cybersecurity

[sick basin]

I expect something actually written by a human.

Book-like (documents).

Otherwise it's API spec. not docs (not just functions with the comments that were written on them, although, even that is a big step up for many popular projects out there).

[raven frost]

Hmm, I've noticed that phenomenon as well and I'm glad you have a term for API-spec vs docs. I get tired of people sending me those claiming they are real docs

[thorn obsidian]

can smb help

[raven frost]

Server message block?

[thorn obsidian]

You can search for tools and how to use them

[rapid kraken]

For my security class I have to implement a covert channel, but I'm not sure really what counts as a covert channel (I know subtly different than steg, breaches containment, and uses unconventional methods that are not meant for communication to bypass the security policy and any enforcement mechanisms in place). I'm out of ideas here tho, since steganography won't work and by extension TCP/IP header editing or sending pings to a host (except that is not really covert), not sure what to do

Anyone here have any ideas

[raven frost]

@rapid kraken that question is a bit broad and unclear, think of a way to transmit data in a non-obvious fashion. There is so much data being sent now adays, its actually quite easy when you start to think about it

In fact, I would almost say that finding what’s NOT a covert channel is more challenging

[raven frost]

I probably don't fully understand your question... What is your specific concern? Vulnerable to what?

I think I know what you're asking, but I want you to clarify because my assumption may be incorrect. Plus, creating yourself a threat model is the first step to making the app more secure

Ok ok. So, this "someone" - who is this? Another application? A person standing behind you?

Frankly, I would not choose either of those languages if I was looking for max in-memory security. But also note that if a user has installed malicious applications, that is already a huge problem and you won;t be able to do much to protect them

There are probably special modules, but generally, IMO Python and Javascript are not really built for that. I wrote a program in Python that handled sensitive data and found that it copied it into memory in multiple locations... However, I rewrote it in C and I was able to consolidate the memory footprint and IMMEDIATELY destroy it when it was no longer needed. But again, this is sort of water over the dam, no matter the language one can get access to memory on his/her own machine with privileges.

Right now, if I have a keylogger installed, it can get what I am typing to you. Discord cant prevent that.

@thorn obsidian The thing is, your app will have to have the data in memory at some point to work with it

any malicious program that has access to the memory would be able to steal the data at that point

I used to reverse engineer software, much of which had encrypted data

all I did was put a breakpoint or hook near the encoding algorithm and wait

then let the program decode the data for me

lol

So, trying to protect data in memory from other applications that a user has installed is not very productive generally speaking. The OS sometimes has protections that help with this, such as permissions/users/sandbox etc...

If you want to know how you could help reduce the length of time that sensitive data is in memory check out something like this: https://stackoverflow.com/questions/53792077/how-does-memset-provide-higher-security-than-bzero-or-explicit-bzero#53792516

but again, thats not Python either.

@thorn obsidian exactly

You'll have more control over memory in C++ and even Rust, but ultimately the same issue exists really

If you really want to know what kind of stuff can be done to hide/protect data in memory, check out this

(I am NOT suggesting you do this; it is extremely complicated, not worth it, and adds a lot of unecessary complexity and performance costs)

https://www.oreans.com/themida.php

See "Features"

that thing is designed to protect/secure/obfuscate apps while in memory

[rapid kraken]

so i broke out the C and wrote a snake program for the Ti 84 CE that transmits a secret message by changing the background color

im wondering if the containment principle doesn't have to be technically enforced

In computer security, a covert channel is a type of attack that creates a capability to transfer information objects between processes that are not supposed to be allowed to communicate by the computer security policy.

hmmmm

yeah im not sure if my program would work

[raven frost]

It sounds like your issue is that you need to get clarification on what’s being asked of you more than anything else @rapid kraken

There is generally some wiggle room when it comes to such definitions in security much like other spaces. So because I feel something is a covert channel that may not be what your instructor is asking for etc

[subtle trout]

Kali linux??

[glad cobalt]

Can i post here link for another discord group?

[vagrant mist]

!rule 6

[past star]

Rules

6. Do not post unapproved advertising.

[glad cobalt]

ok

[wintry ocean]

when I use a MapView on my mobile app, I need to declare MapSource like this:

source = MapSource(
                url = "https://api.mapbox.com/v4/mapbox.satellite/{z}/{x}/{y}.jpg?access_token=my_acess_token",
                cache_key="my-custom-map",
                tile_size=256,
                min_zoom=8,
                max_zoom=17
                )

the problem is: if I put my access_token on url, some user could take my access_token and use for other purposes, besides attacking it
so, my question is, how should I proceed, how can I give the users of my app the rights to use my personal access_token from MapBox API, without exposing the access_token on the app APK?

[raven frost]

@wintry ocean oh boy, the classic question

Everyone asks that. Short answer is you really can't. I mean, you could do something like make another level of indirection such as using something like HashiCorp Vault or AWS Secrets Manager. This would allow more fine-grained control over the key. But IIRC, those keys probably already are designed for this.

So, say for examle it would be a huge PITA for you to rotate that API key... Using a secret manager API like I just explained above would solve that problem

instead of the actual MapBox API access token, you would use a more ephemeral or granular one, so that if something bad occurred, you would not need to rotate the main MapBox accesss token for example

But at some level, you're going to have to expose some client key

you could also try to obfuscate the keybut I highly DO NOT recommend that. It's usually a big waste of time - instead use your brain and aforementioned tools to situation your application's security posture in such a way that worse case scenario, your token starts getting abused, you can quickly limit the damage.

Most obfuscation is rather trivially to undo - I used to do this all the time. In fact, at a previous employer the engineering team specifically asked me this about the MapBox access token.

IIRC you may be able to throttle, monitor, or control its usage in the MapBox control panels

[dapper junco]

when encrypting with aes, you need a key and an iv
is it okay to randomly generate the iv out of a range of characters, such as "abcdefghijklmnop" (as the iv)

[shrewd thorn]

Hi People, im new at Python, i would like to know if, writting a script that runs at the background is easy?

[graceful quarry]

You can get a server (build, buy, or rent) and via VCS (or other IDE) and using requests library, you can try executing a code via on a server. Never done this myself though.

[wicked nest]

can someone help me with a CTF?

[wintry ocean]

@raven frost thanks for the extensive explanation!

I think I may not worry too much about this token in the end

[shrewd thorn]

what is CTF ?

[wicked nest]

Capture the flag, hacking competition

[distant mason]

Hello everyone could you help me with a Kryptography assignement?.. I should add a transaction to a blockchain ..that means I should calculate per brute force a hashvalue smaller of factor 2 of the oldest transaction and I have time till 20 o clock :.(

[light dew]

What's up guys

I'm into cybersecurity right. and i want to learn to write python code/script to automate tasks and do cyber type tasks

most of the stuff i find have to do with data science. is the coding process the same? or should i find python coding videos specific to cyber? help please

[whole steeple]

how do i hack with python

or get started with knowlege

[light dew]

lol bro we're in the same boat it looks like

[raven frost]

Really depends. If you absolutely want to learn Python while also doing cyber stuff right away check out “black hat Python” book. I have not read it but heard great things and I have a ton of no starch published books and they are all pretty excellent.

@whole steeple same answer

20 bucks on Amazon

The longer answer though is that you also just need to learn cybersecurity concepts in general. At the end of the day, when you write a Python (or any) program, you're just instructing the computer to do something for you. If you dont know what needs to be done, that will never happen properly.

[whole steeple]

okay thank u

[raven frost]

But that book does a decent job at combining learning both

[whole steeple]

i am intermediate in python and only know how to exploit games atm

[raven frost]

@whole steeple if you're interested in Web hacking type of stuff, also check out the tool "Burp Suite". You will do a lot of stuff manually with it, but you should be able to translate some steps into python script automation if you simply even know the requests library for example

You want to generally learn things manually first, then automate where it makes sense to do so.

