020, 12:59 AM

#

Hey guys quick question.
I am creating a game called "Astroids" it's a basic simple game.
The reason I am creating it is so I can use it as evidence to get in univirstity to stud computer science and Graphics design.

The question is this?
Can I combine python with other codes such as C++ or C#.
My game I created is written in C++ I think, cannot rember now lol.
But the task I needed it to do I can't do with c++ but I can do in python.

So is their away that python can be used along side c++

I tried using LUA and java however they are still unable of the task lol. Simple because I think it's the software I use.

#

Please ping me when u respond.

Thanks Guys 😁😁

#

If not going I would have to re write my whole game in LUA and Java as these can be combined lmao.

thorn obsidian Dec 16, 2020, 1:06 AM

#

Im pretty sure u can combine them @viral jetty

#

check this reference link out .. hope it helps, https://stackoverflow.com/questions/1153577/integrate-python-and-c#:~:text=Yes%2C it is possible%2C encouraged,it to be very easy.&text=Python%2FC API Reference Manual,extension modules or embed Python.&text=describes how to write modules,Python interpreter with new modules.

Stack Overflow

Integrate Python And C++

I'm learning C++ because it's a very flexible language. But for internet things like Twitter, Facebook, Delicious and others, Python seems a much better solution.

Is it possible to integrate C++ and

vital lintel Dec 16, 2020, 1:06 AM

#

cursive furnace im pretty sure thats not the installer; the real installer would be an iso image

Yes but when i open the iso folder this pops up

cursive furnace Dec 16, 2020, 1:07 AM

#

iso folder?

viral jetty Dec 16, 2020, 1:07 AM

#

Thank you soo much.
Have a nice Christmas guys.

cursive furnace Dec 16, 2020, 1:07 AM

#

im pretty sure its a single file usually

#

@vital lintel

vital lintel Dec 16, 2020, 1:07 AM

#

Yes the iso file sorry

cursive furnace Dec 16, 2020, 1:08 AM

#

can u send the download link you used?

vital lintel Dec 16, 2020, 1:08 AM

#

https://www.kali.org/downloads/

Kali Linux Downloads

cursive furnace Dec 16, 2020, 1:08 AM

#

ok...

#

so the link is good

vital lintel Dec 16, 2020, 1:09 AM

#

Yes but why is that error coming

cursive furnace Dec 16, 2020, 1:09 AM

#

ok so

#

if you look up aszip.exe

#

it says its a self extracting zip program

#

@vital lintel

#

btw

#

which specifc one did u use?

vital lintel Dec 16, 2020, 1:10 AM

#

@cursive furnace come in dm

cursive furnace Dec 16, 2020, 1:10 AM

#

64 bit installer?

iron wadi Dec 16, 2020, 9:42 AM

#

I recently got into doing CTFs. I have a background in Python web applications. The one I did was really simple and fun. Other people -- all pretty new -- were trying to figure out the basics of Django. and I was just like, "They published this site in debug mode lol"

#

It was obviously targeted at newbs but it was fun

gaunt pike Dec 16, 2020, 3:36 PM

#

Hey guys wssup

#

Quick question.
I was reverse engineering a site to get access to data endpoints but I came across firebase credentials with the db paths hardcoded on the client side js. A lot of people told me that this is not really a vulnerability since firebase connects on the client side with exposed credentials and stuff and I was not going to get external access to the db anyways, but the problem is that I did get access to their db and even came across further keys stored in firebase. So my question is that should I report this vulnerability to the company or not?

oak breach Dec 16, 2020, 5:36 PM

#

yeah

#

they should pay you to

#

thats a huuuuuuuge vulnerability

#

huge

#

if its a website you need to login to that is still a big vuln

mortal perch Dec 16, 2020, 6:00 PM

#

they should pay you

#

they also might sue you

#

so uh

#

be careful

#

im not gonna offer legal advice but yeah i'd definitely make yourself very aware of how they might react before reporting things

gaunt pike Dec 16, 2020, 6:39 PM

#

mortal perch im not gonna offer legal advice but yeah i'd definitely make yourself very aware...

so no reporting then? LMAO

thorn obsidian Dec 16, 2020, 6:51 PM

#

Guys, im doin requests rn with proxies, and it sayin, Errno 110 connection refused, is that bcs of proxy or?

spring phoenix Dec 16, 2020, 7:56 PM

#

thorn obsidian Guys, im doin requests rn with proxies, and it sayin, Errno 110 connection refus...

can you please give more info on that

tropic bluff Dec 16, 2020, 8:10 PM

#

spring phoenix can you please give more info on that

He wants to make a get or whatever request to the host but with different-2 ip address

thorn obsidian Dec 16, 2020, 8:50 PM

#

Its just bcs proxy got blocked

#

Nothing spec

astral briar Dec 17, 2020, 1:04 PM

#

I have a question regarding rsa encryption

#

I found this to calculate d, works perfectly, but i don't know why it works, like how, what is it

📎 unknown.png

lapis radish Dec 17, 2020, 3:11 PM

#

@astral briar e is just an inversion of d in some finite field so all what you need to break RSA is to find φ(n) where φ is an Euler function

#

As far as you know n = p * q where p and q are primes so φ(n) = (p - 1) * (q - 1)

astral briar Dec 17, 2020, 4:43 PM

#

I understand that and all, I just need the d = (φ(n)*i+1)/e explained. @lapis radish

lapis radish Dec 17, 2020, 4:46 PM

#

astral briar I understand that and all, I just need the d = (φ(n)*i+1)/e explained. <@!690641...

It comes from congruence. a = b mod n means that a - b is divisible by n so ed = 1 mod φ(n) means that ed - 1 is divisible by φ(n)

#

If a - b is divisible by n so there is integer i that a - b = i * n

#

You can change this equation a = i * n + b where a = ed, n = φ(n) and b = 1 so you got ed = i * φ(n) + 1 and later d = (i * φ(n) + 1) / e)

#

You can read about congruences here: https://en.wikipedia.org/wiki/Congruence_relation

Congruence relation

In abstract algebra, a congruence relation (or simply congruence) is an equivalence relation on an algebraic structure (such as a group, ring, or vector space) that is compatible with the structure in the sense that algebraic operations done with equivalent elements will yield equivalent elements. Every congruence relation has a corresponding q...

#

Hope everything is clear now

umbral finch Dec 17, 2020, 6:58 PM

#

I understand the practice of storing a hash instead of the actual password for a login system however if the attacker gets hold of my database (which is stored an disk along with the login application) then while they can’t know the password, what’s stopping them simply replace my password hash with their own so they can enter their own password and login?

iron wadi Dec 17, 2020, 7:00 PM

#

Someone might have a more expert comment than mine, but... generally, if someone gets the ability the modify entries in your database, they can do a lot of things.

umbral finch Dec 17, 2020, 7:02 PM

#

Exactly, so nothings stopping them replacing the password and therefore being able to login to an existing account?

iron wadi Dec 17, 2020, 7:03 PM

#

yeah, if they have permissions on some user to do that, yeah.

umbral finch Dec 17, 2020, 7:03 PM

#

Is there any way to combat that such as storing check characters IN the hash that the attacker might not notice and confuse him?

#

Any other ways?

iron wadi Dec 17, 2020, 7:04 PM

#

I think the most robust place to start is not getting the system the database is hosted on hacked. But at this point in the convo, someone with more practical and less theoretical knowledge should comment instead of me

umbral finch Dec 17, 2020, 7:05 PM

#

Ah right, I’m making a password/account manager with works offline so storing vulnerable passwords elsewhere is out the question
Gotta rely on windows security I guess

woven gazelle Dec 17, 2020, 7:27 PM

#

i mean yeah if they're in your database then like

#

they can delete all your user accounts

#

so what happens at that point is basically anything

iron wadi Dec 17, 2020, 7:28 PM

#

Yeah, that is the last thing you want to happen, so you can asusme if they can do that, all is lost lol

#

Typically people have configured firewalls, the user accounts on the system the database is on, the role for users on the database config all to avoid this

lapis radish Dec 17, 2020, 8:46 PM

#

umbral finch I understand the practice of storing a hash instead of the actual password for a...

