#cybersecurity

7 messages · Page 37 of 1

fluid verge
#

depends on your question

glass topaz
#

sorry, haven't used this server in a while

#

well it's not a very precise question

fluid verge
#

though you can just copy-paste it afterwards on a general help channel if it's not on-topic

glass topaz
#

I have to (I had the option to) basically pentest our school website

#

and my main focus rn is student's profilepictures

#

because that could get out of hand easily

fluid verge
#

your school offered you the opportunity?

glass topaz
#

they offered it both as like help and a little challenge for me

#

but they trust me

#

it's like a pretty big website but not that secure

#

I've already found some flaws

fluid verge
#

well, you shouldn't divulge anything about your school here, but do you have at least an idea what you want to ask?

glass topaz
#

I'm not very familiar with Networking related things but I wanted to know if one could just change some packets or whatever to get admin access

#

because it seems pretty likely

#

and someone shutting down the entire school isn't really a good thing

fluid verge
#

for networking-related things, you'd probably better ask on #networks

glass topaz
#

okay

#

thanks anyways!

fluid verge
#

for the rest of security-related things (if you have other questions, that is), you can probably ask here

hushed lintel
#

how do I get truly random sets of data?

fluid verge
#

get a true random number generator?

void aspen
#

There is no truly random numbers

#

but they are seemingly random numbers

#

Use entropy based ones

fringe rock
#

is there a way to use python like curl --cookies

patent nimbus
#

you can use python like that, but it has only specific flags

#

which you can get to know by python --help

serene magnet
#

!e

print("33"+("33")
past starBOT
#

@serene magnet :x: Your eval job has completed with return code 1.

001 |   File "<string>", line 1
002 |     print("33"+("33")
003 |                      ^
004 | SyntaxError: unexpected EOF while parsing
serene magnet
#

!e

print("33"+"33") 
thorn obsidian
#

!e

print(“ok”)
#

k

#

‘’’ok’’’

fluid verge
#

guys, if you want to play with the bot, just go to #bot-commands

#

also, stay in topic, please

fringe rock
#

not with python

ionic quarry
#

Hello , I've been looking into some security , given a shellcode , is there any automated way of identifying info like which architecture its run on etc , or do we have to manually disassemble it in different archs and see where it fits?

harsh wasp
#

I've a question about oauth2. Should resource and authorization servers be in seperate servers? I'm trying to use Django OAuth Toolkit

patent nimbus
ionic quarry
patent nimbus
fading plaza
#

@fringe rock dont use curl, use requests

karmic flicker
thorn obsidian
#

s!invite

austere stream
#

hello guys
is there way to know if one's device is being tracked using python?

manic venture
#

hey guys, is ssl the best way to secure a socket object?

sacred quarry
#

Hi guys, i created an xxs script for my cyber security course. For the life of me i cant get it to work

fluid verge
#

what's the error?

sacred quarry
#

this is the issue im having

#

Is my screenshots not showing?

fluid verge
#

sorry, I sent it just after you sent the traceback

sacred quarry
#

I tried this on the website called hack this site, which allows pen testers to try and hack the website legally, as i didn't want to accidentally hack an actual website.

#

I pasted the url in my code

fluid verge
#

remove the brackets, and you'll get a more sensible error

#

The URL parameter needs to be a string

sacred quarry
#

I used raw_input but dosent work for python 3, then i tried input but still had issues

#

I'll try that thank you

#

line 7 yes?

fluid verge
#

yeah

sacred quarry
#

should i keep the quotations marks or should i remove them as well?

fluid verge
#

yes, otherwise it's not a string

sacred quarry
#

ok thank you

fluid verge
#

welcome

sacred quarry
#

hmmm, invalid syntax error for the colon

fluid verge
#

I said to keep the quotation marks

sacred quarry
#

whoops, my bad lol

#

It fixed that error but now i have a NameError

fluid verge
#

yep, that's the more sensible error that I was talking about

#

you should be able to identify the variable name you used incorrectly, and the correct name to use to correct the error, now

sacred quarry
#

That's how my code looks atm

fluid verge
#

yes, I figured

#

can you read the NameError traceback? the problem is explicitly given at the end

sacred quarry
#

req is not defined

#

so i know its because of that

fluid verge
#

yes, so you meant to use req as a name, but you didn't. What name did you use instead?

sacred quarry
#

requests for line 9 and 11 but i never used req anywhere else but in line 13. So I would assume i need to change it to request

#

request =. So i should have named it the same thing in line 13

#

It worked!

#

Thank you so much!

fluid verge
#

welcome 😄 . Next time, use a general help channel for a similar request, though 😉

sacred quarry
#

I will. Again thank you

lament tulip
#

Has anyone ever attempted to make a web framework that is fully E2E encrypted?

ashen spade
#

Hey guys, anyone tried using GDB in order to attach a Python process and debug it?

#

Without restarting the process

woven gazelle
thorn obsidian
#

#bot-commands

turbid folio
#

hi there anyone with experience in bypass anti-bot from cloudfare?

#

to use in a web-scrapping project

grizzled lake
#

@turbid folio we can't discuss such things here, as per our server rules

past starBOT
#
Rules

8. Do not help with ongoing exams. When helping with homework, help people learn how to do the assignment without doing it for them.

grizzled lake
#

!rules 5

past starBOT
#
Rules

5. Do not provide or request help on projects that may break laws, breach terms of services, or are malicious or inappropriate.

grizzled lake
#

(meant to post 5, 8 is not relevant)

white glen
#

if an AES key is made up of 32 characters (numbers and alphabet)

#

does that mean it is AES-32 or AES 256?

flat anvil
#

assuming by "numbers and alphabet" you mean hexadecimal, which would mean each character is 4 bits

#

=> 32 * 4 = 128

fading plaza
#

aes key size is always 128 192 or 256

#

unless you're doing something really weird

slow spire
#

Would you guys use Nmap or Wireshark

fading plaza
#

they have different purposes

#

nmap is for port scanning (and other more advanced scans)

#

wireshark is for tracking local traffic

white glen
#

I imagine AES 128 is plenty secure enough

civic widget
#

I am currently competing in a cyber security comp and I am attempting to complete a buffer overflow question. I have the amount of characters required to overflow and the memory location I want to overflow to. But I am not sure how I can inject this memory location into the message payload we send to the server?

#

Like I have the characters, then after that I need to put the memory location but how do I get that to work with the address properly rather then a string

#

Am happy to provide further details / legitimacy if people want

civic widget
#

Something to do with x86 calling convention. Although im not sure on how to use it

fluid verge
#

you'd probably want to watch LiveOverflow's binary exploitation playlist

civic widget
#

Aight

whole comet
#

im developing a webapp with a django backend and i need to store user data. im not exactly sure on what legally needs to be encrypted (or indeed what encryption django automatically does or doesnt) but is this a reasonable plan?

receive data on signup
encrypt with AES256 (i have the algorithm from a library)
store data
receive data on login attempt
encrypt with AES256
compare to existing entry to validate

im very new to security and argued against being assigned any security related stuff for the project but im the only guy in the office who even knows where to start.
if im leaving vulnerabilities or usability issues please tell me, and if im missing something as simple as encrypt=True in a kwargs for a django model please let me know that also

fluid verge
#

how do you generate your key, and how do you plan to store it? That might be a vulnerability

#

most user data should not be stored, and only if absolutely necessary for the functioning of the application (if data storage is a feature, then sure)

#

how do you plan to ensure that the existing entry is the correct one that the user has given at signup time? Or if it is not malicious in the first place?

#

If you have login information, you should never be able to decipher keyphrases or passwords, because once an attacker gets your key, it's as good a plaintext storage. Use secure cryptographic hashing with secure salting (there are good libraries for that, but I don't know the names, as I come from the more theoretical side of things)

#

Also, be sure you're using the 128-long block version of Rijndael (which is the AES standard), because some libraries claim that the 256-long block version is AES-256 (it is not, and this variant has not been tested as thoroughly as the now AES)

#

Finally, you probably want to read the GDPR if you want to store user data. It's complicated, but it gives a baseline of what you need to do. Also, it has to be respected if some part of your userbase is in the EU

#

And now that I think of it: protect your webapp against all kinds of script injection, database injection and so on as good as you can. There will always be bugs, but be ready to correct them as fast as possible

whole comet
#

thats a lot of things to think about but i'll make sure i properly evaluate them before pushing the app to the server.

immediately though i can see that im leaning heavily on django's form and model packages for validating post requests, and i assume its completely possible to enter a script tag as your username or even email name.