[whole steeple]

okay ty so much

also there is a 2nd edition to the black hat python, should i get read that instead?

@raven frost

[raven frost]

YES. It was published in 2021 so its going to have much more updated content, which might be relevant to python

[whole steeple]

ok

[raven frost]

Burp Suite has a free community edition that you can use for your purposes. The paid one just has a bunch of extra automation plugins and things that you dont really need

[whole steeple]

got it

[light dew]

Good deal bro. I'll check out the resources. Just got back home

[dreamy bear]

Hello guys
can u help me with few projects ideas?
For my git
I m intermediate level in programming

[void dune]

@whole steeple @light dew @dreamy bear
Here is an idea that would work for 3 of you.
"A Rest API in python that offers to scan files for Malware".
Watch out how you will be handling those files once you open the request 😉

[paper fox]

Hello. What's the difference between the blue box "hash algorithm turns to digest" , and the lock "asymmetric crypto algorithm" ? thank you

[sinful cliff]

Encryption can be reversed (decrypted) with the right key, while hash algorithms can not be reversed (only reproduced).

In symmetric encryption the same key is used for encryption and decryption, called a shared key, that both parties (sender and receiver) need to know in advance and thus need to be securely shared between the parties beforehand. If anyone else gets hold of the key and the encrypted messages (also called cyphertext) they will also be able to decrypt the messages.

With asymmetric encryption one create a key pair, a [secret] private key that should [generally] never be shared with anyone, and a public key that can be shared with everyone.
When encrypting a message with one of the keys it can only be decrypted with the other corresponding key, this works both ways, but the same key used for encrypting the message can not be used to decrypt the message.

Both types of encryption will produce a variable length output that depends on the length of the input.
For encryption it is from planetext to cypthertext, and decryption is from cyphertext to planetext.

Hash algorithms (sometimes called a hash function) on the other hand is a one-way operation that produces a fixed length output (the length depends on the hash algorithm used), called a digest (you can think of it as a special type of checksum), for any variable length input text.
The same input always produces the same digest as output, but given only the digest one can't know what the original input was and can't be worked out backwards from the digest.
For a secure hash algorithm, any change (big or small) to the input should produce a [often radically] different digest and it should be unfeasible to willingly find two different inputs that produces the same digest (called a hash collision).

[sinful cliff]

When signing messages using asymmetric encryption one do not encrypt the [variable length] message it self using asymmetric encryption, but instead produce a digest of the message using a hash function and then encrypts the [fixed length] digest using the senders private key.

To verify the signature and make sure that the message and its corresponding signature has not been corrupted or altered in any way, the recipient need to have (or get hold of) the senders public key (and be sure that this this is in fact the public key of the sender and not an imposter).
Then the recipient takes the signature they received and decrypts it using the senders public key to get the original digest that the sender produced for there original message.
The recipient also need to produce a digest of the message they received (excluding the signature it self) using the same hash function as the sender.
As a last step the recipient compares the digest they just produced from the received message with the digest they decrypted from the signature, if they match exactly (and trust both the asymmetric algorithm and the hash function) they can be confident that the message has not been corrupted or altered in any way, and the holder of the private key is also the only one that could have encrypted the digest the recipient got when they decrypted the signature using the corresponding public key.

Anyone that has the public key, the message and the signature can verify the signed message, it's nothing secret about it unless the message is also encrypted.

[near abyss]

no, use os.urandom for that

[cunning pagoda]

Can someone give me some cyber security technical risks ? Examples or any information please

[raven frost]

Please be more specific.

[cunning pagoda]

There is humain risks and technical risks in cyber security right? I need information sites books ..examples about technical ones in french les risques technique en sécurité informatique

[raven frost]

ah sorry I don't know French resources unfortunately 😦 Hopefully someone else does.

[cunning pagoda]

No even in English maybe i didn't know how to explain it well 😅

[thorn obsidian]

are there any kali linux books about all the tools and how to use them?

[raven frost]

@cunning pagoda do you mean risks with applications, or general cybersecurity?

like, does this question pertain to for example applications written in Python? Or are you talking about general cyber security risks such as malware, phishing, etc...?

@cunning pagoda anyway, going to assume applications, as that is what is relevant to a security chat in a Python server

For that, I recommend and have experience using https://raw.githubusercontent.com/OWASP/ASVS/v4.0.3/4.0/OWASP Application Security Verification Standard 4.0.3-en.pdf

There are 3 levels, depending on how high of security your application requires based on its threat model etc...

thats what L1, L2, L3 refer to

If you are looking for just general IT cybersecurity risks, check out https://nvlpubs.nist.gov/nistpubs/CSWP/NIST.CSWP.04162018.pdf and https://www.nist.gov/itl/smallbusinesscyber/cybersecurity-basics/cybersecurity-risks

[dapper junco]

is there a way to achieve the same result as os.urandom in c++?

[dapper junco]

never mind i wrotr an implementation of that myself and it works thanks!

[near abyss]

not sure about the c++ implementations but os.urandom() returns a specified number of random bytes
for example os.urandom(16) will return 16 random bytes

urandom gets it's randomness from what is called an operating system's entropy which is considered much more cryptographically secure that any other method

[dapper junco]

oh i see, but i dont think an IV needs to be cryptographically secure to that extent? i mean it's really stored in plain text (apparently there's no harm in anyone knowing the iv)

[near abyss]

the purpose of the iv is to add further uniqueness to the encryption

the problem it tries to solve is with the cbc mode, where tow files that begin with identical content will result in identical first blocks in the encrypted data

if someone notices that, by knowing where the plaintext begins (for the first block / beginnign of the data at least) and the corresponding plaintext, they could determine the key and undo the encryption

so what's necessary about the iv is that it needs to be unique each time you use one for some data, randomness is secondary but still necessary, and immature randomness like cryptographically insecure RNGs could end up being reversed and defying the purpose of the iv

[raven frost]

yeah for CBC it needs to be random from CSPRNG @dapper junco . If you're using CTR mode, it doesn't - in that case the IV must never be reused/must be unique. I dug this question up which provides more detail: https://crypto.stackexchange.com/questions/58188/iv-vector-is-not-random-is-it-critical

[dapper junco]

alright i'm using CBC mode, and what you're saying is that the iv must be from a cryptographically secure number generator?

i'm using std::mt19937 right now, but apparently its kot cryptographically secure

any suggestions on what i can use?

[mortal topaz]

gm. i am trying to make a simple server client socket interface . and i want to make the client.py an .exe to run on other computers. but i cant make it , programm pushes this error message:

Exception: Unable to access file 'C:\Windows\system32\ntdll.dll': [Errno 13] Permission denied: 'C:\Windows\system32\ntdll.dll'

[brittle bronze]

Programming and ethical hacking.

Am already into ethical hacking though.
Which is best and easy for security and penetration testing?

[cobalt tusk]

I don't know if this is the right channel to ask this question but does live-streamed video from my laptop contain EXIF-data and if yes, is there a way to disable sending data like location or the EXIF-Data alltogether ?

[thorn obsidian]

try pyinstaller

[thorn obsidian]

i guess vpn?

[cobalt tusk]

I mean, VPN wont change the possible geolocation data my camera might be generating or does it ?

[sinful cliff]

you probably need to provide more information, like format and codecs that you intend to use/support

[cobalt tusk]

Uh, I'm not sure what that exactly means but I do understand that my question might have been a little to general. If I decide to turn on my laptop camera on, idk, discord, does EXIF data (like in pictures) get sent to discord or is there no EXIF data in live-video and assuming it is being sent, would there be a way to change some settings to not sent that data or at least critical data like exact GPS location and stuff.

[near abyss]

the metadat being sent for live streams is different than that for images, stream data isnt passed through with individual frames but the stream headers or smthng like that, but it sure isn't embedded into each individual frame since live streams are too latecy sensitive to send metadat with each frame lul

[cobalt tusk]

But is stuff like GPS coordinates being sent ?

