#cybersecurity | Python | Page 34

thorn obsidian Feb 8, 2021, 1:47 PM

#

Ive used base64 only for it to be compatible with bytes

#

So that u can Encrypt a file

#

An i even made an executable Encryptor for .NET binaries

#

By using the C# version of gCrpt

#

And I've made a simple meterpreter payload and it decreased the number of AV s on virustotal a lot

fluid verge Feb 8, 2021, 1:53 PM

#

wait, it's even worse than I though: it's an alphabetical substitution on a base64 encoded text

#

so... all the digits and the two markers are not changed...

arctic ore Feb 8, 2021, 7:22 PM

#

hi guys im looking to add a license key setup for my program that lasts 30 days then expires

thorn obsidian Feb 8, 2021, 7:44 PM

#

any program can be reverse engineered to bypass license check

#

have you considered offering whatever "service"

#

via internet

#

you can have python on the back-end

#

it would be way more secure

fading plaza Feb 8, 2021, 9:06 PM

#

thorn obsidian it would be way more secure

https://en.wikipedia.org/wiki/Kerckhoffs's_principle

bleak tendon Feb 8, 2021, 10:45 PM

#

what security implementations can you actually do with python?

#

I have like, little to no knowledge of security. basiclaly just am a ML and software nerd

woven gazelle Feb 8, 2021, 11:57 PM

#

what do you mean security implementations

#

oh for the question above

rugged stump Feb 9, 2021, 12:13 AM

#

Hi all, is anyone aware of python libraries that can extract the base of a web page to differentiate between local and foreign addresses. As I am scraping a website, I would only want to scrap pages within the domain

woven gazelle Feb 9, 2021, 12:24 AM

#

the base of a web page

#

i don't really know what that means, are you talking about restricting the scope of a scraper

deep raft Feb 9, 2021, 12:51 AM

#

@rugged stump
use Scrapy and in the spider, specify allowed_domains

rugged stump Feb 9, 2021, 12:51 AM

#

deep raft <@!770947192777080872> use Scrapy and in the spider, specify `allowed_domains`

I'm using beautifulsoup

#

I've kinda accomplished it with urljoin

deep raft Feb 9, 2021, 12:52 AM

#

Well, then you are creating your customer spider and you will have to implement the logic your self.

rugged stump Feb 9, 2021, 12:52 AM

#

urljoin(url,'.')

#

Yep, it takes time to master the framework

#

Plus beautifulsoup gives more flexibility in coding

rugged stump Feb 9, 2021, 12:53 AM

#

deep raft Well, then you are creating your customer spider and you will have to implement ...

True

cursive agate Feb 9, 2021, 1:18 AM

#

I thought of an interesting problem. You pick 2 points a, b in 3d space, such that the distance between a,b is a whole number. Can you find points a,b from distance d?

woven gazelle Feb 9, 2021, 1:38 AM

#

sqrt((ax-bx)^2+(ay-by)^2+(az-bz)^2) is an integer

#

you can find some points

#

but you can pretty easily come up with multiple sets of points for values of d

cursive agate Feb 9, 2021, 1:40 AM

#

No I meant can you find the inverse if you only know d

#

@woven gazelle

woven gazelle Feb 9, 2021, 1:41 AM

#

you can find lots of inverses for some values of d

#

for d=1, a=0,0,0 and b=1,0,0 or b=0,1,0 etc

cursive agate Feb 9, 2021, 1:41 AM

#

but a,b could be anywhere in the 3d space

woven gazelle Feb 9, 2021, 1:41 AM

#

well yeah

#

so

#

no

#

but then you could also say given a number n can you find it

#

and the answer is no

#

so i think the interesting bit is framing it in a way wher eit's not immediately obvious whether it's solvable

#

or where there are interesting conditions to it being solvable

cursive agate Feb 9, 2021, 1:42 AM

#

hmmmm

woven gazelle Feb 9, 2021, 1:42 AM

#

for example in your question, if we ignore obvious cases like symmetry/swapping planes or swapping a and b and large values of d

#

it becomes pretty interesting i think

#

maybe write a python program to graph number of solutions as you increase d

#

double interesting

cursive agate Feb 9, 2021, 1:42 AM

#

hmmm

woven gazelle Feb 9, 2021, 1:42 AM

#

because each value of d still has an infinite number of solutions

cursive agate Feb 9, 2021, 1:42 AM

#

I have a python program to calculate d

woven gazelle Feb 9, 2021, 1:42 AM

#

so maybe fix a to 0,0,0

cursive agate Feb 9, 2021, 1:42 AM

#

possibly

#

I was wondering if I could use this as the basis for some sort of crypto

#

idk if that would be possible

#

where d is public information

#

and a,b are secret

woven gazelle Feb 9, 2021, 1:43 AM

#

hmm yeah i was thinking more proof of work

#

or some kind of hash

#

i guess it makes use of similar things to prime using cryptography

#

where multiplying numbers is easier than finding factors

cursive agate Feb 9, 2021, 1:44 AM

#

hmm

#

I guess f(p, d) would have to have an inverse

#

and if it used the values a,b to decrypt could be useful

#

my algorithm can generate 512-bit d very quickly

sturdy owl Feb 9, 2021, 3:01 AM

#

you know where a and b is because you have to allocate it

cursive agate Feb 9, 2021, 4:25 AM

#

Obviously, but let’s say someone else who doesn’t have access to our system knows d, they can’t find a, b

echo seal Feb 10, 2021, 6:43 AM

#

I don’t know if this is the right channel for this, but is there any way to get the password to a pdf file?

jolly karma Feb 10, 2021, 7:50 AM

#

Hi! Is there a way to improve the security of a http server in python?

sturdy owl Feb 10, 2021, 7:53 AM

#

yes

lapis radish Feb 10, 2021, 8:23 AM

#

echo seal I don’t know if this is the right channel for this, but is there any way to get ...

The only way is to crack it

void aspen Feb 10, 2021, 8:23 AM

#

We won’t help with that here

#

!rule 5

past starBOT Feb 10, 2021, 8:23 AM

#

Rules

5. Do not provide or request help on projects that may break laws, breach terms of services, be considered malicious or inappropriate. Do not help with ongoing exams. Do not provide or request solutions for graded assignments, although general guidance is okay.

lapis radish Feb 10, 2021, 8:24 AM

#

void aspen We won’t help with that here

Right. It is the reason why I replied that it's even possible - not with ready-to-use recipe

void aspen Feb 10, 2021, 8:25 AM

#

Sure, your answer was fine

serene meadow Feb 10, 2021, 10:56 AM

#

echo seal I don’t know if this is the right channel for this, but is there any way to get ...

Yes- get the password from the Owner/Creator of the PDF file, thats the only real way- and they only way you should be doing

ocean copper Feb 10, 2021, 3:52 PM

#

jolly karma Hi! Is there a way to improve the security of a http server in python?

here is one way - https://github.com/codemation/easyauth

GitHub

codemation/easyauth

Create a centralized Authentication and Authorization token server. Easily secure FastAPI endpoints based on Users, Groups, Roles or Permissions with very little database usage. - codemation/easyauth

jolly karma Feb 10, 2021, 4:25 PM

#

ocean copper here is one way - https://github.com/codemation/easyauth

Thanks!

craggy lichen Feb 10, 2021, 6:19 PM

#

How do you store credentials in the environment in a virtual env?

#

Is there a way to do that?

#

And how does one store credentials using secrets instead?

deep raft Feb 10, 2021, 10:29 PM

#

@craggy lichen you don't store secrets with virtualenv. Virtual env is for you to manage python packages in a virtual environment so you don't have to install them globally and mess up other packages.
The reason behind it so you can have different version of a package installed and limited to the code you working with.

For secrets in general or variables... .env file has become a common thing, e.g: https://pypi.org/project/python-dotenv/
You store this in .env file that you never commit / checkout.
If you need to checkout your code, you can use git-crypt: https://github.com/AGWA/git-crypt

Or even better: BlackBox:
https://github.com/StackExchange/blackbox

But you don't have to checkout your code, you can use this encrypt your .env file.
Good luck reading! 🙂

steady ore Feb 11, 2021, 12:41 AM

#

Draw the LFSR of 1+x^2+x^5 and compute all the output sequences with start of [0 1 1 1 0].

what does this mean? my professor wants us to use pylfsr library, i dont really understand the documentation :c

craggy lichen Feb 11, 2021, 1:50 AM

#

@deep raft thanks. I thought .env files were for development and then you transfer them to the environment during production.

#

Will read the rest!

craggy lichen Feb 11, 2021, 2:57 AM

#

blackbox sounds difficult. I don't think I've ever used GPG before

#

I'll have a look at both though. It sounds interested to put secrets in github. I've been told not to do that

deep raft Feb 11, 2021, 3:04 AM

#

With Blackbox it's safe to commit your secrets as long as they are encrypted.

If your looking for offline, e.g not repo code, just encrypt your file with GPG without Blackbox.
I just recommended Blackbox since it takes care of everything, easy to use

craggy lichen Feb 11, 2021, 3:09 AM

#

But then if it's encrypted, how will my python code gain access to it?

#

I'd have to store the GPG somewhere right?

deep raft Feb 11, 2021, 3:16 AM

#

You have to trust the owner of the server when you run (the secrets file has to be decrypted), but let's say that you are taking backups or saving code on some shared server, then you can use GPG to encrypt secrets so they are only visible on the server where the code runs

craggy lichen Feb 11, 2021, 4:01 AM

#

well thankfully i'm the owner of the server

#

so i'll be encrypting the .env file, right?

#

and then decrypt it for use the dotenv_load

deep raft Feb 11, 2021, 7:03 AM

#

Can do that, but you put the password in the code then, might as well just leave it unencrypted

#

Unless you want the user to enter the PW at runtime, mind that the PW will be in the memory then

lapis radish Feb 11, 2021, 8:25 AM

#

steady ore ```Draw the LFSR of 1+x^2+x^5 and compute all the output sequences with start o...

LFSR is just a shift register. There is quite nice article on Wikipedia https://en.wikipedia.org/wiki/Linear-feedback_shift_register
In your case poly should be fpoly = [2, 5] if I am correct. State can be any EXCEPT state = [0, 0, 0, 0, 0]

Linear-feedback shift register

In computing, a linear-feedback shift register (LFSR) is a shift register whose input bit is a linear function of its previous state.
The most commonly used linear function of single bits is exclusive-or (XOR). Thus, an LFSR is most often a shift register whose input bit is driven by the XOR of some bits of the overall shift register value.
The ...

fading plaza Feb 11, 2021, 12:55 PM

#

lapis radish LFSR is just a shift register. There is quite nice article on Wikipedia https://...

wait isn't the state [0, 1, 1, 1, 0]

lapis radish Feb 11, 2021, 1:05 PM

#

fading plaza wait isn't the state [0, 1, 1, 1, 0]

Right, sorry. I was thinking forward that from any state we can iterate through every other

fresh flicker Feb 11, 2021, 1:27 PM

#

Why is

shell = True

considered dangerous in subprocess module?

fading plaza Feb 11, 2021, 1:44 PM

#

if you have something like
subprocess.run(f"ls -la {folder}",shell=True)

#

then you can exploit this to run any command

#

using input like && echo "rce"

#

if instead, you do something like subprocess.run(["ls","-la",folder]), then that can't be exploited this way

#

@fresh flicker

fresh flicker Feb 11, 2021, 1:46 PM

#

OK

sturdy owl Feb 12, 2021, 6:13 AM

#

what that do?

#

show a incorrect output?

fathom peak Feb 12, 2021, 6:16 AM

#

Hello, I’m being harassed online, can I share a post here to raise awareness about it?

thorn obsidian Feb 12, 2021, 7:09 AM

#

idk maybe

vague berry Feb 12, 2021, 4:44 PM

#

no

floral adder Feb 12, 2021, 5:36 PM

#

Hello. I recently (2-3 days ago) bought VPS just to learn some stuff. I've installed apache2 and host flask app (simple app, returns 'ok' at '/') and attach domain. Today I checked logs. Is it normal that some, probably, bots are scanning my server already? Besides typical /login or /wp-login.php I see some weird stuff. I didn't share ip anywhere. How those bots are working exactly? Scanning random IP addresses?

fluid verge Feb 12, 2021, 5:37 PM

#

there aren't that many IPv4 addresses

floral adder Feb 12, 2021, 5:39 PM

#

Ok so it's typical, right? Should I be worried? I have set up some basic security - strong passwords, change default ssh port, firewall, disable root login on ssh and stuff like that

lapis radish Feb 12, 2021, 5:39 PM

#

floral adder Hello. I recently (2-3 days ago) bought VPS just to learn some stuff. I've insta...