I do however trust django to escape context data formatted into an html template, if i say that context["myvar"] = "<p>lorem</p>" then {{ myvar }} shows on the page as <p>lorem</p> rather than a p tag, but its probably a good idea to give a firm no to any form data that matches an html tag.

i'll look into any encryption django has built-in, and i'll read the gdpr as im pretty sure the uk still holds it despite brexit.

thank you for your help, i wouldnt have even considered some of the things you mentioned

fluid verge
#

You don't have to outright ban HTML tags, you just need to be careful with them. The GDPR needs to be applied if any of your user is from the EU. So if I (from France) decides to use your app, you need to be prepared to follow this regulation closely (or be fined quite a lot if reported)

#

I just have a bit more experience than you on that topic, because I'm from a Cryptography background, and the correct use of cryptography is basically the point of my internship (although my internship is very specific)

wooden imp
#

is there iranian in here?

velvet field
#

why?

restive oar
#

How can i implement an siphash_4u32 function in python?

fading plaza
#

why not use a well tested MAC function instead of rolling your own?

#

but if you require siphash specifically you should use an existing library

fading plaza
#

!rule 5

past starBOT
#
Rules

5. Do not provide or request help on projects that may break laws, breach terms of services, or are malicious or inappropriate.

fading plaza
#

@thorn obsidian

thorn obsidian
#

Is SHA1 or MD5 good enough for a non-security context, or should I go SHA256? I want to lighten the computational load.

Background: I want to store files uploaded by my users on a file system, and name the file some kind of unique hash derived from user data. It doesn't need to be "secure", (unless you guys can think of an attack that would effect my system). The only condition is that these files cannot be accidentally overwritten by other users (hashing collisions.

atomic ridge
#

it depends on your scale, SHA256 is harder to having collisions, but store everything in one directory is the root cause.

#

In fact I don’t think it’s necessary to use hash as your filename just for avoid collisions. Append random string/timestamp to filename, split upload files into username folder if you have limited user, split into date folder if you have many files per day, use distributed storage service like S3 if you have massive files to store to avoid inode usage issue.

restive oar
# fading plaza why?

I want to create a demo of syn cookies with python, but i have no idea how to create the initial sequence number.
I would like to get some help😁

atomic ridge
restive oar
atomic ridge
restive oar
#

Ok, I will try.
Thank you👍

vernal dome
#

I try to install 2 partitions of Windows on 2 different drives. Drive 1 with Windows 1 and Drive 2 with Windows 2. I try to find a simple solution without disconnecting the Drive from my System to keep sure that If I get a Virus on Drive 2 with Windows 2 that its not possible for the Virus to read and write and infect Drive 1. Iam open for any ideas 😉

quiet gull
#

I think you can just disconnect it virtually

mighty light
#

!e print("wow" )

#

!e X = [[12,7,3],
[4 ,5,6],
[7 ,8,9]]

3x4 matrix

Y = [[5,8,1,2],
[6,7,3,0],
[4,5,9,1]]

result is 3x4

result = [[sum(a*b for a,b in zip(X_row,Y_col)) for Y_col in zip(*Y)] for X_row in X]

for r in result:
print(r)

past starBOT
#

@mighty light :white_check_mark: Your eval job has completed with return code 0.

001 | [114, 160, 60, 27]
002 | [74, 97, 73, 14]
003 | [119, 157, 112, 23]
mighty light
#

!e import ctypes p = (ctypes.c_char).from_address(0) while True: p[0] = 0 p = p + 1

past starBOT
#

@mighty light :x: Your eval job has completed with return code 1.

001 |   File "<string>", line 1
002 |     import ctypes p = (ctypes.c_char).from_address(0) while True: p[0] = 0 p = p + 1
003 |                   ^
004 | SyntaxError: invalid syntax
mighty light
#

!e exec(type((lambda:0).code)(0,1,0,0,0,b'',(),(),(),'','',1,b''))

past starBOT
#

@mighty light :x: Your eval job has completed with return code 1.

001 | Traceback (most recent call last):
002 |   File "<string>", line 1, in <module>
003 | TypeError: code() takes at least 14 arguments (13 given)
mighty light
#

!e for i in range (0, 10): if (i == 6): #Stop the program at 6 just.. because raise SystemExit print(i)

past starBOT
#

@mighty light :x: Your eval job has completed with return code 1.

001 |   File "<string>", line 1
002 |     for i in range (0, 10): if (i == 6): #Stop the program at 6 just.. because raise SystemExit print(i)
003 |                             ^
004 | SyntaxError: invalid syntax
thorn obsidian
#

And why do you need to?

manic venture
#

!e print("hi")

#

nice

#

!e import socket

past starBOT
#

@manic venture :warning: Your eval job has completed with return code 0.

[No output]
manic venture
#

ok

fluid verge
#

if you want to play with the bot, please don't do it here

manic venture
#

oh ok srry

fluid verge
#

there's #bot-commands for that

#

it's okay, I just have notifications on this channel 😅

rose cedar
#

!e print("Hello")

past starBOT
#

@rose cedar :white_check_mark: Your eval job has completed with return code 0.

Hello
rose cedar
#

!e print([ l for l in range(100)])

past starBOT
#

@rose cedar :white_check_mark: Your eval job has completed with return code 0.

[0, 1, 2, 3, 4, 5, 6, 7, 8, 9, 10, 11, 12, 13, 14, 15, 16, 17, 18, 19, 20, 21, 22, 23, 24, 25, 26, 27, 28, 29, 30, 31, 32, 33, 34, 35, 36, 37, 38, 39, 40, 41, 42, 43, 44, 45, 46, 47, 48, 49, 50, 51, 52, 53, 54, 55, 56, 57, 58, 59, 60, 61, 62, 63, 64, 65, 66, 67, 68, 69, 70, 71, 72, 73, 74, 75, 76, 77, 78, 79, 80, 81, 82, 83, 84, 85, 86, 87, 88, 89, 90, 91, 92, 93, 94, 95, 96, 97, 98, 99]
rose cedar
#

!e import os
print(os.getcwd())

past starBOT
#

@rose cedar :white_check_mark: Your eval job has completed with return code 0.

/snekbox
fluid verge
#

#bot-commands

rose cedar
#

!e import os
print(os.getcwd())
print(os.listdir())

past starBOT
#

@rose cedar :white_check_mark: Your eval job has completed with return code 0.

001 | /snekbox
002 | ['Pipfile.lock', 'Pipfile', 'config', 'snekbox', 'user_base', 'tests', 'LICENSE']
rose cedar
#

!e import os
print(os.abspath())

past starBOT
#

@rose cedar :x: Your eval job has completed with return code 1.

001 | Traceback (most recent call last):
002 |   File "<string>", line 2, in <module>
003 | AttributeError: module 'os' has no attribute 'abspath'
rose cedar
#

!e import os
print(os.path.abspath())

past starBOT
#

@rose cedar :x: Your eval job has completed with return code 1.

001 | Traceback (most recent call last):
002 |   File "<string>", line 2, in <module>
003 | TypeError: abspath() missing 1 required positional argument: 'path'
fluid verge
#

please play with the bot in #bot-commands, and stop spamming evals to the bot here, keep it on topic

rose cedar
#

Ohh cool

#

Got it

#

Thanks

fluid verge
#

thank you

elfin widget
#

OPINIONS!?

flat bronze
#

What's the impact of ITP on my JWT Refresh-Access tokens used accross multiple microservices?

manic venture
#

Is RSA a good decision of encrypting a message?

atomic ridge
#

for example, use RSA only won't provide Perfect Forward Secrecy

manic venture
modest canyon
#

Hi, I m coding a program and I want it launch with windows, how can i do ?

fluid verge
#

you want to start a process when windows starts? How is that relevent to this channel's topic?

atomic ridge
#

maybe he is trying to boot malware with windows😆

last ivy
#

@pure kayak If you want to test out !e, we have #bot-commands. Please don't spam.

hasty pollen
#

how can i secure my password/

#

?

thorn obsidian
#

hey guys

atomic ridge
#

hey

remote knot
#

Password managers are still helpful, but imo best password manager is a pen and paper

umbral burrow
#

^^^

fading plaza
#

based on what you said

#

every single time you login to a site, do you scan your paper that has dozens of site/password pairs on it for the right site, then type a 20 char password with special characters and alphanumeric manually?

#

how do you login to your accounts if you're not at home?