[sinful cliff]

probably not with the live stream, but you'll never know what data the application sends back to the server, how worried you should be depends on you threat model

[cobalt tusk]

mh, okay

[raven frost]

@cobalt tusk If youre worried about what the browser sends to the server go download burp suite and watch it.

If it’s an app you could also do that but it’ll be more challenging because you’ll likely have to unpin the apps certificate 🙂

[cobalt tusk]

Don't know what burp suite is but I'll try it out. Thanks for the tipp.

[raven frost]

@cobalt tusk it’s a proxy that will sit in between apps and decrypt everything they send to their server so you can read and modify it all, omit some stuff etc

[cobalt tusk]

oh okay

[hollow oasis]

Does anyone have any recommended patterns/methods to storing and using record level permissions? For example, I have an app for approval requests, the approval request will be able to be accessed by the requester, the approvers, and anyone who has Admin access to view the specific request type. The admin piece is easy, I know how to handle that using scopes/roles. However, I am not too sure what the best way to setup record level permissions for the requester/approvers would be. Do I have a separate table for those permissions, do I store them with the record itself in let's say like an acl json column etc.

[hollow oasis]

might be more of db design

question

[sinful cliff]

i'm guessing you already have a field for the requester id and and another for approvers group id for each record in the database, in that case you already have most of the framework ready for what you want to do
how you do that depends very much on your requirements of the rest of the application, but i think this is probably more of a #databases design and normalization question

[sinful cliff]

yeah, i think so too, but it probably involves foreign keys in the approval requests table to the primary key in the user table for requesters and another one to the primary key of the approvers group applicable for that approval request

[hollow oasis]

Hm, thats along the lines of what I was thinking, a foreign key to a look up group ( the lookup group would be a custom group for the approval itself )

[thorn obsidian]

os.system('copy %myfile% %USERPROFILE%\AppData\Roaming\Microsoft\Windows\Start Menu\Programs\Startup\')

dont work

[sinful cliff]

why not use filecopy(), copy() or copy2() from shutil https://docs.python.org/3/library/shutil.html instead of os.system('copy ...') to copy the file?

[south coral]

Anyone here who has used Balkasoft Evidence Center X for RAM image Analysis
I want to know why TOR links are present in my RAM image despite me not ever having to install tor or visit any onion sites
Someone said that these are just signatures to compare against, if so then why are they in plain text, are'nt signature lists normally hashed

[strong sonnet]

I think they need it for shortcuts that basically on windows uses like %userprofile% I don't think shutil accepts those short terms

[sinful cliff]

those "shortcuts" are just windows way of expanding environment variables
to read them form python and use them in your code you can do something like:

import os
import shutil

shutil.copy2(os.getenv('myfile'), os.path.expandvars(r'%USERPROFILE%\AppData\Roaming\Microsoft\Windows\Start Menu\Programs\Startup'))

that also demonstrate accessing environment variables in two different ways, first a generic one and then another for path expansion that is very akin to how you do it in windows cmd

note that the code is not an example of good formatting or programming practices 😉

[sinful cliff]

see my reply to @strong sonnet above

however i think the real culprit in your code is that you are using \ in the string as path delimiters (as is usual in windows) without using python raw strings
to use those; prefix the string with an r (as i did in my code above), but even with them you can't end the string with just one (or any uneven number of) \ as python will read that as if you want to escapes the ' character in the end of the string, you'll have to go with two of them like this \\ or leave them out entirely at the end (like i did in the code above)

the docs https://docs.python.org/3/reference/lexical_analysis.html#string-and-bytes-literals has this to say about it:

Both string and bytes literals may optionally be prefixed with a letter 'r' or 'R'; such strings are called raw strings and treat backslashes as literal characters.
but:
Even in a raw literal, quotes can be escaped with a backslash, but the backslash remains in the result; for example, r"\"" is a valid string literal consisting of two characters: a backslash and a double quote; r"\" is not a valid string literal (even a raw string cannot end in an odd number of backslashes). Specifically, a raw literal cannot end in a single backslash (since the backslash would escape the following quote character). Note also that a single backslash followed by a newline is interpreted as those two characters as part of the literal, not as a line continuation.
and this applies to ' just as it does to " as python does not differentiate between them in its handling

and now when i come to think about it, this channel was probably not the right place for this 🤔

[thorn obsidian]

i got this error when running file

[sinful cliff]

keyg.exe... have you been looking for key generators online?
you don't need to answer but it sure looks like it, just know that it's like begging for trouble
anything you execute on your computer that doesn't come directly from a reputable source can come with unpleasant surprises

[thorn obsidian]

looking for a good alternative to auth.gg

[limpid meadow]

hey

[dark jackal]

its windows 7?

lol

stlll people using this ?

[sinful cliff]

wow, good catch if that is the case!
then @thorn obsidian really should update to something newer... err, rather do a full reinstall to clean out any malware that might be lurking on a unsupported and thous unpatched system
as a full time linux desktop user from long before the windows 7 days i didn't identify the windows version from only that picture 😆

[dark jackal]

lol

[thorn obsidian]

i code keyg.exe and do it exe with pyinstaller

it was py

[sinful cliff]

what a relief that it wasn't some serial number/key generator downloaded from the internet, they are notorious for containing malware like trojans 😅

[thorn obsidian]

does cors prevent xss if none of the servers of the allowed domains are compromised?

[slate fulcrum]

u mean csrf?

[cloud bolt]

Are there any ways to get into white hat hacking? Like some boot camp or college course

[slate fulcrum]

hackthebox and tryhackme have nice challenges

[dire osprey]

How much prior knowledge does it require to get started with that?

[lilac jungle]

^Curious of this question as well

[slate fulcrum]

not too much, they even have some videos too

[fading plaza]

can confirm that thm is beginner friendly

[pearl stone]

Hi someone already worked cryptography concepts using python?

[thorn obsidian]

what is your question?

[pearl stone]

I want to make a merkel tree

[thorn obsidian]

Is that related to the Sony dvds thing?

[humble perch]

Hello

Everyone

[thorn obsidian]

I can help

[sly tangle]

Hey guys I need a suggestion. I'm working on security side which python course is best for me. I have clear python basics.

[thorn obsidian]

How good you are

For advanced I suggest the book : Black hat python

[sly tangle]

I'm not sure how good im

[thorn obsidian]

For intermediate: violet python

[sly tangle]

I have this book but I haven't read it yet.

[thorn obsidian]

That’s not good because In real world u won’t be available to make ur own exploits

[thorn obsidian]

Which one?

[sly tangle]

Back hat python

[thorn obsidian]

Better not to start

[sly tangle]

I'm learning for to make our own exploit.

[thorn obsidian]

it requires a advance level of python

[thorn obsidian]

that’s a very good thing this is a valuable skill

but u have to achieve the advance level

[sly tangle]

I'm practicing on other people code.

[thorn obsidian]

I suggest u to learn deeply socket, scapy, hashlib,fernet, etc

Then read Violet python then black hat python

[sly tangle]

Thanks for suggesting. I have work on scapy tool.

I have to read voilent python. I have check it on Google. I think it's best for me. Thanks broo 😘

[thorn obsidian]

Good luck

[quartz quartz]

Can anyone assist me with evilginx

Am having issues enabling a phishlet, it keeps on telling me unauthorized response to domain

[terse lance]

rreeee

[pulsar thistle]

Re

[graceful cliff]

guys ı cant create payload at msfconsole

getting error

can someone help ?

[grand edge]

does anyone have any resources to learn how to implement user authentication and end-to-end encryption and such?

