#cybersecurity

7 messages · Page 44 of 1

hallow vortex
#

in this scenario, does the verifier know the password?

#

wikipedia worded it weird so im not sure

hallow vortex
#

in my case, i want only the prover to know the password

#

but that seems pretty complicated

deft flare
deft flare
#

The Wikipedia explains the difference between ZKPP and zero knowledge proof

hallow vortex
thorn obsidian
#

anyone have any complicated mathematic problems in python that return the number 1

honest minnow
#

hey what vulnerability could it bring for my website password field to not have a lenght maximum when registering an account

deft flare
#

Or it could lead to it

honest minnow
#

ty

deft flare
#

np

woven gazelle
#

i mean

#

not really

deft flare
#

I’ve seen a few vulnerabilities like this, it definitely could lead to a DDoS.

thorn obsidian
#

Anyone here want a lesson on 802.11 packet injection right now?

keen minnow
#

@thorn obsidian yess

gentle salmon
#

Hey guys I wanted to ask, how difficult is it to make this encryption algo into code?

sour wind
#

Hi! just wondering if anybody knows of a cool list of cyber projects to write in Python? I'm a total noob and I'm still learning!

thorn obsidian
#

ofc all for educational purposes and dont use that on people lol

#

only on you

shy olive
#

Epik#0168

#

Hi

deft flare
fading plaza
deft flare
#

I mean if he’s a beginner than yeah, you’ll learn some socket programming in the process

#

And intrusion detection system would be better, something similar to snort

#

I’ve coded a few tools for bug bounty like a directory bruteforcer, a crawler, a tool that can manipulate headers and etc..

thorn obsidian
#

@sour wind Learning network is a very beneficial thing.

#

Like @deft flare mentioned, an IDS is a very good approach as far as "harder to do". A library like scapy can easily make an IDS.

deft flare
thorn obsidian
#

I love being able to tear apart a packet in scapy.

deft flare
#

You always talk about scapy lol

thorn obsidian
#

Yep.

#

It's that powerful. Almost like a dash of LSD mixed in with redbull and a couple steroids.

#

802.11 is unique in itself. Leverage something like scapy and you can see like you were superman, xray vision and all. It's an awesome technique for CVE reverse engineering, etc.

#

As an example, IDS work. I wrote my own IDS using scapy and the UDP logs already being fed to our SIEM.

#

It keeps up with "enterprise" level traffic, etc.

#

I just wish I could get the timing right to spark a discussion on how to do X with a tool like scapy. Love teaching it.

lusty flare
#

patch your shit.

#

local priv esc, no RCE angle.

devout sonnet
#

Try base64 encoding, it's more like to be encoded than encrypted

shut apex
#

Hello, I've always wanted to get into cybersecurity tho I don't know if python is a good language for that or any other things like what type of skillset I have to ahve to even begin this journey.

livid laurel
#

Howdy, I'm wondering if there's anyone here that works with django who could answer some questions about secrets. Currently I'm testing a django project with a docker container, and I've been putting my secrets in a git ignored file, for it to draw from.

However when services like travis-ci or, if I deployed this to AWS or something, this file wouldn't exist on the repository, how would I pass my secrets when I can't use this file reference method I'm using locally? Or is there a way to implement that I don't know about?

My 3 hunches of methods were:

  • Maybe have a seperate private github repo and somehow pull the key data from there
  • Insert the key as an environmental variable for docker/travis-ci(though in those .yaml files the data is just as exposed)
  • Make a django project that has all my keys in it, and have my other project perform a get request to get the secrets. I feel like for a big team this would be the way(though where do you store that project's secrets...) but it might be thinking too much about it for just me. There's got to be something I'm overlooking. Thanks.

If you have anything to say on this matter, I'd really appreciate hearing about it. Thanks for your time.

cerulean stag
#

could someone help me find resources for hacking most of those i find are security and prevention against hacking but that's clearly not what i want

torn basalt
#

Does anyone know if a rubber ducky attack will fail if the user has an alternate keyboard layout? Mostly asking out of curiosity since I use an alternate keyboard layout 😂

past starBOT
distant vessel
#

thats very good encrypted isnt it?

fading plaza
jade rover
#

I want to start to learn cyber security on my own. What would you recommend to learn, which books to buy etc.? So far i am good in python and shell scripting and maths...

livid laurel
#

Does anyone here know how the Azure Key Vault service functions? Not about how to set one up I just mean how are they keeping their secrets?

deft flare
deft flare
deft lagoon
#

I'm a noobie with this python shtuff and was if I could make anything kinda cyber-sec related but didn't know where to start, any pointers?

shut apex
deft flare
deft lagoon
#

looks like someone beat me to my own question

deft flare
#

The Hacker Playbook 2 & 3 are pretty good as well

lusty flare
#

because there's a patch.

deft flare
undone pewter
#

some help

2022-01-28_11-47-19.png
#

File "/usr/lib/python3/dist-packages/PyInstaller/building/build_main.py", line 243, in init
self.postinit()
File "/usr/lib/python3/dist-packages/PyInstaller/building/datastruct.py", line 158, in postinit
self.assemble()
File "/usr/lib/python3/dist-packages/PyInstaller/building/build_main.py", line 575, in assemble
self._check_python_library(self.binaries)
File "/usr/lib/python3/dist-packages/PyInstaller/building/build_main.py", line 666, in _check_python_library
python_lib = bindepend.get_python_library_path()
File "/usr/lib/python3/dist-packages/PyInstaller/depend/bindepend.py", line 914, in get_python_library_path
python_libname = findLibrary(name)
File "/usr/lib/python3/dist-packages/PyInstaller/depend/bindepend.py", line 778, in findLibrary
utils.load_ldconfig_cache()
File "/usr/lib/python3/dist-packages/PyInstaller/depend/utils.py", line 375, in load_ldconfig_cache
path = m.groups()[-1]
AttributeError: 'NoneType' object has no attribute 'groups'

feral hare
#

hey, how can we store a session's infos in a python desktop app (windows) like that when you re-open the app it automatically log you on your session?

deft flare
#

or have it fetch it from some where more secure

#

like a databse or something

feral hare
#

I already have it in a json file

#

But the problem is that it's in plain text so anyone can just change the ids and log to any account

deft flare
feral hare
#

Like how?

#

Do i encrypt the json file?

#

Or just the values in it?

feral hare
deft flare
#

with a private key if you use asymmetric encription

feral hare
#

And the key where do i store it?

shut apex
#

anyone knows any good VMs?

honest minnow
#

hey

#

anyone knows of a python script that checks if a list of subdomains is alive or dead (200 or no response)

hushed wagon
#

a questionn guys ,

#

The following message contains the email address to contact us. It has been encrypted using
XOR and put in base64. Retrieve the plaintext content, and follow the instructions.
Tip: the resolution of challenges 1 to 6 of http://cryptopals.com/sets/1 will be useful.

NwMDXGRwQB0wcB1MHBw0PHFMVGhkLUFExAAAUwcCxYXFgUaFlNEVSkXBRwcEBZZBRwRBwlZM
CVFBhkLUxD0KAR4cUxIBBwkKABAZFGA0QH1MBEEEaGxIXDA4dFl4AEG0EKEAoJGQ05EAoHEB4OE
gcGHUIfAV9FFA8aHB4VFAsXsNpFERlZEBwBEEwIBhZFAFwMMAFMEAwkDUwYRHAAQZALDMVRw
WBgFFGg4NFh0MB0waFlMIEB8KEhQAW0Fw3HAYWVRoWBgBFBwkaHB0RFA8NFgEZKGx9ZFxILBk
wVFgBFBQDAMAFMHBwkfADFMBtsUVEhoWVQ0PFhBFAAIcUwMXGhDwWABoRHAMXUxcAVR4cHRc
AD0EPHCAYWWw==

#

what to do after reverse basing64?

deft flare
deft flare
honest minnow
deft flare
honest minnow
#

yeah looking at it rn

deft flare
#

np

#

It doesn’t have any threading or multiprocessing so httprobe is probably better and faster lol

#

It gives you the IP address for the domains as well

deft flare
honest minnow
#

ill try both

deft flare
#

Might have bugs, I haven’t updated it in a year lol

#

I have too many projects

shut apex
feral hare
#

I use it when i log in

#

To verify the connection with a hashed password

#

But i want to do a "don't forget me" button that when activated it automatically log me in my account when i start the app next time

weak shale
#

Does anyone use scapy?

#

when i do "sniff(iface="eth0", count=5)" in the scapy cli i get this error....

OSError: b'eth0: No such device exists (No such device exists)'```
fading plaza
#

to get a list of all of them, ip link show in command line for linux

weak shale
fading plaza
summer mason
weak shale
#

so i should do iface="Wi-Fi"?

fading plaza
#

yea

fallow prairie
#

guys does the instashell work?

weak shale
# fading plaza yea

i was checking an article of realpython abt scapy and i changed sniff(filter="port 80", prn=process_packet, iface=eth0, store=False) to iface=Wi-Fi and got this error
@fading plaza

unknown.png
#

it worked in the cli though

honest minnow
#

Could anyone please explain me what does this part of an HTTP header does :

X-Original-URL: /e08f3mfu6x?e08f3mfu6x=1
X-Rewrite-URL: /e08f3mfu6x?e08f3mfu6x=1

livid thicket
#

e

fallow prairie
chrome ember
#

Hi there, anyone willing to help me a bit with AnonymousUser permissions? 😄 I'm lost and the deadline is getting shorter

#

Problem is I have to use the User model

#

Due to GraphQL right?

deft flare
honest minnow
stone pond
#

@deft flare hi brother, i need some help regarding a project. i want to build a project which uses face as a key so when u move away from a pc it autolocks the computer.

fallow prairie
#

does anyone know about instashell guys?

fallow prairie
deft flare
deft flare
#

and if you're looking for virtual machines to hack into, try vulnhub.com , they have a whole bunch of ctf machines you can try.