#

anyways

#

(along with some other security tips)

somber crypt
#

you can come up with a pattern, i used it before password managers. 90% of the password was the same from one site to another, but strategic spots were changed out based on the sites url/brand

#

and so i had a unique pw on every site but also was easy to remember

fading plaza
#

thats also bad

somber crypt
#

like if araye was my password, discord version could be say adraiye

fading plaza
#

if one of your passwords is leaked

#

then all of your passwords are leaked

somber crypt
#

thats literally false, youd need to have hacked/stolen at least 2 in order to put together the pattern

#

probably more than 2 like 3 or 4 for to be obvious

fading plaza
#

why cant you just use the password manager's builtin generator

#

any decent password manager can generate a fully random password for each site

somber crypt
#

i mean the man clearly doesnt trust the cloud if he wants to use pen and paper

fading plaza
#

you can host keepass locally

#

no cloud involved

somber crypt
#

that so helps when you are : at work, on phone, at home, at friends house, etc

fading plaza
#

uh dropbox sync

#

iirc thats the recommended solution

somber crypt
#

anyways im done arguing this its like you think your version is the only ok version. other methods exist. and shit, a non digital one is 100% the safest you cannot argue that. a hacker has no chance of stealing it, vs you could be ratted and lose all passwords

fading plaza
#

a properly secured non digital one yes

#

however

#

you also need to take into account useability

#

and pen/paper solutions aren't really user friendly

#

but if you're truly paranoid about this type of thing, then yeah they're the only solution

#

but for most people, password managers are better

ashen smelt
#

Yeah the pattern idea isn’t great. Anything that’s not random can potentially make brute force much easier. The advantage of a password manager is you can easily create 20+ character long random passwords without it being inconvenient

#

Bitwarden is nice and open source. Keepass/keepassxc if you’re more paranoid

remote knot
#

If you want to i can share a password generating script

#

I memorise random bullshit very well though

#

For some off reason

#

So I'll eventually remember one randomly generated string 😂

plain crown
#

hello! Is there a set of built in crypto tools in 3.9 or do I have to install external libs or roll my own?

fading plaza
#

never roll your own

fluid verge
#

only roll your own if your implementation has been correctly and thoroughly tested against common attacks. In short, don't

#

Though resistance against common attacks is still a pain point in quite a substantial number of commercial and non-commercial applications

#

(Cryptographic libraries on Android still had known unsecure implementations of AES up until at least 2016)

fading plaza
#

just using HTTPS/TLS as your crypto stack is another option

fluid verge
#

That's an interesting idea. Of course, that's relying on libraries, which you may not trust, but the least trustworthy agent is yourself in crypto design and implementation.

void vessel
#

another_worldgif HTML Is Better

thorn obsidian
#

?

#

??

#

wa

#

t

thorn obsidian
#

has anyone taken part in any ctf

sharp tundra
#

I recently started an internship and the task in hand rn is to anonymize the database. What we are trying to do is that code goes through the csv/sql db and suggests user what anonymization technique could be used on what column, and then that anonymization is to be applied.
Any libraries that could be of use?

elfin widget
#

Hm, well, what needs to be anonymizeD?

thorn obsidian
#

Where do I start cyber security

#

I've learned the bare basics of python

thorn obsidian
#

@thorn obsidian use thei nternet bro, not that hard

ocean copper
rose plover
verbal glacier
#

should i take this intro to security class

#

as an elective

jolly pumice
elfin widget
jolly pumice
elfin widget
thorn obsidian
#

woah

#

this channel seems cool

#

My goal is to be in cyber sec when i get older, what are some of the things that i should start learning or things that i need to learn in order to be able to get into cyber security? i have little to no experience in it.

remote knot
fathom drum
#

Can I make a rubber ducky with python and like tinker m0 or a pi Pico?

thorn obsidian
#

Anyone have experience with anomaly detection and machine learning?

arctic jewel
weary sage
toxic apex
#

HTML is the best programming language, never underestimate the power of HTML

nimble shuttle
toxic apex
nimble shuttle
patent nimbus
#

@hardy flax You can DM @novel cedar, this is for dicussing about security with python like encryption, protecting yourself, data sanitization, etc.

#

And please delete those screenshots

last ivy
#

Are there some common practices/conventions to responsibly disclose security issues/vulnerabilities I find on random websites? Especially when there are no obvious pointers towards people I should contact.

civic widget
#

I spose it depends on the website and who it represents

#

Maybe theres some higher authority for reporting cyber sec issues if its a specific country

glossy tundra
#

if was a Italian/Canadian who runs the company

#

and the systme of hear team é gad

woven burrow
#

Hello,
I have an arduino that makes GET request on my django server to retrieve datas using HTTPS.
I have trouble using HTTPS with the arduino. What is the danger to use HTTP for only one url (the one for the get request) ? Also, is that possible? To avoid the redirect 301 for just one url, using Django ?

jolly pumice
jolly pumice
last ivy
#

yeah, the site owner

jolly pumice
#

I see it varies .. generally the site owners are looking to retrieve emails from their customers . Could look up who is hosting the site and let them know that the site is insecure.. I see they’re more likely to push the issue when it’s a valid point

#

Sometimes there’s a place for it on the sites support section, sometimes there’s not . I’m by no means an expert , just had an idea

livid trout
#

would anyone know were to start learning cybersecurity by chance

thorn obsidian
#

I was reading up on Applied Cryptography and just made it to pg 49. Can someone explain why the hacker cannot decipher the half of a message when it is sent in Interlock Protocol? If the hacker already has the private key they switched out, they should have no issue deciphering it.

pastel rapids
#

W3 dont need to worry about hacker if we dont use internet or any way to transfer data

#

Like magic

lavish citrus
#

oh didnt see this channel

#

looking for security experts that can assist in tracking illegal wildlife traders

void vessel
#

Ok Python - Java script
Poll

fluid verge
past starBOT
#
Rules

9. Do not offer or ask for paid work of any kind.

fluid verge
#

And if it is not paid, then you need to say it from the start

tidal osprey
#

I give fact: RSA > AES

fluid verge
#

don't feed the troll, I suppose?

tidal osprey
#

@fluid verge?

#

What in french this mean ?

fluid verge
#

I hope you are trolling if you're saying that "RSA is better than AES" is fact

tidal osprey
#

Rsa is better

lavish citrus
#

no not paid lol

tidal osprey
#

Asymetric always better than symetric system

lavish citrus
#

its for a conservation charity

fluid verge
#

for what set of criteria?

tidal osprey
#

For the future ... Rsa is better against quantum attack

#

It was break with the algo Shor but still better than aes

fluid verge
#

No, just... no

tidal osprey
#

Lmao no joke 😆

#

Yes

#

Shor break rsa and aes

#

Theoricly

fluid verge
#

If it's already broken with a quantum algorithm, it's not good for post-quantum

tidal osprey
#

Yep but rsa stronger against it

#

Just saying lol

#

Ofc it was broke but stronger than aes

#

I give another fact: ceasar algo > rsa > aes

fluid verge
#

ok, don't feed the troll, bye!

tidal osprey
#

wdym ?

#

Its not a troll lol

fluid verge
#

you're just trolling, but that was a good one, thanks for the laugh!

tidal osprey
#

For the rsa no but ok bye

fluid verge
#

so... AES-256? Shor's algorithm simply reduces security by the square root of the initial security

#

so instead of 256 bits of security, you just get 128 bits of security, which is still way too much computation for brute-force (even with quantum computers)

tidal osprey
#

Yes aes 256 is very good

fluid verge
#

ok, now you seem reasonable. So it's not AES that's broken, it's AES-128

thorn obsidian
# 
import os
import base64
import subprocess
import random
from Crypto.Cipher import AES


with open("file.exe", "rb") as binary_file:
    binary_file_data = binary_file.read()
    encoded_data = base64.b64encode(binary_file_data)
    base64_message = encoded_data.decode('utf-8')
    random_key = os.urandom(16)
    base64_key = base64.b64encode(random_key)

    binary_file.close()


payload = encoded_data
encrypted_key = base64_key

bs = 128
ks = 256

aesKey = base64.b64decode(encrypted_key)
aesBytes = base64.b64decode(payload)

decipher = AES.new(aesKey, AES.MODE_ECB)


with open("Encrypted.exe", "wb") as Encrypted_file:
    Encrypted_file.write(decipher.decrypt(payload))

When i open the Encrypted.exe file I'm getting this app can't run on this pc

tidal osprey
#

@fluid verge"seem reasonable" 😆

fluid verge
thorn obsidian
#

yea

fluid verge
# thorn obsidian yea

And you are reading a random key? If so, you basically can't be sure it's the key that was used for encrypting the file

thorn obsidian
#

so the keys may be different ?

long ledge
#

are you encrypting file.exe or decrypting it?

thorn obsidian
#

encrypting it

#

and then writing the encrypted data in another exe file

long ledge
#

you can't run an encrypted file, it's garbage data unless you decrypt it first

fluid verge
thorn obsidian
long ledge
#

you reverse the steps you did to encrypt it to get your original file back

fluid verge
#

you need the key to decrypt an encrypted file, with the same key (and scheme) as was used for encryption

thorn obsidian
#

what if it's a py2exe file?