Are your site was indexed by Google or other search engines?

floral adder Feb 12, 2021, 5:40 PM

#

I'm not sure. I attach domain to VPS on my vps provider admin panel, besides that I could share link to domain once on facebook messenger

#

I don't know how google indexing works, if it could index my vps by not adding it by myself manually or not

lapis radish Feb 12, 2021, 5:43 PM

#

You can check your domain/IP in services like Shodan

#

If there are hits so here you are - bots come from those places

floral adder Feb 12, 2021, 5:47 PM

#

that's weird, domain was not found on shodan, but when I typed vps ip address, it shows informations about the server but also shows domain next to it, to some online store

#

btw. thanks for showing me shodan, seems like a useful tool

lapis radish Feb 12, 2021, 5:49 PM

#

floral adder that's weird, domain was not found on shodan, but when I typed vps ip address, i...

So you have used IP address, so funny

lapis radish Feb 12, 2021, 5:49 PM

#

floral adder btw. thanks for showing me shodan, seems like a useful tool

Your welcome, there are more services like this but I don't know all of them

woven gazelle Feb 12, 2021, 8:38 PM

#

floral adder Hello. I recently (2-3 days ago) bought VPS just to learn some stuff. I've insta...

Completely normal

#

Bear in mind whoever you rent the vps from has a limited IP range which bots will scan

#

You'll see SSH connection attempts as well as generic exploitation attempts with common web app vulnerability payloads

#

Just make sure SSH is set up securely and you don't have any random ports open

floral adder Feb 12, 2021, 9:03 PM

#

Thank you for the answer @woven gazelle

thorn obsidian Feb 13, 2021, 7:27 AM

#

        while True:
            try:
                user_in = input("CyberCrack: CyberServe/scanner/wordpress/version > ").strip()
                if user_in.startswith("set") and user_in.split()[1] == "URL":
                    url = user_in.split()[2]
                elif user_in == "run" or "exploit":
                    initialize(url=url)
                elif user_in == "help" or user_in == "show options":
                    help()
                else:
                    no_such_command()
            except KeyboardInterrupt:
                return
            except NameError:
                fill_all()

#

in this code no_such_command() wont be executed

#

but fill_all() execute

#

pls solve this

fluid verge Feb 13, 2021, 8:51 AM

#

first: it seems you'd want to ask your question in a general help channel

#

second: you have a NameError, which means you're using a name that isn't initialised

thorn obsidian Feb 13, 2021, 9:28 AM

#

hw to fix it

fluid verge Feb 13, 2021, 9:32 AM

#

I won't help you more, because this potentially breaks rule 5

#

!rule 5

past starBOT Feb 13, 2021, 9:32 AM

#

Rules

5. Do not provide or request help on projects that may break laws, breach terms of services, be considered malicious or inappropriate. Do not help with ongoing exams. Do not provide or request solutions for graded assignments, although general guidance is okay.

thorn obsidian Feb 13, 2021, 9:42 AM

#

!rule 1

past starBOT Feb 13, 2021, 9:42 AM

#

Rules

1. Follow the Discord Community Guidelines and Terms Of Service.

thorn obsidian Feb 13, 2021, 9:43 AM

#

!rule 1032

past starBOT Feb 13, 2021, 9:43 AM

#

:x: Invalid rule indices: 1032

fluid verge Feb 13, 2021, 9:43 AM

#

You have all the rules there: #rules

neon bone Feb 13, 2021, 3:34 PM

#

!rule 2

past starBOT Feb 13, 2021, 3:34 PM

#

Rules

2. Follow the Python Discord Code of Conduct.

neon bone Feb 13, 2021, 3:34 PM

#

!rule 3

past starBOT Feb 13, 2021, 3:34 PM

#

Rules

3. Listen to and respect staff members and their instructions.

fluid verge Feb 13, 2021, 4:14 PM

#

!rule 6

past starBOT Feb 13, 2021, 4:14 PM

#

Rules

6. No spamming or unapproved advertising, including requests for paid work. Open-source projects can be shared with others in #python-general and code reviews can be asked for in a help channel.

fluid verge Feb 13, 2021, 4:14 PM

#

also seems relevant to this discussion

fading plaza Feb 13, 2021, 5:14 PM

#

lmao why are you catching nameerror

woven gazelle Feb 14, 2021, 2:56 AM

#

because they are cybercrack scanner wordpress version

cerulean thorn Feb 14, 2021, 11:21 AM

#

is there a way I can compress data (not file) into very very small string?

#

like from 2000 character to something like 1000 only or even less

fluid verge Feb 14, 2021, 11:22 AM

#

depends on the data

#

if it's random data, you'll have a hard time reducing its size

cerulean thorn Feb 14, 2021, 11:23 AM

#

it's an image encrypted to base64

#

kinda random depending on image

#

there's no library for it? or any easy way

fluid verge Feb 14, 2021, 11:24 AM

#

I don't know

#

though I'm not sure this channel is the right one to ask this question

cerulean thorn Feb 14, 2021, 11:25 AM

#

so where should I ask?

fluid verge Feb 14, 2021, 11:25 AM

#

a general help channel (see #❓｜how-to-get-help)

craggy lichen Feb 14, 2021, 2:22 PM

#

I have a question about logging. Is there a better channel for that?

craggy lichen Feb 14, 2021, 2:24 PM

#

deep raft Can do that, but you put the password in the code then, might as well just leave...

there doesn't seem like there's a way to win. I'm currently not uploading the env file and denying read access to anyone but the owner and hoping that's enough

deep raft Feb 14, 2021, 4:34 PM

#

@craggy lichen that's what I said, you someway have to trust the owner of the server. There is a chain of trust.

What you could do, is implement a logic in the code on the initialization to pull a config file from another server that you control, that way, in case of a compromise the file is not locally stored on the server where the code is. So you can block access to your server if something happens.

Maybe you could read a research paper on the problem:
https://scholar.colorado.edu/concern/graduate_thesis_or_dissertations/kk91fk911
"Securing Secrets and Managing Trust in Modern Computing Applications"

craggy lichen Feb 14, 2021, 5:16 PM

#

deep raft <@!90026239925956608> that's what I said, you someway have to trust the owner o...

Thanks! Sorry for being dense!

thorn obsidian Feb 14, 2021, 7:02 PM

#

hello?

thorn obsidian Feb 14, 2021, 8:01 PM

#

thorn obsidian hello?

ask away

#

you talking about @thorn obsidian

#

?

thorn obsidian Feb 14, 2021, 10:02 PM

#

So I am building this security camera from a raspberry pi that has facial recognition, where when it detects a person it will send me an email and play a sound depending on the person. The only problem is that it does that every single frame, so I would be getting a million emails lol. I am trying to use epoch time but it does not seem to working. I will take a picture of my code and send it. Any ideas?

#

📎 image0.jpg

#

It starts at the if statements

deep raft Feb 15, 2021, 12:38 AM

#

@thorn obsidian that is not security related, check out #❓｜how-to-get-help

fading plaza Feb 15, 2021, 2:37 AM

#

also please post code as text

#

not a picture of your screen

thorn obsidian Feb 15, 2021, 11:04 AM

#

wheres the host file on windows stored

lapis radish Feb 15, 2021, 11:57 AM

#

thorn obsidian wheres the host file on windows stored

%SystemRoot%\System32\drivers\etc\hosts

thorn obsidian Feb 15, 2021, 11:58 AM

#

and i presume the UAC will pop up if u attempt to edit it?

lapis radish Feb 15, 2021, 11:59 AM

#

I don't know, I am not using Windows

thorn obsidian Feb 15, 2021, 11:59 AM

#

ah alr

craggy lichen Feb 15, 2021, 11:59 AM

#

thorn obsidian So I am building this security camera from a raspberry pi that has facial recogn...

Why not use timedelta instead?

#

or rather have states.

#

so have an active state and an idle state. it starts in the active state, then when it detects something, take an image and move to the idle state for a certain amount of time.

#

You could use datetime.now() - datetime.timedelta(parameters) and see if it's more than the datetime before hand.

#

from datetime import datetime, timedelta
from camera import Camera

ACTIVE, INACTIVE = range(2)

def main():
    SecurityCamera = Camera("example@gmail.com")
    state = ACTIVE
    time_to_activate= None
    delay = timedelta(minutes=1)
    while True:
        if state == ACTIVE and SecurityCamera.detected:
            state = INACTIVE
            SecurityCamera.mail_picture()
            time_to_activate = datetime.now() + delay 
        elif datetime.now() > time_to_activate:
            state == ACTIVE```

#

something like this should do?

lapis radish Feb 15, 2021, 12:33 PM

#

craggy lichen ```python from datetime import datetime, timedelta from camera import Camera AC...

Better use enum.IntEnum as states.

You can also use threading.Timer to change state from INACTIVE to ACTIVE

cinder widget Feb 15, 2021, 12:42 PM

#

hi can someone help or figure this out ?

assume i have code like this

aa = '\x4d\x4f\x52\x00\x00\x03\x08\x00\x55\x0d\x0d'
f = enc(aa) # aa -> aes enc -> base64 encode -> aa encrypted

test_dec = dec(aa) # aa encrypted -> base64 decode -> aes decrypt -> aa decrypted
test_dec

question, after i decrypted it, it become 'MOR\x00\x00\x03\x08\x00U\r\r' and not stay the same like before '\x4d\x4f\x52\x00\x00\x03\x08\x00\x55\x0d\x0d' how do i make it stay the same like before ?

lapis radish Feb 15, 2021, 12:45 PM

#

cinder widget hi can someone help or figure this out ? assume i have code like this ```py aa ...

What are enc and dec?

#

Those are your functions?

cinder widget Feb 15, 2021, 12:45 PM

#

yes

#

it return strings

lapis radish Feb 15, 2021, 12:45 PM

#

It's hard to say without knowing them, can you share your code?

cinder widget Feb 15, 2021, 12:45 PM

#

ok

lapis radish Feb 15, 2021, 12:46 PM

#

You don't need to paste whole code, just minimal example

dusty geyser Feb 15, 2021, 3:53 PM

#

Hello, can anyone please help me figure out what is a padding scheme in RSA

thorn obsidian Feb 15, 2021, 6:20 PM

#

Hey I need help

#

Pls soemoen help

#

@joe

#

@mossy junco

fluid verge Feb 15, 2021, 6:21 PM

#

First: don't ask to ask
Second: if it's general help you need, please use a general help channel

thorn obsidian Feb 15, 2021, 6:21 PM

#

Uhh

#

I need help now understand

fluid verge Feb 15, 2021, 6:22 PM

#

like I said: don't ask to ask and ask anyway

thorn obsidian Feb 15, 2021, 6:22 PM

#

Oof stop it

#

I am not in the mood

fluid verge Feb 15, 2021, 6:22 PM

#

just ask, really

thorn obsidian Feb 15, 2021, 6:22 PM

#

What wdym?

fluid verge Feb 15, 2021, 6:23 PM

#

what do you need help with?

thorn obsidian Feb 15, 2021, 6:23 PM

#

I got brute forced what to do?

#

I installed something and now it's running in background and brute forcing my pc

#

What to do ?

fluid verge Feb 15, 2021, 6:24 PM

#

what OS are you using?

thorn obsidian Feb 15, 2021, 6:24 PM

#

Windows 10

fluid verge Feb 15, 2021, 6:24 PM

#

can you identify the program running in the background (in the task manager)?

thorn obsidian Feb 15, 2021, 6:25 PM

#

What to do?

#

@fluid verge

thorn obsidian Feb 15, 2021, 6:25 PM

#

fluid verge can you identify the program running in the background (in the task manager)?

Uhh it's hidden

#

Should I send u the code?

#

The python code

#

It's an brute force file

#

:(

fluid verge Feb 15, 2021, 6:25 PM

#

if you want to, go on

thorn obsidian Feb 15, 2021, 6:26 PM

#

U know pythan I assume

fluid verge Feb 15, 2021, 6:26 PM

#

I do

past starBOT Feb 15, 2021, 6:27 PM

#

Hey @thorn obsidian!

Uh-oh! It looks like your message got zapped by our spam filter. We currently don't allow .txt attachments, so here are some tips to help you travel safely:

• If you attempted to send a message longer than 2000 characters, try shortening your message to fit within the character limit or use a pasting service (see below)

• If you tried to show someone your code, you can use codeblocks
(run !code-blocks in #bot-commands for more information) or use a pasting service like:

https://paste.pythondiscord.com

thorn obsidian Feb 15, 2021, 6:27 PM

#

Lots the code

#

What

#

I am dming u

fluid verge Feb 15, 2021, 6:30 PM

#

okay

thorn obsidian Feb 15, 2021, 6:30 PM

#

U there?

fluid verge Feb 15, 2021, 6:30 PM

#

I didn't receive a message, so I'm waiting

thorn obsidian Feb 15, 2021, 6:36 PM

#

Che k dms

#

Check u r dmss

#

@fluid verge u read it?

fluid verge Feb 15, 2021, 6:42 PM

#

I read the file, yeah

thorn obsidian Feb 15, 2021, 6:45 PM

#

What it does

#

How to remove it and all

#

Ppz tell

#

@fluid verge

fluid verge Feb 15, 2021, 6:47 PM

#

I can't help you without a call context

thorn obsidian Feb 15, 2021, 6:48 PM

#

@fluid verge what u mean?