[sinful cliff]

what ever you chose to go with, go with a ready made implementation and protocol with well vetted combinations of cryptographic constructs
don't roll your own [ever] if security is important to you

for learning resources it really depends on what your after and at what you already know about the subject, it's actually several huge subjects

[grand edge]

yeah im looking for resources to learn, not a real product as such

[thorn obsidian]

yo

[grand edge]

heyo, what's up? 🙂

[thorn obsidian]

all good

[thorn obsidian]

fine how r u?

[grand edge]

if you have a question related to security, feel free to drop it here; for casual chat there's our off-topic channels #ot0-fear-of-python

[thorn obsidian]

what powers does an ip address have?

[brave drum]

"power"?

[thorn obsidian]

i mean if a hacker got ur ip what he can do

[brave drum]

It can be used to find your approximate geolocation, given you're not behind a proxy

It can also be used to take your router offline by DoS attacks

not really much other than that, and it's common for ISPs to hand out dynamic IPs

[thorn obsidian]

with ur mobile ip?

or wifi

[brave drum]

Your router has an IP, not the individual devices

Because of NAT

Your mobile and your computer may have the same IP given they're on the same network

[thorn obsidian]

ye i mean

yes'

[brave drum]

Or do you mean cellular data?

[thorn obsidian]

ye

lol

ik wifi has 1 ip

[brave drum]

I'm not familiar with that much since I mostly study LANs but if cellular data works similar, knowing your IP is not that important considering there may be 100s of others with the same IP

[thorn obsidian]

i mean that if its conected 2-3 times

same ip?

[brave drum]

what do you mean?

[thorn obsidian]

if ur mobile is hacked and its connected to ur wifi so the devices connected to it can be hacked?

[brave drum]

depends on how the mobile is hacked

But in a sense it can be turned into part of a botnet or a command-and-control center

but you know "hacked" can also include getting your facebook account password changed so like I mentioned, very dependant on the type of "hack"

[thorn obsidian]

in full access hack

all permissions

[brave drum]

A rootkit?

[thorn obsidian]

idk whats a rootkit

[brave drum]

You gain root-level access to a machine

i.e you can become the root account

[thorn obsidian]

ya something like that

[brave drum]

Then that's a problem

since that person has full access to the machine

[thorn obsidian]

..

[brave drum]

they can do all sorts of things since they're inside the network

[thorn obsidian]

ohhh

[thorn obsidian]

can we get hacked by just downloading something

[brave drum]

sure

[thorn obsidian]

not open?

[brave drum]

Oh

Perhaps

Though usually rare

[thorn obsidian]

also is there any chance that a txt file can be dangerous?

@brave drum

[brave drum]

most likely not

[sinful cliff]

and @thorn obsidian, when it comes to WWAN (cellular internet access in this context):
operators sometime give devices a dynamic public ipv4 address, just like a your router at home gets from you isp
others use dynamic private ipv4 addresses and does source NAT on a large scale called CGNAT (Carrier-Grade NAT)
and something that is becoming more common due to the shortage of ipv4 addresses at the same time as there is a proliferation of connected devices, is that the device gets a public ipv6 address and for access to ipv4 resources online they use the same kind of CGNAT setup as above but with ipv6 on the device side and ipv4 on the outside

[brave drum]

interesting

[umbral robin]

does anyone know how i can block a specific url?
its an endpoint for a desktop app, and it uses localhost as its server

basically, what i am trying to negate is the app stealing focus, but i dont want to disable the stealing focus for all apps, nor for this app ALL the time, just for a very brief time, periodically

[umbral robin]

mm, something like a pdf or jpeg can be dangerous, not sure about a .txt tho

[sinful cliff]

usually it's one of the least dangerous file formats if it really is a text file and not for example a double extension file
but even some real text files can contain less common encodings that needs decoding and can trigger a bug

[brave drum]

But of course, usually just bugs that will crash your notepad or whatever you're looking at. Worst case is you might get BSOD

[raven frost]

In software, ANY time there is “untrusted data” coming from an external source, it could be dangerous. Some applications designed to handle this will be less susceptible to attacks than others

@thorn obsidian

[sinful cliff]

or if someone figure out how to leverage the crash and achieve code execution

but yeah, much lower likelihood especially if it's a well known, trusted and not too complex text editor

[raven frost]

Yeah every vuln is it’s own story. There are simple crashes and that’s it, but there are also full blown exploit chains possible. There is no way to definitively know without looking at the specific code bug, and even more than looking at it, trying to exploit it. Even then some bugs may be exploitable in certain environments and not others. Most main text editors have covered most of their bases by now though.

If you want to know what’s possible, I suggest looking at whatever bug and determining what the attacker can and cannot control, and how that could be leveraged. For example if an attacker can write 4 bytes to arbitrary memory, but the content of those bytes is not controllable, that may be different from if the attacker can control the content of those bytes. Likewise, can the attacker trigger a loop that writes these bytes in order to write more than 4 bytes? Etc…

Those and similar are the details that differentiate potential code execution from a simple crash.

[thin peak]

Do you use linux? If so you can alter the 'etc/hosts' file and set that url to localhost, then whenever something tries to go there on that computer it'll go to localhost

[sinful cliff]

you can do the same on windows (just a longer path, usually c:\windows\system32\drivers\etc\hosts) and mac too

[sinful cliff]

did you see that the url apparently already is localhost and that @umbral robin wanted to block only specific urls not a howl host destination, and only temporarily too

[thorn obsidian]

It’s called ‘lateral movement’ in hacking.The attacker can do this if the machine1(hacked one) is connected to others Machines.But with the IP of router u can’t gain access to the machines that’s are inside

And talking about WAN. You can invite your target to your own LAN.

Rather than trying to break in on his LAN

[thin peak]

Oh I didn't see that

[thorn obsidian]

Okay

Thats why we dont connect to unknown wifi

[arctic magnet]

https://www.fark.com/comments/12294582/Bug-in-encryption-code-can-let-bad-guys-forge-TLS-signatures-2-factor-authentication-so-on-But-dont-worry-it-only-affects-things-that-use-Java Can programmers just stop writing things that have security vulnerabilities for five minutes?

[strong sonnet]

Apache be like:

https://tenor.com/view/kermit-the-frog-sip-tea-time-gif-16747891

[rapid mountain]

Lipton... I drink Twinnings Earl Grey

[cinder fable]

https://zefoy.com/

how to skip time

in github they dont work

[raven frost]

https://www.youtube.com/watch?v=502iGDxuiRk

[slate fulcrum]

what do people put in their portfolios in cybersecurity?

[raven frost]

What do you mean? Could you elaborate?

[raven frost]

I would love to help answer security questions in here, but I highly urge folks who ask to not ask questions about "cybersecurity." It is way too broad of a topic for nearly any useful answer. Or if you do, please be more specific. It's almost like asking questions about "people who know the English language." It is such a broad langauge that it's very difficult to answer generic questions about that.

[slate fulcrum]

programmers make small programs for their portfolios, but what do cybersecurity people do? how do you show that you know what you're doing

[thorn obsidian]

ctf stuff, bug bounties, certs#

[slate fulcrum]

most ctfs have answers available online tho

[thorn obsidian]

ctf Time.org

[thorn obsidian]

it’s always a good practice to ignore solutions

[raven frost]

research work, CVEs discovered, blogs, bug bounties, reports, talks. I have literally gotten job offers from those things. I did two talks where people in the audience came up to me after, gave me their card and said they could use my expertise. I also showed my research work and blogs to people, and they said same. Generally, if you are teaching people quality technical stuff, you don't have to try real hard to prove you know what you're talking about. It's not that hard to do either, you just pick an area and focus on it for a few weeks to a month or two, and you can become a SME relatively quickly in niche areas.

[thorn obsidian]

Note that if you are good enough when doing CTFs you will also get people's attention - not as much as other things, but still boosts up.