#

or pyinstaller

long ledge
#

that doesn't matter

#

you encrypt an exe, it's no longer executable

#

you can decrypt it back into the original exe, and run the original

thorn obsidian
#

so when i run it it should decrypt?

long ledge
#

you can't run the encrypted file

#

period

thorn obsidian
#

how do i make it run xd

long ledge
#

if you are trying to do this to protect your code, abandon this idea. you were told as much in your help channel

thorn obsidian
#

the file i'm trying to protect is getting false positives on virus total

long ledge
#

yes, that's just something that happens with pyinstaller onefile

#

unless you build pyinstaller yourself

tidal osprey
#

@fluid vergeWell for now i never see a website with a 256 key, even amazon and google still go on 128. Probably its too long for a user 😫

#

If we all got the time we will go one 2048 bit aes and it will be secure !

fluid verge
#

There is no 2048 bits AES. It's not in the standard, and it's not even in the proposed scheme

tidal osprey
#

It was a joke ...

#

And no i just see a website on 256

long ledge
#

aes 128 uses less computation than 256 for negligible increase in risk, that's why it's used

thorn obsidian
#

Is it possible to decrypt exe files using python?

fluid verge
#

If you know the encryption scheme and the key, there's no problem with that

glossy tundra
#

python can be used to decrypt packets from close wireless spots

#

with wireshark, or it just capture packets from the interface im connect to

crisp yew
#

what's wireshark ?

glossy tundra
#

i don't know exaclty

#

its gossip, and he tells every details even the lenght of the packets

native flicker
vagrant mist
#

does anyone know how useful GIAC qualifications are?

livid notch
#

cool

past starBOT
#

:incoming_envelope: :ok_hand: applied mute to @thorn obsidian until 2021-06-19 20:03 (9 minutes and 59 seconds) (reason: mentions rule: sent 85 mentions in 10s).

ancient nacelle
#

!ban 854121856789774336 go troll somewhere else

past starBOT
#

:x: User is already permanently banned (#40032).

visual oriole
slim verge
#

What just happened

thorn obsidian
#

ping?

#

yes

#

i got pinged

jagged night
#

Just someone spam-pinging. They've been removed from the server

thorn obsidian
#

Ping

fringe parrot
woven gazelle
#

i think i have a giac

#

is gcfe a giac

#

yes it is

#

yeah theyre pretty good qualifications and they will teach you stuff even if you're an industry veteran

#

but yeah it really depends on industry and who you're looking to get hired by

#

probably worth trying to get your job to pay for it as well

thorn obsidian
#

probably you should look for CTF servers which usually also include cryptography challenges

worthy wharf
fading plaza
past starBOT
#

@solemn cedar Please don't try to ping @everyone or @here. Your message has been removed. If you believe this was a mistake, please let staff know!

devout condor
#

or it might store some IL instead of assembly if the dev compiled it to run in CLR

devout condor
#

security through obscurity is rough to break through but not impossible

dusty sundial
# thorn obsidian how do i make it run xd

you would use a crypter that would bind a stub to the file so when its run it decrypts it, you can also build one that decrypts it in memory but thats getting onto the virus side of things

thorn obsidian
#

So i have a question, can a python script have this much potential that can actually disable a server, community or an account in another web application? Like sending a remote command to application servers. And yes the app's security sucks

#

And please ping me when anyone replies to it :D

hasty pollen
#

hey guys. lemme ask a question: how many hours do you code? is it everyday or 5 times a week and many duration you guys code.

#

to start, i code for about 6 hours a day

#

3 hours at moring and 3 hours at evening

hoary geyser
smoky terrace
ruby lance
#

Hellloooo

#

How much is/can python be used in cybersecurity?

thorn obsidian
dusty sundial
thorn obsidian
#

yea ik that but how to do it in python

fading plaza
#

though pyarmor is still relatively easy to deobfuscate (compared to native code)

wet shard
#

How many possible combination there can be in a 8 character password and a 6 character password? Also tell me how you caluculated

sonic drum
#

Password of what? Does this have numbers? Letters? Symbols? You can use combinatorics to solve this

wheat swift
#

What would you need to get into cyber security?

lone fjord
#

Interest and will is the must.

hasty pollen
tall kite
#

Rumour has it you need a secure password as well....

zealous marsh
wet shard
glossy tundra
#

how a system do not detect when a brute force is happening

dull thunder
#

Is there a way I can check if a piece of HTML is safe? I'm currently using Mozilla's bleach library, but it can only sanitize strings not check them

#

I am currently just checking that bleach.clean(text) == text but that breaks in practice if text has been sanitized by a different version of bleach, for instance I have HTML documents with <br/> that don't pass validation because bleach now returns <br>

glossy tundra
#

mozilla it's very safe because it already had been exploited in thousands of ways

#

I have no idea about this, i'm just giving a opinion based in random details that I saw in other people analysis

runic birch
glossy tundra
#

I don't understand how it works, so I will put it that way:

if a user tries a incorrect password one time, the server probably will receive that message. it's ok, everyone made mistakes... but no one can try 100000000 combinations differentes in 10 seconds

plucky osprey
#

There are safe guards typically in place that if invalid attempts reach a certain threshold a lock out happens.

summer cliff
#

If there is a system between you and the encrypted data then you will most likely be throttled very quickly

#

most websites wont let you guess indefinitely

plucky osprey
#

An email might be sent to the account holder after x invalid attempts

glossy tundra
#

but you can guess indefinitely out of the system

#

but somehow with a "mirror system

summer cliff
#

but if you have direct access to the data store, there is nothing to prevent you from trying as fast as your hardware allows

glossy tundra
#

?

plucky osprey
#

If you had direct access to the system, yes you can never be locked out

#

but in most cases, if I tried to login to a gmail account that isn't mine. I will be locked out after a certain number of tries

glossy tundra
#

the most random and extensive is better then

#

like a 4000 characters password

plucky osprey
#

Technically true for security. Yet no one will want a password that long

glossy tundra
#

but it will stores where?

plucky osprey
#

A database

#

and it is hashed most of the time

glossy tundra
#

yeah, that word appears a lot in links and files right here

#

other thing, I tried Kali Linux and everytime I used airodump-ng my machine freezes up

plucky osprey
#

What are you trying to do?

#

crack hashed passwords?

glossy tundra
#

what that means?

#

I was trying to get PMKID or something like that

#

a three handshake or something like that, but soon it appears the CPU usage go to the roof and the computer is locked

fading plaza
#

isn't that for wifi hacking

north torrent
#

hey guys

#

how do i know which encryption is being used here?

#

'encrypt_msg': lnW7JzI1GT1RAlXrM7k3g88vmBXh6d1z6y+NSjUgoarr/4RC7j13cIi0jt22gU9j03dbt/p2mgPGf45lylOyezsa+EwJNaebR5ehxvKouOq1Qu6Jms1vFn68ucb+4c6wLkv2yqYRz8mOA7ur5rGwUNTIC7G9bFFcXRzWmfasoErc274R7WZBgEDLIm+cLnEs/tySydgajgsJVnMxsv+3uG78/y9hoG84/+MGVDvsaUexS1UUDOGRSn0+bKa6zun/ultnWMkR+Klzw3AaMKmFe5h3BtBaQA1p/P1WBWnmvEX5CcyEvRLwmAuanAr3AP0f8wtotKQDKkCOrfqmu/rCZgh1kj4daMk7Fy1cRK0EHroa95TD7c/jZY5O7PyPCzWUJJp6NerE3byba3L/EKgGbz6JEUXIJcWsdNU/w53rno3dolLwyFpfdLUAREhbsQTDfURMvx28q332CeLIVcpiceh5Sq5YgI2K/r1284NgmgxmeAivmaCbRMZWTb9WQvALm9T6Ye7sK8P+QnRGJO32WWFVV03s7xum5pJCJJndn2EFqejN7bfERFDe9I5KvYaG

#

i want to reverse engineer this and i also know the decrypted message

#

5178661735
I know for sure this number is in the message

fading plaza
#

not without any context on what this is from

sly sonnet
north torrent
#

@fading plaza its from a get request to a server

#

in this input

unknown.png
#

i want to make a get request from python but my lack of knowledge forbids me

robust stratus
#

is this the right place to ask about permissions issues?

fluid verge
zealous folio
#

What is the difference between Science Comp, Cyber Security & IT

robust stratus
#

I'm having a windows permissions issue when running some code. Can anyone help?