#

@fluid verge what is that in short?

fluid verge Feb 15, 2021, 6:49 PM

#

the huge string at the end of your file looks like a malicious load, but there is no reference to it anywhere else in the file, so it won't execute itself

thorn obsidian Feb 15, 2021, 6:49 PM

#

Is that a bruteforce?

#

Or what?

fluid verge Feb 15, 2021, 6:49 PM

#

I have no idea what it is

thorn obsidian Feb 15, 2021, 6:49 PM

#

Like is that dangerous

#

Anyone else have?

wispy sleet Feb 15, 2021, 6:50 PM

#

bruh, just install malwarebyte !

thorn obsidian Feb 15, 2021, 6:50 PM

#

I can dm u guys the file if anyone is good at it

restive hazel Feb 15, 2021, 6:50 PM

#

payload .... ??

wispy sleet Feb 15, 2021, 6:50 PM

#

install fricking malwarebyte

thorn obsidian Feb 15, 2021, 6:50 PM

#

@wispy sleet it would do anything

wispy sleet Feb 15, 2021, 6:50 PM

#

yes !

thorn obsidian Feb 15, 2021, 6:50 PM

#

@restive hazel bruteforce

restive hazel Feb 15, 2021, 6:50 PM

#

hmmm .....

thorn obsidian Feb 15, 2021, 6:50 PM

#

U know?

wispy sleet Feb 15, 2021, 6:51 PM

#

i was testing it on multiple dangerous viruses..

#

just install malwarebyte

thorn obsidian Feb 15, 2021, 6:51 PM

#

wispy sleet just install malwarebyte

I used it's free trial

#

And it's hidden also

wispy sleet Feb 15, 2021, 6:51 PM

#

u have free option

thorn obsidian Feb 15, 2021, 6:51 PM

#

Yeah

fluid verge Feb 15, 2021, 6:51 PM

#

free trial is enough

wispy sleet Feb 15, 2021, 6:52 PM

#

yes

thorn obsidian Feb 15, 2021, 6:52 PM

#

Ok

fluid verge Feb 15, 2021, 6:52 PM

#

(usually)

restive hazel Feb 15, 2021, 6:52 PM

#

yup

thorn obsidian Feb 15, 2021, 6:52 PM

#

So then am I good ?

#

Are u sure?

past starBOT Feb 15, 2021, 6:52 PM

#

:incoming_envelope: :ok_hand: applied mute to @wispy sleet until 2021-02-15 19:02 (9 minutes and 59 seconds) (reason: duplicates rule: sent 4 duplicated messages in 10s).

thorn obsidian Feb 15, 2021, 6:52 PM

#

Ok

#

Lol

#

Sad

#

😭

restive hazel Feb 15, 2021, 6:53 PM

#

reverse engineering time haha xD

fluid verge Feb 15, 2021, 6:53 PM

#

hopefully, Malwarebytes will find and kill the process that's running in the background

#

I got the payload if you don't already, but it's too long for a discord message

#

other than that, it looks like a perfectly capable Minecraft server thingy

#

a gadget thingy, but hey! I'm not here to judge

restive hazel Feb 15, 2021, 6:57 PM

#

Can you share me the payload. Maybe I can found smtg on it

restive hazel Feb 15, 2021, 8:09 PM

#

ah, just some Minecraft account checker...... (Based on the file & thread) , it checks cape, pvp status, account ver across legitimate minecraft server (Hypixel)... and line 1178, its a type of payload, along with encoding.

thorn obsidian Feb 16, 2021, 3:33 AM

#

@restive hazel so is it safe

thorn obsidian Feb 16, 2021, 4:03 AM

#

?

#

@stone wraith

#

I need hel

#

P

#

Ppz

#

Plz

#

@buoyant tartan

#

Hello help me plz

#

@spice plover

#

Help me

#

Someone help me plz

#

@flat anvil

#

@ornate coral

thorn obsidian Feb 16, 2021, 4:34 AM

#

Will anyone help me

#

@sick glen

sick glen Feb 16, 2021, 4:34 AM

#

Please don’t ping random people

thorn obsidian Feb 16, 2021, 4:34 AM

#

Ok

#

Thx

#

Plz help

#

Ppz don't go

sick glen Feb 16, 2021, 4:35 AM

#

If someone has an answer they will answer, we are all volunteers

fading plaza Feb 16, 2021, 4:35 AM

#

did you run it in virustotal

thorn obsidian Feb 16, 2021, 4:35 AM

#

I didn't post the quaetion

#

I got bruteforced

thorn obsidian Feb 16, 2021, 4:35 AM

#

fading plaza did you run it in virustotal

Yeag

fading plaza Feb 16, 2021, 4:35 AM

#

brute forced?

thorn obsidian Feb 16, 2021, 4:35 AM

#

Yeah

#

I think so

#

I don't know why admin gone

fading plaza Feb 16, 2021, 4:36 AM

#

explain

thorn obsidian Feb 16, 2021, 4:36 AM

#

Uhh come on dm

#

Plz

magic barn Feb 16, 2021, 4:36 AM

#

thorn obsidian I don't know why admin gone

I think there might be a misunderstanding. Staff members aren't available for ~~on-demand~~ on-call help.

thorn obsidian Feb 16, 2021, 4:36 AM

#

Can u help me

magic barn Feb 16, 2021, 4:37 AM

#

I don't know what it is that you need help with.

thorn obsidian Feb 16, 2021, 4:37 AM

#

Like plz

thorn obsidian Feb 16, 2021, 4:37 AM

#

magic barn I don't know what it is that you need help with.

Can I dm u the code

#

Is it a brute force code?

#

Am I getting bruteforced?

magic barn Feb 16, 2021, 4:37 AM

#

Why is it that you want to DM people what you're working on? You can share code in this channel.

#

!code

past starBOT Feb 16, 2021, 4:37 AM

#

Here's how to format Python code on Discord:

```py
print('Hello world!')
```

These are backticks, not quotes. Check this out if you can't find the backtick key.

magic barn Feb 16, 2021, 4:37 AM

#

What do you mean, "am I getting bruteforced"?

thorn obsidian Feb 16, 2021, 4:37 AM

#

magic barn Why is it that you want to DM people what you're working on? You can share code ...

Becoz I can't send the file here

past starBOT Feb 16, 2021, 4:38 AM

#

Hey @thorn obsidian!

Uh-oh! It looks like your message got zapped by our spam filter. We currently don't allow .txt attachments, so here are some tips to help you travel safely:

• If you attempted to send a message longer than 2000 characters, try shortening your message to fit within the character limit or use a pasting service (see below)

• If you tried to show someone your code, you can use codeblocks
(run !code-blocks in #bot-commands for more information) or use a pasting service like:

https://paste.pythondiscord.com

magic barn Feb 16, 2021, 4:38 AM

#

You can copy and paste the code in question.

thorn obsidian Feb 16, 2021, 4:38 AM

#

Look

thorn obsidian Feb 16, 2021, 4:38 AM

#

magic barn You can copy and paste the code in question.

It's long

magic barn Feb 16, 2021, 4:38 AM

#

!paste

past starBOT Feb 16, 2021, 4:38 AM

#

Pasting large amounts of code

If your code is too long to fit in a codeblock in discord, you can paste your code here:
https://paste.pydis.com/

After pasting your code, save it by clicking the floppy disk icon in the top right, or by typing ctrl + S. After doing that, the URL should change. Copy the URL and post it here so others can see it.

thorn obsidian Feb 16, 2021, 4:38 AM

#

Ok

#

Wait

#

Let me copy it don't go plz

magic barn Feb 16, 2021, 4:39 AM

#

thorn obsidian Let me copy it don't go plz

I will look, though keep in mind that pinging random staff members asking for on-call help is wrong and I am not seeking to reward that behavior. I may not be able to answer your question.

thorn obsidian Feb 16, 2021, 4:40 AM

#

plz

#

i am in need

#

sorry

magic barn Feb 16, 2021, 4:41 AM

#

That's fine. Did you paste the code?

thorn obsidian Feb 16, 2021, 4:41 AM

#

!paste

past starBOT Feb 16, 2021, 4:41 AM

#

Pasting large amounts of code

If your code is too long to fit in a codeblock in discord, you can paste your code here:
https://paste.pydis.com/

After pasting your code, save it by clicking the floppy disk icon in the top right, or by typing ctrl + S. After doing that, the URL should change. Copy the URL and post it here so others can see it.

thorn obsidian Feb 16, 2021, 4:41 AM

#

how to paste it becomes a .txt file

magic barn Feb 16, 2021, 4:42 AM

#

That's fine. Please paste it and then put the link in this chat.

thorn obsidian Feb 16, 2021, 4:42 AM

#

ok

#

i think this is the url

#

can u see the code?

magic barn Feb 16, 2021, 4:43 AM

#

Yes. One moment.

thorn obsidian Feb 16, 2021, 4:43 AM

#

ok

#

take time its long sir

#

in the end whats the string is the burte force? in the background?

#

the end string is sus for me

#

ping me when u answer

magic barn Feb 16, 2021, 4:46 AM

#

thorn obsidian the end string is sus for me

if you don't know what the string at the end is for, do not run this program.

thorn obsidian Feb 16, 2021, 4:48 AM

#

I ran it alredy lol

#

Can u take help with other so plz

magic barn Feb 16, 2021, 4:49 AM

#

I don't know enough about security to offer informed opinions. However, you should not run code from an untrusted source.

thorn obsidian Feb 16, 2021, 4:49 AM

#

Yeah

#

But if it's an backdoor what to do?

#

Like how to re.ove it

#

I deleted the file

#

But if it's in the background

#

Then what

#

@magic barn u there bro? ( Sorry for ping)

magic barn Feb 16, 2021, 4:51 AM

#

thorn obsidian <@253696366952316929> u there bro? ( Sorry for ping)

I am no longer available to help with this.

thorn obsidian Feb 16, 2021, 4:52 AM

#

Ok so whom should I contact with?

#

Like who is good at it?

magic barn Feb 16, 2021, 4:52 AM

#

You may have to wait for someone else to come along.

thorn obsidian Feb 16, 2021, 4:52 AM

#

Ok

#

Whoever is availble for help ping me plz

thorn obsidian Feb 16, 2021, 6:05 AM

#

Anyone for help available?

hardy zephyr Feb 16, 2021, 6:07 AM

#

!run hello world

#

eek

thorn obsidian Feb 16, 2021, 6:07 AM

#

hi

hardy zephyr Feb 16, 2021, 6:07 AM

#

!print Hello world!

thorn obsidian Feb 16, 2021, 6:07 AM

#

i need help

hardy zephyr Feb 16, 2021, 6:07 AM

#

thorn obsidian i need help

with what?

thorn obsidian Feb 16, 2021, 6:08 AM

#

let em tell u wait

hardy zephyr Feb 16, 2021, 6:08 AM

#

!print Hello, world!

#

oi

#

!print

#

!code

past starBOT Feb 16, 2021, 6:08 AM

#

Here's how to format Python code on Discord:

```py
print('Hello world!')
```

These are backticks, not quotes. Check this out if you can't find the backtick key.

fresh flicker Feb 16, 2021, 9:41 AM

#

Does anyone here know changing mac address in windows

#

Are there any simple commands which we can enter in the cmd like:

ifconfig {interface} down
ifconfig {interface} hw ether {new mac address}
ifconfig {interface} up

in linux

versed zinc Feb 16, 2021, 9:43 AM

#

Hello everybody. I am creating a function that at a certain time must generate an image via a site (fortnite-API)
if I send you the part of the code will you help me?

#

!request

#

!rules

past starBOT Feb 16, 2021, 9:44 AM

#

Rules

The rules and guidelines that apply to this community can be found on our rules page. We expect all members of the community to have read and understood these.

lapis radish Feb 16, 2021, 9:53 AM

#

fresh flicker Does anyone here know changing mac address in windows

How about https://docs.microsoft.com/en-us/powershell/module/netadapter/set-netadapter?view=win10-ps in PS?

Set-NetAdapter (NetAdapter)

Use this topic to help manage Windows and Windows Server technologies with Windows PowerShell.

fresh flicker Feb 16, 2021, 9:55 AM

#

Yes this one is good ||if not the best|| but it is not working when I type in Set-adapter...

#

operable program or batch file.```

#

This is the error

#

@lapis radish

lapis radish Feb 16, 2021, 9:59 AM

#

fresh flicker ```'Set-NetAdapter' is not recognized as an internal or external command, operab...

Are you trying to type it in PowerShell?

fresh flicker Feb 16, 2021, 10:00 AM

#

No in cmd

#

Should I do it in Powershell?