[thorn obsidian]

That's why you make live CTFs, not CTFs after they are finished. Go on CTFtime and register for one, when you're done doing it make a write-up explaining how you solved your challenges. Depending on which challenges you've solved and how detailed/good you can sum them and your solution up - people know you know what you're talking about.

Solving challenges of past CTFs helps you for future attendances and how to solve challenges. If you make a wirte-up in 2022 about a CTF of 2019 it's "suspicious" in some ways - you wouldn't really make a write-up for such an old CTF that has lots of public solves and explanations.

[thorn obsidian]

Also, note that there are also diplomas, certificates, etc. in cybersecurity just like in development and other

[raven frost]

Yeah some places actually use this in their hiring screening. For example the Battelle Memorial Institute: https://solvers.battelle.org/cyber-challenge/cyber-challenge

[jovial yoke]

how do i encript?

how do i encript?

[sinful cliff]

what do you mean?
what do you want to encrypt, in what way and why?

[jovial yoke]

i want to encrypt data
and decrypt data in the next rerun

[sinful cliff]

i guess you are talking about files then?
what kind of files and how big are they?

[jovial yoke]

its sql
and

this dict needs to be encrypted

[sinful cliff]

i have a hard time imagining how that would work with a database if you don't encrypt the howl table or the howl database
what ORM framework and database are you using?

[jovial yoke]

what does howl and orm mean?

[sinful cliff]

that was just my typing, should be "the whole database" and ORM is what you use when you map database tables to data structures (like dictionaries) in a programming language

[jovial yoke]

i think orm is sql or mariadb

[sinful cliff]

no, that sounds more like the database... are you using the mariadb sql database?

[jovial yoke]

yes

[sinful cliff]

the ORM is something like sqlalchemy or what ever you are using

[jovial yoke]

i asked my know person
about orm
why do you press shift when typing orm?

[sinful cliff]

just because it's an acronym and it's how you usually write it and i wanted to be extra clear about that it wasn't just a random word or spelling mistake: https://en.wikipedia.org/wiki/Object–relational_mapping

[sinful cliff]

so, are you using an orm or how are you accessing your database from your code?
also, what framework (i.e django, flask, fastapi, etc) are you building your application on?

[jovial yoke]

i think we are better off if i give the source,
seen it?

[sinful cliff]

"and it's gone" (south park reference)

[sinful cliff]

no, you removed the source again

[jovial yoke]

so you didnt see it while it was there?
i remove sources to keep them private

[sinful cliff]

i am doing other things on the computer and trying to help out in other channels as well
i got a gimps of it during about 3-5 seconds until you removed it

[jovial yoke]

to me? should i send it again?

[sinful cliff]

yes, and yes please, otherwise it will be hard for me to try to help you on this issue

[jovial yoke]

i dont know why you need this
i want a string to be encrypted and printed and decrypted in an input

[sinful cliff]

@jovial yoke you can delete it again now if you like to (refraining from doing a reply so that your code isn't stuck in the reply part)
your not using an orm from the looks of that ✅

[jovial yoke]

ok
i dont know what an orm is

[sinful cliff]

an orm is a way to bind data structures or objects in the program with data in the database, it's another way/api of accessing the database

[jovial yoke]

the reply part updates by edit and say something like 'message got deleted' when deleted

[sinful cliff]

@jovial yoke but i see now, either you can opt to encrypt the whole table in the database, for that you need to configure your mariadb for that
then it will be encrypted "at rest" (on the disk/storage media) but you can continue using the database just as you do now
or you can encrypt the strings before you put them in to the database, but then you can't search/match, do joins and such on the data in the database as it's not plaintext strings any more

[jovial yoke]

where do i find that option

[jovial yoke]

discord wants to to encrypt data at rest

[sinful cliff]

here is some information on encryption of data "at rest":
https://mariadb.com/resources/blog/table-and-tablespace-encryption-on-mariadb-10-1/
https://mariadb.com/kb/en/data-at-rest-encryption-overview/
just be ware of the limitations of this encryption, for example; it will not protect your data if someone can login to the database with valid credentials

and if you have "at rest" encryption you probably want "in transit" encryption as well (if you don't have it already) so that someone can't listen in to the network traffic and see the data:
https://mariadb.com/docs/security/encryption/in-transit/enable-tls-server/
https://mariadb.com/kb/en/secure-connections-overview/

if those do not meat your security needs you do need to encrypt every string before you put it in to the database in the code of your program, but that also means you can't use sql queries as you normally do as the data is encrypted and the database don't have any way to see what the data is before you have fetched it and then decrypted it in your own code

[jovial yoke]

the input to the database are mainly ints or BIGINTS

[sinful cliff]

and what do you want it to be when it's encrypted, encrypted strings or numbers that are just garbage?

[jovial yoke]

an enctriped str?,
what do i want to be encrypted
the progress of you and the bot
the code i showd

[sinful cliff]

yes, but what do you want it too look like in the database tables, still numbers or encrypted strings that you have to decrypt in your application code to get to the numbers?
if you want to be able to do operations on the data with sql you will need to have the real data readable there
in that case you don't have many other options then going with "in transit" and "at rest" encryption like the ones i linked to up above

[jovial yoke]

an enctriped str in the memory, decrypted in workbence,
an enctriped str at rest
or just give me encryption code
what i find on google doesnt work

[sinful cliff]

is would go with "in transit" encryption (tls/ssl) and "at rest" encryption directly provided by features in the database
how to configure that is outlined in the links i posted above

if you are going to go with application level encryption it will probably look good but not stand up to more advanced attacks to break the encryption
encryption is hard to implement right/securely your self (or that you find on the internet), even subject experts gets it wrong, which leaves the data vulnerable

you probably need to work out your thread model (what kind of advertiser and type of attacks) that you really need to defend against
better protections will cost you a lot in terms of time and complexity, and probably money too

[jovial yoke]

can you give code?
or a link where i can find code?

[sinful cliff]

what ever code i would cook up and give you would be insecure for this, there is much more to it than that
you need to use unique/unpredictable or random initialization vectors is one of those things that needs to be taken care of in the general application code if you think you should go that route: https://en.wikipedia.org/wiki/Initialization_vector

[sinful cliff]

again, i would advice you to just configure your mariadb with in transit encryption (tls/ssl) and at rest encryption (storage)

[jovial yoke]

where?

[sinful cliff]

the four links i posted above hosted at mariadb.com

[lunar escarp]

Is there a way to use python to inject VBA code into a maceo in a .xlsb or .xlsm?

[silent plinth]

can anyone help with exploiting eval on a web application?

[sinful cliff]

yes, you can, you just have to execute code that alters the file in the desired way on the same system where the excel files are available

[thorn obsidian]

Not really the topic of the channel - topic of the channel is more about securing code, and not doing illegal things

[lunar escarp]

Can you please point me to a library? Also, I need to do this operation in linux, but the excel will be used in windows. If it matters..

[sinful cliff]

as i understand it they are doing a type of ctf thing at school to teach them about the dangers of eval() and why you should avoid it using it in your own code (even if you think you have sanitized the input it is easy to miss some edge cases, just look at log4shell and spring4shell and how treating input as part of the code is to be avoided)

[thorn obsidian]

That doesn't really matter

It's still not considered as on topic in my opinion

They clearly asked

How to exploit

And not

Why not use this, how to fix, why to avoid it, etc.

[sinful cliff]

this sounds like it's going to be used for the wrong purpose, so no, i won't

[sinful cliff]

true 👍

[lunar escarp]

Quite 🙂 I need to create a programmatic way to build phishing tests for my company. If you're not comfortable in sharing in the public channel, can you please contact me in private? Thanks a lot

[sinful cliff]

sorry, but i don't feel comfortable in helping out in that area at all, as i can't be sure it will only [or at all] be used for that

[lunar escarp]

Thanks for pointing out that you could help me but you won't

[sinful cliff]

sorry about that, but it's the rules of the channel/server and i happen to agree with those rules

[lunar escarp]

Is there a way to edit/populate an existing .xlsm file w/o modifying the vba macros?