#

I've spent a few hours trying to resolve PermissionError: [WinError 5] Access is denied

tall terrace
#

@robust stratus did you try to run the program as administrator?

tall terrace
#

I need to make a private api that is only used by the application. How do I do that? I don’t want anyone to call the api outside the application.

tribal vigil
#

Are you setting up a microservice for a larger application that is hosted in a different container or server?

tall terrace
#

It will be hosted on Google cloud platform along with the database

stark lodge
tall terrace
#

?

thorn obsidian
#

i have a question related to networking/packets/cybersec
lets say that i own a car and i use my wireless key to open my car

key -> send data to car -> car -> open doors

ive heard people could grab the radio frequency (packets) and copy it and use it to unlock my car

how could someone defend themselves from this?
i dont know how to explain it a little better since im dumb

marble wing
# thorn obsidian i have a question related to networking/packets/cybersec lets say that i own a c...

This is actually a really good question. There are a couple different methods. The most obvious one is to simply expand the length of the packets that need to be transferred, resulting in a longer key. This still faces the same problem, though, but it provides more opportunity for environmental error introduction. Another method is to increase the complexity of the key, in hopes that it'll make it more difficult for someone to essentially record the packets transmitted. The third option, and the one that would make it most secure is just adding more requirements to the key. Specifically, a lot of garage doors can actually be opened with minimal hardware by simply playing through all the possible frequency combinations, essentially brute-forcing it. The simple requirement that there is no information transmitted before the key begins can multiply the duration of that brute-forcing tenfold. Adding on other requirements, like distinct product recognition, can help to reduce that. In this case, a very simple method would be adding a counter that changes the "key" slightly every time, transmitting say "236467256a-1" followed by "236467256a-2", and then -3, and so on.

thorn obsidian
#

like the key sends a car a request to send data

the car creates a session with new keys and sends the public key to the Key device

key device receives it, encrypts the data needed to unlock the car and send it

#

a new session or a new request to send data will have different keys to deter hackers from snooping in the traffic

marble wing
#

that would only really work if the car created a distinct session each time, with a different key system for each

#

lmao, that's what you just said

#

the main point is that that process involves a whole lot more hardware than just receiving a set signal

#

and a whole lot more software as well

#

keeping things in security as simple as possible is desirable, especially when a thing as costly as a car hangs in the balance, since more complicated systems have proportionately more bugs

thorn obsidian
#

true that

#

the lost is efficiency and cost
the gain is security

#

the chances of a hacker stealing your car is slim

#

very slim

marble wing
thorn obsidian
#

the fact the car industry is very unregulated is scary

#

did u know ur car manufacturer could listen on ur calls,etc...

#

they can do whatever the fuk they way

#

and get a way with it

marble wing
#

If a person is already investing sufficiently to get hardware that's capable of recording and re-transmitting a key, they'll likely be able and willing to invest time, effort, and money into achieving that same goal through other means.

marble wing
thorn obsidian
#

throw car keys away and use phones as general keys :D

#

an encryption function could easily be built

#

a phone can be a general purpose device as a key

marble wing
#

In addition to that, it's really hard to regulate past transmissions and vehicle data, since data privacy rights get kinda blurred. If you have a vehicle that's collecting data like addresses you commonly visit in order to help you navigate in the future is also communicating with other personal devices of yours, like your phone if you're playing music or on a call, the storage of that data, at least temporarily, is necessary, and establishing any sort of hard regulation on when to get rid of that data can be tricky for safety reasons, like sending a text as soon as someone is in cell range, which could be necessary in an emergency.

thorn obsidian
#

agreed

marble wing
thorn obsidian
#

could i take a look?

marble wing
#

And the thing is, it's really not that hard.

thorn obsidian
#

im not that good at data encryption, i only know some protocols

#

ye its not

#

multiple modules these days

marble wing
thorn obsidian
#

that does the maths for ya

#

bruh

#

pgp email time trollface

#

jkjk

thorn obsidian
marble wing
thorn obsidian
#

smh not pog

marble wing
#

The other side to that is that most computers are capable of encrypting way beyond 256 bits anyways

thorn obsidian
#

is there more then AES512?

marble wing
#

Theoretically, yes, but most commercial encryption programs don't really go beyond 10 or 12-cycle aes256

marble wing
#

cracking 8-cycle aes256 already takes multiple centuries with a supercomputer

#

and actually, I saw a thread about this, if one were to store all of the possible decryptions, there wouldn't be enough atoms in the universe to store that information, even if each atom were able to represent a bit, or even a byte

#

plus, the energy costs for that storage of information already exceed the total energy contained within our solar system at something like 16-cycle 128-bit

#

then again, it doesn't really make sense to store all of that, but it's a fun thought experiment

#

and it makes the cia's employment of ~5k mathematicians far more logical

#

anyway, gtg, nice talking to you

thorn obsidian
#

same! have a nice day

#

great talk

thorn obsidian
#

e

#

n

thorn obsidian
#

Anyone know how to make an Akamai gen?

junior parcel
#

Before you learned ethical hacking what IT skills did you need to learn first? I'm very new to all of these things and im trying to get started. Im trying to find a foundation for learning ethical hacking.

junior parcel
#

Alright, I've found these things are good to learn. Networking skills, Learning to operate with Linux, using Kali Linux, and what else?

fading plaza
#

@thorn obsidian i highly recommend using an existing crypto protocol like ssl/tls or ssh

fading plaza
#

no

verbal egret
#

Ok, data are crypted, using ssh, sorry !

junior parcel
#

Alright, I've found these things are good to learn in IT before I learn cyber security. Networking skills, Learning to operate with Linux, and using Kali Linux. What else is there?( Sorry for repeatedly posting this but Im trying to learn the stuff I should learn as soon as possible)

rapid oak
#

Looking for advice: I'm working on a project that will allow me to schedule recurring buys using the coinbase api. Using OAuth2 I'm given an access token that expires after 2 hours. This means my program will not be able to complete a scheduled buy in the future unless I store the refresh token and get a new access token before each buy. This sounds like a security issue, but I'm not sure of a safe solution really.

thorn obsidian
ashen arch
#

Can anyone solve this puzzle?

←←↓→↑↑←↓
↑←→↓←↑↑→ ↑←↓→↑↑↓↑
←↑↓↓↑↑↑↓ ↑←→→↑→↑→
↑↑↓→↑↑↓← ↑↑↓↓↑↓↑→

Info:
It's not a Konami code
All you need to solve it is the cipher itself
It's not FNF
It's not a cheat code
It's not 84210 or 9602
It's not an arrow alphabet
The answer is not 7 words or letters long
It's 100% original, you won't find anything about it anywhere else
The final result is text, not numbers.

cedar imp
#

numbers are text

rapid oak
thorn obsidian
#

dude

#

why are u complaining about APIs

#

those are easy

#

ur not changing ur whole code

thorn obsidian
ashen arch
thorn obsidian
ashen arch
#

ok

rapid oak
fluid verge
#

The current "norm" for RSA is using an n that is at least 2048 bits-long

wild dagger
#

Cybersecurity is all about working in companies?