#

property and retry.
At line:1 char:1
+ Set-NetAdapter -Name "Ethernet 1" -MacAddress "00-10-18-57-1B-0D"
+ ~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~
    + CategoryInfo          : ObjectNotFound: (Ethernet 1:String) [Set-NetAdapter], CimJobException
    + FullyQualifiedErrorId : CmdletizationQuery_NotFound_Name,Set-NetAdapter
``` It is coming like this when I try in Powershell

lapis radish Feb 16, 2021, 10:06 AM

#

fresh flicker Should I do it in Powershell?

Ofc, CMD doesn't have cmdlets

lapis radish Feb 16, 2021, 10:06 AM

#

fresh flicker ```Set-NetAdapter : No MSFT_NetAdapter objects found with property 'Name' equal ...

Get-NetAdapter

fresh flicker Feb 16, 2021, 10:08 AM

#

At line:1 char:35
+ Get-NetAdapter -Name "Ethernet 1" -MacAddress "00-10-18-57-1B-0D"
+                                   ~~~~~~~~~~~
    + CategoryInfo          : InvalidArgument: (:) [Get-NetAdapter], ParameterBindingException
    + FullyQualifiedErrorId : NamedParameterNotFound,Get-NetAdapter

lapis radish Feb 16, 2021, 10:08 AM

#

Are you just pasting commands that I sent you?

#

Get-NetAdapter is to get available adapters...

#

Then use choosen name in Set-NetAdapter

lapis radish Feb 16, 2021, 10:10 AM

#

versed zinc Hello everybody. I am creating a function that at a certain time must generate a...

Use general chat maybe, how is it related with security?

rancid ore Feb 17, 2021, 1:18 AM

#

can i post a challenge here. it is security related as its reverse engineering-steganography?

civic widget Feb 17, 2021, 1:19 AM

#

As long as its not illegal or doesnt break any rules Id assume so

rancid ore Feb 17, 2021, 1:19 AM

#

ok

#

Lost Files Challenge
So I have an image (512 x 512 pixels). and I somehow happened to mix up my files when I was copying them back over. and if you would be able to help me retrieve my precious files as they mean so much to me. I can tell you that the binary on the image has nothing to do with the hidden files I got a bit angry :slight_smile:. you can use any online tool or tools that you may know of. and you can create your own scripts that may aid you in the recovery of my files, there are 120 files in total. thank you in advance.
Image Link: https://ibb.co/7tbzC5n
who knows there may also be challenges in those files just for some added bonus if you get them.

ImgBB

normal-profile-picture

Image normal-profile-picture hosted in ImgBB

civic widget Feb 17, 2021, 1:21 AM

#

Have you decoded the binary?

#

Then I'd check the file itself, since your told its 512x512 its likely it'll actually be 'bigger' under the hood so to speak. So likely something there

rancid ore Feb 17, 2021, 1:22 AM

#

i made the challenge. just wanted to see if anyone wanted to give it a go

civic widget Feb 17, 2021, 1:22 AM

#

Ah

rancid ore Feb 17, 2021, 1:22 AM

#

should have stated that

civic widget Feb 17, 2021, 1:22 AM

#

yea

rancid ore Feb 17, 2021, 1:28 AM

#

well for anyone that may give it a go. good luck 🙂

fading plaza Feb 17, 2021, 1:29 AM

#

@rancid ore solved

rancid ore Feb 17, 2021, 1:30 AM

#

@fading plaza that was bloody quick

fading plaza Feb 17, 2021, 1:43 AM

#

experience from ctf stego challs 😛

fading plaza Feb 17, 2021, 5:49 AM

#

sighs

#

https://dontasktoask.com/

Don't ask to ask, just ask

dapper verge Feb 17, 2021, 7:43 AM

#

PrivateKey(203087101096906067215647033187908374281, 65537, 100280783047697899435315631453581430273, 180366354183713467841, 1125969984901120841) Can anyone explain me what rsa is returning in a private key tuple? I understand only exponent 65537, i was expecting one key.

fluid verge Feb 17, 2021, 8:48 AM

#

So what you have is the following (in usual RSA notation): PrivateKey(N, e, d, p, q)

#

where N = p*q, d*e == 1 mod (p-1)*(q-1)

#

a RSA public key is the tuple (N, e), and a usual private key is (N, d), though you can speed up the decryption operation 4-fold if you use (p, q, d) as a private key, and use the Chinese Remainder Theorem to decipher the message

merry socket Feb 18, 2021, 6:31 AM

#

Is this the right channel to ask for help regarding github?

lapis radish Feb 18, 2021, 6:32 AM

#

merry socket Is this the right channel to ask for help regarding github?

It depends pithink If it's related with security go ahead

merry socket Feb 18, 2021, 6:32 AM

#

I can't get .gitignore to ignore my .env

#

so it kinda is 😛

#

So Im working on a JS discord bot, I've setup a branch template with .env containing just "TOKEN="

#

I've now created a 2nd branch, called current

#

The bot is only in a server where Im also in so it's dangerous in any way or form at this point

#

But it's also tracking .env in that 2nd branch

lapis radish Feb 18, 2021, 6:34 AM

#

merry socket I can't get .gitignore to ignore my .env

Looks more like #tools-and-devops for me pithink

#

However show me your .gitignore

merry socket Feb 18, 2021, 6:35 AM

#

node_modules
.env
config.json```

#

I even managed to fuck up more, I removed the .env file from github itself

lapis radish Feb 18, 2021, 6:35 AM

#

merry socket So Im working on a JS discord bot, I've setup a branch template with .env contai...

So it's Python server btw :v

merry socket Feb 18, 2021, 6:35 AM

#

it is

#

But im not here for help with the js part

#

this is just github trickery

lapis radish Feb 18, 2021, 6:36 AM

#

merry socket ``` node_modules .env config.json```

Did you commit .env file before add it in .gitignore? Can you give me more details?

merry socket Feb 18, 2021, 6:36 AM

#

but now it won't even push due to version mismatch and pulling doesn't fix it either

#

No

#

The .gitignore has been there from the start

#

However, I didn't git init from the start

#

I made the template first, then did git init, added the readme, forgot I needed to do git init first, cut and pasted everything back in and voila

lapis radish Feb 18, 2021, 6:37 AM

#

It's no matter when you call git init as far as I know

#

I see it's working perfectly for me - I created new repo, created file test, then call echo 'test' >> .gitignore and after call git status I see only .gitignore as an option

merry socket Feb 18, 2021, 6:38 AM

#

okay I managed to fix the pull within atom

#

so now I've got my branch current without .env

#

I've created .env

#

added TOKEN=test

#

odd

#

now it works

lapis radish Feb 18, 2021, 6:40 AM

#

Magic

merry socket Feb 18, 2021, 6:40 AM

#

first time im really using github tbh

lapis radish Feb 18, 2021, 6:40 AM

#

I think it's not related with your remote server

#

You just missed something

#

However if it works I am glad

merry socket Feb 18, 2021, 6:43 AM

#

just noticed

#

I managed to do the same trickery with node_modules

#

nobody will notice right

mint umbra Feb 18, 2021, 9:54 AM

#

@obsidian sail

#

hey

#

can you send that code here so i can look at it

obsidian sail Feb 18, 2021, 9:55 AM

#

oh sure

#

import random
class Code:
    ascii_map = {i: chr(i) for i in range(128)}
    def Generatekey(self):
        keys=[]
        for i in range(0,128):
            keys.append(i)
        values=keys.copy()
        random.shuffle(values)
        encrypt_key={keys[i]: values[i] for i in range(len(keys))}
        decrypt_key={value : key for (key, value) in encrypt_key.items()}
        return encrypt_key, decrypt_key
    def encrypt(self,text,encryption):
        encoding=text.translate(encryption)
        return encoding
    def decrypt(self,text,decryption):
        message=text.translate(decryption)
        return message
keygen=Code().Generatekey()
encrypt=Code().encrypt(input("Enter Message You'd Like to encrypt:  "),keygen[0])
decrypt=Code().decrypt(encrypt,keygen[1])
print(f'Encrypt Key:    {keygen[0]}')
print(f'decrypt_key: {keygen[1]}')
print(f'Secret Message:    {encrypt}')
print(f'Message: {decrypt}')

mint umbra Feb 18, 2021, 9:55 AM

#

what does chr do again?

fluid verge Feb 18, 2021, 9:56 AM

#

it transforms an integer into a unicode character

obsidian sail Feb 18, 2021, 9:56 AM

#

mint umbra what does chr do again?

if i recall correctly

#

converts an integer/char into unicode

mint umbra Feb 18, 2021, 9:56 AM

#

ohhh i get it

dusty crest Feb 18, 2021, 2:22 PM

#

guys what do i do about Trojan:Win32/Wacatac.D7!ml

#

i think i got it while trying to make a python file an exe

#

the one exe i download gives me a virus lol

fading plaza Feb 18, 2021, 2:23 PM

#

pyinstaller?

#

this is your source file right?

#

then its just a false positive

dusty crest Feb 18, 2021, 2:24 PM

#

yeah py installer

#

and somthing like nsis

fading plaza Feb 18, 2021, 2:24 PM

#

yeah some AVs have issues with it

dusty crest Feb 18, 2021, 2:25 PM

#

is there anything i can do to make windows not notify me every 10 minutes

obsidian sail Feb 19, 2021, 12:11 AM

#

yo

thorn obsidian Feb 19, 2021, 1:20 AM

#

yo

obsidian sail Feb 19, 2021, 1:43 AM

#

anyone worked with python encryption?

fading plaza Feb 19, 2021, 2:03 AM

#

https://dontasktoask.com/

Don't ask to ask, just ask

obsidian sail Feb 19, 2021, 2:08 AM

#

I want to work on encryption and so far this is my code ```python
import random
class Code:
ascii_map = {i: chr(i) for i in range(128)}
def Generatekey(self):
keys=[]
for i in range(0,128):
keys.append(i)
values=keys.copy()
random.shuffle(values)
encrypt_key={keys[i]: values[i] for i in range(len(keys))}
decrypt_key={value : key for (key, value) in encrypt_key.items()}
return encrypt_key, decrypt_key
def encrypt(self,text,encryption):
encoding=text.translate(encryption)
return encoding
def decrypt(self,text,decryption):
message=text.translate(decryption)
return message
keygen=Code().Generatekey()
encrypt=Code().encrypt(input("Enter Message You'd Like to encrypt: "),keygen[0])
decrypt=Code().decrypt(encrypt,keygen[1])
print(f'Encrypt Key: {keygen[0]}')
print(f'decrypt_key: {keygen[1]}')
print(f'Message: {decrypt}')
print(f'Secret Message: {encrypt}')

#

i want to make it harder to decrypt through brute force.

#

I was thinking what I could do

#

how would the structure of my encryption look like

fading plaza Feb 19, 2021, 2:20 AM

#

first of all, thats not how you're supposed to use classes

#

the right way would be to only create 1 instance of the class

#

and have encrypt_key and decrypt_key as instance vars

#

also, obligatory "don't roll your own crypto"

#

this is basically just monoalphabetic substitution which is pretty easy to crack

#

using freq analysis like https://quipqiup.com/

obsidian sail Feb 19, 2021, 2:45 AM

#

fading plaza also, obligatory "don't roll your own crypto"

what does that mean?

obsidian sail Feb 19, 2021, 2:45 AM

#

fading plaza this is basically just monoalphabetic substitution which is pretty easy to crack

was thinking about increasing the random range to 143,859 characters to include unicode

#

and allowing for unicode encryption

#

allowing for generation of between 1 to 2 key values per map.

#

or encryption it sequentially or 4 times

fading plaza Feb 19, 2021, 3:07 AM

#

https://security.stackexchange.com/questions/18197/why-shouldnt-we-roll-our-own

Information Security Stack Exchange

Why shouldn't we roll our own?

Why shouldn't we create our own security schemes?

I see a lot of questions around here about custom crypto and custom security mechanisms, especially around password hashing.

With that in mind, I'm

#

@obsidian sail the input charset is still the same

#

a-z A-Z 0-9

#

frequency analysis doesn't care about the output charset

obsidian sail Feb 19, 2021, 3:18 AM

#

fading plaza <@!361955686185304074> the input charset is still the same

i was hoping it would accept arabic too

#

and basically all unicode characters

#

but after learning about aes I'd like to work on it at a byte level.

fading plaza Feb 19, 2021, 3:20 AM

#

hm arabic would be harder to freq analyssi

obsidian sail Feb 19, 2021, 3:22 AM

#

fading plaza hm arabic would be harder to freq analyssi

i don't know what that implies but i hope that's good for security

fading plaza Feb 19, 2021, 3:25 AM

#

um monoalphabetic ciphers are still bad for security tho

obsidian sail Feb 19, 2021, 3:28 AM

#

fading plaza um monoalphabetic ciphers are still bad for security tho

yea probably gonna work on it at a byte level

#

i wanna see how i can implement things from aes to this.

thorn obsidian Feb 19, 2021, 5:36 AM

#

const Jimp = require('jimp');

module.exports = async function createCaptcha() {
const captcha = Math.random().toString(36).slice(2, 8);
const image = new Jimp(175, 50, 'white');
const font = await Jimp.loadFont(Jimp.FONT_SANS_32_BLACK);
const w = image.bitmap.width;
const h = image.bitmap.height;
const textWidth = Jimp.measureText(font, captcha);
const textHeight = Jimp.measureTextHeight(font, captcha);
image.print(font, (w/2 - textWidth/2), (h/2 - textHeight/2), captcha);
image.write(${__dirname}/captchas/${captcha}.png);
return captcha;
}

#

help

limber nacelle Feb 19, 2021, 5:37 AM

#

What is "salt"?

hardy haven Feb 19, 2021, 6:01 AM

#

@limber nacelle just a little extra on top before it gets turned to a hash

#

grand glacier Feb 19, 2021, 6:36 AM

#

i'm using scapy: what does it mean when it says received X packets received 0 answers???