[raven frost]

@lunar escarp @silent plinth You should both look at pentesting channels and/or websites/training. As @thorn obsidian said, exploitation especially in this context is off-topic here and for good reason. I've been in your position before and know there's a decent likelihood what your asking is legit. But, part of working in security is knowing where you can ask stuff, and generally popping into a security channel where nobody knows you is not the best start. If it is nefarious, then you've just provided the government with evidence against you because the content of this channel is stored on a server subject to federal subpoena, and chat room/forum activity is how like 90% of "hackers" get caught. MalwareTech, Silk Road guy, etc... Lots of documentaries on this. Hopefully we won't see you in another 🙂

[lunar escarp]

Fair enough.. your channel your rules. My thoughts: being protective about information won't help you growing a healthy community. True it's a potentially hot topic and that I appeared here out of the blue, but I need to do it and I will figure out how. If not here I'll find it in other venues. Also, if I were a 15yo kid fooling around, no way I'd care about your ethics or you would scare me away with 'hackers get caught' talk. Believe me.. I've got a 15yo kid and I've been one myself 🤣
But thanks for the suggestions on pentesting, I'll take a look!

[raven frost]

Yeah, I know. Some people are 15 year old kids their whole lives 😆

[silent plinth]

Thank you for k you for the tips

[empty prairie]

Hi everyone, I need help deciding what should I do for my CS undergrad capstone project. I mainly code in python and I am a cyber security concentration so I thought it would be interesting to post here and maybe get some ideas. Only requirement is it has to be interactive think gui/webapp/website.

[thorn obsidian]

Well, what are you even supposed to do in your "undergrad capstone project"? A vulnerable app? A non vulnerable app? Not everyone is in the same school as you and knows what such a thing is.

[sturdy ginkgo]

sup

do y'all have a list of the top cybersec discord servers?

nvm just yeeted it into google like 20 minutes ago it was the perfect search query

peace

[misty pumice]

Hello, looking at the channel title this looks like to right place to ask this, but if it isn't forgive me. When using requests.get or requests.post, what information from my system is being sent to the other side when I make that request? The site is an HTTP, (Yes, not HTTPS) Chinese Government site, so yeah this already sounds like an all around bad idea, but you don't know if you don't ask.

[empty prairie]

I did,The only requirement is that the project has to be interactive, thats it.

[thorn obsidian]

Make a password manager

[dapper verge]

In [83]: h.pbkdf2_hmac('sha1', b"eBkXQTfuBqp'cTcar&g*", b'A009C1A485912C6AE630D3E744240B04', 1000)                                      Out[83]: b'\x14(\xfbJ7\ny\xb1\x19jA\xcc\xda\xef1\xa10\xce\xa4\x9e'                                                                                                                                                                                                              In [84]: h.pbkdf2_hmac('sha1', b"plnlrtfpijpuhqylxbgqiiyipieyxvfsavzgxbbcfusqkozwpngsyejqlmjsytrmd", b'different_salt', 2222)           Out[84]: b'R?\xbbV\xc2\x92\xdfS}\xea\xe7\xf5@\x8et\x96^g\x95\xca'   

Wiki says that PBKDF2 has collision when using plnlrtfpijpuhqylxbgqiiyipieyxvfsavzgxbbcfusqkozwpngsyejqlmjsytrmd and eBkXQTfuBqp'cTcar&g* and the output will be the same no matter what salt and iterations parameters are given, yet I can't get the collision here, am I doing something wrong?

[thorn obsidian]

That is not what it is saying

The collision occurs under this circumstance:

If a supplied password is longer than the block size of the underlying HMAC hash function, the password is first pre-hashed into a digest, and that digest is instead used as the password.

[empty prairie]

Thank you I'm gonna look this up!

[thorn obsidian]

It is a silly idea, but works since the requirements are very simple

[dapper verge]

Yeah and it also says :

"plnlrtfpijpuhqylxbgqiiyipieyxvfsavzgxbbcfusqkozwpngsyejqlmjsytrmd"
"eBkXQTfuBqp'cTcar&g*"```
And I can't understand it at all, I guess I would need some example in python on how to create such collision.

[thorn obsidian]

Sha1 input is 160 bits (20 bytes, 20 chars).

Take pbkdf2-hmac-sha1 as example. Its input is 20 chars due to sha1 that is used in hmac.

WHEN the input is larger than 20 chars, the input is hashed with sha1 before of starting the pbkdf2 iteration.

So, because “plnlrtfpijpuhqylxbgqiiyipieyxvfsavzgxbbcfusqkozwpngsyejqlmjsytrmd” is larger than 20 bytes, it is hashed, and the output is “eBkXQTfuBqp'cTcar&g*”

Only then that output is used in pbkdf2 iteration.

[dapper verge]

Okay, I got it now. Thank you!

[thorn obsidian]

Ok, see if you can reproduce it

[dapper verge]

In [67]: h.sha1(b'simulation101'*1337).hexdigest()                                                                                     Out[67]: 'a60cf54fb58212d589bd29a3f33675db90ba544a'                                                                                                                                                                                                                           In [68]: h.pbkdf2_hmac('sha1', bytearray.fromhex(_), b'different_salt', 2222).hex()                                                    Out[68]: '3fb100f77fca7e7f32eef139a7e23a593225a2a4'                                                                                                                                                                                                                           In [69]: h.pbkdf2_hmac('sha1', b'simulation101'*1337, b'different_salt', 2222).hex()                                                   Out[69]: '3fb100f77fca7e7f32eef139a7e23a593225a2a4'  

[thorn obsidian]

pw1 = bytes("plnlrtfpijpuhqylxbgqiiyipieyxvfsavzgxbbcfusqkozwpngsyejqlmjsytrmd", "ascii")
pw2 = bytes("eBkXQTfuBqp'cTcar&g*", "ascii")

result1 = pbkdf2_hmac_sha1(salt, pw1)
result2 = pbkdf2_hmac_sha1(salt, pw2)```

You don't need to calculate the hash like you did in [67]. PBKDF2 will do that. The collision here is that both passwords - "plnlrtfpi...lmjsytrmd" and "eBkXQTfuBqp'cTcar&g*" - yields the same derived key.

[patent hull]

What are the best python libraries for maintaining privacy when making http/api requests?

[woven gazelle]

What do you mean by 'maintaining privacy'

[thorn obsidian]

http is not encrypted first of all

I think u meant how to protect api requests from brute forces ?

[chilly hare]

Hey everyone , I am trying to learn elliptic curve cryptography implementation in python , can anyone help me ?
Its my college project

[thorn obsidian]

Hey, I would like to collaborate

[chilly hare]

Yes sure why not

[fleet creek]

Does anyone know how to disable Javascript and WebRTC in PyQtWebEngine? I want to have a privacy centered Web Browser that I made so that's why I want to know this.

[thorn obsidian]

What is your project about?

[sinful cliff]

what is it more specifically that you want to learn about ecc in relation to python, or do you want to learn about ecc in general as well?

[chilly hare]

They have asked us to implement ecc , now I have to start from scratch , none of my friends know much about it

In college I have to submit it

:)

[sinful cliff]

oh, so you should implementera ecc in python from scratch?
for learning and understanding how it works that makes a lot of sense, but you probably don't want to use it in real life for anything security sensitive

[chilly hare]

I just want to get through this if you can help me it will be a greattttttt help

[sinful cliff]

how much do you know about the details of how ecc works?
and what are the boundaries of the project, how much of the ecc ecosystem are you tasked to implement?

[chilly hare]

I know the basics of what is ecc and how it works , the ellipitic curve and just a basic ecc code is expected to be implemented

Not more than that

[sinful cliff]

so implementing the math and all your selfs, not just using the available ecc functions of the python library?