That's why current authentication scheme is wrong... I don't know why there are no systems based on hybrid cryptography with signing users' actions with their keys

umbral finch Dec 17, 2020, 9:05 PM

#

what do you mean @lapis radish

#

the users actions?

lapis radish Dec 17, 2020, 9:07 PM

#

You can assign public key to user account and sign with this key every action (like comment, post, settings update and so on)

#

Even when some hack your database the attacker cannot sign anything because only user has his private key

umbral finch Dec 17, 2020, 9:08 PM

#

ohhh right

lapis radish Dec 17, 2020, 9:08 PM

#

It's just a concept in my head but I think that every system should follow this path

umbral finch Dec 17, 2020, 9:09 PM

#

Im designing a system and im just stuck on the storing of account details lol

📎 unknown.png

#

winforms ^^

lapis radish Dec 17, 2020, 9:09 PM

#

For example someone can hack Twitter database and post something as a president but how others can verify that is this fake or not? 🙂

umbral finch Dec 17, 2020, 9:09 PM

#

lol yeah i see what you mean

lapis radish Dec 17, 2020, 9:10 PM

#

umbral finch Im designing a system and im just stuck on the storing of account details lol

If you are creating password manager you cannot use hash function to store passwords

umbral finch Dec 17, 2020, 9:10 PM

#

only for the login system, then the rest use encryption

lapis radish Dec 17, 2020, 9:10 PM

#

Oh okay

umbral finch Dec 17, 2020, 9:11 PM

#

i might skip all this hassle and just use encryption for the login bit, then i can implement the same system for everything

#

it means the attacker could still log in but it would take a bit more work (generating password encryption and all that)

lapis radish Dec 17, 2020, 9:12 PM

#

How about protection of data after decryption?

#

Do you want to store plaintext in the memory?

umbral finch Dec 17, 2020, 9:12 PM

#

yeah id have to clear it from memory and all that right?

#

yeah exactly

#

so hashes are indeed the best option for the login

lapis radish Dec 17, 2020, 9:13 PM

#

umbral finch yeah id have to clear it from memory and all that right?

I think you should but I don't an expert of this

lapis radish Dec 17, 2020, 9:14 PM

#

umbral finch so hashes are indeed the best option for the login

Yep, key derivation function is the best scheme to generate secure keys nowadays

#

As far as I know

umbral finch Dec 17, 2020, 9:14 PM

#

ughhh 😆 this isnt even a serious or graded project, i'm just doing it in my free time

lapis radish Dec 17, 2020, 9:16 PM

#

Don't be afraid of KDF 😂 it's like normal hash function but with some extra parameters

umbral finch Dec 17, 2020, 9:17 PM

#

cant i just use SHA 256?, whats KDF (im a bit new to this)

#

or whatever C# natively supports

lapis radish Dec 17, 2020, 9:18 PM

#

You can build KDF based on SHA2-256 like PBKDF2-HMAC-SHA2-256

#

It's more resistant against offline attacks

umbral finch Dec 17, 2020, 9:18 PM

#

so its more computationally intensive?

#

thats fine actually

lapis radish Dec 17, 2020, 9:19 PM

#

And PBKDF2 for example accepts salt as second parameter so it's additional level of security

lapis radish Dec 17, 2020, 9:19 PM

#

umbral finch so its more computationally intensive?

Yes, this is the case

umbral finch Dec 17, 2020, 9:19 PM

#

does KDF use salt?

lapis radish Dec 17, 2020, 9:19 PM

#

In PBKDF2 you have iterations parameter

lapis radish Dec 17, 2020, 9:19 PM

#

umbral finch does KDF use salt?

By default as far as I know

umbral finch Dec 17, 2020, 9:19 PM

#

nice ill look into it

lapis radish Dec 17, 2020, 9:19 PM

#

PBKDF2 uses salt and Argon2 too

#

There is something like HKDF too

umbral finch Dec 17, 2020, 9:21 PM

#

thanks 😄

lapis radish Dec 17, 2020, 9:22 PM

#

Your welcome

umbral finch Dec 17, 2020, 9:24 PM

#

SHIT i just deleted my GUI

#

damn i guess il start again, i hadnt implement much code yet anyway

lapis radish Dec 17, 2020, 9:25 PM

#

Use git or something

umbral finch Dec 17, 2020, 9:26 PM

#

ah it just restored for some reason 😆 damn im a mess today

lethal knoll Dec 18, 2020, 12:08 AM

#

https://i.imgur.com/vm5qQaJ.png lol i spend the night trying to bot my teacher website comment section

Imgur

#

now ima spam "Use recaptcha!"

woven gazelle Dec 18, 2020, 12:09 AM

#

uh

#

right

sonic drum Dec 18, 2020, 2:33 AM

#

Does anyone have any cool projects that I can do? Security projects

sonic drum Dec 18, 2020, 3:32 AM

#

the last project I did was a GUI that takes in credentials and stores them in a database with the password hashed in argon2id using SQLAlchemy ORM

#

it has register, login, and logged in windows, it's mostly just for if I forget things in the future I can come back and look at my code, but I don't know what else to do

#

I was thinking maybe an E2EE chat app?

#

maybe if I do make that I can merge it with the project I just finished that I just mentioned

#

that'd be awesome

#

anyway, any ideas?

frail kite Dec 18, 2020, 2:37 PM

#

please help
why cpp's socket is slow at sending?
it takes 15-30 seconds to send 65535 packets
compare to python, it only takes 3 seconds to send the same amount of packets
please help
(udp protocol)
The reason I am doing this is to brute force all possible port to perform udp hole punching to bypass nat

jade sonnet Dec 18, 2020, 2:42 PM

#

hey! anyone wanna join me asap to solve some CTF taks! thanks

thorn obsidian Dec 18, 2020, 4:06 PM

#

#❓｜how-to-get-help

gaunt sapphire Dec 18, 2020, 8:13 PM

#

@frail kite Basically it is guaranteed cpp would be as fast or faster if the appropriate libraries were used as intended. Your code spends most of it's time waiting for something.

rotund yarrow Dec 18, 2020, 10:38 PM

#

Python's sockets are a relatively thin wrapper over the operating system's socket syscalls, but C++ gives an even thinner wrapper. If you perform the same operations, C++ should do them strictly faster.

sturdy kayak Dec 19, 2020, 12:55 AM

#

why is this a grabify link?