#

example:

#

Begin emission:
Finished sending 1 packets.
....................................................................................................q........^C
Received 108 packets, got 0 answers, remaining 1 packets```

lapis radish Feb 19, 2021, 8:57 AM

#

grand glacier i'm using scapy: what does it mean when it says `received X packets received 0 a...

You sent DNS query and no answer for this query was received (however scapy got 108 other packets)

umbral finch Feb 19, 2021, 10:38 AM

#

thorn obsidian const Jimp = require('jimp'); module.exports = async function createCaptcha() {...

wrong language, this is a python server

#

not JS

golden wagon Feb 19, 2021, 12:32 PM

#

Hi guys

thorn obsidian Feb 19, 2021, 3:38 PM

#

Hi, need any help?

obsidian sail Feb 20, 2021, 12:17 AM

#

umbral finch wrong language, this is a **python** server

import time
class Console:
    def WriteLine(text):
        WriteLine=print(text)
        time.sleep(0.3)
        return 'compiled in 0.3 seconds'
    def ReadLine():
        ReadLine=input()
        return ReadLine
Console.WriteLine('Hello World')
Console.ReadLine()

pulsar dagger Feb 20, 2021, 2:35 AM

#

obsidian sail ```cs import time class Console: def WriteLine(text): WriteLine=prin...

Bruh why fake the return and time sleep lol

obsidian sail Feb 20, 2021, 2:52 AM

#

pulsar dagger Bruh why fake the return and time sleep lol

👀 its supposed to be c#

grand glacier Feb 20, 2021, 3:07 AM

#

lapis radish You sent DNS query and no answer for this query was received (however scapy got ...

ah, so it's just sniffing on the interface waiting for the right packets and those are just the other packets that arrived in the meantime, thanks for the explanation!

rancid sundial Feb 20, 2021, 3:44 AM

#

thorn obsidian const Jimp = require('jimp'); module.exports = async function createCaptcha() {...

If you want a js server, I can dm you the invite to one. And please, use code blocks.

sturdy owl Feb 20, 2021, 4:07 AM

#

because the speed of python reading is not elegant

golden harness Feb 20, 2021, 4:35 AM

#

Hey i want to learn ethical hacking plz guide me with some tutorials

viscid island Feb 20, 2021, 8:12 AM

#

@shrulob#7172

#

Nvm he left

umbral finch Feb 20, 2021, 10:44 AM

#

obsidian sail ```cs import time class Console: def WriteLine(text): WriteLine=prin...

What’s this?

umbral finch Feb 20, 2021, 10:44 AM

#

thorn obsidian const Jimp = require('jimp'); module.exports = async function createCaptcha() {...

No way about it, this is JS not python

thin marsh Feb 20, 2021, 11:40 AM

#

Can somebody tell me how to handle reverse shell using python.

I mean something like netcat which will listen on port for reverse shell and then issue some commands in it

void aspen Feb 20, 2021, 1:22 PM

#

Do you want to build your own reverse shell?

thorn obsidian Feb 20, 2021, 2:46 PM

#

Stop replying to that js code

umbral finch Feb 20, 2021, 2:48 PM

#

thorn obsidian Stop replying to that js code

Why did you post it in a python server?

hasty dawn Feb 20, 2021, 4:06 PM

#

Yo

fluid verge Feb 20, 2021, 4:06 PM

#

hi, you got a question?

hasty dawn Feb 20, 2021, 4:07 PM

#

No actually I just got unnbaanned so.....

#

Lol

#

Well the reason is also pretty interesting

#

fluid verge Feb 20, 2021, 4:09 PM

#

okay... whatever don't pollute #cybersecurity, though

hasty dawn Feb 20, 2021, 4:09 PM

#

K

#

Well I got one dout

#

Will you be able to help or should I go to the networking tab ?

fluid verge Feb 20, 2021, 4:11 PM

#

depends on what it is you're asking

hasty dawn Feb 20, 2021, 4:11 PM

#

It's security based on networking

#

So...

fluid verge Feb 20, 2021, 4:17 PM

#

ok, so what's you question, just ask, and you could transfer it to #networks if we can't help here

turbid lion Feb 20, 2021, 10:58 PM

#

Im wondering if there is a term for a site requiring a password and an additional password like a secret question? If I understand things right, this isn't multi-factor authentication because it is two of the same type of factor, aka knowledge.

woven gazelle Feb 20, 2021, 11:20 PM

#

i've heard it called memorable information

#

in a banking context

obsidian sail Feb 20, 2021, 11:22 PM

#

void aspen Do you want to build your own reverse shell?

would that be a problem/

turbid lion Feb 20, 2021, 11:46 PM

#

woven gazelle i've heard it called memorable information

Okay cool thanks. I'm still learning so trying to understand how describe things intelligibly.

lapis radish Feb 21, 2021, 12:00 AM

#

turbid lion Im wondering if there is a term for a site requiring a password and an additiona...

However it is a second factor of this same kind

turbid lion Feb 21, 2021, 12:01 AM

#

lapis radish However it is a second factor of this same kind

So it is multi-factor authentication then?

lapis radish Feb 21, 2021, 12:01 AM

#

turbid lion So it is multi-factor authentication then?

In my opinion yes

#

Consider next example

#

You have two factors to authenticate user: fingerprint and iris scan

#

Both are "who you are" but in my opinion it is a two factor auth system

turbid lion Feb 21, 2021, 12:03 AM

#

hmm interesting yeah I dont know what to make of it. Maybe it doesn't matter but I'm curious

winter warren Feb 21, 2021, 7:23 AM

#

#rules

hasty dawn Feb 21, 2021, 2:07 PM

#

Over here can I ask my pentesting douts ?

lapis radish Feb 21, 2021, 2:11 PM

#

hasty dawn Over here can I ask my pentesting douts ?

It looks like a good place

hasty dawn Feb 21, 2021, 2:11 PM

#

K

#

What's the logic behind the "blackeye" project in GitHub

#

?

mystic fern Feb 21, 2021, 2:16 PM

#

Just realised there's a topical security chat.
#help-carrot

hasty dawn Feb 21, 2021, 2:43 PM

#

K

hasty dawn Feb 21, 2021, 2:43 PM

#

mystic fern Just realised there's a topical security chat. <#696840664435916950>

Maybe you can ans my ques

lapis radish Feb 21, 2021, 2:47 PM

#

hasty dawn What's the logic behind the "blackeye" project in GitHub

Which one? There are few blackeye projects

hasty dawn Feb 21, 2021, 2:48 PM

#

lapis radish Which one? There are few blackeye projects

This one 👆 👆

void aspen Feb 21, 2021, 3:21 PM

#

!warn @hasty dawn Don't ask for help with phishing tools here.

past starBOT Feb 21, 2021, 3:21 PM

#

:incoming_envelope: :ok_hand: applied warning to @hasty dawn.

hasty dawn Feb 21, 2021, 3:21 PM

#

Well ok

spiral merlin Feb 21, 2021, 10:28 PM

#

hasty dawn Well ok

welcome to the python discord

dim tartan Feb 22, 2021, 1:17 AM

#

When I try to use python Crypto RSA and generate a key it gives an error : module 'time' has no attribute 'clock' any solutions?

hasty dawn Feb 22, 2021, 1:36 AM

#

spiral merlin welcome to the python discord

Thnx

hasty dawn Feb 22, 2021, 1:37 AM

#

dim tartan When I try to use python Crypto RSA and generate a key it gives an error : **mod...

U may try from time import clock

dim tartan Feb 22, 2021, 1:45 AM

#

hasty dawn U may try from time import clock

cannot import name 'clock' from 'time' (unknown location)

hasty dawn Feb 22, 2021, 1:45 AM

#

dim tartan cannot import name 'clock' from 'time' (unknown location)

Pls send the part where the error is occurring

#

The Kali Linux logo looks op

dim tartan Feb 22, 2021, 1:54 AM

#

hasty dawn Pls send the part where the error is occurring

from Crypto.PublicKey import RSA

def generate_keys():
modulus_length = 1024

***key = RSA.generate(modulus_length)***

pub_key = key.publickey()
private_key = key.exportKey()
public_key = pub_key.exportKey()
return private_key, public_key

a = generate_keys()
print(a)

fading plaza Feb 22, 2021, 3:04 AM

#

@dim tartan you're using an outdated version of the library

#

time.clock has been removed in recent versions of python

dim tartan Feb 22, 2021, 10:06 AM

#

fading plaza time.clock has been removed in recent versions of python

So I can't use RSA in python3?

lapis radish Feb 22, 2021, 10:09 AM

#

dim tartan So I can't use RSA in python3?

You have cryptography.io library

#

There are RSA, EC and other asymmetric crypto

fading plaza Feb 22, 2021, 12:51 PM

#

dim tartan So I can't use RSA in python3?

no you can

#

its just that your version of pycryptodome is too old

#

update to the latest version

#

if you're using pycrypto, please update to pycryptodome

dim tartan Feb 22, 2021, 12:52 PM

#

fading plaza if you're using *pycrypto*, please update to pycryptodome

ok thank you

fading plaza Feb 22, 2021, 12:52 PM

#

pycrypto hasn't been updated in a long time

#

pycryptodome is almost completely api-compatable

bright glen Feb 22, 2021, 6:44 PM

#

how do people send packets to routers with python

past starBOT Feb 22, 2021, 6:44 PM

#

Resources

The Resources page on our website contains a list of hand-selected learning resources that we regularly recommend to both beginners and experts.

bright glen Feb 22, 2021, 6:44 PM

#

? wdym

ebon cape Feb 22, 2021, 6:45 PM

#

I'm a newbie nvm

bright glen Feb 22, 2021, 6:45 PM

#

o

ebon cape Feb 22, 2021, 6:45 PM

#

😏

#

Yhp

thorn obsidian Feb 22, 2021, 8:30 PM

#

hi

dusty geyser Feb 23, 2021, 6:35 AM

#

Can anyone please tell me what is r in RSA-OAEP

#

coz i'musing rsa for a project

lapis radish Feb 23, 2021, 11:17 AM

#

dusty geyser Can anyone please tell me what is r in RSA-OAEP

https://en.wikipedia.org/wiki/Optimal_asymmetric_encryption_padding#Algorithm

r is a randomly generated k0-bit string

Optimal asymmetric encryption padding

In cryptography, Optimal Asymmetric Encryption Padding (OAEP) is a padding scheme often used together with RSA encryption. OAEP was introduced by Bellare and Rogaway, and subsequently standardized in PKCS#1 v2 and RFC 2437.
The OAEP algorithm is a form of Feistel network which uses a pair of random oracles G and H to process the plaintext prior ...

ionic flicker Feb 23, 2021, 11:58 AM

#

Hey guys, I need some help about AES key transfer with Pycryptdome :)) #cybersecurity

I want to use a hybrid encryption protocol which works like this:

1. Create a key for AES protocol.
2. Send that key using RSA-PKCK_OEAP
3. Since both of them have same key, now turn to AES protocl
4. With using mode EAX, send "nonce, MACtag and message" together

Is it secure to send mactag and nonce directly without encrypt them again with key? Or the Pycryptodome module does it itself? I'm sending my minimized example code here bellow. (Note: I haven't got an cryptography class, so that I'm learning it by myself)

past starBOT Feb 23, 2021, 12:00 PM

#

Hey @ionic flicker!

It looks like you tried to attach a Python file - please use a code-pasting service such as https://paste.pythondiscord.com

ionic flicker Feb 23, 2021, 12:01 PM

#

https://paste.pythondiscord.com/daqixonoqi.properties

lapis radish Feb 23, 2021, 12:18 PM

#

ionic flicker Hey guys, I need some help about AES key transfer with Pycryptdome :)) <#3666740...

Your security shoudn't rely on unknown IV/nonce

ionic flicker Feb 23, 2021, 12:21 PM

#

lapis radish Your security shoudn't rely on unknown IV/nonce

So, pardon me for not understanding it, you're saying me that security doesn't really depend on nonce or init.vectors? It doesn't change if I encrypted the nonce or MACtag, or something else.. I can directly send them on network?

lapis radish Feb 23, 2021, 12:24 PM

#

ionic flicker So, pardon me for not understanding it, you're saying me that security doesn't r...

I saw some CTF challenges that were based on IV/nonce manipulation to produce known plaintext with access to encryption/decryption machine without any knowledge about key.

However many file formats for example (like KeePass or LUKS as far as I remember) store IV/nonce in plaintext so I don't think that it's very vulnerable attack vector.

ionic flicker Feb 23, 2021, 12:26 PM

#

Oh thank you, okey then. I'll implement the method for my software.

lapis radish Feb 23, 2021, 12:28 PM

#

ionic flicker Oh thank you, okey then. I'll implement the method for my software.