#

if you're not into CTF, try DVWA or metasploitable.

shut apex
#

Aight ty. I tried somewhat of a ctf, but i juat have no knowledge of hacking n cybersecurity, i tried looking on youtube google but everyone says different skillsets n stuff. I looked into cryptology but i didnt have enough time to get deeper. Im not sure what to learn and learning everything seems a little too hard.

deft flare
shut apex
#

Okay tysm

simple silo
#

I have a log file which it has a line of report which a module try to run this python code:

python -c 'import crypt; print crypt.crypt("bmp","$5$n0Gdq6e8")'

why a linux module try to use this code? is it suspicious?

thorn obsidian
#

this function just produces a hash

#

of the word "bmp"

#

you can look up hashing online, its easy, but the general idea is, you take a word such as "bmp", pass it through the function and as the output you get a random string of characters, a gibberish

#

but that gibberish is a signature of this word, and you cant reverse the process, so you cant get the original word from the gibberish, this is mostly used for storing passwords (we store hashes of passwords instead of actual passwords)

honest minnow
#

hey guys from yall personal experiences do you prefer parrotOS or kali linux as an installation on a VM

deft flare
honest minnow
#

probably to dual boot tho

#

with windows

red cairn
#

I need to store and use multiple SMTP credentials, so how should I go about securely storing passwords in a way that I can decode them?

honest minnow
#

i guess you could hash and salt them and store them in a sqlite db

red cairn
#

How do I decode them later?

honest minnow
#

ah

#

use a encryption key

#

you later decrypt with the key

honest minnow
red cairn
#

I thought about that or using something like RSA

winged totem
#

Maybe I’m stupid but one thing I’ve been rly confused on is how two parties are able to encrypt and decrypt a message without the decryption key being intercepted. I tried to read about public and private keys, but I don’t understand how the keys are communicated between the parties / how the keys are established or set

red cairn
# winged totem Maybe I’m stupid but one thing I’ve been rly confused on is how two parties are ...

In asymmetric encryption you generate two keys - a public one which you can give anyone, and a private one which you must keep to yourself. Data can be encrypted using the public key, but it can only be decripted with the private key which is again kept secret. If you want, for example, exchange messages with someone, both of you will have to generate a pair of keys. You'll encrypt your message with your friend's public key, and decrypt the messages they send to you with your own private key

winged totem
#

So in total are there two public keys and two private keys?

red cairn
#

In this example, yes

winged totem
#

I have a public and private key and my friend has the same?

#

Ok

#

Makes sense lmao maybe I just needed to read it in simpler terms

#

Thank you

red cairn
#

👍

#

The public key works like a lock, and the private key is, well, the key

distant vessel
#

is it technicly possible to make a spyware for ios with python?

analog fulcrum
#

Technically but I would not recommend it you could get in trouble.

thorn obsidian
#

Anyone interested in participating in a network CTF?

twin acorn
#

yes, me

#

@thorn obsidian YES,ME

#

@thorn obsidian you are here

tight scroll
#

Hi guys, Django beginner here. I want to salt and hash my password but I don't know how to compare a password that was input from the frontend against the salted password stored in the DB?

honest minnow
past starBOT
#
Rules

5. Do not provide or request help on projects that may break laws, breach terms of services, or are malicious or inappropriate.

tight scroll
#

I understand that we send a post request but how do I compare the plaintext string in the request with the hashed password in the backend?

honest minnow
tight scroll
warm owl
#

can i change system settings even without actiaved windows license? i was going to use kali linux, but somehow i get error when i activate windows support for linux systems

deft flare
#

Are you talking about WSL?

gusty rapids
#

!e

a = "a"

while a = "a":
print("1")

honest minnow
zenith dagger
#

anyobody has scripting experience here

#

I want to make a script that runs skipfish and stores the output file in my local machine

smoky turtle
#

As far as i understood you can use the subprocess module and then run skipfish using the subprocess.run(['skipfish','parameters','go','here',])

#

Skipfish accepts an -o flag so u can use tht so save the output

cobalt hinge
#

Hi all! Would it be suggested that I make my own password manager using python? And what are its drawbacks if I do make it? Compared to a let’s say a free version ??

smoky turtle
#

If its to learn then go ahead. But if you want to use a good password manager look into bitwarden. Its open source and free

zenith dagger
zenith dagger
#

Just a quick question
I wasn't able to get any stdout on my terminal after running my python script even though I did stdout=subprocess.PIPE and the skipfish report was also fine but no output on my terminal

smoky turtle
#

I havent used the subprocess module in a while so i ll have to look but if i remember correctly the stdout is stored in an attribute of the created object and tht you just have to print that attribute

#

@zenith dagger its object.stdout

#

but its a bytes object so u can do a print(object.stdout.decode()) to get clean output

zenith dagger
#

But not for skipfish

smoky turtle
#

@zenith dagger can u share the subprocess.run command you are executing?

thorn obsidian
#

I've been hearing recently about "image loggers" which are pretty scary. I saw this one video and it could be fake but it got me thinking about all of this. Supposedly they can remotely execute code on your pc, with you only clicking an image. I don't know if it's fake to just scam people. But if it's real, how would that work and how can I avoid it?

fading plaza
#

should be fine if you keep updated to latest and be aware of related news

thorn obsidian
acoustic lynx
cobalt hinge
zenith dagger
thorn obsidian
#

ty for telling 😄

quaint bear
#

e!

#

Dead

fluid dragon
#

how is python good for hacking

vagrant mist
eager void
# 
import random

c = int(input("How many characters do you want?"))
i = 0
l = ["1", "2", "3", "4", "5", "6", "7", "8", "9", "0"
                                                  "a", "b", "c", "d", "e", "f", "g", "h", "i", "j", 'k', "l", "m", "n",
     "o", "p", "q", "r", "s", "t", "u", "v", "w", "x", "y", "z"]
with open("password.txt", "r") as f:
    z = (len(f.readlines()))
if z > 0:
    f = open("password.txt", 'r+')
    f.truncate(0)
while i < c:
    l1 = (random.choice(l))
    f = open("password.txt", "a")
    f.write(l1)
    f.close()
    i = i + 1
x = open("password.txt", "r")
s = (x.read())
print("your password is", s)
#

password generator

thorn obsidian
#

would you like me to give feedback?

eager void
#

yup

thorn obsidian
#

sure

eager void
#

you need a file named password.txt

fading plaza
# 
import random
import string
c = int(input("How many characters do you want?"))
pwd = "".join(random.choices(string.ascii_lowercase + string.digits, k=c))
with open("password.txt", "w") as f:
  f.write(pwd)
print("your password is", pwd)
#

is all you need

thorn obsidian
# eager void ```py import random c = int(input("How many characters do you want?")) i = 0 l ...

so first of all, the random module is not cryptographically secure, see https://security.stackexchange.com/questions/242492/is-pythons-secrets-module-using-the-same-code-as-the-random-module

You might want to use the secrets module, its an in-built module in python, see https://docs.python.org/3/library/secrets.html

Second of all, instead of truncating the file, then opening it in a mode, a lot of code can be eliminated by just doing

open("password.txt","w").write(password)

Then, it creates a new file if there is not an existing password file.

Also, manually writing all the characters l you can do:

import string
l = string.ascii_letters + string.digits + string.punctuation
fading plaza
#

open("password.txt","w").write(password)
-1, use with instead

eager void
#

ok

#

will take that into account

#

thank u

proven perch
#

Hi, does anyone know where I can find a Python implementation of the SHA3 algorithm (in pure python, without C libraries) ? I'm trying to implement it myself using the official NIST documentation but I can't make it work properly and I would like to check my code by comparing it to a working code. Thank you !

honest minnow
proven perch
honest minnow
#

ah

#

sorry

spiral dagger
#

I am interested in python programming

honest minnow
#

most people in here are too 🙂

spiral dagger
#

Cool

#

This password generator does it work as smtp scanner

main bough
#

Hello, does anyone know encode data with a private key and decrypt it with a public key? It would be very much appreciated if you could give me a short and easy code but you could also give me a longer one.

honest minnow
main bough
#

Thanks but it is encrypting the data with the public key and decrypting it with the private one. I need the oposite.

#

Now that i think about it, i could use signatures.

#

To explain what i am doing:

#

I am coding an advanced form of cryptocurrency that need less computing power. I need a way to check if you are the owner of a coin.

#

I was thinking that i could use either a signature function or an encryption function. Sadly, I can't find a way to implement the stuff to my code.

main bough
honest minnow
main bough
#

Ok, but I have already tryed 2 times in the help channels: help-kiwi and help-candy

tawny pagoda
#

my software is reday

charred merlin
#

Hey, i'm Mathis, a middle schooler, so yeah i'm pretty young and i'm trying to learn Python, sooo
Basically, i don't know anything about it, where should I start ? How to learn ?

proven perch
#

Basic tutorials on Youtube are great, that's how I learned the basics

thorn obsidian
#

i started with tutorials on youtube

charred merlin
#

Alright, i'll give it a look, thank you

neat rampart
#

I am designing an account system for a web app I have, and I'm looking to use bcrypt to salt/hash passwords. Is there any way to lock other data and encrypt it such that it can only be decrypted with the salt/hash/something generated from the user's password?

#

As the app owner, I want to have no way to access these tidbits of information except through the user's login.

vagrant mist
neat rampart
#

That's not what I was wanting to do at all. I wanted to use the password or some intermediary data as an encryption/decryption key.

tired dome
tall kite
#

This way you aren't just learning a bunch of coding concepts but you have direction in your learning and can explore how other people did what you want to do.

neat rampart
#

I am developing a chat app and I want to make it such that users' direct messages are encrypted, so that I cannot read them from the database. As of now, my train of thought is that I would generate an RSA keypair for each direct message "room", with the public key stored in it and a copy of the private key stored in the accounts of all users who have access to it. That way, the users could request the data from that room and the server would retrieve it, retrieve the key from the user's account, and fetch & decrypt the requested data.
The fly in my ointment is storing the private keys in user accounts. How can I generate an encryption/decryption key from the user's password? I am already using bcrypt for the salting/hashing for logins, but that's not really helpful here.

charred merlin
tardy forge
#

Question for code obfuscation, can I have a txt file with all the imports, read it, exec() it, and use it in the py file as though I had imported it from the actual code

dense knoll
#

Keep in mind that if you let the users change they passwords you could have problems in the future

midnight bloom
#

I dunno if there's any good python bindings for libsignal though

leaden crater
#

Could make your own?