#

@rotund yarrow

rotund yarrow Dec 19, 2020, 12:57 AM

#

what?

sonic drum Dec 19, 2020, 2:52 AM

#

can a moderator delete that

frail kite Dec 19, 2020, 5:11 AM

#

please help

#

https://hastebin.com/ucimitugez.cpp
why code 2 is slower than code 1

frail kite Dec 19, 2020, 5:32 AM

#

python version

#

#code 1
import socket, time
s=  socket.socket(socket.AF_INET, socket.SOCK_DGRAM)
t = time.time()
for i in range(1,65536):
  s.sendto(b"hi", ("127.0.0.1", 9000))
print(time.time() -t) // only 3 seconds for me
#code 2
s=  socket.socket(socket.AF_INET, socket.SOCK_DGRAM)
t = time.time()
for i in range(1,65536):
  s.sendto(b"hi", ("127.0.0.1", i))
print(time.time() -t) // 30 seconds for me

thorn obsidian Dec 19, 2020, 8:02 AM

#

@frail kite in the first code you are sending about 120k bytes to 127.0.0.1 on a particular port
in the second code you are sending 120k bytes to 127.0.0.1 on 65 thousand different ports

#

and its not a security related question so next time post a question like that in another channel

frail kite Dec 19, 2020, 8:18 AM

#

@thorn obsidian this is the same problem

#

not in C but I write this in python

#

and udp is connectionless

#

thus, it doesn't make any sense

#

It seems to be not a problem if you test it on unix

#

but I tried on my 2 window machine and the performance issue occurs on both of them

thorn obsidian Dec 19, 2020, 8:29 AM

#

why are you so concerned about this

frail kite Dec 19, 2020, 8:47 AM

#

udp hole punching

#

timing is important

#

you can try this code for you self and the difference is not much

#

but why it run so bad on my machine

#

?

oak garden Dec 19, 2020, 10:14 AM

#

hi, how to protect my code from being read ?
is there a way to encrypt it and still easy to run ?
is pyinstaller very secure to do that ? or there is another way ?
when using pyinstaller it generate a VERY BIG exe File !
any suggestion or help ?

thorn obsidian Dec 19, 2020, 10:33 AM

#

frail kite you can try this code for you self and the difference is not much

even if its udp I would strongly assume that sending the same packets to 65000 different ports via UDP would still take longer than sending the same exact packet times 65000 to the same port

woven gazelle Dec 19, 2020, 11:49 AM

#

oak garden hi, how to protect my code from being read ? is there a way to encrypt it and st...

there really is no way to prevent your code from being read/disassembled whatever language you use

#

and pyinstaller makes it harder for people to read your code but definitely not impossible

#

why do you want to do this

oak garden Dec 19, 2020, 12:19 PM

#

woven gazelle there really is no way to prevent your code from being read/disassembled whateve...

i want to write a software that transmit data to clients in secure way .
then in client side data should be decrypted some how to be used later. so maybe some one can figure out how to decrypt data by reading the code !
so how could it be ?

woven gazelle Dec 19, 2020, 12:19 PM

#

well how are you decrypting the data

#

are you storing the secret password on the client

oak garden Dec 19, 2020, 12:20 PM

#

yup . a part of it . i can send the other parts from server . as a changeable one.

woven gazelle Dec 19, 2020, 12:21 PM

#

that's a bad idea

#

you shouldn't assume that anything you send to the client can't be discovered by them

oak garden Dec 19, 2020, 12:23 PM

#

i am agree with you .
so how could i make my data secure ?

woven gazelle Dec 19, 2020, 12:23 PM

#

i think the way you're doing the transmission is a bit flawed

#

are you trying to send a different secret message to each client

#

and verify that only the right client gets it?

oak garden Dec 19, 2020, 12:24 PM

#

all clients are the same for me ..

woven gazelle Dec 19, 2020, 12:25 PM

#

so how is it a secret

#

is the distribution of the program limited to people you want to receive the messages

oak garden Dec 19, 2020, 12:26 PM

#

sort of ,

#

my program is [Scientific Program]
i used to create a python Env and feed it with readable scripts.

when sharing it , anyone can use the code or modify it ..
i want to make it harder to be read or hidden if possible ..

so i asked about how to hide or prevent others from reading the code ..
or compile it in a simple form not very big Size file
so what do you think?

ripe condor Dec 19, 2020, 7:35 PM

#

guys how do install pwntool (python lib) as a linux CLI

dire comet Dec 19, 2020, 8:23 PM

#

any one here a experienced ethical hacker?

#

pls text me

fading plaza Dec 19, 2020, 8:38 PM

#

pip3 install pwntools?

thorn obsidian Dec 20, 2020, 4:42 PM

#

dire comet any one here a experienced ethical hacker?

Im not even gonna lie that name and those messages makes you seem like a skid. 🤣

fading plaza Dec 20, 2020, 5:55 PM

#

plus the pfp

thorn obsidian Dec 20, 2020, 6:01 PM

#

fading plaza plus the pfp

Yea...

sonic drum Dec 20, 2020, 9:44 PM

#

I'm trying to make a program where you can connect to another machine using sockets and communicate with them and I want to do it securely, so I want to establish an encrypted connection with the client, like End-To-End encryption

lapis radish Dec 20, 2020, 9:45 PM

#

sonic drum I'm trying to make a program where you can connect to another machine using sock...

Use SSL

sonic drum Dec 20, 2020, 9:45 PM

#

is there any good easy to use libraries out there that I can use for my program that encrypts data?

lapis radish Dec 20, 2020, 9:45 PM

#

sonic drum is there any good easy to use libraries out there that I can use for my program ...

What do you use to send data?

sonic drum Dec 20, 2020, 9:45 PM

#

I wanna send it over a socket connection

#

just socket

lapis radish Dec 20, 2020, 9:48 PM

#

You can use https://cryptography.io/ if you want to build something on your own

sonic drum Dec 20, 2020, 11:21 PM

#

Nah I don't wanna build it on my own

#

I'll just use SSL

hollow badge Dec 21, 2020, 7:17 PM

#

sonic drum is there any good easy to use libraries out there that I can use for my program ...

checkout http://docs.pwntools.com/en/stable/

sonic drum Dec 21, 2020, 7:18 PM

#

what is this?

#

Is this for pentesting?

woven gazelle Dec 21, 2020, 7:27 PM

#

yes

nimble isle Dec 21, 2020, 11:22 PM

#

Anyone know if fail2ban detects illegal path traversals?

vital gyro Dec 22, 2020, 12:53 PM

#

@thorn obsidian this channel is related to pythons ecurity, what you are asking would be better in an off topi channel

#

!ot

past starBOT Dec 22, 2020, 12:54 PM

#

Off-topic channels

There are three off-topic channels:
• #ot0-fear-of-python
• #ot1-this-regex-is-impossible
• #ot2-the-original-pubsta

Their names change randomly every 24 hours, but you can always find them under the OFF-TOPIC/GENERAL category in the channel list.

thorn obsidian Dec 22, 2020, 12:55 PM

#

oh, sorry for the interruption of the topic, thanks for the info

main condor Dec 22, 2020, 4:20 PM

#

how i can obfuscate my python code?

lapis radish Dec 22, 2020, 4:22 PM

#

main condor how i can obfuscate my python code?

Quick look at Google and I see that you can compile your code into byte-code and distribute in this form
https://stackoverflow.com/questions/3344115/how-to-obfuscate-python-code-effectively/7418341#7418341

Stack Overflow

How to obfuscate Python code effectively?

I am looking for how to hide my Python source code.

print "Hello World!"
How can I encode this example so that it isn't human-readable? I've been told to use base64 but I'm not sure how.

main condor Dec 22, 2020, 4:26 PM

#

but

#

with that

#

i still can make my .py an exe?

woven gazelle Dec 22, 2020, 4:29 PM

#

pyinstaller generally needs a py file

#

why do you want to obfuscate your code

woven gazelle Dec 22, 2020, 5:04 PM

#

what

fading plaza Dec 22, 2020, 11:19 PM

#

thonk

#

do you know what "skid" means

viral jetty Dec 23, 2020, 12:30 AM

#

Merry Christmas Everyone. Keep Safe.
Also thanks for everyone helping me too when I need help with coding.

Merry Christmas x 🎄🤶

meager latch Dec 23, 2020, 12:46 AM

#

Guys what Script do i need if i have a bitlocked usb Can someone give mt the script to un lock it

woven gazelle Dec 23, 2020, 12:52 AM

#

You can't remove bitlocker encryption without the key

#

it would take more than a billion billion years with the world's fastest supercomputer

lapis radish Dec 23, 2020, 6:28 AM

#

meager latch Guys what Script do i need if i have a bitlocked usb Can someone give mt the scr...