Your welcome

Maybe there are smarter fellas whose have different opinions than mine

acoustic sinew Feb 23, 2021, 4:46 PM

#

yeah yeah

cursive ermine Feb 23, 2021, 9:35 PM

#

How do I use proxies with the requests library?

fading plaza Feb 24, 2021, 4:32 AM

#

https://requests.readthedocs.io/en/master/user/advanced/#proxies

wide laurel Feb 24, 2021, 5:16 AM

#

after some basic help

#

whats the best way to post small amt code in channel

stark scaffold Feb 24, 2021, 5:54 AM

#

for an api, just do

#

import requests

#

url = '<your url>'

#

k = requests.get(url)

#

that's it

stark scaffold Feb 24, 2021, 5:55 AM

#

cursive ermine How do I use proxies with the `requests` library?

u can practice requests with beautiful soup or an api like https://openweathermap.org

Сurrent weather and forecast

Get current weather, hourly forecast, daily forecast for 16 days, and 3-hourly forecast 5 days for your city. Historical weather data for 40 years back for any coordinate. Helpful stats, graphics, and this day in history charts are available for your reference. Interactive maps show precipitation, clouds, pressure, wind around your location.

winter vault Feb 24, 2021, 6:25 AM

#

I'm very new to this, but how would one go about encrypting a password and username?

More specifically, if I want to run a script on a server, how would I go about making sure that it (the username and password) is protected compared to plain text? I've heard of oauth2 connections but am very confused about the process

sturdy owl Feb 24, 2021, 9:42 AM

#

there is a possibility of sensible information be on plain text

#

like i dont even to acess the site or google it fancy, just use requests

surreal rose Feb 24, 2021, 12:44 PM

#

I have an app. This app requires a license key to run it and I'll take that specified key on my site. My exe file request PHP file in my site to take that key but I don't want to that anyone can intercept web request and change it(like a burpsuite). I mean when my app request my site then if anyone change the response my file will accept a changed key. I shouldn't let this happen.

To solve this problem i thought like an algorithm that controls key integrity and accuracy.

the key consists of 5 part and each part consists of 5 number. it seems like:

43252-23523-62362-62363
the algorithm checks;

does the sum of the key equal to the specified integer?
does the last number in one section of the key equal the first number in the next section?
is the sum of the first 4 digits in any part of the key equal to the 5th digit when mod 10 is received?
what I want to ask is there an algorithm like this with other control mechanisms in python? or is there any way to do it?

fading plaza Feb 24, 2021, 12:48 PM

#

@surreal rose usually for integrity you use a mac

#

such as hmac

surreal rose Feb 24, 2021, 12:48 PM

#

what is hmac?

fading plaza Feb 24, 2021, 12:49 PM

#

do you know what a hash or checksum is?

surreal rose Feb 24, 2021, 12:49 PM

#

i know both of them yes

fading plaza Feb 24, 2021, 12:50 PM

#

ok, so a MAC is basically like a hash with a secret key

#

it allows you to gurantee that the key hasn't been tampered with

#

and HMAC is just one common algorithm for a MAC

surreal rose Feb 24, 2021, 12:52 PM

#

ok i will look it

#

thx

woven gazelle Feb 24, 2021, 2:13 PM

#

also this doesn't stop anyone from changing the key

surreal rose Feb 24, 2021, 2:16 PM

#

why?

#

then how can i stop some poeple to change key?

#

@woven gazelle

woven gazelle Feb 24, 2021, 2:18 PM

#

why do you want this

surreal rose Feb 24, 2021, 2:19 PM

#

i will make my program and i made license with cryptolens for this program the program have to send some key and information to cryptolens site

#

thats why

woven gazelle Feb 24, 2021, 2:20 PM

#

so if the license key is wrong, then it will just fail

#

what's bad about that

#

if someone tries to pirate your program, it won't work

surreal rose Feb 24, 2021, 2:20 PM

#

if anyone create account in this site and change the information about request

#

he or she can use freely

woven gazelle Feb 24, 2021, 2:21 PM

#

well that's a flaw with your program then

#

wait so

#

what

#

your program downloads a license key, then sends it to cryptolens to check?

surreal rose Feb 24, 2021, 2:22 PM

#

not download i will send key to customer

#

and he or she will use the program but

#

if anyone can write code or change the request which program send the cryptolens

#

program is used freely

#

thats why i want to check the key which receives program (my app)

woven gazelle Feb 24, 2021, 2:23 PM

#

your last message makes no sense

#

you want to check the key which the program receives?

#

when does the program receive a key

surreal rose Feb 24, 2021, 2:24 PM

#

woven gazelle you want to check the key which the program receives?

yeah

woven gazelle Feb 24, 2021, 2:24 PM

#

so i mean

#

it's almost always going to be trivial to pirate your program if your only anti piracy is an if statement checking the license

surreal rose Feb 24, 2021, 2:24 PM

#

my man i will send key to the customer

#

then when customer write key the program, my program will request to cryptolens

#

if key is right cryptolens say to the program yeah its right

#

if itsnot say its not

#

when program send request to the cryptolens program also sends my user information

#

cryptolens will look at the license key by looking at my user information and verify if the key is available.

#

If someone else solves this and opens a different account in cryptolens and sets this information to query his own user account, then he will look at his user account and the license key he entered will be correct, so the application will be accessed for free.

#

Could I express it correctly

woven gazelle Feb 24, 2021, 2:28 PM

#

you mean changes your code/alters the request being sent?

surreal rose Feb 24, 2021, 2:29 PM

#

alters the request being sent this part im asking for

#

r u there?

#

someone else should not change the web request sent by my program

keen prairie Feb 25, 2021, 3:32 AM

#

you should proxy your cryptolens requests through your server, that way the key stays on the server and your local program cannot extract the key

tropic patio Feb 25, 2021, 1:00 PM

#

hello

#

x)

lapis radish Feb 25, 2021, 1:07 PM

#

tropic patio hello

Hey, what's up?

tropic patio Feb 25, 2021, 1:25 PM

#

Hey i allready opened a help topic at florine

#

SIOCSIFFLAGS: Operation not permitted

mental panther Feb 25, 2021, 1:52 PM

#

Is it bad that I constantly spoof my MAC and HWID adress? (I am not qualified in the security field at all, I am a data scientist)

fading plaza Feb 25, 2021, 1:53 PM

#

why tho

blazing moon Feb 25, 2021, 10:30 PM

#

Hello guys, somebody knows where I can find documentation or information about how to develop an NIDS with python?

summer ibex Feb 27, 2021, 9:11 PM

#

how to change proxy through python?

turbid terrace Feb 27, 2021, 9:41 PM

#

Not sure if this has been posted, but a 9.8 level severity issue has been detected (and fixed?) found in some Python versions, involving _ctypes/callproc.c, involving a buffer overflow due to unsafe use of sprintf:

https://nvd.nist.gov/vuln/detail/CVE-2021-3177

summer ibex Feb 28, 2021, 4:04 PM

#

!code

past starBOT Feb 28, 2021, 4:04 PM

#

Here's how to format Python code on Discord:

```py
print('Hello world!')
```

These are backticks, not quotes. Check this out if you can't find the backtick key.

thorny spade Mar 1, 2021, 2:02 PM

#

print("hello")

astral oak Mar 1, 2021, 4:23 PM

#

I have some code that i use to encrypt messages for a server and client that uses the cryptography module's asymmetric stuff, and at first i was getting an error:
ValueError: Cyphertext length must be equal to key size
Tracing back to the line where i decrypt, so i googled it and tried solving the problem by encoding in base64 before encrypting and decoding in base64 before decrypting, like so:

# Encoding (msg is of bytes type):
msg = base64.b64encode(msg)

# Decoding:
msg = base64.b64decode(msg)

But instead of solving it, i just got a different error, it encodes fine but on the line where i decode in base64 i get an error:
binascii.Error: Incorrect Padding
And i'm not sure how to solve this

#

Server - https://pastebin.com/MKsSz6sj
Client - https://pastebin.com/9C0Pf4Jj
Security - https://pastebin.com/r1Chmvqc```

lapis radish Mar 1, 2021, 4:53 PM

#

astral oak I have some code that i use to encrypt messages for a server and client that use...

Encoding/decoding with base64 is not a solution

#

Why when you send data you use decrypt?

astral oak Mar 1, 2021, 4:54 PM

#

lapis radish Why when you send data you use `decrypt`?

wdym i decrypt

lapis radish Mar 1, 2021, 4:55 PM

#

    def send(self, msg: bytes, crypt: bool = True) -> None:
        """
        Sends a message to this instance's connected client, and no others
        """
        msg_length = int.to_bytes(len(msg), 2, "little")
        self.sock.sendall(msg_length)
        if crypt:
            msg = self.security.decrypt(msg)  # <-- here
        self.sock.sendall(msg)

#

You are sending decrypted message and decrypting it on the other side

astral oak Mar 1, 2021, 4:56 PM

#

lapis radish You are sending decrypted message and decrypting it on the other side

oops

#

i didnt notice

lapis radish Mar 1, 2021, 4:56 PM

#

Double decryption?

    def receive(self, crypt: bool = True) -> bytes:
        """
        Receives, decrypts, and returns messages
        """
        msg_length = int.from_bytes(self.sock.recv(2), "little")
        msg = self.sock.recv(msg_length)
        if crypt:
            msg = self.security.decrypt(msg)  # <-- here
        return msg

astral oak Mar 1, 2021, 4:56 PM

#

let me go fix it and run it

#

yea i should encrypt it instead of decrypt it in send()

#

ok that was the problem

#

now i get a different error

#

#

hmm

lapis radish Mar 1, 2021, 4:58 PM

#

Check your encrypt and decrypt methods.

Encryption: encode then encrypt
Decryption: decode then decrypt

#

Are you sure this is correct order?

astral oak Mar 1, 2021, 4:59 PM

#

shoot it's not

#

for decryption it shoul dbe like decryupt then decode right?

lapis radish Mar 1, 2021, 4:59 PM

#

Right

#

You have ENCRYPTED(ENCODED(DATA))

#

So you need to decrypt it first

#

You can omit encode/decode and transport raw bytes but it's your choice

astral oak Mar 1, 2021, 5:00 PM

#

yeah no i still get the same error

#

😦

#

#

am dummy dumb

lapis radish Mar 1, 2021, 5:01 PM

#

Check your send

#

What you are doing there?

#

Get message length, send it and then add padding, encryption and encoding

astral oak Mar 1, 2021, 5:02 PM

#

that looks right

lapis radish Mar 1, 2021, 5:02 PM

#

How do you think?

astral oak Mar 1, 2021, 5:02 PM

#

i first send the length

lapis radish Mar 1, 2021, 5:02 PM

#

Is the length same after those transformations?

astral oak Mar 1, 2021, 5:02 PM

#

wow true

#

oops

#

i would have NEVER thought about that

lapis radish Mar 1, 2021, 5:03 PM

#

Padding can increase length

#

Encoding can change length (both increase or decrease)

astral oak Mar 1, 2021, 5:04 PM

#

still same error btw

#

UGHH

lapis radish Mar 1, 2021, 5:04 PM

#

Encryption can also change length as far as I know because you are not using block cipher

astral oak Mar 1, 2021, 5:04 PM

#

lapis radish Encryption can also change length as far as I know because you are not using blo...

whats a block cipher

#

kinda sad to see so many obvious but unnoticed errors in my code

lapis radish Mar 1, 2021, 5:05 PM

#

astral oak whats a block cipher

Block cipher takes block of data (always of same size) and encrypts it

#

AES or DES are block ciphers

#

Block ciphers are better to encrypt data rather than asymmetric encryption

astral oak Mar 1, 2021, 5:06 PM

#

do they still have that whole asymmetric feature

#

cause thats kinda what im goin for

lapis radish Mar 1, 2021, 5:07 PM

#

Nope, this is kind of symmetric encryption but there is something like hybrid cryptography

#

However you should start from the basics I think

astral oak Mar 1, 2021, 5:07 PM

#

when i first tried doing encryption stuff i did it for funzies but now ill have a project actually running on the internet and i think its best to actually have it be safe

#

so yeah

#

thats why i want asymmetric encryption

#

i actually got it to work in another project of mine but that was very different

lapis radish Mar 1, 2021, 5:11 PM

#

It is working for me

>>> from cryptography.hazmat.primitives.asymmetric import rsa
>>> private_key = rsa.generate_private_key(
...     public_exponent=65537,
...     key_size=2048,
... )
>>> message = b"my secret message"
>>> public_key = private_key.public_key()
>>> from cryptography.hazmat.primitives import hashes
>>> from cryptography.hazmat.primitives.asymmetric import padding
>>> ciphertext = public_key.encrypt(
...     message,
...     padding.OAEP(
...             mgf=padding.MGF1(algorithm=hashes.SHA256()),
...             algorithm=hashes.SHA256(),
...             label=None
...     )
... )
>>> plaintext = private_key.decrypt(
...     ciphertext,
...     padding.OAEP(
...             mgf=padding.MGF1(algorithm=hashes.SHA256()),
...             algorithm=hashes.SHA256(),
...             label=None
...     )
... )
>>> message == plaintext
True

astral oak Mar 1, 2021, 5:12 PM

#

hmm

lapis radish Mar 1, 2021, 5:12 PM

#

Are you sure that keys are valid?

astral oak Mar 1, 2021, 5:12 PM

#

idk what that means

#

as in they're the correct ones?