#

There are no freelance?

keen prairie
#

@wild dagger there are freelance bug bounty programs. Look up hackerone and bugcrowd to start

thorn obsidian
#

yo does anyone know if theres a function that can convert characters like "ÆØÅ" into their counterpart Æ becomes AE

split nymph
# 
def convert_ae(string:str):
    return "".join(["ae" for char in string if char=="æ"])
#

For "æ" character only

fading plaza
oblique niche
fading plaza
stiff elk
#

def convert_ae(string:str):
return "".join(["ae" for char in string if char=="æ"])

#

what

#

hard

#

I now player

fading plaza
#

?

wet ore
#

hello I was wondering how i can make sure a link is safe

#

are there other tools i can use to further protect myself

wild dagger
slender swallow
#

is hacking and ethical hacking the same?

fading plaza
#

no

thorn obsidian
deep canyon
#

Hey guys so I'm interested in cybersecurity and want to start the basics so I can get a head start before college, where should I start? I have no knowledge at all and there's just a ton of information out there all saying different things.

obtuse raptor
#

I also want to learn cybersecurity

#

pls can anyone help me

wary spade
lone ruin
#

thats all

cedar imp
#

if i post all my personal information to internet will it be impossible to doxx me because i already doxxed myself?

grand smelt
#

oml

#

well

#

yeah

#

@cedar imp

#

just you'lll be dead

plain ether
#

@cedar imp no, sometimes doxing includes looking at social media

cedar imp
#

ok

dusk cedar
#

Is anyone here familiar with the "privacy engineering" field? Please DM me, I have some questions 😄

gritty island
#

hey

#

someone here ? dm please

remote knot
remote knot
thorn obsidian
#

This can be used for illegal purposes, so please don't ask people about it here

fading plaza
#

idt htb is that good for beginners

#

picoctf, overthewire and tryhackme are good

plain kettle
pastel rapids
#

Hello smart people!
Can you solve this simple challenge i made

↑, ↓, →, →

Hint:
It use tab to work :)

#

DM for more clue or straight up a answer

thorn obsidian
#

Well, it selects your message, but other than that, nothing

pastel rapids
#

Its a alphabet challenge

thorn obsidian
#

?

lapis radish
lapis radish
dusk cedar
#

Well it's a specific field focused on implementing legal and ethical privacy requirements into software development

#

I am wondering if anyone works in that field and knows more about the type of work it entails exactly

#

As I am interested in that direction since I have a background in privacy law

lapis radish
dusk cedar
glossy tundra
#

oh, what a surprise

north elbow
#

can someone help me decrypt something
It's a message I did 2 years ago and I forgot how to decrypt it

gleaming coral
#

no unfortunately no one can magically read what the message was if you dont provide it

trim ember
#

so we can help you out by decrypting

lapis radish
sharp zephyr
#

I'm fooling around with some reverse engineering tools like ghidra and ida at the moment and I'm wondering how you would "hide" a string? For example if I have a secret api key thats part of a compiled .exe that I give out to other people, how can I prevent them from reading the api key from the executable?

last ivy
#

or dump the entire memory of a process

sharp zephyr
#

Hmm I see, but there are probably other situations where hiding a string would help, is there any way to do this?

honest geyser
thorn obsidian
#

what

lapis radish
woven gazelle
last ivy
#

Yes. If the program is running on the user's hardware, they can figure out what it's doing.

sharp zephyr
#

Yeah I got it, it's never secure when the key is transmitted over the internet anyway, but I'm talking about a fictive use case where the key is only used within the application. Is there any way to at least make it harder for an attacker to find it?

lapis radish
wet star
#

um help

#

how do I kill a python process in the terminal in kali linux?

#

I ran a file, and now can't get out of it without closing the terminal

#

and I don't want to reopen terminal alot of times for testing my code

sharp zephyr
#

Does Ctrl+C not work?

wet star
#

no it doesn't

#

I think it's because of the connection

#

is there any way I can fix it?

#

I don't really want to scan 500 ports now

lapis radish
wet star
#

umm how do you do that?

lapis radish
#

Type htop in terminal, find process and then press F9, select SIGTERM and kill with Enter

wet star
#

it doesn't work

lapis radish
#

First of all, install htop

#

Secondly, I think it's not related to channel's topic

#

!rule 7

past starBOT
#
Rules

7. Keep discussions relevant to the channel topic. Each channel's description tells you the topic.

wet star
#

oh yes

vital pier
#

Errrr... Is it a super big pain in the booty to create a VPN? I'm honestly not quite sure... It sounds like it could, but to be perfectly honest i don't know. I dont have money to buy one and honestly i dont know if just downloading free ones would be better or making my own

quasi steppe
vital pier
quasi steppe
vital pier
quasi steppe
vital pier
vagrant mist
#

not many VPNs like that at the moment

vital pier
vagrant mist
#

it's hard to generate profit the usual free usage methods, advertisements aren't particularly easy to implement, and selling data would defeat the purpose of a VPN (admittedly they probably don't care about that, but if it became public they would probably go out of business)

hollow turret
#

hi

fluid scarab
#

Hello. I'm impleneting jwt using the jose-jwt library. In my API I have two endpoints:

/login
<credentials>
(validate credentials)
return access_token: token, refresh_token: token

/refresh
<refresh_token>
(validate refresh_token)
return access_token: token

lets say user-A logins and gets a refresh token and access token. Then his refresh token gets leaked somehow and user-B generates an another access_token via the /refresh endpoint, now there would be two access tokens. Is there a way to make the first access token not usable any longer? I found a way to make the second one not usable but that means that even user-A cant generate a new one after a session, which is not right.
Ideally the refresh token would also reset, causing all users to authorize themselves again.

topaz heron
#

how can i find md5 hashes for a dictionary file i have made with random phrases and words

glossy tundra
#

what discord.cpp:111 means?

fluid verge
#

line 111 of file discord.cpp, I suppose?

glossy tundra
#

and after that JS Console

fluid verge
#

are you sure it's relevant to this channel's topic?

glossy tundra
#

no, I don't know what it is

fluid verge
#

Well, the JS Console is a Javascript console... like a Python console/REPL

glossy tundra
#

so DIscord it's running from two different sources?

#

or the cpp code it's passing to the JS console

fluid verge
#

there's probably a couple or more languages used to make Discord run indeed

ashen pine
#

Hi I have a class project of 3-4 months that should focus on a specific field in cs and do a deep research about it. I am really interested in 'data security' encryption types ans so on... if any of you have a good project idea with somewhat of a wow factor it would be greatly appreciated!(I'm quite fluent in python and cpp).

fluid verge
#

implementing cryptographic primitives can be somewhat interesting, especially when following a standard. So if you want to go that way, implementing correctly something like AES, RSA, SHA-2, maybe even SHA-3 if you have time, is at least interesting, but (except SHA-3) not does not have that much of a wow factor

#

Implementing AES efficiently with several block encryption modes is not easy, testing it correctly is hard (especially if you try to implement it securely)

ashen pine
#

yeah I agree that to study the math of the encryption algos is quite fun I researched about the math behind RSA cause it's quite simple, I thought about implementing a tor messaging app which has somewhat of a wow factor to it

fluid verge
#

If you use encryption libraries for your school project, you are somewhat doing it wrong, sadly. The problem is that you'd need to implement (corectly) all the relevant algorithms beforehand to use the same algorithms in a library for your project, just to ensure that you've done it correctly. And Elliptic Curve Cryptography is not an easy thing to use (and it's pretty much everywhere in key exchanges)

ashen pine
#

gotcha thx for the info

vital pier
lapis radish
lapis radish
olive iron
#

What’s the best library for encryption/decryption?

fading hemlock
olive iron
#

Does it have the key thingy?

fading hemlock
#

what key

olive iron
#

So I can decrypt things using a key.

#

Kinda like a password.

fading hemlock
#

Yes you can give it a password and it decrypts it for you

olive iron
#

I see. Thank you!

lapis radish
lapis radish
fading hemlock
#

Whatever

lapis radish
lapis radish
#

There is big difference between ciphers and hash functions

fluid verge
#

they'd just need to find the encryption key and the deed is done

olive iron
restive prairie
tall kite
olive iron
#

Fick.

tall kite
#

The key/password is 9 by the way everyone! So whoever said just know the key and you are set goodluck xd

olive iron
#

I don’t know what to do with it

fluid verge
#

depends what the algorithm is. I won't try to reverse that, while an attacker would (and that's the difference between an attacker and some random person in the internet)

tall kite
#

Yes but to try reverse it you would need to know the algorithm I used and how it is implemented.

#

Before you could bruteforce the key/use other attack methods.

fluid verge
#

you only need to brute-force algorithms and wait until you get an English word or sentence

tall kite
#

By that logic your answer would be every possible English sentence that fits within the length of that ciphertext.

#

Unless you are saying once you know the algorithm, in which case you are agreeing with me.