Hashcat has BitLocker mode since 31 Dec 2019 so you can try to break password

#

But it's kinda offtopic here

meager latch Dec 23, 2020, 12:35 PM

#

i dont have the key its for my customer but i dont have a script lol i was wondering if there was a pythoon script

woven gazelle Dec 23, 2020, 3:44 PM

#

as I said, I could give you a script but it would take a billion billion years if you have no idea at all what the password is

#

and it's secure

lapis radish Dec 23, 2020, 3:48 PM

#

Try to ask NSA #joke

heavy arch Dec 23, 2020, 6:35 PM

#

NSA only have $ 290 millions per day to spend on spying people

thorn obsidian Dec 23, 2020, 8:37 PM

#

Do you need to know data structures and algorithms for cybersecurity?

heavy arch Dec 23, 2020, 8:41 PM

#

if you have that amount of money

#

?

lapis radish Dec 23, 2020, 8:44 PM

#

thorn obsidian Do you need to know data structures and algorithms for cybersecurity?

You should but it depends

thorn obsidian Dec 23, 2020, 8:45 PM

#

@lapis radish Yeah I think if learn data structures and algorithms then This would benefit me for problem solving you know what i mean?

lapis radish Dec 23, 2020, 8:46 PM

#

It can help you ofc

thorn obsidian Dec 23, 2020, 8:46 PM

#

it's conspicuous

lapis radish Dec 23, 2020, 8:48 PM

#

For example if you are a pentester and you are trying to break some code (like app for mobile devices) knowledge about data structures and internal processor layout can be helpful to find vulnerabilities

thorn obsidian Dec 23, 2020, 8:50 PM

#

@lapis radish absolutely right

#

I like that example

lapis radish Dec 23, 2020, 8:51 PM

#

👍

vivid frost Dec 25, 2020, 7:22 AM

#

sha512 hash starts with $6$ right

fading plaza Dec 25, 2020, 7:53 AM

#

sha512crypt, yes

primal star Dec 25, 2020, 1:37 PM

#

waut

thorn obsidian Dec 26, 2020, 2:28 AM

#

anyone have ideas for cyber security related projects? I already made a portscanner and various other things im just bored now

sonic drum Dec 26, 2020, 2:42 AM

#

lol same

#

I finished my login/register program and I'm bored now

#

I don't know what to add to it anymore

#

maybe a UI? But I'm more focused on security related things

chilly linden Dec 26, 2020, 4:16 AM

#

security! security!

oak steeple Dec 26, 2020, 11:41 PM

#

@sonic drum code some exploits

dusty skiff Dec 27, 2020, 5:57 AM

#

where is the cryptography section ?

sonic drum Dec 27, 2020, 6:27 AM

#

You can ask here

thorn obsidian Dec 27, 2020, 3:27 PM

#

Let's say I have implemented token auth for my web application.

Could a user theoretically brute force the token stored in the cookie, until they match the token of another user? Then be able to log in?

lapis radish Dec 27, 2020, 4:47 PM

#

thorn obsidian Let's say I have implemented token auth for my web application. Could a user th...

Brute force is always an option

#

So tokens' space should be big enough that brute force is wrothless

thorn obsidian Dec 27, 2020, 4:49 PM

#

@lapis radish so, long tokens to ensure that there are a load of possible combinations, therefore making brute force take exceedingly long?

lapis radish Dec 27, 2020, 4:50 PM

#

thorn obsidian <@690641855045697653> so, long tokens to ensure that there are a load of possibl...

Yep and chance to get token used by another user is small enough

thorn obsidian Dec 27, 2020, 6:14 PM

#

what does a port scanner do

rose plover Dec 27, 2020, 6:56 PM

#

scans any open or closed ports on a target machine

lapis radish Dec 27, 2020, 8:03 PM

#

thorn obsidian anyone have ideas for cyber security related projects? I already made a portscan...

You can implement DES and attack using differential cryptoanalysis

#

It's nice introduction into block ciphers and cryptoanalysis

rose plover Dec 28, 2020, 7:47 PM

#

Why is this channel dead today 😞

lapis radish Dec 28, 2020, 8:11 PM

#

rose plover Why is this channel dead today 😞

?

patent lion Dec 28, 2020, 8:52 PM

#

Some people know scapy here ?

lapis radish Dec 28, 2020, 8:53 PM

#

patent lion Some people know scapy here ?

I know scapy a little

patent lion Dec 28, 2020, 9:00 PM

#

do you know what it said like matplotlib not imported and also texte smth ?

#

like i use matplotlib for jupyter notebook

lapis radish Dec 28, 2020, 9:02 PM

#

How is it related with scapy and security? 😂

patent lion Dec 28, 2020, 9:03 PM

#

it's on scapy

#

when i load scapy

#

i got those two messages

patent lion Dec 28, 2020, 10:15 PM

#

this

📎 unknown.png

#

but i've installed both

#

yert

fading plaza Dec 28, 2020, 10:19 PM

#

check python versions

#

and venv

patent lion Dec 28, 2020, 10:41 PM

#

how do i check venv on linux

#

pithink

#

for python3 --version i have 3.6.9 and python --version i have 2. 7.12

woven gazelle Dec 28, 2020, 10:50 PM

#

how are you running scapy

#

and run which scapy and which python3

patent lion Dec 28, 2020, 10:51 PM

#

hmm to launch scapy i do sudo scapy

woven gazelle Dec 28, 2020, 10:51 PM

#

why sudo

#

also it may be using a different python install somewhere

patent lion Dec 28, 2020, 10:52 PM

#

i am following the scapy documentation where they do " sudo ./scapy "

#

but since ./scapy doesn't work i just do sudo scapy

patent lion Dec 28, 2020, 10:53 PM

#

woven gazelle also it may be using a different python install somewhere

i see

woven gazelle Dec 28, 2020, 10:54 PM

#

what did which scapy and which python3 output

patent lion Dec 28, 2020, 11:02 PM

#

for which scapy : /home/tom/.local/bin/scapy

#

and for which python3 : /usr/bin/python3

woven gazelle Dec 29, 2020, 2:09 AM

#

Is there any non terrible way to do PGP operations in python

wet plover Dec 29, 2020, 4:14 AM

#

Haii, can i ask where should i start for studying security?

heavy arch Dec 29, 2020, 8:32 AM

#

everytime you use a requests.get

#

the site counts as a "viewer"?

fading plaza Dec 29, 2020, 8:34 AM

#

@patent lion ah then you need to sudo pip install matplotlib

#

since otherwise python wont read from ~/.local/lib/site-packages

#

where i assume matplotlib is installed(by default)

pallid epoch Dec 29, 2020, 8:37 AM

#

hi how can i ethical hack?

void aspen Dec 29, 2020, 10:48 AM

#

Hey @pallid epoch, we don't allow talking about ethical hacking here, because we have no way of verifying your actual intentions.

patent lion Dec 29, 2020, 10:49 AM

#

When I do sudo pip install matplitlib he said requirement already satisfied

thorn obsidian Dec 29, 2020, 11:54 AM

#

can cyber security be doneby py

jolly crypt Dec 29, 2020, 12:58 PM

#

Python can be/is used in cyber security

torpid coral Dec 29, 2020, 3:07 PM

#

patent lion When I do sudo pip install matplitlib he said requirement already satisfied

that means that matplotlib is already installed. you might not need the sudo though

#

also, your question is offtopic for this chanel lemon_grimace

patent lion Dec 29, 2020, 5:41 PM

#

O

versed anchor Dec 29, 2020, 5:53 PM

#

can anyone suggest a cool security project with Python?

lapis radish Dec 29, 2020, 5:53 PM

#

versed anchor can anyone suggest a cool security project with Python?