#

i am yea

lapis radish Mar 1, 2021, 5:13 PM

#

I see that you send public keys through the network

astral oak Mar 1, 2021, 5:13 PM

#

ye

#

is there a better way to exchange them

lapis radish Mar 1, 2021, 5:13 PM

#

Have you checked that server receives exactly what client sends?

astral oak Mar 1, 2021, 5:13 PM

#

oh

#

i should probably do that

#

let me do that

lapis radish Mar 1, 2021, 5:14 PM

#

astral oak is there a better way to exchange them

You can use Diffie-Hellman algorithm to create session key

astral oak Mar 1, 2021, 5:17 PM

#

lapis radish Have you checked that server receives exactly what client sends?

yeah its the same

#

i checked it

lapis radish Mar 1, 2021, 5:17 PM

#

How about your Security class? Have you tested it locally?

astral oak Mar 1, 2021, 5:17 PM

#

what does that mean

lapis radish Mar 1, 2021, 5:19 PM

#

Open Python REPL and do what I did above

#

Encrypt and decrypt on same computer

astral oak Mar 1, 2021, 5:25 PM

#

so do that i added this at end of the security file and now i get

#

this

#

wtf i never even use '&'

#

oo i found an error

#

i was encrypting using my own public key instead of the other person's

#

so like the server encypts using his own public key and then beacuse of that the client doesnt know how to decrypt it

#

so i fixed that but i still get the same error

#

@lapis radish

lapis radish Mar 1, 2021, 5:32 PM

#

astral oak so i fixed that but i still get the same error

Which one?

lapis radish Mar 1, 2021, 5:34 PM

#

astral oak so do that i added this at end of the security file and now i get

msg_enc shouldn't be a bytes type?

astral oak Mar 1, 2021, 5:35 PM

#

lapis radish Which one?

both

astral oak Mar 1, 2021, 5:36 PM

#

lapis radish `msg_enc` shouldn't be a bytes type?

guess so, added .decode() when i check, but it doesnt get there cause of the error

astral oak Mar 1, 2021, 5:37 PM

#

lapis radish Which one?

still the & error when i test it and also the error when i run the server and client

spring moss Mar 1, 2021, 5:54 PM

#

that's a vs code error

#

try running it from the cmd

astral oak Mar 1, 2021, 5:54 PM

#

ah

spring moss Mar 1, 2021, 5:55 PM

#

I don't know about the server/client error tho

turbid terrace Mar 1, 2021, 11:56 PM

#

Researcher uploaded 3500 packages to PyPi that point to a malicious URL

https://twitter.com/DataNerdery/status/1366263351685226499

Genevieve Buckley (@DataNerdery)

Hi friends, be careful pip installing packages - someone's just uploaded three and a half thousand packages to @PyPI that point to a malicious URL. A lot of the names are things like "numpyDjango" or other common typos

Retweets

468

Likes

542

#

Social engineering is alive and well, apparently. Given that these packages rely on presumed familiarity ("numpyDjango") for their use.

#

It's also very reminiscent of a JavaScript exploit of the NPM repository that relied on a simple misspelling

turbid terrace Mar 2, 2021, 1:55 AM

#

The solution is to keep packages approved and local, with someone responsible for vetting

lapis radish Mar 2, 2021, 8:12 AM

#

turbid terrace Social engineering is alive and well, apparently. Given that these packages rely...

This is why I really like Docker Hub - you have official images that are shortnames (like ubuntu or redis) and you can publish your own image in your user-space (user/image)

summer ibex Mar 2, 2021, 2:24 PM

#

astral oak

U writing end2end chat?

turbid terrace Mar 2, 2021, 6:27 PM

#

lapis radish This is why I really like Docker Hub - you have official images that are shortna...

Agreed. Abstracting the complexity away is always preferable. Of course, gotta have someone responsible generating those containers.

astral oak Mar 2, 2021, 6:33 PM

#

summer ibex U writing end2end chat?

Wut

summer ibex Mar 2, 2021, 10:39 PM

#

I mean you are writing E2E/P2P messages encryption ?

wind tartan Mar 3, 2021, 2:10 PM

#

how to get the start and the end address of data region of a specific process?

umbral finch Mar 3, 2021, 3:50 PM

#

how vunerable is a website running of a raspberry pi behind a home router with no security measures implement other then default ones???

lapis radish Mar 3, 2021, 4:37 PM

#

umbral finch how vunerable is a website running of a raspberry pi behind a home router with n...

It depends. If there are known bugs you can even perform RCE. However if you trust all of the devices inside your LAN don't worry.

sharp island Mar 3, 2021, 5:39 PM

#

I need to secure my web app how can I do thta

#

!voiceverify

surreal rose Mar 4, 2021, 3:53 AM

#

keen prairie you should proxy your cryptolens requests through your server, that way the key ...

i really appreciated man. thx for ur help. its sounds both more logical and nicer

thorn obsidian Mar 4, 2021, 2:30 PM

#

sharp island I need to secure my web app how can I do thta

This is a good place to start https://owasp.org/www-project-top-ten/

The OWASP Top 10 is the reference standard for the most critical web application security risks. Adopting the OWASP Top 10 is perhaps the most effective first step towards changing your software development culture focused on producing secure code.

naive saddle Mar 4, 2021, 11:30 PM

#

do u need python knowledge on bug huntign

fading plaza Mar 5, 2021, 12:22 AM

#

no

#

most web exp can be done with just a browser plus a proxy like burp suite

#

python is just useful for automating stuff

umbral finch Mar 5, 2021, 1:49 PM

#

i know you cant fully rely on it but cant you make your own encryption algorithm that does so much stuff that its unkown to the attacker what youve done, espically if you never disclose your encryption algorithm

thorn obsidian Mar 5, 2021, 3:10 PM

#

Thats called security through obscurity and is generally considered a bad practice https://en.m.wikipedia.org/wiki/Security_through_obscurity

Security through obscurity

Security through obscurity (or security by obscurity) is the reliance in security engineering on design or implementation secrecy as the main method of providing security to a system or component. Security experts have rejected this view as far back as 1851, and advise that obscurity should never be the only security mechanism.

woven gazelle Mar 5, 2021, 3:50 PM

#

umbral finch i know you cant fully rely on it but cant you make your own encryption algorithm...

that's exactly the same as having a really secure secret password though

#

because you need to tell others how to use your encryption algorithm

#

which has the same flaws as a secret password

fading plaza Mar 5, 2021, 3:52 PM

#

umbral finch i know you cant fully rely on it but cant you make your own encryption algorithm...

https://security.stackexchange.com/questions/18197/why-shouldnt-we-roll-our-own

#

just use a well-tested algo like AES

fluid verge Mar 5, 2021, 8:28 PM

#

though you still need to be careful how it's implemented

fading plaza Mar 5, 2021, 11:56 PM

#

the really easy approach would be to just use something like https://cryptography.io/en/latest/fernet.html

#

where all the internal crypto impl is abstracted into a higher level api

fluid verge Mar 6, 2021, 6:19 PM

#

looks interesting, but the security of the API depends on the implementation details of AES

thorn obsidian Mar 6, 2021, 9:01 PM

#

fading plaza the really easy approach would be to just use something like https://cryptograph...

Can it do anything the ssl module can't?

fading plaza Mar 6, 2021, 9:26 PM

#

thorn obsidian Can it do anything the ssl module can't?

ssl also works ig

thorn obsidian Mar 6, 2021, 9:27 PM

#

It seems they're both built on top of OpenSSL

#

Makes me wonder if there's a LibreSSL module for Python

thorn obsidian Mar 6, 2021, 9:45 PM

#

Hello ! I'm starting cryptography and I wanted to try a very simple example to store a hashed password and compare it to the hashed version of a password entered by an user. Then I wanna compare it and if they match, grant the access to whatever is behind. Here is what I did :

#

first of all I use the hashlib librairy to hash using the sha256 algorithm.

#

import hashlib # this module provides many hash algorithms.

m = hashlib.sha256() #sha256 CAN NOT BE DECRYPTED. it is simply NOT POSSIBLE.
# more, it will also provide the exact same byte sequence if you enter the right password.

key = "<insert key representation here>"

print("Now, let's play a game. The public key is the following one :")
print(key)

passwd = input("Type your password : ")
m.update(passwd.encode('utf-8')) # we encode the password to bytes.
encrypted_passwd = m.digest() # at this point we can store the encrypted password in there.

# It is pretty much public. Now let's try to guess this password from the public key.

if encrypted_passwd == bytes(key) :
    print("You're right ! The password was xxx")
else : 
    print("You failed miserably.")

#

Now what I don't know how to do is to store the right hashed version of the good password in the "key" variable so that I can compare it with the hashed version of the password provided by the user, but I can't figure out how to do it. Any clues ?

thorn obsidian Mar 6, 2021, 10:08 PM

#

You should consider using PBKDF2 and not SHA256 for storing passwords

#

why ?

#

Also I managed to store the hashed password in a fine in binary mode and read it, so it's all good

#

It's slower by design

#

but is PBKDF2 more secure ?

#

Since it's slower it's harder to brute-force

#

That's the only real difference between them, they're both good options

#

but isn't a 256 bits hash physically impossible to bruteforce ?

#

https://crypto.stackexchange.com/a/1160/23623

Cryptography Stack Exchange

How much would it cost in U.S. dollars to brute force a 256 bit key...

I am often told that any key can be broken and that it is only a matter of time and resources for any key to be broken. I know that this is technically true. However, I think that there is probably a

#

I saw this thing online

#

You don't bruteforce it bit by bit

#

oh yeah

#

You use a wordlist

#

yeah sure you're right

#

it's funny how only hashing algorithm are better because they're slower

#

True lol

#

This might be of interest to you: https://cheatsheetseries.owasp.org/cheatsheets/Password_Storage_Cheat_Sheet.html

Password Storage - OWASP Cheat Sheet Series

Website with the collection of all the cheat sheets of the project.

#

thanks a lot ! My little program was for educational purposes only, so this will be coming handy :)

#

Also... passwd = input("Type your password : ") --> passwd = getpass.getpass("Type your password : ")

#

Just hides to password from being displayed when you enter it

#

yes I saw that one afterwards, thanks as well

#

Not a big deal when it's not attached to anything, but good to know for future reference

#

actually I would like to try this to crack a password with my code : https://github.com/hashcat/princeprocessor

GitHub

hashcat/princeprocessor

Standalone password candidate generator using the PRINCE algorithm - hashcat/princeprocessor

#

this or any cool bruteforcing algorithm

#

Maybe try it on some of these https://weakpass.com/wordlist

Weakpass

wordlists, weakpass, bruteforce, password list

#

guys i am using an external backend with heroku to authenticate users and i want to make a register, should i hash passwords client side? if i dont doesnt that mean that a plain text password is being sent to a server which is unsecure..?

#

Are you not transmitting data over TLS?

#

what is tls

#

Client-Server encryption

#

i dont know

#

im new to this

#

this is scary

#

Tried bruteforcing using a 500k words dictionary

#

I'm hashing the password every single time

#

What hash is it?

#

sha256, I believe python hashlib I'm using don't support PBKDF2 (yet ?)

#

actually I'm pretty sure a good number of passwords in the world is made up of one of those words with one to three letters afterwards

#

Try to add salt and/or peppers

#

after trying with a few capitalized letters Any "simple" password made of a word and a few numbers could pretty much be bruteforces in matter of seconds (way more if the password verification is made server-side)

#

what is sald/pepper ?

#

I heard of it but I don't how what it exactly is

#

Here's the function for PBKDF2 in Python: https://docs.python.org/3/library/hashlib.html#key-derivation

#

thanks !

#

A salt is a unique, randomly generated string that is added to each password as part of the hashing process. As the salt is unique for every user, an attacker has to crack hashes one at a time using the respective salt, rather than being able to calculate a hash once and compare it against every stored hash. This makes cracking large numbers of hashes significantly harder, as the time required grows in direct proportion to the number of hashes.

Salting also provides protection against an attacker pre-computing hashes using rainbow tables or database-based lookups. Finally, salting means that it is not possible to determine whether two users have the same password without cracking the hashes, as the different salts will result in different hashes even if the passwords are the same.

#

Pepper is the same thing, except it's stored externally and shared between all passwords

#

alright

#

cryptography is truly fascinating

#

I wonder when there will be a new AES

#

Can i encrypt / decrypt pieces of text with hash functions ?

#

Hashes are one-way, so no

#

what's AES ?

#

okay

#

But can I create a program that will decrypt a program only if the right password is provided ?

#

like, using the password as a key ?