#

Assuming you have some sort of c/cpp knowledge

#

In theory you could write the wrapper using PyBind11.

neat rampart
#

I don't need it all encrypted end-to-end, I just need to encrypt the data stored on the database

flat bronze
#

you can encrypt anything by public key, but you cannot decrypt

#

and private key can encrypt AND decrypt 😉 (+generating new public keys)

neat rampart
#

Yes, I am aware of asymmetric cryptography. Still doesn't explain how to generate keypairs from passwords, unless I can simply encode the password in utf and use it as a seed for the random number generator, but I doubt that will yield the same primes or anything like that every time

errant yoke
flat bronze
#

I have a goal to generate RSA key pair, that can be used for encryption decryption in a code, and as a SSH private/public pair at the same time

#

I achieved goal to generate RSA key pair, that can encrypt and decrypt

#

I achieved goal to save public key in OpenSSH format (similar to what linux in ssh-keygen generates)

#

I have the problem to save private key in a format compatible to connect the server now %

#

I am working from this example

# 
from Crypto.Cipher import PKCS1_OAEP
from Crypto.PublicKey import RSA
from binascii import hexlify

#The message to be encrypted
message = b'Public and Private keys encryption'

#Generating private key (RsaKey object) of key length of 1024 bits
private_key = RSA.generate(4096)

#Generating the public key (RsaKey object) from the private key
public_key = private_key.publickey()
print(type(private_key), type(public_key))

#Converting the RsaKey objects to string 
private_pem = private_key.export_key().decode()
public_pem = public_key.export_key().decode()
print(type(private_pem), type(public_pem))
#Writing down the private and public keys to 'pem' files
with open('private_pem.pem', 'w') as pr:
    pr.write(private_pem)
with open('public_pem.pem', 'w') as pu:
    pu.write(public_pem)
    
#Importing keys from files, converting it into the RsaKey object   
pr_key = RSA.import_key(open('private_pem.pem', 'r').read())
pu_key = RSA.import_key(open('public_pem.pem', 'r').read())

print(type(pr_key), type(pu_key))
#Instantiating PKCS1_OAEP object with the public key for encryption
cipher = PKCS1_OAEP.new(key=pu_key)
#Encrypting the message with the PKCS1_OAEP object
cipher_text = cipher.encrypt(message)
print(cipher_text)
#Instantiating PKCS1_OAEP object with the private key for decryption
decrypt = PKCS1_OAEP.new(key=pr_key)
#Decrypting the message with the PKCS1_OAEP object
decrypted_message = decrypt.decrypt(cipher_text)
print(decrypted_message)
#

Exported public OpenSSH key with

public_key.export_key("OpenSSH").decode()
#

Question, how to save private key in the way that will work for linux Unubuntu 20.04 default SSH application to connect the server

flat bronze
#

nvm

#

I succeded

#

used answer for python generating ssh key pair from cryptography

#

and used it to be imported as a key for the thing above, with skipping the generation, it worked fine

turbid light
#

is there any more secure way of storing passwords other then

random = 2 digit random number
salt = random 10 chars base 64
pepper = read_secret_from_file()
result = hash(password + salt + pepper + random)

for x in range(1000):
    result = hash(result + salt + pepper + random)
database.insert(f"{result},{salt}")
#

I mean this is still reversable

#

hard to do but it is

#

even more so if we are let's say hashing user names from another platform

#

so there is like only 3000 possible values

turbid light
#

Can you guys ping me if you find out?

fading plaza
#

this just seems like pbkdf2

#

but roll-your-own

#

should still be secure assuming hash isn't something bad, though you should really use something from a trusted library

turbid light
#

the random is just randomly generate number

#

what's not clear about that?

turbid light
#

since it's pretty easily reversable

#

if you have list of possible values

last ivy
#

so it just won't work

#

Just use something battle-tested like bcrypt

turbid light
#

Bcrypt is easily reversible

turbid light
last ivy
last ivy
#

If you have a list of known values, there is no way to make it non-reversible

#

I mean, just logically

turbid light
#

For example secret pepper would make un reversible

last ivy
#

what's preventing you from using a pepper with bcrypt?

turbid light
last ivy
#

wdym?

#

hash will produce different results when you restart the program, so hashes will no longer work

#

!e

print(hash("foo"))
past starBOT
#

@last ivy :white_check_mark: Your eval job has completed with return code 0.

7814480978635085837
last ivy
#

!e

print(hash("foo"))
past starBOT
#

@last ivy :white_check_mark: Your eval job has completed with return code 0.

-1907129312318368269
turbid light
#

On verification you would try all 100 combinations

turbid light
#

I am asking for theoretically unbreakable hash method

#

If even possible which I doubt

turbid light
last ivy
#

A peppered hash isn't really "uncrackable". It is very crackable if you find the pepper.

#

Similarly, storing passwords in plain text is not a vulnerability on its own, if there is mathematical certainty that an attacker can't get hold of the passwords.

turbid light
# last ivy

ok took me longer then I would like to admit but the python script is running

turbid light
last ivy
#

Unless you're parallelizing

turbid light
#

I am

#

24 threads

#

but still it will take some time that's true I don't argue with that

#

I am just saying it is reversible

turbid light
last ivy
turbid light
#

that's my point

#

that's exactly what I mean

#

how do I make it more secure

#

I am glad we are on the same line now

last ivy
#

What are your threat models?

turbid light
#

non

#

I am doing this for my self out of interest 😄

#

I am just student

last ivy
#

Well, you can't make an application abstractly secure 🙂

turbid light
#

Well I just want to be more secure

#

😄

#

then what I have now

#

ok maybe 300 000 was way to much but I am pretty much done

#

it will take 30 minutes

#

but in real word scenario you could limit that number of entries to something like 3 000

#

or order them from lowest to highest chance of success

fading plaza
turbid light
#

that would not work

#

it would generate random hash

fading plaza
#

well you asked for theoretically unbreakable

#

that's your answer

fading plaza
#

not the hash built-in

fluid dragon
#

what can I do with python as far as hacking the local pizza place and getting fr ee piozza deliveries ?

#

What can I do with python as far as hacking the local pizza place and getting free pizza deliveries?

zinc field
#

!rule 5

past starBOT
#
Rules

5. Do not provide or request help on projects that may break laws, breach terms of services, or are malicious or inappropriate.

smoky moat
last ivy
vagrant mist
upbeat monolith
last ivy
#

Step 2.5: go to jail

spice sequoia
#

rofl

light rapids
#

is python good for cryptocurrency? I heard it's no great for security

sharp sparrow
light rapids
#

cool

sharp sparrow
#

yes

#

there are many projects for security aspect too

thorn obsidian
#

it depends: a programming language designed for security is rust.

thorn obsidian
#

Can anyone help me please?

#

How can I check my private browsing history? and how to stop someone who is tracking my history remotely?

last ivy
#

You can't track someone else's history, even if you intercept all their network traffic, as long as they are using HTTPS.

fading plaza
#

and mitm is also possible

last ivy
honest minnow
#

whats the name of this part of a script

quaint token
#

what's the best tool to obfuscate code (free or paid)

fading plaza
#

security by obscurity is bad

neat rampart
#

I just saw one of the best ways to patch social engineering-based security holes! This is what you get when you hit F12 on Discord in a browser (access to console, element inspector, etc):

Screenshot_from_2022-02-14_20-18-52.png
fading plaza
#

will that even work on the target audience of those scams

#

also easily bypassed by javascript: urls

nova hollow
#

is there a way in which i can have users input username & password in the safest way such that I do not have access to it but I can use the username/password into my code?

#

by using I mean; a simple request to a certain API

quaint token
fading plaza
#

what

heady fable
#

Hello!

#

I have a keyring question!

#

Is this the correct place to ask?

tardy forge
#

How good is pyarmor

#

Like any flaws I wanna know what they are

fading plaza
#

there's plenty of methods to deobfuscate it

#

a search on Google turns up quite a few, though I can't vouch for any of them

tardy forge
#

K

thorn obsidian
#

eh

magic narwhal
#

Hi guys I really don't know where to start To learn how to protect python Source code so if I send for example my code to a friend he\she can't change or see my source code ,
I read that cython can convert python code and from there I can decrypt the source code is it true?

magic narwhal
tardy forge
#

Then why sending source code lol?

thorn obsidian
thorn obsidian
#

@thorn obsidian

thorn obsidian
gleaming coral
gleaming coral
#

This is how websites are blocked and censored within isps

tender mesa
#

anyone here

#

help me airecrack-ng

#

showing wlan0 is on channel 1 but AP is on channel 3

craggy copper
#

I'm trying to figure out what I want to do for my senior project. I'm majoring in computer science but have a minor in computer security. I want to do some project with cybersecurity and programming of some sorts. Any of you guys have any ideas for a project?

errant epoch
#

So, I've heard eval is a big baddie when it comes to security, and ast.literal_eval is much better. I'm using literal_eval in my code currently, and I guess it's the best alternative after looking a bit into it, but call me out if I'm wrong!

I get a 2d-list from from a text file written by another program which is already formatted like a python file, literally [[1,2],[3,4]]-style.

What I currently do (basically):

from ast import literal_eval

filepath = "in.txt"
with open(filepath, 'r', encoding="utf8") as text_file:
    text_file_data = text_file.read()

the_list = literal_eval(text_file_data)
craggy copper
fading plaza
mortal perch
#

^ your goal is serialising data to disk, and then deserialising it into memory at a later point. using json works a lot better for this kind of data storage

hushed vessel
#

Does sharing a IDENTITY column number of DB rows in a server response pose a vulnerability?

#

I mean, i query the db based on clients request and provide them also my IDENTITY number to track any changes between the data sent and in the DB

gleaming coral
past starBOT
#
Rules

5. Do not provide or request help on projects that may break laws, breach terms of services, or are malicious or inappropriate.

gleaming coral
# magic narwhal Hi guys I really don't know where to start To learn how to protect python Source...

You can use a packager like pyoxidizer that packges the whole python interpreter to bypass and mitigate the problem that fundamentally python is an interpreted language that can only be converted into bytecode which is also a giant flaw because your packaged binary could be reverse engineered with uncompyle6 and then the memory representation of the code could be unmarshalled.. If you want to know more: https://nedbatchelder.com/blog/200804/the_structure_of_pyc_files.html

The structure of .pyc files

I spent some time digging around in the Python code to understand how .pyc files work. It turns out they are fairly simple, then kind of complex.

gleaming coral
hushed vessel
magic narwhal
thorn obsidian
#

Hey guys I trying to make a login in and username password this is what I've done so far, i can't seem to figure out how to make sure when your asked to enter your password and username the programme checks that the password you've used is correct here's what I've wrote so far

CODE -

import time
print('Welcome to Login V.1')
print('-----------------')
time.sleep(1)
username = input("Enter your username ")
print('-----------------')
time.sleep(2)
password = input("Enter your password ")
print('-----------------')
time.sleep(3)
print("Your username is "+ username)
print('-----------------')
time.sleep(3)
print("Your password is "+ password)
print('-----------------')
time.sleep(3)
print('Please remember these credentials!')
print('-----------------')
time.sleep(3)
print(' --- Login --- ')
print('-----------------')
time.sleep(2)
attempts=0
while attempts<3:
username=input(' please enter your username ')
password=input(' please enter your password ')
if username== '+ password' and password=='correctpassword':
print('you are in!')
else:
attempts+=1
print('incorrect!')
if attempts==3:
print('too many attempts')

pliant cedar
#

You should assign a variable to the username and password and check if they are the same using if statement

thorn obsidian
#

Thankyou!