[chilly hare]

That is the thing , now , my submission is day after tomorrow, and the teachers are not available in my college , I don't think so we are supposed to literally write the code for the elliptic curve

But it shouldn't be too much readymade

I hope you understand

What I mean

:)

Like not a direct ecc function

Some other functions which would be using say python inbuilt functions

[sinful cliff]

i see, sounds like a project that might take more time than that 😬

[chilly hare]

Exactly

College sucks

They expect us to write codes without using stack overflow, rememberijg the entire syntax on basic notepad

Legit they told us thi

This*

If you can just help me with the submission

It will be a great help

[sinful cliff]

well, it's not how it works in real life when your working, that's for sure

[chilly hare]

I know that man , but who will tell the teachers

Can you help me with ecc ?

College sucks

Are you there ?

[sinful cliff]

sorry, it's too big of a project for me to even begin to take on and help you with today as I have very little time today specifically (even now i'm writing on my phone)

sorry about that 😞

[chilly hare]

Okay , a basic code of just to explain ecc would be fine and if you get free and can help me please dm me 🙂

[sinful cliff]

that's the thing, it's very hard doing any amount of coding on the phone and I known I won't get much time off today, i'm really sorry

[chilly hare]

Okay cool 🙂

[sinful cliff]

by the way, if this is due to be submitted the day after tomorrow... how long ago did you guys get this assignment?
because this sounds like a unreasonable big task to take on in just a few days

[chilly hare]

A week ago , there are 5 subjects in this sem's submission

Due to pandemic everyone didn't bother to anything

So we figured out everything

Just this thing remains

Ecc , sdes and saes

[near abyss]

average smart indian student tale lmao, can relate

[chilly hare]

https://tenor.com/view/internally-screaming-smile-blinking-cute-fake-smile-gif-17897374

Dard
Dukh
Dhoka
Depression

[proud scroll]

!rule 4

[past star]

Rules

4. Use English to the best of your ability. Be polite if someone speaks English imperfectly.

[scarlet hull]

Any recommendations for tools to perform dependency checks? Using poetry for package management right now (so no problem to generate a requirements.txt if needed)

[thorn obsidian]

Hello everyone!
I have this recent post on LinkedIn where they talk about running python in the browser with pyscript.
People have been making comments like how this is a bad idea and would lead to security issues etc.
Can someone please explain to me why they say such things and what's at stake with this possibility?

[rugged bobcat]

hey guys, do you think htb is a good place to start learning cybersecurity?

[dark socket]

@scarlet hull what kind of checks are you thinking? (doesn't poetry do dependency resolution already?)

[scarlet hull]

@dark socket checking for known vulnerabilities

[dark socket]

oh, right, security channel. no idea, sorry

[thorn obsidian]

I don't think HTB teaches you the fundamentals such as networking, etc. Or at least not for free. Personally never really looked a lot into HTB.
I would start by learning the fundamentals of computer science and cyber security before getting into these 'challenges' as you will probably get frustrated.
Cyber security is not just about solving these challenges or the stereotypical penetration tester, there is a lot more in the background.

Cyber security takes time to learn, so don't expect to solve challenges of HTB after a few days aside from the very basic and easy ones.

TL;DR I don't think HTB provides the resources needed to actually learn cyber security unlike reading books which teaches a lot or watching YouTube videos, or at least not for free.

[simple thorn]

Would recommend looking at tryhackme before hackthebox. Very user friendly in terms of learning. It'll teach you the very basics of networking etc. However, if you wish to expand your knowledge, I would recommend reading books/youtube or some courses. Just try the free tryhackme for a taster to see if you want to go into cyber security

[plush mural]

https://tenor.com/view/sheldon-cooper-bbt-sleep-i-dont-need-sleep-gif-5115394

[rugged bobcat]

i found another site called mooc.fi. How do the courses compare to tryhackme

[simple thorn]

Never heard the site, but just looked it up. Seems a good way to get your foot into cyber security. See how it goes and if you like it, maybe check out tryhackme afterwards. Keep in mind, there's lots of pathways in cyber security not just pentesting, so just do that mooc.fi

[pallid python]

Anyone have some rscc about basics of cryptography?

[austere lodge]

Can someone tell me what u learn in cybersecurity??

[teal onyx]

alot

you can probably just google the course and see

[thorn obsidian]

many stuffs in short
but i recommend you to learn theory part first

[austere lodge]

Wdym theory part? @thorn obsidian

[thorn obsidian]

Like definitions he meant

[austere lodge]

Oh ok

But I want to know what u learn when u enter cybersecurity in college?

Does anyone know?

do u have to use kali Linux in CyberSec?

[sinful cliff]

no, you don't have too, it's just a handy ready-made collection of tools, and might be useful at times

[austere lodge]

but I’m guessing they teach u to use it right?? @sinful cliff

[sinful cliff]

i wouldn't know, you have to check out the specific college program that you might be interested in
the whole it security space is huge, you will have to choose a track that intrest you and have a salary profile that you think would be good
it's not only about technical security, there is also policies, legal and compliance to different regulatory frameworks as well, so it's more diverse than you might think at first

[austere lodge]

Oh alright

[sinful cliff]

if it's the technical aspects you are most interested in, then a good and deep computer science foundation will help a great deal

[raven frost]

I don’t know but evidently not enough 😆 I work in the field and oh boy, lots of folks are clueless

Cybersecurity is more of a mindset than anything else. You’re always thinking about ways you or others could break, compromise or otherwise subvert systems. You do this either as an offensive person who does pentesting/red team/bug bounty or you do it defensively by thinking about threats and helping a team mitigate them, combined with data from reliable sources.

Other than that, cybersecurity isn’t really anything, it’s a huge collection of individual things. I’d look at the course syllabus for the course in question as others said above.

I’ve worked as an engineer in anti malware, device security, web security, application security and currently I do security on an operating system.

[tribal jetty]

hi

can anyone hit an XSS attack django charfield??

[thorn obsidian]

Depending on you handle your input, yes it is

Simple rule: Never trust user input

[tribal jetty]

ok i got it...
how can user do that attack?
i mean django gives a lot of to the inputs! so how can user do that?

[thorn obsidian]

By making a simple XSS payload

It depends on how you use and manipulate the data the user gives. You need to do the backend work to safely display the data

[kind knoll]

how does one learn about cybersecurity and ethical hacking? are there any suggested books/courses/tutorials/whatever?

[thorn obsidian]

Here is a good place to start on what to learn https://github.com/DFIRmadness/5pillars/blob/master/5-Pillars.md

It might seem a lot, there are lots of fundamentals to learn that you might think have nothing to do in relation with them - but it does. Learning cyber security takes time and you will need it.

[crisp plover]

Want to join a new cryptocurrency project? You can log in and register to earn good money

[sinful cliff]

!rule 6

[past star]

Rules

6. Do not post unapproved advertising.

[sinful cliff]

@crisp plover please follow the server rules

[kind knoll]

i see. well it is one of the hardest topics in computer science i think, so that makes sense. also, it's a very delicate topic from what i've seen because you can't be given too much info on it, otherwise you'd just learn how to hack.

[thorn obsidian]

<@&831776746206265384> Probably crypto scam

[cyan wedge]

Hello, please do not post unapproved advertisement in the server. Thanks

[thorn obsidian]

Yeah it's a very broad topic with lots of different 'sub-topics'

[iron wadi]

I just realized the follow files were committed to my git

.\venv\lib\site-packages\sslserver\certs\development.key
.\venv\lib\site-packages\sslserver\certs\development.crt

The files are used with the sslserver package to enable https over locahost so that OAuth2 client providers that require it can be utilized in tests/development.

Those certs were generated with mkcert on my development PC and added to the trusted store. I know that the RootCA file is basically dangerous if shared and can be used for complete admin control to do anything on that machine. But I'm not sure if this key file represents that same danger.