#

without the possibility of reading the text by reading the code

#

Yes

#

AES is the Advanced Encryption Standard

#

Currently Rijndael

#

https://www.youtube.com/watch?v=O4xNJsjtN6E

YouTube

Computerphile

AES Explained (Advanced Encryption Standard) - Computerphile

Advanced Encryption Standard - Dr Mike Pound explains this ubiquitous encryption technique.

n.b in the matrix multiplication animation, the matrices are in the incorrect order, but hopefully the animation still helps to illustrate the general idea.

One Encryption Standard to Rule Them All! : https://youtu.be/VYech-c5Dic
Almost All Web Encrypt...

▶ Play video

#

thanks !

#

It's complicated stuff

#

You'll watch this and end up more confused than before you watched it

#

well, I truly can't thank you enough for the introduction you gave me to cryptography, but I think it's time for me to take a good night of sleep lol

#

have a good day / evening, whichever time it is for you !

#

yeah lol I guess it makes sens

#

You too

#

thanks

fading plaza Mar 7, 2021, 12:41 AM

#

thorn obsidian Hello ! I'm starting cryptography and I wanted to try a very simple example to s...

o_O i think thats (theoretically) vulnerable to a timing attack

#

use hmac.compare_digest to prevent that

cloud cypress Mar 7, 2021, 3:54 AM

#

Hello!
I am using a VM to run Kali Linux.
It runs perfectly but when I tried to shut it down it just “crashes”. It just stays on the shut down screen and I can’t even exit full screen. I am using Oracle.

thorn obsidian Mar 7, 2021, 11:30 AM

#

Probably has something to do with ACPI

#

Try poweroff from the terminal

shadow imp Mar 7, 2021, 2:41 PM

#

hello

#

how ae you guys

fluid verge Mar 7, 2021, 2:42 PM

#

hi, what's your question or remark concerning security?

shadow imp Mar 7, 2021, 2:42 PM

#

absolutely nothing

#

im just bored af

fluid verge Mar 7, 2021, 2:43 PM

#

then you can go to #python-discussion

shadow imp Mar 7, 2021, 2:43 PM

#

aahhhhhhhhhhhhhhhhhhhhhhhh okkkkkkkkkkkkkkeyyyyyyy

fluid verge Mar 7, 2021, 2:43 PM

#

yeah, because of rule 7

#

!rule 7

past starBOT Mar 7, 2021, 2:44 PM

#

Rules

7. Keep discussions relevant to channel topics and guidelines.

jovial wedge Mar 7, 2021, 6:20 PM

#

hi

winged parcel Mar 8, 2021, 8:07 AM

#

i need help with kali linux

lapis radish Mar 8, 2021, 2:00 PM

#

winged parcel i need help with kali linux

Any details?

ocean temple Mar 8, 2021, 3:13 PM

#

I have a question how hard is to take a persons info and play follow the persons employer because the last 2 places my father has gone to for worl has been ransomed

#

I am thinking they have his info and are playing follow the bouncing ball and hacking where ever he goes knowing that it will probably be a easy target as he will be new there

wraith shadow Mar 8, 2021, 3:16 PM

#

Hi

ocean temple Mar 8, 2021, 3:19 PM

#

This question is to anyone in the world that has the understanding to help me dm me please

thorn obsidian Mar 8, 2021, 3:25 PM

#

ocean temple I have a question how hard is to take a persons info and play follow the persons...

depence on the person and how strong there security is
if u are encountering with this maybe try ure local authorities
also a password reset onto everything would be a good idea

ocean temple Mar 8, 2021, 4:06 PM

#

How hard is it to track

#

A user using social media

thorn obsidian Mar 8, 2021, 4:27 PM

#

Track what?

lapis radish Mar 8, 2021, 5:11 PM

#

ocean temple How hard is it to track

Tracking a person can be easy or hard, depending on this user activity in the Internet

ocean temple Mar 8, 2021, 5:19 PM

#

Ok thank you

ocean temple Mar 8, 2021, 5:36 PM

#

What if they got a linked in account

#

Ok sorry

#

And never mind

#

And thanks

winged parcel Mar 8, 2021, 7:45 PM

#

im trying

#

to crack my own wpa2 encryption

#

cant

#

it just retries the same pin

#

reaver –bssid (mac address of wifi) –channel (number) --interface wlan0 –vvv -no-associate

thorn obsidian Mar 9, 2021, 5:50 AM

#

Doesn't Reaver only crack WEP?

thorn obsidian Mar 9, 2021, 11:51 AM

#

thorn obsidian Doesn't Reaver only crack WEP?

nope

thorn obsidian Mar 9, 2021, 11:59 AM

#

winged parcel reaver –bssid (mac address of wifi) –channel (number) --interface wlan0 –vvv -n...

dumb question but does your router have WPS?

weak eagle Mar 9, 2021, 3:42 PM

#

It would need WPS and for it to be enabled and for it to be old enough not to protect brute force on the WPS PIN

#

You can't really 'crack' WPA2 it's other mechanisms around it that might have vulnerabilities

white yarrow Mar 9, 2021, 4:12 PM

#

cloud cypress Hello! I am using a VM to run Kali Linux. It runs perfectly but when I tried to ...

It happens sometimes

thorn obsidian Mar 9, 2021, 5:53 PM

#

weak eagle It would need WPS and for it to be enabled and for it to be old enough not to pr...

true

floral adder Mar 9, 2021, 7:32 PM

#

Guys, do you think that keeping packages for your web application outdated can lead to GDPR (EU) penalty?

stiff acorn Mar 9, 2021, 8:13 PM

#

@floral adder potentially, yes. Organizations are required to implement "reasonable" data security protections. So, you should at least have reasonable package upgrading guidelines and protocols inside your organization, and follow them. If some breach happens, and it is determined that it was caused by an out of date package, you can at least show that you were following your "reasonable" package upgrading/updating guidelines.

floral adder Mar 9, 2021, 8:16 PM

#

stiff acorn <@!690125676619104397> potentially, yes. Organizations are required to implement...

Thank you for the answer, it's very useful! I was struggling to find any info about this topic

stiff acorn Mar 9, 2021, 8:20 PM

#

@floral adder No problem. I'm no expert, but I'm required to pass a GDPR exam every year (from my employer).

floral adder Mar 9, 2021, 8:23 PM

#

internal exam in your company, right?

stiff acorn Mar 9, 2021, 8:24 PM

#

Yes, but they use a vendor for the courses and training. This is mostly for certification compliance

floral adder Mar 9, 2021, 8:27 PM

#

May I ask in which country? I'm doing research for a small company that I work for

stiff acorn Mar 9, 2021, 8:27 PM

#

US-based

floral adder Mar 9, 2021, 8:35 PM

#

Oh ok, so I need to keep looking in my country then 🙃 Anyway, thanks again for the answers! cheers

thorn obsidian Mar 10, 2021, 1:48 AM

#

Ya can’t seem to crack wps 2.0 with reaver

#

Word list is just too big

untold ermine Mar 10, 2021, 2:07 AM

#

Is anyone familiar with ssl? I'm having a nightmare of a time trying to get it to work

dapper verge Mar 10, 2021, 2:39 AM

#

SSL is a nightmare itself, and SSL alone is not used anymore, only SSL-TLS variants afaik

#

If you want to implement your own thing or just break something then you would have to understand how Diffie-Hellman works and understand lots of math and cryptography basics, which is pretty hard tbh

#

It may not be a good place to start playing with security

untold ermine Mar 10, 2021, 2:58 AM

#

My problem isn't understanding SSL, its using the ssl module in python. I need to use anonymous diffie-hellman, specifically ADH-AES256-GCM-SHA384, in TLS 1.2. Running openssl s_server -accept localhost:8080 -tls1_2 -cipher ADH-AES256-GCM-SHA384:@SECLEVEL=0 -nocert from a terminal does what I want, however when I try to recreate that with python's ssl,

context = ssl.SSLContext(protocol=ssl.PROTOCOL_TLSv1_2)
context.set_ciphers("ADH-AES256-GCM-SHA384:@SECLEVEL=0")
sock = socket.socket(socket.AF_INET, socket.SOCK_STREAM, 0)
sock.bind(("localhost", 4443))
sock.listen(0)
ssock = context.wrap_socket(sock, server_side=True)

I get a server side error no shared cipher

topaz fable Mar 10, 2021, 7:52 AM

#

hey guys, i'm a newbie in this area and I'm not sure what I'm talking about, might not even be an issue and might be posting this in the wrong channel but here we go...
I'm having a lot of excel documents sent to my email that I plan to fetch with some pyhton code and take the contents of a specific sheet and throw it in a database on a sql server. It's fetched by putting it in a pandas dataframe and imported to sql. Now here's my quesion, how would I secure that the contents isn't some kind of inject attack or what ever it's called...?

#

As said go easy on me, I'm green as hell on this 🙂

thorn obsidian Mar 10, 2021, 9:38 AM

#

topaz fable hey guys, i'm a newbie in this area and I'm not sure what I'm talking about, mig...

Prepared SQL statements

topaz fable Mar 10, 2021, 9:43 AM

#

so basically, don't use pandas.to_sql() to import to db

stiff acorn Mar 10, 2021, 3:31 PM

#

@topaz fable Do they [pandas] mention that to_sql is ~~insecure~~unsafe?

topaz fable Mar 10, 2021, 4:12 PM

#

@stiff acorn no, but not stating it is safe neither so i'm a bit better safe than sorry i guess, but as said I got no knowledge in this area

stiff acorn Mar 10, 2021, 8:26 PM

#

@topaz fable I do think that it is safe, being such a popular package, I don't think they would expose their users like that. Do you have examples of some of the attacks that you are anticipating? Try applying these attacks on the library and see how it responds.

dapper verge Mar 10, 2021, 9:54 PM

#

@untold ermine Have you made it work? I couldn't reproduce this issue, context.get_ciphers() has everything it should, no errs for me

untold ermine Mar 10, 2021, 9:56 PM

#

I haven't been able to get it to work. When I connect to it with openssl s_client -connect localhost:8080 -tls1_2 -cipher ADH-AES256-GCM-SHA384:@SECLEVEL=0 or an http.client.HTTPSConnection with the same context setup it crashes with the no ciphers error

dapper verge Mar 10, 2021, 9:59 PM

#

Can you put it in 2 files maybe? I mean like server.py and client.py, it may be hard to tell whats wrong without testing it all the way

untold ermine Mar 10, 2021, 10:01 PM

#

I have 2 files. One with the server code above and a client with py context = ssl.SSLContext(protocol=ssl.PROTOCOL_TLSv1_2) context.set_ciphers("ADH-AES256-GCM-SHA384:@SECLEVEL=0") connection = http.client.HTTPSConnection("localhost", "8080", context=context) connection.connect() Which can connect to the server created by openssl s_server... but not to the python created one

#

context.get_ciphers() on the server side and client side include ADH-AES256-GCM-SHA384 but it can't seem to agree on it

topaz fable Mar 11, 2021, 12:02 AM

#

stiff acorn <@!358331813120180225> I do think that it is safe, being such a popular package,...

Thanks man, good approach. Gotta read up on that.

thorn obsidian Mar 11, 2021, 6:50 AM

#

Thanks

pure cairn Mar 11, 2021, 7:23 AM

#

idk if it belongs here but i wanna make an alert system basically whenever a token grabber/logger whatever u call it tries to access the place where the token is stored something is triggered

#

i dont know how to start with that

pure cairn Mar 11, 2021, 7:23 AM

#

pure cairn idk if it belongs here but i wanna make an alert system basically whenever a tok...

discord token

thorn obsidian Mar 11, 2021, 7:40 AM

#

What module did you use @pure cairn

#

In python

pure cairn Mar 11, 2021, 7:41 AM

#

i didnt use any i want to start from scratch i want some guidance

thorn obsidian Mar 11, 2021, 7:41 AM

#

Ok

pure cairn Mar 11, 2021, 7:42 AM

#

possibly modules and and links to docs

stray socket Mar 11, 2021, 5:44 PM

#

Hey guys I am looking for instances where registry keys were exploited. Does anybody know of some?

winged parcel Mar 12, 2021, 10:47 AM

#

thorn obsidian dumb question but does your router have WPS?

Ya

thorn obsidian Mar 12, 2021, 2:40 PM

#

Lol

limber nacelle Mar 13, 2021, 12:31 AM

#

@mossy junco wut

#

wut is this https://github.com/python-discord/snekbox/blob/master/snekbox/config.py#L17-L972

woven gazelle Mar 13, 2021, 1:13 AM

#

what

mossy junco Mar 13, 2021, 3:28 AM

#

limber nacelle wut is this <https://github.com/python-discord/snekbox/blob/master/snekbox/confi...

Generated code to read the NSJAIL config file

#

Read the start of it

#

It gets generated by protobuf

limber nacelle Mar 13, 2021, 3:31 AM

#

so why does it have to be in the repo?

#

can i generate it myself?

mossy junco Mar 13, 2021, 3:31 AM

#

limber nacelle so why does it have to be in the repo?

because we don't want to generate code in production