#

I'm sure this will work right?

#

while userName == userName and password == password: # The Input will always lead to this while loop, so we can see if their username and password is wrong or correct.

#

If I change the variables that's should work?

pliant cedar
#

Is there any error you are getting

thorn obsidian
#

Thank you for help! Yes there is but that's because of the issue here --

#

if username== '+ password' and password=='correctpassword':

#

That's the issue. But I believe I can resolve it :)

#

The code is working fine but when I put the right password and username it says 'you are in!' But... it continuously spams 'you are in!'

import time
print('Welcome to Login V.1')
print('-----------------')
time.sleep(1)
username = input("Enter your username ")
print('-----------------')
time.sleep(2)
password = input("Enter your password ")
print('-----------------')
time.sleep(3)
print("Your username is "+ username)
print('-----------------')
time.sleep(3)
print("Your password is "+ password)
print('-----------------')
time.sleep(3)
print('Please remember these credentials!')
print('-----------------')
time.sleep(3)
print(' --- Login --- ')
print('-----------------')
time.sleep(2)
attempts=0
while attempts<3:
username=input(' please enter your username ')
password=input(' please enter your password ')
while username == username and password == password:
print('you are in!')
else:
attempts+=1
print('incorrect!')
if attempts==3:
print('too many attempts')
print('-----------------')
print('Exiting programme...')
quit(1)

pliant cedar
#

Use break

#

print(“you are in”)
break

thorn obsidian
#

Should I use that instead of quit() ?

#

Thankyou!

pliant cedar
#

It’s optional

#

u can use break or quit

thorn obsidian
#

It's still spams you are in!

pliant cedar
#

import time
print('Welcome to Login V.1')
print('-----------------')
time.sleep(1)
username = input("Enter your username ")
print('-----------------')
time.sleep(2)
password = input("Enter your password ")
print('-----------------')
time.sleep(3)
print("Your username is "+ username)
print('-----------------')
time.sleep(3)
print("Your password is "+ password)
print('-----------------')
time.sleep(3)
print('Please remember these credentials!')
print('-----------------')
time.sleep(3)
print(' --- Login --- ')
print('-----------------')
time.sleep(2)
attempts=0
while attempts<3:
username1 = input(' please enter your username ')
password1 = input(' please enter your password ')
if username == username1 and password == password1:
print('you are in!')
break
else:
attempts+=1
print('incorrect!')
if attempts==3:
print('too many attempts')

#

I tested it, it shouldn’t spam the you are in message

#

send me ur code

thorn obsidian
#

Alright 👍

#

Just sent you it via dm

gleaming coral
broken spruce
#

Can anyone tell me some basic security based project i can do with python?

forest wind
hushed vessel
# gleaming coral In your question you said how you will give the user the id number so that they ...

Ok, let me clarify. Idea is to have a web app in which users can import their bank statements, and have full overview of their transaction history, with dynamic filtering, some summarization and so on. Additionally, they should be able to manually change some details of these transactions, in case bank statements were not complete in information, or if they want to, e.g. categorize these transactions. Till now, I've queried these transactions from DB and provided all the details about transaction to the user, except of transaction ID. Now, when the user can modify few values of transaction, I need a way to recognize which transaction was modified, to subsequently update it in the DB (and for this I want to use transaction ID, but now i have to include it into web response sent to the user)

#

As I am a complete newbie, I've read somewhere that passing ID of records from table to the clients could be a dangerous thing to do, altho I have no idea if this applies to my case. To my feeling, not really.

rapid mountain
rapid mountain
#

Maybe implement a tranaction hash

thorn obsidian
past starBOT
#

@solid agate, looks like you posted a Discord webhook URL. Therefore, your message has been removed, and your webhook has been deleted. You can re-create it if you wish to. If you believe this was a mistake, please let us know.

solid agate
#

aww

#

i wanted to share my virus

#

no harm

fading plaza
west oxide
#

heyy!
i wanna learn cyber security!

#

is anyone here can help me with it?

thorn obsidian
#

Not sure what you need help with.

# 
An FBI report obtained by Newsweek has called on the U.S. private sector to be prepared for potential state-sponsored cyber attacks to be launched by Russia as tensions over Ukraine threaten to spill into an all-out conflict in Eastern Europe.
#

hahahaha

#

The US private sector... prepared... for russian cyber attacks 😆 😂 🤣

broken spruce
smoky turtle
west oxide
smoky turtle
#

Rule no1 in tech. Google it my friend

thorn obsidian
#

:)))

thorn obsidian
dire osprey
#

Whats a good way to start getting into cyber security

#

?

thorn obsidian
#

!rule

past starBOT
#
Rules

The rules and guidelines that apply to this community can be found on our rules page. We expect all members of the community to have read and understood these.

thorn obsidian
#

@dire osprey dm me

stiff mauve
#

Lol💀

tardy forge
#

if a system is attacked by ransomware while a py script is running, and encrypts any file regarding the python language, or c language files etc, will it continue to run on ram?

pallid wedge
#

O_o

raw dome
tardy forge
#

in python yes, but i dont know about source files, aka not the ones i wrote

#

like the actual language

dire osprey
#

Why is Linux the preferred os when it comes to cybersecurity?

shy wren
white ice
# dire osprey Why is Linux the preferred os when it comes to cybersecurity?

I think one of the reasons is the flexibility that Linux gives you in terms of what runs in your system. You can have a barebones install with only minimal packages of even recompile the kernel to remove all the unnecesary modules you wont need for your purpose... You can basically customize any part of a Linux system to your needs... The less software you have running, the harder it will be to exploit.

dire osprey
#

Ah cool. I'm currently using windows, is it adviced and possible for me to use Linux instead?

silk fiber
#

Using it for what?

smoky turtle
paper ridge
#

سلام دوستان burp suite رو کجا میتونم یاد ب

#

گیرم؟

#

ممنون میشم اگه منبع خوبی میشناسید معرفی کنید.

short wadi
#

can anyone assist me with some dnspython issues regarding docker?

im trying to get the dnskey from a website, however it cant seem to establish a connection to the dns server from docker but runs locally, does anyone have any suggestions and or has dealt with this directly?

graceful cape
#

I have a few questions about asymmetric encryption

#

A key is applied to an algorithm to encrypt some data. That encrypted data can be used as a key to the algorithm run in reverse to produce the original key.

#

With asymmetric encryption — reverse application of the algorithm will yield the original key used. But all one has at that point is the key and and the encrypted data, not the original copy.

#

So, having the key is useless.

#

That's how that is supposed to work, right?

thorn obsidian
#

i am not the cryptography expert

#

but that doesn't sound right

thorn obsidian
#

you can get the original plaintext data

#

before encryption

#

for asymmetric encryption, all you do is generate 2 keys, then choose which one will be "public" and which one will be "private", then you take a simple plaintext data such as "my secret message", pass it through the encryption algorithm while providing the "private" key

#

as a result you get a gibberish

#

then to decrypt that gibberish into "my secret message" you can use the "public" key

#

aka the other key you had unused

graceful cape
#

All of that is well and good

#

Aghghghghg

#

XD I need to study the concepts more before I can proper phrase my questions

#

I'l be back, perhaps

midnight bloom
#

all you do is generate 2 keys, then choose which one will be "public" and which one will be "private"

#

there's multiple asymmetric crypto schemes out there but in general you generate them as a pair and you don't get to pick which one is public and which is private

graceful cape
#

Okay, so...

#

I guess my question is this

#

If I apply a key to an algorithm to encrypt some text

#

How is it that, if I apply the steps of the algorithm in reverse, I do not yield the original text?

thorn obsidian
thorn obsidian
#

and when you go the other way

#

you use key #2

graceful cape
#

Yes, but how

thorn obsidian
#

how what exactly?

#

I do not yield the original text? - if you call encryption() function and provide key #1 to it, then calling decryption() and proving the same key #1 will not yield the original text, thats expected behaviour

#

thats why its asymmetric encryption, not symmetric

#

instead when you call decrypt() you provide key #2

#

then it will yield the original data

midnight bloom
#

I think you're asking why the encryption is not reversible with just the public key. The answer to that depends on the exact scheme you're using, to make this more concrete I would fix one to study like RSA

graceful cape
# 
def step_1(key, text):
  """some sequence of steps"""

def step_1_reversed(key, text):
  """every line of code in step 1, reverse order"""

def step_2(key, text):
  """some sequence of steps"""

def step_2_reversed(key, text):
  """every line of code in step 2, reverse order"""

def step_3(key, text):
  """some sequence of steps"""

def step_3_reversed(key, text):
  """every line of code in step 3, reverse order"""

def encrypt(key, decrypted):

  tmp = step_1(key, decrypted)
  tmp = step_2(key, tmp)
  tmp = step_3(key, tmp)

  return tmp

def decrypt(key, encrypted):

  tmp = step_1_reversed(key, encrypted)
  tmp = step_2_reversed(key, tmp)
  tmp = step_3_reversed(key, tmp)

  return tmp
#

Somehow, the steps in the decryption would have to fail if the original key is provided instead of the secret key

thorn obsidian
#

because thats the way its supposed to work

#

you can't just encrypt and decrypt data

#

using just one key

#

thats why its called asymmetric encryption

graceful cape
#

King, bro

#

You're really not helping

thorn obsidian
#

to encryp() you'd pass key #1 and to decrypt() you'd pass key #2

#

then everything will work

graceful cape
#

You're just saying "it just works"

thorn obsidian
#

as you're expecting

thorn obsidian
#

at the level of manipulating bytes

#

then you can find some good articles online

#

but it's not what you are asking is it?

#

i think you are just not understanding the keys

#

would have to fail if the original key is provided instead of the secret key

#

can you elaborate on that

#

so you are passing same key to both encrypt and decrypt right?

midnight bloom
#

they understands how asymmetric schemes works, they're just asking what properties make it possible for you to write a function that you can go encrypt(data, key) without being able to reverse it with that same key

#

and the answer is: it depends on the scheme

thorn obsidian
#

and the scheme can only be explained at the lower level

midnight bloom
#

RSA uses prime factors and exponentiation to achieve it

graceful cape
#

😛 Thanks y'all

thorn obsidian
#

was it clarified to you

#

or not

#

cause it don't seem that way

graceful cape
#

Ohhhhhhhhkay.... so....