What do you mean "cool"?

versed anchor Dec 29, 2020, 5:54 PM

#

whatever cool means for you

lapis radish Dec 29, 2020, 5:55 PM

#

Do you want to contribute, use or what?

versed anchor Dec 29, 2020, 5:55 PM

#

i'll edit that: can anyone suggest a security project with Python where I could learn some fundamental sec skills?

lapis radish Dec 29, 2020, 5:56 PM

#

You have https://cryptography.io/ where you can use cryptographic primitives, you have scapy to capture and manipulate packets

versed anchor Dec 29, 2020, 5:58 PM

#

nice, thanks

#

do you have any personal sec projects with python?

lapis radish Dec 29, 2020, 5:59 PM

#

versed anchor do you have any personal sec projects with python?

I have few

lapis radish Dec 29, 2020, 5:59 PM

#

versed anchor nice, thanks

Your welcome!

versed anchor Dec 29, 2020, 5:59 PM

#

@lapis radish would you like to talk about them? I would be very interested

lapis radish Dec 29, 2020, 6:00 PM

#

versed anchor <@!690641855045697653> would you like to talk about them? I would be very intere...

Grab some free help channel, it's kinda offtopic here

versed anchor Dec 29, 2020, 6:00 PM

#

isn't this a security python channel?

lapis radish Dec 29, 2020, 6:02 PM

#

We can talk here, this is not problem for me but maybe mods have different opinion 😂

versed anchor Dec 29, 2020, 6:03 PM

#

talking about python sec projects in a python sec channel doesnt sound off-topic to me

lapis radish Dec 29, 2020, 6:04 PM

#

Right.. So, what do you like to learn?

versed anchor Dec 29, 2020, 6:06 PM

#

i would like to get myself into web app pentesting since it's a field with high demand

#

but i was interested in what you worked on

#

sharing your experiences

lapis radish Dec 29, 2020, 6:07 PM

#

I worked with steganography and dictionaries generation for hash cracking

#

Mostly

versed anchor Dec 29, 2020, 6:08 PM

#

wow, that sounds cool

#

personal projects or for work?

lapis radish Dec 29, 2020, 6:08 PM

#

Steganography for my studies, dictionaries generation for work

#

There are good tools to generate dictionaries but there are implemented in different languages - like CUPP or duplicut

#

I don't have experience with pentesting but OWASP sites should be good place to start

#

You can implement simple backend detector (returns server's OS and HTTP server type and version) for example

versed anchor Dec 29, 2020, 6:13 PM

#

thanks for the suggestions

#

i will look into that

lapis radish Dec 29, 2020, 6:16 PM

#

Good luck

thorn obsidian Dec 30, 2020, 2:39 PM

#

hii

#

anyone arround

void aspen Dec 30, 2020, 2:40 PM

#

Hey, no need to ask to ask, just ask lemon_pleased

thorn obsidian Dec 30, 2020, 2:42 PM

#

what do u do work or study

thorn obsidian Dec 30, 2020, 2:42 PM

#

void aspen Hey, no need to ask to ask, just ask <:lemon_pleased:754441880263196742>

u

void aspen Dec 30, 2020, 2:42 PM

#

Wdym?

thorn obsidian Dec 30, 2020, 2:43 PM

#

i wanna ask i m going for networking diploma and then cyber security diploma

#

i m free for 3 months

#

and i was just wondering i should learn those languages that should be helpful in my cyber security career

#

like python c and java

#

ig python is used for automation in security domain

#

and c and java idk

#

or any other lang

thorn obsidian Dec 30, 2020, 2:44 PM

#

void aspen Wdym?

can u guide me

void aspen Dec 30, 2020, 2:45 PM

#

Yeah, that would definitely be valuable

#

I'd recommend you Python and C, but I'm not sure if learning both would be possible in 3 months

#

If you are motivated enough, I think so

#

Java is useless for CyberSec honestly

#

There's no real reason to use it

thorn obsidian Dec 30, 2020, 2:46 PM

#

void aspen I'd recommend you Python and C, but I'm not sure if learning both would be possi...

i m done with all my python basics i started a month ago

#

and i m thinking to learn python selenium automation and web scraping

#

rn

#

is it good

#

and also tell me other than this i should learn machine learning with python?

#

also i was wondering that when i would be doing that cyber security diploma i could learn all this at that time too what u say ?

void aspen Dec 30, 2020, 2:48 PM

#

No, that isn't going to be useful for CyberSec, at least I don't think

thorn obsidian Dec 30, 2020, 2:48 PM

#

void aspen No, that isn't going to be useful for CyberSec, at least I don't think

machine learning

void aspen Dec 30, 2020, 2:49 PM

#

Well, it depends on what is included in the diploma, if there's programming or not

thorn obsidian Dec 30, 2020, 2:49 PM

#

yes so

#

no for machine learning

#

what after learning c basics

#

what all i can do with that and what i have to do with c for cybersec

void aspen Dec 30, 2020, 2:51 PM

#

C will have low level access to the computer resource, this is very important for some work

thorn obsidian Dec 30, 2020, 2:51 PM

#

so for now i should learn python automation and c basics only

thorn obsidian Dec 30, 2020, 2:51 PM

#

void aspen C will have low level access to the computer resource, this is very important fo...

there?

woven gazelle Dec 30, 2020, 2:52 PM

#

what

void aspen Dec 30, 2020, 2:52 PM

#

I'd say get comfortable with both languages

thorn obsidian Dec 30, 2020, 2:53 PM

#

void aspen I'd say get comfortable with both languages

how, i didnt understand

woven gazelle Dec 30, 2020, 2:53 PM

#

what do you mean by 'there?'

thorn obsidian Dec 30, 2020, 2:53 PM

#

i was asking r u there

#

being comfortable with a language, u mean learning their basics and all the domains they are used ? @void aspen

#

can i have ur 5 mins pls

void aspen Dec 30, 2020, 2:55 PM

#

Not necessarily all the domains they are used in, it would be way too much

thorn obsidian Dec 30, 2020, 2:55 PM

#

yeah

#

thats what i was wondering

void aspen Dec 30, 2020, 2:55 PM

#

Just know how to do some simple stuff in those languages

thorn obsidian Dec 30, 2020, 2:55 PM

#

not to tackle real word problems

#

bruh u confused me

#

ok leave i will ask someone else, i will go with some blogs

heavy arch Dec 30, 2020, 7:40 PM

#

how can I know ifmy machine

#

has something bad caused by a .py f

#

file

lapis radish Dec 30, 2020, 7:42 PM

#

heavy arch has something bad caused by a .py f

Check file source code

heavy arch Dec 30, 2020, 7:42 PM

#

like a --verify

#

there is no way that can be ofuscado?

#

Obfuscated*

lapis radish Dec 30, 2020, 7:43 PM

#

You can run virtual machine with suspected Python script and check any I/O operations or disk changes

heavy arch Dec 30, 2020, 7:44 PM

#

how much it costs

lapis radish Dec 30, 2020, 7:44 PM

#

Qemu has something named cow

lapis radish Dec 30, 2020, 7:45 PM

#

heavy arch how much it costs

What do you mean costs? Dolars, time?

heavy arch Dec 30, 2020, 7:45 PM

#

dolars

lapis radish Dec 30, 2020, 7:45 PM

#

Idk

raw jewel Dec 30, 2020, 7:48 PM

#

Unless the script is obfuscated or encrypted in some way, I'd think code analysis would be the most direct and least expensive route.

heavy arch Dec 30, 2020, 7:48 PM

#

if you have money

raw jewel Dec 30, 2020, 7:48 PM

#

Assuming you have someone with moderate python experience.

heavy arch Dec 30, 2020, 7:49 PM

#

which service would you paid for?

lapis radish Dec 30, 2020, 7:49 PM

#

raw jewel Unless the script is obfuscated or encrypted in some way, I'd think code analysi...