#

Well algorithm and implementation*

fluid verge
#

if you know the algorithm and the key, you immediately get the plaintext

tall kite
#

I mean replace immediately with can and you are correct. Though no one disagreed with that...

fluid verge
#

if you know the key, just brute-force usual algorithms before trying exotic ones

tall kite
#

If we don't consider implementation, sure.

lapis radish
#

However I am not sure what them do in details, I only heard about them

fluid verge
lapis radish
fluid verge
lapis radish
#

Like Enigma? pithink

fluid verge
#

that would be a cryptanalysis challenge rather than a black-box challenge

#

With black-box analysis, you have a device that does an encryption, and you can record pretty much everything about the behaviour of the device. You can record a power trace, an electromagnetic trace, analyse each layer of the device's main silicon chip, glitch it to see what happens, etc.

#

from what you get, you can reverse the encryption algorithm and maybe find the key from other identical devices

lapis radish
#

👍

fluid verge
#

The most common analysis is grey-box analysis: you have some information about the device's behaviour, maybe you have the algorithm, maybe parts of the protection, things like that

#

And then you have white-box, where you have everything

#

I am doing an internship at a company that does hardware security evaluations, most commonly grey-box evaluation (including analysis) because clients usually don't want to give details of their code to evaluators (and thus it's not white box), or there is no unsecured version to compare against (thus you can't evaluate the strength of the protections themselves)

lapis radish
thorn obsidian
#

web scraping

spark acorn
#

is it dangerous storing a serialized file containning password hashes in google drive?

lapis radish
#

You should encrypt it for example

spark acorn
#

user inputs: input gets hashed -> salt is added -> serialized into a file

lapis radish
lapis radish
spark acorn
#

hashed

lapis radish
#

Which hash function are you using?

spark acorn
#

whats the difference between encryption and hashes

#

oh

#

is hashing 1 way only

lapis radish
spark acorn
#

gotchu

lapis radish
#

👍

spark acorn
#

doesnt that mean that if there is a popular encryption algorithm it can easily be decrypted by potentioal attackers?

lapis radish
spark acorn
#

o

#

so like

#

a different key

#

gives diferent encryption?

lapis radish
#

Yep

#

!e

import cryptography
past starBOT
#

@lapis radish :x: Your eval job has completed with return code 1.

001 | Traceback (most recent call last):
002 |   File "<string>", line 1, in <module>
003 | ModuleNotFoundError: No module named 'cryptography'
lapis radish
#

Sorry, I cannot show it with bot

lapis radish
spark acorn
#

sha156

#

with salt

lapis radish
spark acorn
#

yes

lapis radish
# spark acorn sha156

I think that SHA-2 256 can be not strong enough if you want to store users' passwords pithink All depends on informations which you want to hash

spark acorn
#

well isnt the biggest flaw with hashes rainbowtables?

#

with a lil bit of salt shouldnt I bee good to go?

lapis radish
#

Currently you should focus on taking hash function which performance will be low on GPU and FPGA/ASIC devices

spark acorn
#

im not really that concerned as I am just using it for the codejam submission

remote knot
#

you're most safe if you salt + pepper it

lapis radish
#

For example performance of some hashes on Nvidia GeForce RTX 3080

MD5                        58814.9 MH/s
SHA-1                      18828.4 MH/s
SHA-2 256                   8120.5 MH/s
scrypt (Iterations: 16384)    2450  H/s
bcrypt (Iterations: 32)      77226  H/s
remote knot
#

pepper eliminates offline guessing

#

https://www.youtube.com/watch?v=FvstbO787Qo @lapis radish @spark acorn this goes over it pretty quickly and accurately

YouTube
mCoding
Salt, pepper, and hash. A cryptographer's breakfast.

Try Hostinger: https://hostinger.com/mcoding
Use coupon code MCODING at checkout for up to 91% off all yearly hosting plans!

Thanks to Hostinger for sponsoring this video!

IN THIS VIDEO...

Your password database just leaked. What info does the hacker get and what can they do with it if you us...

▶ Play video
spark acorn
remote knot
#

then you're good to go imo :)

spark acorn
#

ok ty

lapis radish
remote knot
#

the point of the pepper is to store it differently than a salt

#

in an ideal scenario, the attacker would never even have access to your user/password hashes

#

in addition to that, you'd implement hash/salt/pepper

#

in case of an employee gone mad, for example

lapis radish
lapis radish
remote knot
#

I'd say all 3 are important

waxen pagoda
#

how python can help in ethical hacking

#

I am new in hacking world

#

and someone said learn python first

lapis radish
agile maple
#

Hey guys can anyone tell me how can I make a python script that caan encode and decode a image

waxen pagoda
#

can you tell me how I will learn python here

lapis radish
past starBOT
#
Resources

The Resources page on our website contains a list of hand-selected learning resources that we regularly recommend to both beginners and experts.

https://pythondiscord.com/pages/resources
lapis radish
agile maple
#

@lapis radish

lapis radish
#

Expected input and output

agile maple
#

but how

fading plaza
#

what are you encoding to

#

encode just means to convert from one format to another

fast pond
#

Does anyone know how to make a token without accessing a route
For example in my application of two types of user. Client user and admin user. both the client token and the ADM token are able to access all end-points
How do I make the client's token not be authorized in the user's route

proven epoch
#

I'd like to test if my encoding algorithm is strong, how can I do that?

thorn obsidian
thorn obsidian
proven epoch
#

permutations?

thorn obsidian
#

How many possibilties/combinations there are, u have to use a mathematical formula i believe, but with the AES 128 bits, to calculate 2^128 = 3.4028237e+38 permutations, so 3.4028237e+38 possible combinations which for the most powerful computer will take 885 quadrillion years to crack

proven epoch
#

But I get the idea yeah

#

Thanks

thorn obsidian
#

np

proven epoch
#

So I've made an header for my API and because I don't want it to be reverse engineered I encrypted it

b'\x80\x05\x95\xb7\x00\x00\x00\x00\x00\x00\x00}\x94(\x8c\x01p\x94\x8cwN]125xz&5b8xSlok13&w0&63gl3f@$K$2\rO\x08\x03\x15\x10#,\x0fB\x02Fs\x05\x17\\bo(i).b\x13y\x1d\x119\x0b\x03y\x03@$iF\x10\x1dU\x034 \x1fm\x08:xih9;1\x19\x1e\nq\x0c;)x3Xnh]_ZBlB9d(b@4!_n8pn4%@3\x94\x8c\x01m\x94C\x1ctN)\x19\x17H\x02_!\x15\x05\x0e\n\x07v\x054A:.2\x0bUX\x1a\x13\x15p\x94\x8c\x01t\x94\x8c\n1626150368\x94u.'

This is how it look and the key to decode the message is inside the request so, everything to decode is here, no need of any key or else

#

And I wanted to know if it's possible to break it

lapis radish
#

Encoding =/= encrypting, decoding =/= decrypting

proven epoch
#

Encoding

# 
Encoding:

Purpose: The purpose of encoding is to transform data so that it can be properly (and safely) consumed by a different type of system.

Used for: Maintaining data usability i.e., to ensure that it is able to be properly consumed.

Data Retrieval Mechanism: No key and can be easily reversed provided we know what algorithm was used in encoding.

Algorithms Used: ASCII, Unicode, URL Encoding, Base64.

Example: Binary data being sent over email, or viewing special characters on a web page.

Encryption:

Purpose: The purpose of encryption is to transform data in order to keep it secret from others.

Used for: Maintaining data confidentiality i.e., to ensure the data cannot be consumed by anyone other than the intended recipient(s).

Data Retrieval Mechanism: Original data can be obtained if we know the key and encryption algorithm used.

Algorithms Used: AES, Blowfish, RSA.