#

The number 12

#

Can be produced by multiplying the numbers 4 and 3, or the numbers 2 and 6

#

So if I'm looking at the number 12, I have no way of knowing which two numbers were used to produce it

#

Is it a bit like that?

midnight bloom
#

yup exactly, it's a similar process to that

graceful cape
#

2 seconds

# 
def encrypt(key, data):
  return str([chr(ord(character) * key) for character in data])
midnight bloom
#

obviously this one can be trivially reversed with the key in hand

#

just divide each ciphertext character by key

#

to obtain the original

graceful cape
#

Well that's what I'm getting at. Without the key, every character could be the result of pretty much any character multiplied by pretty much any key

#

But with the key, easy peasy

#

Can you think of just a simple example of a function with one way properties?

midnight bloom
#

heh it's easy to make one that's one way, but going back the other way with a linked key is the hard part

#

and is the crux of asymmetric cryto

#

consider a hash function like sha1 for example, it'll go one way

#

good luck finding what was the input

#

but in an asymmetric crypto scheme we do want to be able to reverse it with a corresponding private key

#

and that usually needs some hard math problem backing it like prime factorization or discrete logarithms

graceful cape
#

Okay, cool

#

XD I'm tasked with writing a few paragraphs about Kerchoff's Principle

#

And I could bullshit my way through it — the principal is sound even if I don't know exactly how the math waorks

#

But as a matter of good faith, I want to do some studying just so I can say I actually learned something

graceful cape
#

So, I think I've come to the conclusion

#

Lemme make sure this is right

#

Any encryption algorithm can by definition be cracked. However, the time it takes to crack the algorithm increases to a prohibitive amount given sufficient complexity

#

Even if all the steps are known, if it will take a million years for a super computer to crack an encryption then it is effectively uncrackable

#

So, the fundamental problem becomes the sharing of the keys

#

Using the same key for every communication is obviously out of the question

#

But if you want to establish a secure line of communication with anyone who wants it, you must generate a new password randomly each time

#

The problem becomes this: there is no way to prevent the generated key from being intercepted in transmission, or knowing if the receiving party's "infrastructure" is compromised (malware could be watching, they could be deceived into sharing their key, etc) [you yourself could in theory be compromised, but you have the agency over yourself to take the appropriate steps, you have no way of knowing if the other party is doing the same]

#

The only way to ensure a password remains secure, therefore, is to never share the password.

#

With asymmetric encryption, a password is shared which can encrypt, but cannot decrypt

#

To achieve this, some kind of operation is perform which transforms a bit of information according to a key, but which cannot be reversed using that same key

#

But which can be reversed using a different key, one which is never shared

#

The nature of the math involved in these operations is complex — but perfectly possible in a broad sense

#

And so the important factors in these steps are:
A relationship must exist between two randomly generated passwords
Some operation must exist which can be performed in one direction with one key, but cannot be reversed using that same key
That same operation can be reversed using the second key

#

Is that the jist of it?

gusty tendon
#

That, at least to me, would be the jist of it

radiant timber
#

How can I remove and scan for malware?

vagrant moss
# radiant timber How can I remove and scan for malware?

Depends on the nature of the malware imo. If you got some known malware not specifically targeted at you, you should be able to see least scan and detect it with a modern anti-virus program (try several), at least of you scan your disk from a Linux boot session(e.g. a USB boot disk).

It's recommended you copy what data you need and then do a clean reinstall though, you can't be sure what's lurking in your system after an infection imo. :(

radiant timber
#

Ok Ty

vagrant moss
#

In general you should scan downloaded files you don't trust, especially executable ones. You can use https://www.virustotal.com for instance by uploading them to have them scanned by several scanners. Personally I don't trust files if they get even just one or two detections on there.

proper idol
#

Anyone here know about implementing Diffie-Hellman key exchange end to end encryption? I am trying to get multiple clients in a chat room to share a secret key. The wikipedia article outlines a method of distributing the public keys in an iterative process, but It seems pretty complicated to implement. I had another idea of simply caching the public key of each client so that when a new user join a chat room, the client can add its public key to the cache. After the new public key is cached, the new set of public keys is pushed to each client so that they can regenerate there secrets keys using the combined public keys. Wikipedia article for reference: https://en.wikipedia.org/wiki/Diffie–Hellman_key_exchange#Operation_with_more_than_two_parties

Diffie%E2%80%93Hellman_key_exchange
#

Just wondering if what I outlined is possible and secure

tulip holly
#

It would have to be asymmetric otherwise Alice removes Alice's public key from shared secret and uses Bob's private key to authorise a transfer of some currency from Bob to Alice.

radiant timber
vagrant moss
#

The best advice I can give is really to search for tutorials or how to's. Sorry

radiant timber
proper idol
#

My plan is to regenerate the secret key for each user by recombining all of the public keys when a user join or leaves

#

Then all new messages will be sent using the new secret as a password

#

do you mean that Alice will still have access to Bob's secret key that they generated together? I think I can get around this by regenerating the shared secret whenever someone leaves or joins a room. (Client stores one secret key per chat channel, this can be removed from memory at any time and replaced with a new key)

proper idol
#

Okk soo scrap that key cache idea. There is no way to make g^a and g^b become g^(ab)^c... because it just results in g^(a+b)^c

proper idol
#

Aww yiss now just time to implement it on a server 😅

#

!e ```py
class PartialKey:
"""Class to represent a public key which is built up by multiple clients"""
def init(self, base: int, prime: int):
self.base = base
self.prime = prime
self.value: int = pow(base, 1, prime)

def mix_paint(self, private_key: int):
    self.value: int = pow(self.value, private_key, self.prime)
    return self.value

g = 2
p = 997
a, b, c = 80085, 1337, 69420

carol

partial_key = PartialKey(g, p)
partial_key.mix_paint(a)
partial_key.mix_paint(b)
c_secret = partial_key.mix_paint(c)

alice

partial_key = PartialKey(g, p)
partial_key.mix_paint(b)
partial_key.mix_paint(c)
a_secret = partial_key.mix_paint(a)

bob

partial_key = PartialKey(g, p)
partial_key.mix_paint(a)
partial_key.mix_paint(c)
b_secret = partial_key.mix_paint(b)

print(c_secret, b_secret, a_secret)

past starBOT
#

@proper idol :white_check_mark: Your eval job has completed with return code 0.

888 888 888
thorn obsidian
#

!e

hollow fossil
#

hi, how long does python take to learn from zero. for cybersecurity

hot anchor
#

So my company is slow to adopt pretty much anything, and they've been using Java 4 / 6 for some apps that I am convincing them to let me rewrite in modern Python (3.9 / 3.10)
They asked on how I could secure the source files from being read in the case of a security intrusion on the server, and I don't actually know the answer to that
Is there a process by which a python file can be encrypted and still usable? I'm sure there's still security considerations for the Python runtime being able to decrypt the code, and then you could read that from the system memory, but I figure

  1. these servers are internal only, so external security issues aren't really a factor (unless the intruder got in to our entire network, which itself is a minefield)
  2. encryption and setting the right read/write/execute permissions on the server would be enough
cold coyote
#

Pretty sure this thing has a dependency that decrypts the source code before using it, haven't gotten a good look at it, I suppose that can help you find a reasonable solution somehow.

hot anchor
#

Hey that's pretty much what I'm looking for!
It does work on a paid subscription, or otherwise the trial version limits the amount of time your encryption will last to be 24 hours - but I'm sure that either my company would be willing to pay for it, or I'll just re-encrypt the files every 24 hours
Thanks again!

#

If I wanted to go full-bore on preventing a user from reading my files. I figure I could do something like this:

  1. obfuscate code with some obfuscation library
  2. encrypt with source defender
  3. compile to C or C++ with Cython
  4. generate executable with pyinstaller
hot anchor
#

Step #4 also means I don't need to have a Python installation on the machine itself

tender mesa
#

i have some handshakes file and i am not able to crack them can anyone here do that

#

pls dm me

silk fiber
hot anchor
silk fiber
#

that's... pretty silly

#

if an intruder gains root access it doesn't matter if your files are encrypted. They do a remote backup, wipe the server, and demand a few dozen bitcoin

#

IMO the marginal cost in operational complexity from encrypting your source files is probably much higher than the amortized cost of a potential source code leak over the same time period

#

but like, it actually should barely matter. If you're storing your secrets with a secretsmanager, and not in the source code, you in theory can just give away your source code for the asking and nobody can hurt you with it

#

this is like putting the keys to the safe in another safe that's in the same place. Either way all the intruder has to do is search your house for one set of keys.

formal mauve
#

:v

#

!e import sourcedefender
from os import environ
environ["SOURCEDEFENDER_PASSWORD"] = "1234abcd"
environ["SOURCEDEFENDER_SALT"] = "dcba4321"
import mycode

past starBOT
#

@formal mauve :x: Your eval job has completed with return code 1.

001 | Traceback (most recent call last):
002 |   File "<string>", line 1, in <module>
003 | ModuleNotFoundError: No module named 'sourcedefender'
formal mauve
#

!e pip install sourcedefender

past starBOT
#

@formal mauve :x: Your eval job has completed with return code 1.

001 |   File "<string>", line 1
002 |     pip install sourcedefender
003 |         ^^^^^^^
004 | SyntaxError: invalid syntax
formal mauve
#

:V

frank charm
#

!e

past starBOT
#
Command Help

!eval [code]
Can also use: e

*Run Python code and get the results.

This command supports multiple lines of code, including code wrapped inside a formatted code block. Code can be re-evaluated by editing the original message within 10 seconds and clicking the reaction that subsequently appears.

We've done our best to make this sandboxed, but do let us know if you manage to find an issue with it!*

frank charm
#

!e while True:
print("hello world")

past starBOT
#

@frank charm :x: Your eval job has completed with return code 143 (SIGTERM).

001 | hello world
002 | hello world
003 | hello world
004 | hello world
005 | hello world
006 | hello world
007 | hello world
008 | hello world
009 | hello world
010 | hello world
011 | hello world
... (truncated - too many lines)

Full output: too long to upload

hot anchor
hot anchor
#

Seems that management doesn't because of some built-in security measures that the OpenShift team is using, so less work for me!

graceful cape
#

Can I get a check on this answer?