Right, obfuscated/encrypted code can "wait" for good time to attack

raw jewel Dec 30, 2020, 7:49 PM

#

I fail to see how a service is going to provide that for you.

heavy arch Dec 30, 2020, 7:49 PM

#

its not reallywrong

#

with my machine

raw jewel Dec 30, 2020, 7:49 PM

#

As Morowy described, you can sandbox the application

#

and observe its behaviors

#

but even that is non-deterministic

lapis radish Dec 30, 2020, 7:50 PM

#

heavy arch which service would you paid for?

You can build it on your own or find some cybersec analysts

raw jewel Dec 30, 2020, 7:50 PM

#

since the program could do something harmful in 60 minutes or 60 years

#

or or act on some input that does not exist in your sandbox

#

there may be static analysis tools that will do preliminary analysis

#

but again, whatever they spit out will probably require you to dig into the sources for usable details

#

is this a post mortem analysis?

heavy arch Dec 30, 2020, 7:52 PM

#

yeah

raw jewel Dec 30, 2020, 7:52 PM

#

That script is the least of your worries.

heavy arch Dec 30, 2020, 7:53 PM

#

worries about what?

raw jewel Dec 30, 2020, 7:53 PM

#

The fact that it exists should be your primary concern.

#

I assume it's a root kit or some kind of bot client?

heavy arch Dec 30, 2020, 7:53 PM

#

something like that

#

im not interested in my machine

#

but in the info

raw jewel Dec 30, 2020, 7:54 PM

#

You mean data exfiltration?

heavy arch Dec 30, 2020, 7:54 PM

#

I mean

#

I wanna know if I can afford

raw jewel Dec 30, 2020, 7:55 PM

#

Afford what exactly?

heavy arch Dec 30, 2020, 7:55 PM

#

whatever

#

piece of information

raw jewel Dec 30, 2020, 7:55 PM

#

Hiring someone to provide full forensic post-mortem?

heavy arch Dec 30, 2020, 7:55 PM

#

yes

#

$ 20k ?

#

if it's not illegal I can pay directly

raw jewel Dec 30, 2020, 7:56 PM

#

All I can tell you is that in 2006, our firm started at $10k for basic imaging and preliminary analysis.

#

I have no idea what the market looks like today.

#

There's nothing illegal about having someone image your compromised system and provide root cause.

heavy arch Dec 30, 2020, 7:57 PM

#

I can afford it...

raw jewel Dec 30, 2020, 7:58 PM

#

Well, you're asking in the wrong place. There are plenty of companies which provide forensic systems analysis.

heavy arch Dec 30, 2020, 7:58 PM

#

yeah

#

o give it up

#

im not searching things

raw jewel Dec 30, 2020, 7:59 PM

#

Have a nice day.

heavy arch Dec 30, 2020, 7:59 PM

#

have a nice day too and a happy new year

#

i appreciate your attention

past starBOT Dec 31, 2020, 12:34 AM

#

Hey @deep mirage!

It looks like you tried to attach a Python file - please use a code-pasting service such as https://paste.pythondiscord.com

#

Hey @deep mirage!

It looks like you tried to attach file type(s) that we do not allow (.exe). We currently allow the following file types: .3gp, .3g2, .avi, .bmp, .gif, .h264, .jpg, .jpeg, .mkv, .mov, .mp4, .mpeg, .mpg, .png, .tiff, .wmv, .svg, .psd, .ai, .aep, .xcf, .mp3, .wav, .ogg, .webm, .webp, .flac, .afdesign, .m4a, .csv.

Feel free to ask in #community-meta if you think this is a mistake.

deep mirage Dec 31, 2020, 12:43 AM

#

Here is an experimental encryption algorithm I have created.
It is not very secure, but it provides basic encryption and decryption with symmetric key's and parameters.
Type help encode and help decode for the command syntax.
https://paste.pythondiscord.com/alonilofaz.lua

#

It also says lua for some reason

#

But it is a python file

thorn obsidian Dec 31, 2020, 12:54 AM

#

can someone help me with a homework problem, i am new to python and i really really need help

#

it involves a question regarding the vigenere cipher

deep mirage Dec 31, 2020, 1:05 AM

#

You shouldn't ask for homework answers online.
It is considered cheating by most.

restive stone Dec 31, 2020, 1:32 AM

#

@balmy mural are you having problems with the cipher or the python? I can help you with either.

rotund yarrow Dec 31, 2020, 2:22 AM

#

deep mirage You shouldn't ask for homework answers online. It is considered cheating by most...

We have a policy against giving answers to homework problems, but not against helping with homework problems. Doing the work for someone else is cheating (and defeats the point of the homework), but helping someone to understand the problem and to work out the solution is teaching (and that's the point of the homework in the first place). And for homework (as opposed to tests, for example) use of external resources is usually allowed.

sonic drum Dec 31, 2020, 4:39 AM

#

Is "never trust the client" a good way to go about security?

lapis radish Dec 31, 2020, 4:41 AM

#

sonic drum Is "never trust the client" a good way to go about security?

It's always a good way

#

Never trust user input

#

Always check both sides of the one way road

#

In real life too

sonic drum Dec 31, 2020, 4:41 AM

#

Okay, so matter who uses my product, no matter what they do, it is not trusted

#

alright yeah

#

that makes a lot of sense

lapis radish Dec 31, 2020, 4:45 AM

#

🙂

heavy arch Dec 31, 2020, 6:25 AM

#

if a person uses a credit card from a foreign person in USA, for example

#

that person cannot be judged, but in case of the adress bill are in USA

#

getting a mandate is difficult to put that person in jail?

shy solar Dec 31, 2020, 8:55 AM

#

i was talking to my comp sci teacher earlier this sem and he told me that using plenty of exec() in my program may cause security issues as the inputs may be processed as code?

#

does any1 know more about this and can tell me a bit more about it?

rotund yarrow Dec 31, 2020, 9:41 AM

#

shy solar does any1 know more about this and can tell me a bit more about it?

exec makes you vulnerable to what are called "injection attacks". If you ever take input from the user and wind up passing it to exec, it could wind up doing anything that the user wants - writing or deleting files, making network connections, etc

#

eval has the same problem. People frequently use eval to make a calculator, by doing something like:

num1 = input("first number?")
num2 = input("second number?")
print("Multiplying them gives:", eval(num1 + "*" + num2))

#

but the problem is, what happens if the user doesn't type a number, but instead types print("Hello world") for instance?

#

!e ```py
num1 = 'print("Hello world")'
num2 = '5'
print("Multiplying them gives:", eval(num1 + "*" + num2))

past starBOT Dec 31, 2020, 9:45 AM

#

@rotund yarrow :x: Your eval job has completed with return code 1.

001 | Hello world
002 | Traceback (most recent call last):
003 |   File "<string>", line 3, in <module>
004 |   File "<string>", line 1, in <module>
005 | TypeError: unsupported operand type(s) for *: 'NoneType' and 'int'

rotund yarrow Dec 31, 2020, 9:45 AM

#

note that it ran the print("Hello world"); you can see it there in the output.

#

so if instead of print, they were to start a new evil process, let's say, you're going to have a bad time.

#

You should never use eval or exec on any string unless you already know exactly what it contains, and that it doesn't have any untrusted user input mixed in.