Example: Sending someone a secret letter that only they should be able to read, or securely sending a password over the Internet.
#

Since the key to decode is in the message...

lapis radish
#

I cannot find trait such as "being secure" in case of encoding pithink

proven epoch
#

Hmmm

proven epoch
lapis radish
proven epoch
#

Yeah, this was the purpose

#

I'm lost 😅

#

Sorry

#

Wait, this is dumps with pickle

#

gimme a sec

# 
{'p': 'N]125xz&5b8xSlok13&w0&63gl3f@$K$2\rO\x08\x03\x15\x10#,\x0fB\x02Fs\x05\x17\\bo(i).b\x13y\x1d\x119\x0b\x03y\x03@$iF\x10\x1dU\x034 \x1fm\x08:xih9;1\x19\x1e\nq\x0c;)x3Xnh]_ZBlB9d(b@4!_n8pn4%@3', 'm': b'tN)\x19\x17H\x02_!\x15\x05\x0e\n\x07v\x054A:.2\x0bUX\x1a\x13\x15p', 't': '1626150368'}
#

this is how the header look normaly

fading plaza
#

wait if the key is within the request thats easily decrypted

#

unless you're rolling your own or something

#

which is also bad

proven epoch
#

Try to decrypt the message

fading plaza
#

well i can't without any context

#

i dont even know what the key is

#

(which can be easily obtained if an attacker monitors the network)

#

why do you want to prevent someone from reverse engineering your api anyways

#

it should be properly protected with authentication

proven epoch
fading plaza
#

im not exactly sure what the encryption is supposed to accomplish

#

because https is already a thing

proven epoch
fading plaza
#

???

proven epoch
#

charles proxy

fading plaza
#

xd thats a client side thing

proven epoch
#

Ahhh

#

You talk server sided xD

#

Okk

fading plaza
#

your attacker already has access to the client side code, they can read the messages after the client decrypts it anyways

proven epoch
#

Yeah, but the client sided is compiled/protected like a normal "good" software

#

I just want that if the request is catch by someone else, it won't be decoded and cannot be read

fading plaza
#

https already prevents that

proven epoch
#

Ok

proven epoch
#

Never mind, thanks guys for your answers, I guess I'll have to do more research on the subject x)

waxen pagoda
thorn obsidian
#

np

woven gazelle
somber temple
#

Hello everyone,
Quick question - If I wanted to safely install Kali Linux on my Windows laptop, is the best way to do it to use vmware? I'm not planning on becoming a cybersec expert, just want to get familiar with the tools. So preferably I'd have something I can easily uninstall/delete after

proven epoch
somber temple
glossy tundra
#

it's all nmap scripts and google posting

coarse edge
#

.

torpid coral
#

We are not going to help you with cracking programs.

#

!rule 5

past starBOT
#
Rules

5. Do not provide or request help on projects that may break laws, breach terms of services, or are malicious or inappropriate.

torpid coral
#

@high kettle and please do not spam your messages across multiple channels. It's annoying

high kettle
#

sorry

#

can you guys help me

#

if you know

high kettle
torpid coral
high kettle
#

can we talk

#

in dms?

weary cobalt
#

you

#

basically python used for exploits

weary cobalt
#

NES

waxen pagoda
drowsy stratus
mint agate
#

Hello, does anybody here know how to pen test?

#

if so can you teach me?

lapis radish
mint agate
#

a website

lapis radish
#

Yours?

#

!rule 5

past starBOT
#
Rules

5. Do not provide or request help on projects that may break laws, breach terms of services, or are malicious or inappropriate.

fluid verge
#

If it's not yours, you really need to provide a proof of having the owner's permission

mint agate
#

here is my situation

#

i have been given creative liberty to test a webstite

#

i am to record its flaws and provide suggestions

#

this includes security

#

however i do not know how to test the security

#

so here is my question, can i be provided help, or does this breach the server's rules

#

?

fluid verge
#

Assuming the owner's permission extends to any you would employ to help you, you cannot ask for this to be a paid job (because of the server's rules), but that obviously needs paying (because pentesting a whole application is a full-on job)

#

!rule 9

past starBOT
#
Rules

9. Do not offer or ask for paid work of any kind.

fluid verge
#

this for reference

mint agate
#

oh

fluid verge
#

If the owner's consent does not extend to someone you'd ask for help (and you really need to ask them before giving someone access to your application), then that's also against the server's rules

#

!rule 5

mint agate
#

but i am not asking to employ someone

past starBOT
#
Rules

5. Do not provide or request help on projects that may break laws, breach terms of services, or are malicious or inappropriate.

mint agate
#

i am asking to be taught

#

so then what is to be made of my situation

fluid verge
#

However, pentesting is difficult (I have a colleague that is learning to pentest, and it's going to take months for him to get good at it). I'm not sure you can learn within the given deadlines.
I'd recommend watching the LiveOverflow Youtube channel. I think for a web app, you probably want to start with his "Web Hacking" playlist (link to the first video in the playlist here: https://www.youtube.com/watch?v=jmgsgjPn1vs&list=PLhixgUqwRTjx2BmNF5-GddyqZcizwLLGP)
I'm not a pentester, and I can't really judge his content's usefulness for future pentesters, but I think you'll get the basics with those, though maybe a little late (depending on you deadlines)

YouTube
LiveOverflow
HTML + CSS + JavaScript introduction - web 0x00

Before we get into security stuff we have to talk a little bit about the basics of web development. A very fast introduction to HTML, CSS and JavaScript.

-=[ 🔴 Stuff I use ]=-

→ Microphone:* https://geni.us/ntg3b
→ Graphics tablet:* https://geni.us/wacom-intuos
→ Camera#1 for streaming:* https://geni.us/sony-camera
→ Lens for streaming:* https...

▶ Play video
mint agate
#

Thank you B)

#

Your help is well appreciated

weary cobalt
fluid verge
weary cobalt
lapis radish
weary cobalt
#

Best os for pentesting

lapis radish
#

Kali Linux is only the set of tools

weary cobalt
#

Not the best but you got it

lapis radish
#

If you don't know how to use them then it's useless

weary cobalt
#

Paid

#

Im us8ng phone rn

fluid verge
#

You need to first be comfortable with Linux to use Kali, so... that's probably not a good idea to say that to a beginner

weary cobalt
fluid verge
weary cobalt
mint agate
#

How does Juridsiction come into play here?

#

i live in canada, should i be concerned

drowsy stratus
weary cobalt
fluid verge
# mint agate How does Juridsiction come into play here?

there may be laws in place in certain countries that straight out prohibit fraudulent access (e.g. not using it properly and getting into the whole database, or getting access to a private website without access codes) if you are not the owner of the web app. I am reasonably sure Canada is not one of them. I am not a lawyer and this is not legal advice. If in doubt, check with a lawyer.

mint agate
#

Understood, thank you for your assistance it is greatly appreciated, best of luck - Ron Swanson

cerulean sphinx
#

Youtube

bleak ravine
#

If I have a super complicated encryption system and people don't have the correct key it will take them very long to know the key right?
If I have a super complicated encryption system and people don't have the correct key it will take them very long to know the encrypted message right?

vagrant mist
fickle siren
#

You dont need the subscription

#

Beginneres level is almost free

#

From using linux , recon, enumeration, exploitation

#

You ll learn the basics

#

And play some begginer level ctf there

#

See up the writeups and have some experience on how and when to use the tools

#

But to advance from beginner to intermediate , it ll take some time

#

And fun part, tryhackme provides linux machine simulation

#

You dont need to install linux if u dont have one

lapis radish
#

What do you want to learn?

#

"How to start in security?" is similar to "How to learn math?" - it depends what do you want to learn

lapis radish
somber temple
#

The security channel seems kind of separate from Python. How do these two relate?

lapis radish
#

Theoretically when you have x bits of security attacker needs to check 2^(x - 1) possible keys to find the right one as far as I know

lapis radish
thorn obsidian
#

I'm new with ethical hacking with Python

#

And can someone help my to start?

tall kite
#

Can these questions get any more vague?

#

I mean at least make.it interesting, ask how you can do blockchain AI Flask website security with triple stripped delta standard security passing.

fading plaza
fading plaza
crude dagger
#

You know when u want to see a password stored in my google account it triggers this window right. Is there some sort of way i can trigger this window through python using some api so i can verify the user.

unknown.png
tall kite
tall kite
quasi steppe
thorn obsidian
#

Hello I am trying to encrypt AES Key using RSA and whenever I pass the AES key in the RSA.encryption menthod it doesn't freaking work

fading plaza
sonic drum
#

Pretty sure you can access the API with ctypes, ctypes is already builtin

real light
#

I'd like to pentest my raspberry Pi, but I don't know how to start.

foggy skiff
#

hi
can you help me check the code and see if its open source and no one can steal my informations when I use this

sonic drum
#

Don't run anything you can't read

foggy skiff
#

yep I didn't run it

#

thats why I wanted you guys to help me check

#

I don't know the codes

smoky hollow
spiral dagger
#

Hello

remote knot
#

Pycryptodome seems to be the standard for cryptography

north rover
last ivy
north rover
#

i also ask myself that question regularly

past starBOT
#

@gritty harbor Please don't try to ping @everyone or @here. Your message has been removed. If you believe this was a mistake, please let staff know!

zinc ridge
#

I’m a n00b at security and so far I’m using JWT tokens to secure my API. Can we use CRSF tokens to secure APIs or do these tokens have nothing to do?