#

The question: What are the steps, from the instantiation of a secure communication channel to the decryption of a message, of an asymmetric encryption scheme?

tepid rover
#

what package would you guys recommend from encryption and decryption for fun? I want to try to make my own symmetric ciphers (i know this is bad idea generally speaking and inefficient)

#

or some kind of encryption algorithms with adjustable parameters like custom block size or variable key length or rounds that i can play around with.

tepid rover
#

you mean use ssl package for non https use?

#

hmm cool never even considered that before thanks!

spice acorn
#

guys

#

help

#

all my files

#

is turning into .qbaa files

#

;-;

verbal jolt
#

hello everyone
🧬 : 4 / 61

⛔️ APEX
╰ Malicious
⛔️ SentinelOne
╰ Static AI - Suspicious PE
⛔️ Webroot
╰ W32.Malware.Gen
⛔️ MaxSecure
╰ Trojan.Malware.300983.susgen
is it danger?

thorn obsidian
#

Hey, anyone would like to join me for a matrix (messaging protocol not the movie) inspired project?

graceful cape
#

Hey all

#

Could someone give this a look-see and let me know if I'm missing anything?

#

Question: What are the steps, from the instantiation of a secure communication channel to the decryption of a message, of an asymmetric encryption scheme?

# 
· Party-A requests secure communication with party B
· Party-B generates a pair of public and private encryption keys (these keys may already exist)
· Party-B transmits its public key to Party-A
· Party-A generates a third key, a session key, for use in subsequent encryption
· Party-A encrypts the session key with the public key
· Party-A transmits the encrypted session key to Party-B
· Party-B decrypts the session key with its private key
· Party-A encrypts and transmits a message with the session key
· Party-B receives and decrypts the message with the session key
· Everyone goes out for beers
midnight bloom
#

that looks good

past starBOT
#

:incoming_envelope: :ok_hand: applied mute to @compact hearth until <t:1646332317:f> (9 minutes and 59 seconds) (reason: discord_emojis rule: sent 69 emojis in 10s).

bitter grove
#

!unmute 713003400547270676

past starBOT
#

:incoming_envelope: :ok_hand: pardoned infraction mute for @compact hearth.

bitter grove
#

please don't spam emojis

compact hearth
compact hearth
graceful cape
#

What he actually wanted was this:

· Parties A and B both exchange their public keys
· Party-A encrypts a message with Party-B's public key
· Party-B decrypts the message with its private key
· Party-B encrypts a reply with Party-A's public key
· Party-A decrypts the reply with its private key
#

So, a two-pair scheme

#

-_-

twilit quail
#

Hi , I wanted some resources/techniques on finding the actual IP addresses behind a proxy/VPN IP address. Its for a project Im working for, not getting much info regarding this.

spring rapids
shell depot
#

hi guys

thorn obsidian
#

You can use the Fritz vpn from a Fritzbox, If you have one, this is a free VPN created by your router

shell depot
#

!e print("Hello world")

past starBOT
#

@shell depot :white_check_mark: Your eval job has completed with return code 0.

Hello world
shell depot
#

!e import tkinter as tk
from tkinter import *

past starBOT
#

@shell depot :x: Your eval job has completed with return code 1.

001 |   File "<string>", line 2
002 |     from tkinter import *
003 | IndentationError: unexpected indent
shell depot
#

!e import tkinter as tk
from tkinter import *
root=tk.Tk()
root.mainloop()

past starBOT
#

@shell depot :x: Your eval job has completed with return code 1.

001 |   File "<string>", line 2
002 |     from tkinter import *
003 | IndentationError: unexpected indent
shell depot
#

!e import tkinter as tk
from tkinter import * root=tk.Tk()
root.mainloop()

past starBOT
#

@shell depot :x: Your eval job has completed with return code 1.

001 |   File "<string>", line 2
002 |     from tkinter import * root=tk.Tk()
003 |                           ^^^^
004 | SyntaxError: invalid syntax
shell depot
#

!e import tkinter as tk
from tkinter import *
root=tk.Tk()
root.mainloop()

past starBOT
#

@shell depot :x: Your eval job has completed with return code 1.

001 | Traceback (most recent call last):
002 |   File "<string>", line 1, in <module>
003 |   File "/usr/local/lib/python3.10/tkinter/__init__.py", line 37, in <module>
004 |     import _tkinter # If this fails your Python may not be configured for Tk
005 | ImportError: libtk8.6.so: cannot open shared object file: No such file or directory
#
Command Help

!eval [code]
Can also use: e

*Run Python code and get the results.

This command supports multiple lines of code, including code wrapped inside a formatted code block. Code can be re-evaluated by editing the original message within 10 seconds and clicking the reaction that subsequently appears.

We've done our best to make this sandboxed, but do let us know if you manage to find an issue with it!*

#

Hey @shell depot!

You either uploaded a .txt file or entered a message that was too long. Please use our paste bin instead.

thorn obsidian
#

hmm... opera vpn? but its only in the opera browser and very slow... tor vpns(like orbot) would also work, but are a little bit slow

thorn obsidian
#

orbort is a relativly good coice for vpn, because its based on the tor system

thorn obsidian
#

what are you willing to do with it, if its browsing try the tor browser(also win linux etc.)

#

Hmm... sorry, for desktop I don't know anymore who are free, the problem is that most of the free use data to pay their servers, what isn't that what you want(I guess) 😦 only vpns based on tor would work, but are slowww...

#

I dont know much about proxies sorry... I don't want to tell you false stuff xD

#

uhh... MS defender is relatively good, if you are connected to the internet, otherwise it is 💩 When I used free antivirus stuff, I used Kaspersky Free, but with the Russia war... I don't trust kaspersky anymore... but that is only my opinion. Kaspersky free is creatively good rated by chip etc. but I don't remember if it had real time protection

#

because MS defender uses AI when you have Internet

smoky moat
#

best approach to validate that a string is a valid bitcoin address of any address type?

tidal gorge
#

pls help

#

1093241-323452-0887352134

#

244267995-294514-965345

#

sir

tidal gorge
#

-882253-284945-24526

boreal cairn
#

download openvpn and download a free courvix server config

fading plaza
#

protonvpn

#

oh wait that needs registration

#

and downlaod openvpn

fading plaza
#

windows defender, malwarebytes

frigid matrix
#

Hey guys, I'm not into the security side of python so I don't know anything about it really but i stumbled over this discord bot RAT thingy (https://github.com/moom825/Discord-RAT). How does this work? You can't just add this bot to a server and it gives you access to other people's computers, right? That would seem like a bit easy

#

So the person has to run the file

#

?

#

Okay thx

copper shoal
#

ayoo

thorn obsidian
agile leaf
#

Is using keyrings safe to store a master password that is used to access an encrypted database?

astral phoenix
south coral
#

Hey how can i take a forensic image of a android device, without using ADB or rooting my phone, just need a method name to look into

fleet mango
#

Can one of you help me out in #help-candy real quick? I'm trying to make a buffer overflow exploit for a cybersecurity class, but I'm running into issues setting it all up. My sys.stdout.write statements are being displayed out of order..

cobalt geode
#

Hi, I would like to make a system that translates messages, and that people themselves can host, but how to make sure that the host (the people who translate) can't read the message, but only the code? Because a message can contain personal information. Or a way to check that he didn't modify the code for read message.

unknown.png
#

I can't encrypt the message, because it will need the key to decrypt the message for translate

thorn obsidian
cobalt geode
#

well I can but the one who translates the message must have the key, so it is useless

thorn obsidian
cobalt geode
#

yes it is used for this case, but it can simply modify the code that translates to retrieve the messages

#

The person who translates is not necessarily reliable

#

so if I encrypt the message, he just has to modify the code that translates to get the decryption key

#

I need that even the translator can't get the key

#

only the "code"

#

or else a way for example by looking at the hash of the code, and therefore can not use that user who has modified the data

#

I can post the key on the first connection, but it can sniff the traffic to see it, or read the ram, or edit the code for print the key.

celest gyro
#

I'm not sure if this is the right place to ask, but I'm not sure how I'm going to be dealing with sending and storing of passwords for my App, it's got a Python FastAPI backend.

My idea was to encrypt it front end (and salt and hash) on the App, and then when logging in, compare that email and hashed+salted password against the local API copy, does this sound like a decent idea?

Since the passwords will be encrypted and salted, there should be no point at which passwords are vulnerable right?
I only need one way encryption for this right?

Please ping me if you have any thoughts

smoky moat
#

@celest gyro

celest gyro
#

Sorry, I meant locally on the API server

#

So you log in, type your password

#

It gets bcrypt hashed on the app side, sent over to the API, which either puts it in the database (if it's account creation), or compares it against a previously put in hash, to see if they're logging in correctly (compares email and hashed password to verify log in)

smoky moat
#

sounds like normal practice to me

celest gyro
#

Is there better ways to do it?

shrewd thorn
#

Hello, my gentleman

#

Can any of you could me informe how much a pentester or ethical hacker earn per years ?

#

Its is worth all the study and sacrifice ?

celest gyro
#

Isn't that what he's doing now? Conducting research on how much he should expect in that position?

#

To see if it's worthwhile?

#

🤨

thorn obsidian
thorn obsidian
shrewd thorn
#

Whats is the difference betweein bug bounty and a binary exploitation ?

#

Is a kind of thing that grey hats do ?

thorn obsidian
#

but binary exploitation is not ez

#

here u have to change the behavior of the binary

#

and here u have use ur brain

#

u have to understand the program how it’s working and how can I break it? Where is the loop hole?

#

but web penetration is mostly found in market

shrewd thorn
#

So, binary exploration, is harder but pays better than bug bounty? Because a less demand at the market

#

And are rare to finds this kind of professionals,like Cobol senior's

#

Has less**

#

@thorn obsidian

vocal beacon
#

! rule5

#

!rule5

#

!rule

past starBOT
#
Rules

The rules and guidelines that apply to this community can be found on our rules page. We expect all members of the community to have read and understood these.

vocal beacon
#

!rule5

#

we won't answer this

#

!rules5

#

! Rule 5

#

Do not provide or request help on projects that may break laws, breach terms of services, or are malicious or inappropriate.

thorn obsidian
#

This is a joke

thorn obsidian
#

smhhhh

fluid dragon
#

How useful is Python for cyber security ?

thorn obsidian
# fluid dragon How useful is Python for cyber security ?

It's the most common scripting language for security tools/libraries and the main scripting language of IDA.
For almost any role in computers nowadays, you should have a basic ability to read and write object-oriented Python,
but for security it's usually not necessary to have an advanced knowledge of it (e.g. few security tools use its parallelism features)

thorn obsidian
#

Woah

#

Hello People I'am new

#

And I'am No american

#

I'am Turkish

#

But I know small english Language

#

Not used translate

#

Hello!

woven gazelle
#

hi!