#

the "use eval as a calculator" thing is fine, if you make sure that the user gave you a number, only a number, and nothing else, for instance. But it's unsafe if they're allowed to enter anything at all.

olive iron Dec 31, 2020, 4:16 PM

#

can someone tell me what account leeching and slayer leecher is?? can my account get "leeched" or hacked???????????????????????????????????????????????????????????????????????????????????????????????????????????????????????????????????????????????

shy solar Dec 31, 2020, 7:27 PM

#

rotund yarrow note that it ran the `print("Hello world")`; you can see it there in the output.

icic, got it ty

proper path Dec 31, 2020, 7:42 PM

#

@olive iron

#

https://www.bing.com/search?q=account+leeching+wikipedia&qs=n&form=QBRE&sp=-1&pq=account+leeching+wikipedi&sc=0-25&sk=&cvid=E5C6CA7012164C99B1061A30A5571D67

#

very simple

#

you have the internet, this is a programming discord, not google

olive iron Dec 31, 2020, 7:45 PM

#

in your case bing

weary hull Dec 31, 2020, 10:22 PM

#

is there anyway for one way encryption
eg: encrypt string with a key, cant get the encrypted string back
but you can re-encrypt the same string with the same key and get the same encrypted string

sonic drum Dec 31, 2020, 11:00 PM

#

I think you can do that with UUID5

#

>>> uuid.uuid4()
UUID('e817d382-e08c-4351-a1ba-1db2a25207ff')
>>> uuid.uuid5(uuid.UUID('e817d382-e08c-4351-a1ba-1db2a25207ff'),"hi")
UUID('38f9b040-a72c-5027-945a-fcc9f71a6274')
>>> uuid.uuid5(uuid.UUID('e817d382-e08c-4351-a1ba-1db2a25207ff'),"hi")
UUID('38f9b040-a72c-5027-945a-fcc9f71a6274')``` is this what you mean @weary hull

#

UUID('e817d382-e08c-4351-a1ba-1db2a25207ff') is the "key"

#

and you can use UUID5 and the UUID4 key to "encrypt" a string and get some other UUID, like hi with the key of UUID('e817d382-e08c-4351-a1ba-1db2a25207ff') will get you UUID('38f9b040-a72c-5027-945a-fcc9f71a6274')

#

if you choose a different key, it'll be different

woven gazelle Dec 31, 2020, 11:53 PM

#

Well conceptually it's a salted hash

#

Or alternatively asymmetric encryption with an unknown private key

fading plaza Jan 1, 2021, 2:28 AM

#

uuids aren't cryptographically secure afaik

#

but yeah thats basically hashing

heady zenith Jan 1, 2021, 2:47 AM

#

weary hull is there anyway for one way encryption eg: encrypt string with a key, cant get t...

https://en.m.wikipedia.org/wiki/Cryptographic_hash_function

Cryptographic hash function

A cryptographic hash function (CHF) is a mathematical algorithm that maps data of arbitrary size (often called the "message") to a bit array of a fixed size (the "hash value", "hash", or "message digest"). It is a one-way function, that is, a function which is practically infeasible to invert. Ideally, the only way to find a message that produce...

#

https://docs.python.org/3/library/hashlib.html have some common hash functions, but most of them are pretty weak by modern standards.

nimble crater Jan 1, 2021, 6:12 AM

#

Hey guys, I converted my python file to executable using pyinstaller, and Windows Detector among other various security software is detecting it as a virus, how to fix this?

versed cliff Jan 1, 2021, 10:45 AM

#

guys need help... working on a web scraping code with selenium. the website blocks bot action but grants access to manuel input. what can i do?

heady zenith Jan 1, 2021, 2:35 PM

#

nimble crater Hey guys, I converted my python file to executable using pyinstaller, and Window...

It will generally show that for any unsigned exe downloaded from the internet. There is some links to various resources and such here : https://stackoverflow.com/questions/48806909/how-to-pass-the-windows-defender-smartscreen-protection

lapis radish Jan 1, 2021, 7:18 PM

#

!rule 6

past starBOT Jan 1, 2021, 7:18 PM

#

Rules

6. No spamming or unapproved advertising, including requests for paid work. Open-source projects can be shared with others in #python-general and code reviews can be asked for in a help channel.

hybrid finch Jan 2, 2021, 12:21 AM

#

ㅐㄴㅅㆍ

civic bolt Jan 2, 2021, 3:22 AM

#

Hello, Is there any way to have Voice Identification (as a Biometric) in Python?

lapis radish Jan 2, 2021, 4:10 AM

#

@civic bolt You need to get some samples, create models and compare audio from microphone for example with your models, stored somewhere

#

I have some examples from my studies and we worked with LPC and MFCC methods to extract data from audio samples

woven gazelle Jan 2, 2021, 5:59 PM

#

the problem with malware generally isn't that it takes more than 20 lines

void aspen Jan 2, 2021, 6:05 PM

#

Hello @mental relic, let's not share articles about malicious projects please

restive hazel Jan 2, 2021, 6:09 PM

#

Hello, Is there any recommended library for handling and interpreting CTI Sources . I have been looking some for my open-sources project

violet light Jan 2, 2021, 8:45 PM

#

versed cliff guys need help... working on a web scraping code with selenium. the website bloc...

I dont think there is a way for them to do such antibot protection since with selenium you can simulate human activity very well. So the mistake, in my opinion, is that you are not interacting with the correct element. Try setting .value attribute or using .sendKeys()

#

And try to interact with every possible element in the area of the text bar

#

Thats how I solved similar problem to yours

fading plaza Jan 2, 2021, 11:21 PM

#

@violet light detecting bot-like activity is very easy, its what recaptcha does

#

also check the user agent

thorn obsidian Jan 2, 2021, 11:42 PM

#

You could also do what WAF's do, they usually check for mouse clicks, user-agent, ip (whether it's a proxy/vpn), how long you've been there, the cookies, etc.

violet light Jan 3, 2021, 8:21 AM

#

Yes but I used undetected chromedriver

#

You can either use this ore edit one variable of chromedriver in hex editor

#

And with undetected chromedriver it is hard for websites to detect you. They may give you a recaptcha, thats true, but they dont know that u are a bot for sure

#

Undetected chromedriver can bypass even instagram anti bot protection

#

So I doubt that the website inputs are blocked for bots

#

I think thats not the reason

#

Best for me would be if B2_Code_B2 provided me with the website he wants to bot so I could figure out whats going on

thorn obsidian Jan 3, 2021, 11:17 PM

#

Just wondering can i make a .py file "non crackable" i want to give my friend my tool but i don't want him getting the source 🤔 (tldr:how to make .py to safe .exe)

woven gazelle Jan 3, 2021, 11:45 PM

#

why don't you want them getting the source

#

does it have a secret in

#

or is it just about protecting the code

lapis radish Jan 3, 2021, 11:53 PM

#

thorn obsidian Just wondering can i make a .py file "non crackable" i want to give my friend my...

Anybody always can make reverse engineering of your exe...

thorn obsidian Jan 4, 2021, 12:24 AM

#

thorn obsidian Just wondering can i make a .py file "non crackable" i want to give my friend my...

You can use Pyarmor if you don't know much about obfuscation. Pyarmor can be reversed (heck I've done it myself), although it gives a relatively strong protection for Python files. Otherwise, you can create your own (you can take notes from Pyarmor), but, only do if you know what you're doing. If not, it'll be really easy to reverse it.

thorn obsidian Jan 4, 2021, 12:25 AM

#

thorn obsidian You can use Pyarmor if you don't know much about obfuscation. Pyarmor can be rev...

Alright, thank you for a proper answer.

#

👍

thorn obsidian Jan 4, 2021, 12:40 AM

#

Anyone have an idea of what else I should add ping me if so? Really just covers the basics here. (This is just something I'm doing for fun, probably won't use it in any project) https://i.imgur.com/UwRJh96.png

Imgur

fading plaza Jan 4, 2021, 2:14 AM

#

wtf is "undetected chromedriver" @violet light

#

anyways it looks like it just patches window.navigator and console.log(why?)