#

your english is good, but "I'am" -> "I'm" and "small english language" -> "not much English"/"a little English" is better

#

or "I'am" -> "I am"

smoky moat
#

Hi

blissful narwhal
#

se'u'i'ty

smoky moat
#

can someone help with SSL

smoky moat
#

Hi, any pentesters here???

light gorge
#

dont ask to ask, just ask

ashen garden
#

dont ask to ask, just ask

thorn obsidian
#

dont ask to ask, just ask

smoky moat
#

who wants to pentest my site I made in python

north rover
# smoky moat who wants to pentest my site I made in python

this is not really what the channel‘s purpose is, it‘s rather for asking questions regarding security aspects of specific parts of your code, or e.g. how to implement cryptographic functionality in python. if you ask in one of the off-topic channels, someone may want to take a look at it though

#

if you have nothing useful to contribute to the conversation then why contribute in the first place?

north rover
#

absolutely, i buy all of that.

ionic maple
#

Hello can someone learn me how to recover ur own password?

light moss
loud comet
#

I am taking over a project at work that deals with webscraping from a website that requires login credentials. I would like to make sure that in the process I am storing the password safely and inputting in the login portal.
Is pycryptodome a way to solve this issue?
I know that azure key vault is a safe way to do it with cloud but was wondering if there was an alternative for on-prem.

weary patrol
#

Hi, is there someone who has experience with the MVT tool from amnesty international? (docs.mvt.re) or maybe with adb in python?

thorn obsidian
west sky
#

Hi,

#

i wanted to perform an encryption/decryption on a file

#

client side encryption
server side decryption

nimble lava
#

[ Jinja2Template/FastAPI ]
How do I get the bearer token in the header from the local storage?

@router.get("/dashboard", status_code = 200)
def dashboard_page(request: Request, token: str = Depends(auth_handler.oauth_scheme)):
    return templates.TemplateResponse("dashboard.html", {
        "request": request
    })
thick turtle
#

If I want to protect my Python code from being read,
What options should I use of Pyinstaller?

proud scroll
#

is there any way to make a script which can detect python malwares? if so what approach should I take to make such script

last ivy
#

Is tempfile.mktemp really that unsafe? The chance of a collision between two names is 1 in 3.5 trillion

olive crater
thick turtle
white spire
#

Hey guys I have a text file on my server and I just want it to be accessible by a python file on the same server.....people cant view it....as in if some1 types its address its unviewable so should I set the file permission as 700...will that help?

pearl viper
white spire
woven gazelle
#

you just need to not host the text file

#

assuming you want the python program to be able to access it as a file, not as a URL

orchid oriole
#

how do i prevent select statements from being sql injected into?
with insert it goes like this:sql VALUES (%s, %s, %s, %s)", (interaction.guild.id, channel.id, message, round(T.time())))
but with insert would i do the same thing to just go like this?

mycursor.execute("SELECT * FROM `uploads` WHERE serverid = `uploads`(`id1`, `id2`, `id3`) VALUES (%s, %s, %s)", (value1,value2,value3)));```
smoky moat
#

You have the right idea, but is that a valid select statement?

#

@orchid oriole

orchid oriole
#

figured it out already

smoky moat
#

oh nice

orchid oriole
#

having another error now

#

i thought this was correct

mycursor.execute("SELECT * FROM uploads WHERE short_id = %s", (img_id))```error:```mysql.connector.errors.ProgrammingError: 1064 (42000): You have an error in your SQL syntax; check the manual that corresponds to your MariaDB server version for the right syntax to use near '%s' at line 1```
vernal ice
#

how can i decrypt passwords obtained from my computer with sqlite3 using win32cryPT?

cedar imp
#

what are the chances to repeat a uuid4 sequence

#

!d uuid.uuid4

past starBOT
thorn obsidian
# 
def get_auth(env_user_key: str,
             env_pass_key: str) -> tuple:
    """
    :param env_user_key: Access username from .env
    :param env_pass_key: Access password from .env
    :return: Tuple of strings
    """
    return (
        os.getenv(env_user_key),
        os.getenv(env_pass_key)
    )

is this bad?

#

like, in the way of accessing the environment based on input?

thorn obsidian
#

without any extra checks

#

so that sensetive info doens't get leaked

#

yes

#

its quite bad

#

what are you trying to achieve with this?

rapid mountain
#

Lol it says
This specification defines a Uniform Resource Name namespace for UUIDs (Universally Unique IDentifier), also known as GUIDs (Globally Unique IDentifier). A UUID is 128 bits long, and can guarantee uniqueness across space and time. UUIDs were originally used in the Apollo Network Computing System and later in the Open Software Foundation's (OSF) Distributed Computing Environment (DCE), and then in Microsoft Windows platforms.

cedar imp
#

time to make it go wrong

#

thanks

stray dawn
#

hi

#

can somebody explain to me

#

and why is this a real url

thorn obsidian
# thorn obsidian what are you trying to achieve with this?

just having variable info in the .env for different sites.
After writing it i realized that's kinda bad, so i'll undo that.

This is my first attempt at incorporating proxies and other 'unnecessary' request context specified in the requests. I tried to make it able to handle anything

def get_response(
        test_url: str = "https://ipv4.webshare.io/",
        protocol: Optional[str] = WEBSHARE_IO_PROTOCOL,
        env_auth_prefix: Optional[str] = None,
        additional_headers: Optional[dict] = None,
        cookies: Optional[object] = None
) -> requests.Response:
    """
    Send a web request with auth, headers, and proxies. Take a protocol to add proxies, a dotenv prefix to access
    auth info, and a dict to add additional headers to boilerplate headers
    :param test_url: web address
    :param protocol: 'http' or 'sock5' or None
    :param env_auth_prefix: prefix for accessing username and password for .env file
    :param additional_headers: None or a dict with modifying headers
    :param cookies: optional requests.RequestsCookieJar object
    :return: requests.Response object
    """
    r = requests.get(
        test_url,
        headers=get_headers(
            additional_headers=additional_headers
        ) if additional_headers is not None else get_headers(),
        proxies=None if protocol is None else get_proxies(protocol),
        auth=None if env_auth_prefix is None else get_auth(
            f"{env_auth_prefix}_USERNAME",
            f"{env_auth_prefix}_PASSWORD"
        ),
        cookies=None if cookies is None else cookies
    )
    r.raise_for_status()
    return r

this is where it comes from https://github.com/shaenr/proxy-requests-template

#

I tried to make a request wrapper to have some built in defaults

def get_proxies(
        proxy_protocol: str = WEBSHARE_IO_PROTOCOL
) -> dict:
    """
    Get context info for proxy requests: uses dotenv for https://proxy.webshare.io/
    :param proxy_protocol: 'http' or 'sock5'
    :return: dict of proxy addresses and credentials
    """
    dotenv.load_dotenv()
    proxy_address = os.getenv('PROXY_ADDRESS')
    proxy_port = os.getenv('PROXY_PORT')
    proxy_username = os.getenv('PROXY_USERNAME')
    proxy_password = os.getenv('PROXY_PASSWORD')
    assert proxy_protocol == "http" or proxy_protocol == "socks5"
    return {
        "http": f"{proxy_protocol}://{proxy_username}:{proxy_password}@{proxy_address}:{proxy_port}/",
        "https": f"{proxy_protocol}://{proxy_username}:{proxy_password}@{proxy_address}:{proxy_port}/"
    }


def get_headers(
        ua: str = UserAgent().chrome,
        additional_headers: Optional[dict] = None
) -> dict:
    """
    Boilerplate headers context.
    :param ua: a user-agent string
    :param additional_headers: optional dict to update the boilerplate headers with
    :return: a headers dict
    """
    headers = {
        "User-Agent": ua,
        "Accept-Language": "en-gb",
        "Accept-Encoding": "br,gzip,deflate",
        "Accept": "test/html,application/xhtml+xml,application/xml;q=0.9,*/*;q=0.8",
        "Referer": "http://www.google.com"
    }
    if additional_headers is not None:
        headers.update(additional_headers)
    return headers
thorn obsidian
jovial yoke
#

what does color of hat mean?

#

how to encrypt data in python

distant vessel
#

whats the encoding for this? "\xb1v\xa5P\xb8\x8cD\xc8\xae~\x8c\xd5=\x05\xfe\xab\xa0\xcf\xa7\x89\xf2\xb8b\xc0\x0eCW#x\xe2\xd8E"

jovial yoke
#

can someone exopain encrypt date

rancid verge
raw mango
#

anybody can recommend where to start learning cyber security? hackthebox and tryhackme are pretty restrictive for non premium accounts

cedar sphinx
#

@raw mango I would highly recommend getting a subscription to either of the services

#

They are phenomenal

#

I can’t really recommend other ways, I’m sure there is a plethora of ways to learn but in my opinion, hands on is the best way to learn for this type of field

raw mango
#

i mean, there got to be another (also free) way, how did the ones before learn?

thorn obsidian
#

You can watch all the courses for free, or pay for the course and get a certificate

#

udemy usually has sales and offers. there are a few CompTIA courses to prepare you for cybersec

cedar sphinx
thorn obsidian
cedar sphinx
#

And it’s rated for 4 hours a week @ 8 months so it can obviously be finished quicker

thorn obsidian
#

It really is up to your pace. You can pay for a month and complete like half of the course

cedar sphinx
#

Only thing bad about udemy is the plague of emails I receive from them 😂

thorn obsidian
#

@raw mango check https://www.youtube.com/watch?v=a83ASGn_V_s. basically: get certified

YouTube
Josh Madakor
How to get into Cybersecurity with NO Experience - The Ultimate Guide

In this video I will be breaking down the steps anyone can take to get a job and start a career in cybersecurity. If you follow these steps and do the BEST you can at each step, it's only a matter of time before you will find yourself working in cyber or at the very least, working in IT and well on your way. Best of luck!

🙇‍♂️ - Patreon - 🙇‍♂️...

▶ Play video
thorn obsidian
thorny abyss
#

have you tried typing "what skills are required to work in IT security" or smth like that in your browser?

thorn obsidian
#

literally my HEAD~3 msg

thorn obsidian
#

what do

unknown.png
thorn obsidian
#

print(colored(...))

grizzled sleet
#

Hello uhh how would I go about speeding up my hash brute forcer?

thorn obsidian
grizzled sleet
#

Ok great another question io or cpi bound

#

Cpu*

last ivy
#

just sharing a very interesting talk about the security of smart cards:
https://www.youtube.com/watch?v=ET0MFkRorbo

YouTube
Black Hat
How Smartcard Payment Systems Fail

By Ross Anderson

"The USA is starting to introduce EMV, the Europay-Mastercard-Visa system for making payments using chip cards instead of the old mag strip variety. EMV is already in wide use in Europe, and has started to appear in countries from Canada to India.
In theory, smartcards should have reduced fraud by making bankcards much harder t...

▶ Play video
vernal inlet
#

hey guys anyone has any idea how do i access all utf-8 encoding characters?

thorn obsidian
thorn obsidian
errant yoke
silver sail
#

Would encryption of a folder be a good way to store personal data?

#

I would be using the RSA module?

barren plank
#

nice

thorn obsidian
errant yoke
raw mango
#

can someone recommend some books on cyber security? i have average knowledge about the topics, i know networking, linux basics

thorn obsidian
unborn linden
#

#bot-commands

jaunty ermine
#

i need help with some homework on linux its basic stuff im behind in school. i will pay for the help

coral echo
#

Hi everyone. Does anyone know how this sight is accessing the match data that fills there website? They are not officially apart of pokemon unite and I can't find a public API being offered by the game so I am curious how they are doing it.

https://dev.uniteapi.dev/

Unite Api
Homepage

Latest Pokémon Unite news and information

jolly bay
#

!code

past starBOT
#

Here's how to format Python code on Discord:

```py
print('Hello world!')
```

These are backticks, not quotes. Check this out if you can't find the backtick key.

devout sonnet
light garnet
raven frost
#

Currently, I analyze code vulnerabilities/assist product team with patches, work on tools that assist with these tasks, perform security code audits both manually and semi-automated.

#

That is WAY different from example, monitoring antivirus and logs in IT

#

Both would be called "security" or "cybersecurity" by some

#

Broadly speaking, there are folks who do more IT-side stuff such as network security, log monitoring, operating whats called a "SOC" or security operations center, responding to potential attacks etc...

#

There are also some folks who work more on the "code side", analyzing code, patching, etc... like I do. Then there are people who are "regular" software engineers but they work on a security product, such as authentication, firewall, security portions of the kernel, etc...

#

FInally, there are pentesters and red teamers. Pentesters are basically legal hackers who actually break into systems and write reports about it to their clients, red teamers emulate adversaries and could include things like even breaking into buildings, tricking security guards, etc...

#

My suggestion would be, explore these areas and discover what interests you. Dabble in a few.

#

Note that even what I stated was no where near exhaustive. Another such example is there are malware researchers who reverse computer viruses and malware for a living (I used to do this also), usually they work for an anitvirus company, but sometimes can also work for other orgs or the government. Even these jobs differ. You can be a malware researcher who responds to emergencies and does some forensics analysis, or you can be a proactive researcher who is trying to spot trends and bolster up the antivirus solution.

raven frost
#

RSA is useful for having to work with others, if you just want to encrypt some shit with a password RSA definitely isn’t needed.

silver sail
#

hmm

#

im not storing passwords tho

#

im making the softwqare for a robot with facial recognition and logging, so its just general file encryption is what i need.

raven frost
#

I see. So typically AES or another symmetric system is used to encrypt files because RSA again is mostly for sharing things and it’s way slower. So practical example: say I want to encrypt a directory or files on disk and I also need to share it with you... this is what I would do:

  1. Use AES and encrypt the files (when I said password I meant the password/key you would encrypt the files with)
  2. Put the password in another file or otherwise encrypt it with RSA or another asymmetric system. You would encrypt that document with the AES key/password to your files with my RSA public key
  3. Send me both the encrypted (with AES) files and the encrypted (with RSA) password

That gives you the benefits that you can encrypt thousands or more files very fast as AES is fast. You only need to encrypt the password with RSA and that also benefits you because now nobody else can see the AES key since it’s encrypted with my key.

#

So basically if you just need to encrypt some stuff in your own control; you can use AES. If you need to send it and such you’d also want a asymmetric system.

silver sail
#

ah.

#

alright then lol. i will use AES for the files

#

thx for the info dude!

scarlet shore
#

does anyone have any material on best practices on mitigating rainbow table attacks?

untold stratus
#

hey so what is this system 32 file

#

someone told me to delete it

#

i contains a virs

#

*virus

#

so should i delete it?

raven frost
raven frost
#

Im not on Windows right now but go into it and look at the contents. I can say that system32 at one point and probably still is a necessary system folder. You won’t be able to delete it if it is. However a common malware technique is to mimic or impersonate legitimate windows files. Windows Defender should handle it. Someone may be pulling your leg

#

If you’re worried something is a malware you can upload it to https://virustotal.com too and it’ll get scanned by all antivirus software sans give you results. Just don’t upload anything with sensitive personal info there.

VirusTotal

VirusTotal

raw mango
ebon wave
#

hi guys i need some help with my python project can anyone help me

raven frost
# raw mango ok, i see, so lets say i want to learn to reverse viruses, where do i start, sho...

Yes. Get "Ghidra", learn to use a native debugger like X64Dbg on Windows, also get the (older but teaches fundamentals) book Practical Malware Analysis. You'll going to need a virtual machine software like VirtualBox or VMWare and get an older Windows image for it. Youre going to also want to check out youtbe channels "Colin Hardy", "Malware Analysis for hedgehogs", "OALabs". Some peolple use IDA Pro rather than Ghidra which you can also do (use the free version; paid version is very expensive)

#

Note that Python is still relevant because the way you script most of these tools is via Python

#

There is also one called Binary Ninja which has a super nice Python API. First learn to do it manually though of course. 🙂

#

Also lots of malware is also in javascript, vbscript, C#/.NET/powershell now too. So for those you can use tools like dnSpy. javascript should be self explanatory.

raw mango
#

Ok, thx a lot

last ivy
#

!ban 713602315478892576 Seems like you're only here to advertise an upwork scam

past starBOT
#

:incoming_envelope: :ok_hand: applied ban to @arctic cliff permanently.

raven frost
rapid widget
rapid widget
rapid widget
rapid widget
#

Bash can be used for automation too.

#

I use bash when pentesting but big processes such as maybe scanning through all ports. sudo nmap -PN -p-

#

To customize this kind of process I would prolly automate it with scapy.

rapid widget
sick basin
#

@raven frost So one other thing to keep in mind is that some of that baseline complexity is further extended by human inability to keep everything organized (we are not perfect). So we add some more complexity like designing OOP systems and such. It's purely for the humans working on the program, even though it's technically worse for the computer / complexity.

raven frost
sick basin
#

One approach is that many people try to use methods that actually measure this / optimize for the human overhead.

#

An example is compression oriented programming which tries to put an objective measure on it.

#

Basically not adding unnecessary complexity to the code.

#

OOP and such (SOLID, etc) are rules that we feel might make it better, but nobody is actually measuring it AFAIK.

#

So they might be, but it's unknown.

#

And IMO if programmers want to move programming forward for speed, robustness, maintainability, and especially security, they need to start measuring things. Right now nobody is doing that.

#

Like, if we choose SOLID, time how long it takes for someone new to understand your code. And how many bug reports do we get. And does the code keep changing and why, etc.

raven frost
#

Its certainly not common in the general sense (Jow Blow app developer at X startup etc). It does happen in certain specialized areas or niches though.

sick basin
#

Yeah, but not enough. And software is too important for this to not be a thing, it affects too many people.

raven frost
#

I do agree. It will also require the business side of things to cooperate too though. I honestly don't think it's just on the programmers.

sick basin
#

It's not, but programmers are the ones that will be blamed, so, being passive on this is not going to fix anything.

raven frost
#

From what I've seen in my experience -> If you want change, it must show the business in some (usually large) dollar amount how they will either mitigate huge losses or make huge profits.

#

I would be interested in seeing the number of complaints from customers before e.g. something entirely insecure or slow gets proper resources/focus for a fix.

#

I have no visibility into that, or at least havent at my last few jobs.

sick basin
#

It's also an expectations issue that programmers set forth. Your boss thinks you can add features faster than you actually can. And it comes from being able to add features fast in the beginning, but as the complexity increases it slows down. But your boss does not understand that and still expects the original speed. A solution is to start slow to set expectations (which also leaves you will less of a mess later).

#

Go slow to go fast.

#

It's all connected to the core idea of unnecessary complexity.

raven frost
#

I mean it's very relevant to security.

#

In fact, I would say thats the main cause of security issues

sick basin
#

Yeah and that humans are even easier (social engineering) targets than programs for cost/effort payoff ratio.

raven frost
#

Orgs lose control and tracking over their shipped software and its dependencies. One of my former bosses used to say "We can't secure what we don't even know about."

#

Most of the fight was just wrangling up what the hell we were shipping and accounting for it... I think its also a side effect of security being more of an afterthought a decade or two ago, and needing to bring it in after the fact.

#

I mean, even SolarWinds... Okay it was a supply chain attack... But end of day they were shipping things they didnt even know they were shipping

sick basin
#

Yeah, there is this general idea that somehow libraries don't count towards your programs complexity, because you did not write them, but they do. And for example, CPython is to be considered part of the complexity of every Python program that uses it, and so it needs to be considered as an attack target, and for speed, and maintainability (what if they just decide to stop / it's not the cool thing anymore (is the source code documented? Is it reasonable? (not really if you have read it (50 function calls deep with gotos for errors)))), etc.

#

Or another example, since I work on AGI, OpenCV. If you have ever read OpenCV, I feel you. If you have not, keep your sanity.

raven frost
#

Oh gosh I remember working on a vuln that the product depended on a library, and long story short I went upstream to the library (OSS), and contacted the "maintainer" who worked with me on a patch, but stated "You know, Im actually not the maintainer. I'm just a random developer like you who was the only one left when this project got abandoned."

#

I'm thinking "Oh, lovely"

sick basin
#

Yet so many projects rely on OpenCV (in robots! which can cause physical immediate harm!).

#

We don't use OpenCV with our robots, it's all custom because of this stuff.

#

Keep it simple.

#

Take a page out of NASA's book.

raven frost
#

What I look for with projects like that is:

  1. Is it well-maintained?
  2. Is upstream responsive?
  3. Does upstream have a security policy?

It can be done right, but sometimes it does need to be forked by folks who know it well.

sick basin
#

Yeah, and a quick method is just look at their docs real quick. Easy to ignore then if it's not good.

#

If it's doxygen autogenerated stuff that adds nothing. Nope.