#

plus enable a few flags

#

still can be detected

#

also

#

!rule 5

past starBOT Jan 4, 2021, 2:29 AM

#

Rules

5. Do not provide or request help on projects that may break laws, breach terms of services, be considered malicious or inappropriate. Do not help with ongoing exams. Do not provide or request solutions for graded assignments, although general guidance is okay.

fading plaza Jan 4, 2021, 2:29 AM

#

and that bullshit with a "hexeditor" makes you sound like a skid

past summit Jan 4, 2021, 5:27 AM

#

@thorn obsidian actually i'm pretty sure what you're asking is how to compile your program.

#

obfuscation is also another preventative measure you can take if you suspect your friend will try to reverse engineer your program

#

but yeah you can compile a program in many different ways, there's apps like auto-py-to-exe that'll do it for you or you can do it yourself via the cmd terminal

violet light Jan 4, 2021, 8:43 AM

#

What? No

#

It really is undetectable

#

just search it up bruh

#

like I was able to be undetected on a page with Cloudflare

#

selenium chrome driver is detectable because it has some string in it with a certain value if I understood it correctly, and the websites can easily check the string. You can edit the string chromedriver so the websites wouldnt be able to see the difference between normal chrome browser and the chromedriver

#

https://stackoverflow.com/questions/33225947/can-a-website-detect-when-you-are-using-selenium-with-chromedriver

Stack Overflow

Can a website detect when you are using Selenium with chromedriver?

I've been testing out Selenium with Chromedriver and I noticed that some pages can detect that you're using Selenium even though there's no automation at all. Even when I'm just browsing manually j...

violet light Jan 4, 2021, 8:55 AM

#

fading plaza and that bullshit with a "hexeditor" makes you sound like a skid

Also please do not be toxic towards me, thanks. I am just trying to help that guy who needed it. Plus, I am not helping him breaking the law. I said that he should try to interact with different elements.

nimble crater Jan 4, 2021, 12:08 PM

#

this line of code var_5 = subprocess.check_output("dir", shell=True) works as a python script, but when I convert this into exe, it just dont work

try:
            var_5 = subprocess.check_output("dir", shell=True)
        except:
            await channel.send('error occured')
        else:
            await channel.send(file = discord.File(io.BytesIO(var_5), spoiler=True))

thorn obsidian Jan 4, 2021, 2:35 PM

#

I wonder if undetected chrome driver breaks the fifth rule 🤔

#

I got so many good ideas, like auto join to remote school classes

void aspen Jan 4, 2021, 2:54 PM

#

Yeah, it does break the 5th rule

violet light Jan 4, 2021, 4:24 PM

#

Is undetected chromedriver illegal??

void aspen Jan 4, 2021, 4:25 PM

#

It is against most ToS, yeah

violet light Jan 4, 2021, 4:25 PM

#

Then why is it so commonly used among web botters

#

ahh

#

okay

vapid nymph Jan 4, 2021, 7:03 PM

#

HEy there
Does anyone know about Nginx ??
I am being unable to block an automated web request. I used the deny <ip> in the location directive but nothing happens
I still see the <ip> in the access log

lapis radish Jan 4, 2021, 7:51 PM

#

vapid nymph HEy there Does anyone know about Nginx ?? I am being unable to block an automate...

What do you do and what do you want to achieve?

vapid nymph Jan 4, 2021, 7:51 PM

#

@lapis radish Want to restrict an IP from making GET requests

#

It's making those requests using cURL

#

https://docs.nginx.com/nginx/admin-guide/security-controls/controlling-access-proxied-tcp/?__cf_chl_captcha_tk__=1581bcf419e852ba606840f2aa7ff5c8d0cdb1ae-1609789425-0-AclbIKHDjZAdWjfd1FBsPM0kfC4qk3Gl_qbZIcNTlq3C0aCXA6vFuIvR0a7jkL_ovsa7RexmKuwlXMZNXpLrkFXM9tw5H1S5Z5JnX4AT5GLurNhEpPWJ3MHqzkyCt8B-YSCT1FMV6rpjbgHz2liXz4C1Aw57BNFY5kOILcrq85L2XYLUL_ohLbU6MaZ1dBibFpRyhw3bAmENcDjS_5kghnkjKkZjcuOv_CA5DmkO7ag0r2xJ1ddYaH4ND8AyZbZNBvfeNwGYQS4qEkSaAVV1VCG0Yh-LpyG8MH9gjXXe3_Wvkpkv2Q5E2v9Z71DHwHDPTwAQEGMuCGUDUinMZO6_wiyRkPC1BauJFsHcxbPgWa6SugGDHZ2KFlE4dzQEuiW5KP6Pr1YqZZLhEHpcjCxmcaAJMdA4oOfnFcO7ymPBg45hhJ1hdCJx7HsobGZqBeQy3m2_75TC5NbOkg6UJHnNj8JzQ1tVSjmXHKGf8mJD4eAabcaO2cuJuhdsSAQv4fL0QbL-C07ZarIPfMuKsE0tUk2beWWpcLsVIuK8ETI9m7bdfkpg90nu2wKjU6aceDuowcnZf4aPGnUNz93B0RFO8qvIpD7KLUYPLNDBKknc2cH9YWy4-XJDRamQjqOs-eZcG4e2z0odzBsnPBBxrQUMOH54FS1d3WcixghS7Uzxwjke

NGINX Documentation

NGINX Docs | Restricting Access to Proxied TCP Resources

Protect your upstream TCP application servers by limiting connections or bandwidth, based on client IP address or other variables.

#

I followed this

#

And deny the IP at various places

#

Like location / {}
server{}
http{}

#

But IP can still make the requests somehow

lapis radish Jan 4, 2021, 7:54 PM

#

There is info that allow and deny should be in stream or server blocks

#

Do you restarted nginx after changes?

vapid nymph Jan 4, 2021, 7:56 PM

#

Yeah

#

I did

#

Yeah, deny was in server block

lapis radish Jan 4, 2021, 7:56 PM

#

Can you paste some code?

vapid nymph Jan 4, 2021, 7:56 PM

#

I restarted, reloaded, force-reloaded the server

#

Send the code

#

I won't be able to paste it.....

#

I shit down the PC and now out for a walk

lapis radish Jan 4, 2021, 7:57 PM

#

So why you think that it's not working? Have you tried to block your IP?

vapid nymph Jan 4, 2021, 7:58 PM

#

I should have tried to deny all the IPs

#

No

lapis radish Jan 4, 2021, 7:58 PM

#

Block yours and try to enter

vapid nymph Jan 4, 2021, 7:58 PM

#

That just entered the theator of my imagination too

lapis radish Jan 4, 2021, 7:58 PM

#

deny <your ip>
allow all

vapid nymph Jan 4, 2021, 7:59 PM

#

Will try and let you know.
Will it be okay if I msg you personally later ?

lapis radish Jan 4, 2021, 7:59 PM

#

Try to put it in the server block, restart nginx and we will see the result

vapid nymph Jan 4, 2021, 7:59 PM

#

Probably will do after a few hours

lapis radish Jan 4, 2021, 7:59 PM

#

Yes, you can msg me tomorrow

vapid nymph Jan 4, 2021, 8:00 PM

#

Yeah, will do

#

Coll

#

*Cool

lapis radish Jan 4, 2021, 8:00 PM

#

But I am not master of nginx

vapid nymph Jan 4, 2021, 8:00 PM

#

Oh, then you can suffer with me.

lapis radish Jan 4, 2021, 8:00 PM

#

Okay, good luck then!

vapid nymph Jan 4, 2021, 8:00 PM

#

Ohkay bye

#cybersecurity

All the stuff inside your window.

Create the Window

Event Loop to process "events" and get the "values" of the inputs