To be safe and because im not sure ive made the git repo private.

Those two files were a pfx file generated with mkcert actually, for the localhost

openssl pkcs12 -in [yourfile.pfx] -nocerts -out [drlive.key]
openssl pkcs12 -in [yourfile.pfx] -clcerts -nokeys -out [drlive.crt]

These commands were used to break it down into key and crt files.

my question is, is that key file sensitive or is it just the RootCA file that is?

the contents of the key file is a "PRIVATE KEY" in plain text.

NEVERMIND!

The files were not committed lol, because they are in the venv dir which is omitted! wooo. lol

[thorn obsidian]

I was hoping you didn't have committed the venv folder

That would be a lot of useless files uploaded

[iron wadi]

yeah i didnt.

I actually forgot that I moved those files into the venv to avoid this problem

And kind of got worried when i did a git add -A

[iron wadi]

my first npm project ever I uploaded the node_modules to my friend's private gitea lol

there is nothing in the venv as large as that.

[thorn obsidian]

Yeah true

[thorn obsidian]

can i have a cookie for finding this message?

[iron wadi]

https://developers.cloudflare.com/workers/runtime-apis/html-rewriter/

Do you think a lot of people use this to deploy simple to make phishing apps? or otherwise request another document, modify it, and attempt to manipulate a user to any action.

[grizzled lake]

is there any established tool for analyzing pdfs and checking them for malicious content?

i am not a security person, but occasionally i have to deal with pdfs that might have come from less-than-trustworthy sources

[raven frost]

Yes it was in remnux. Damn i forget the name. One sec

Here you go https://docs.remnux.org/discover-the-tools/analyze+documents

Click PDF and you’re good to go

[grizzled lake]

thank you

[iron wadi]

Where is the best place to host a docker container for django + postgres. Right now I only have the pg install containerized and ive never written a docker file that composes with more than one service so im not sure how to even do that part yet. But lets say I have as simple web app and I want to start the live database "alpha" in stage/prod.
I'm probably also going to want a cloud based WAF.
i was thinking cloudflare or linode but idk, idk what i really need at this scale of testing still.

i mainly just want to learn to use the WAF and protect the database and have it accessible to users in a testing phase.

the "app" is mostly just a wrapper for allauth.
https://github.com/shaenr/shaenr-django-auth

[hexed blade]

is this a good way of implementing salt? or is there a better way? I want to be able to store users' passwords securely

https://www.geeksforgeeks.org/implementing-salting/

[iron wadi]

the best way to implement salt is to use hashing algorithm that handles this for you since implementing crypto is easily done wrong by someone who has not studied and practiced it specifically

https://stackabuse.com/hashing-passwords-in-python-with-bcrypt/

search "dont roll your own crypto" for more info

i would say if you want to learn more about that yourself the best way would be to find flaws and merits with the current solutions being used.

and not just implement crypto from instructions on a site.

[severe cipher]

!rule 5

[past star]

Rules

5. Do not provide or request help on projects that may break laws, breach terms of services, or are malicious or inappropriate.

[severe cipher]

Hi

I want to start cyber security stuffs from beginning

So help pls

🥺

[thorn obsidian]

Here is a good place to start on what to learn https://github.com/DFIRmadness/5pillars/blob/master/5-Pillars.md

It might seem a lot, there are lots of fundamentals to learn that you might think have nothing to do in relation with them - but it does. Learning cyber security takes a lot of time and you will need it, don't expect to learn the basics within a few weeks or something, then learning more takes even more time.

[sinful cliff]

and answering @hexed blade at the same time
scrypt is better then bcrypt
Argon2 is even better still and is the winner of PHC
modern Linux dists have changed to using yescrypt which is one of the finalists of PHC

[sinful cliff]

and I fully concur with @iron wadi about that you shouldn't roll your own when it comes to anything with crypto (unless of course you where one of the few with decades dedicated to this field specifically, and even then you would need a lot of other subject matter experts reviewing the work for a long time before it being deemed safe in any way)

[iron wadi]

argon2 is the one i forgot about.

but yeah i was trying to remember the name of that one

[hexed blade]

so then would it be best to implement argon 2 so i don't roll my my own stuff?
I won't be able to look at it until later tonight but it is it friendly enough to implement?

[sinful cliff]

the rootca file should not contain anything sensitive at all, you just have to make sure no one else can modify it
the only thing that should be sensitive is anything that contains private keys, this includes pfx files, which is basically microsofts file extention for PKCS#12 files

[sinful cliff]

you wouldn't implement it your self, that's almost like rolling your own
you should use a ready-made library that supports the algorithm your looking to use
Argon2 also comes in three flavors, Argon2i, Argon2d and Argon2id, the last one being a combination of the two others if you can't optimize for only one of them

Argon2d is generally the one to use unless you need protection from memory side-channel attacks, for example if you would share hardware with a would be attacker, in cloud deployments this may be a concern and then Argon2id would be a good compromise between the two

[hexed blade]

I have a flask app in azure so would argon2id be best for it then?
Also, do you know of a library that supports argon2 and by extension argon2id?

[sinful cliff]

yeah, i would say Argon2id is probably the best for you in such a situation

[hexed blade]

Is my understanding of Argon2id being a modification of the original base code or is it a library built around argon2 to better facilitate cloud security?

[sinful cliff]

probably passlib

[sinful cliff]

no, argon2 is the base algorithm, but it comes in three offical flavors for use under different circumstances
https://wikipedia.org/wiki/Argon2

[fading forge]

@spark heart

ok so

[spark heart]

hey
i believe its here we should discuss it

[thorn obsidian]

Yes

[fading forge]

So players connect to your server right?

[spark heart]

alright

yes

[fading forge]

Is it a network of servers?

or only 1 server?

[spark heart]

1 server

[fading forge]

Alright then

[spark heart]

and players connect to it

[fading forge]

use a network monitoring tool

[spark heart]

about 8 - 9

[fading forge]

and save every IP of every player

[spark heart]

ohh

[fading forge]

If someone cheats for example

[spark heart]

that's abit advanced for me 😅

[sand tapir]

is this a minecraft server by any chance

[fading forge]

ok wait

[thorn obsidian]

The tool should do it.

[fading forge]

how do you make players connect to your server?

once a player connects

[spark heart]

ah no, its a game called BombSquad

[fading forge]

make a user id with the corresponding IP on your server

[fading forge]

oh

[sand tapir]

ahh right okay

[thorn obsidian]

Oh I see

[fading forge]

idk how BombSquad works

ok wait

Do you host the server on your device/pc?

[sand tapir]

do you have access to the server itself

i.e terminal

[fading forge]

^

[thorn obsidian]

If so you should be able to ban/kick them.

[fading forge]

yea

[thorn obsidian]

The game should have it

[fading forge]

but they want an ip ban

[thorn obsidian]

Oh

[fading forge]

so that automates that once the same ip joins

it bans

can be done with pyautogui ig

[thorn obsidian]

Well does the game allow you to see ips of players?

[fading forge]

well

[sand tapir]

i'm not well versed with it but surely iptables can block a non-changing IP

[fading forge]

there is a way ig but I won't share it because one on one ip logging is illegal afaik

[thorn obsidian]

Well. This is taking some turns

[spark heart]

its on Dedicated server

[fading forge]

so wait

[spark heart]

yes

[fading forge]

its the game's servers?

like if someone were to make a malicious server

can they send packets directly to your client?

[fading forge]

alright

[spark heart]

when they join and play

i can find their ip

[fading forge]

lemme send u a scapy tutorial to capture connected IPs

I mean if you're on a linux server

[spark heart]

but there are many ip's

[fading forge]

u can use scapy like

[spark heart]

oh

[thorn obsidian]

I believe you can mask your ip if you have a vpn aye?

[fading forge]

i = sniff()
print(i.summary())```

that captures your server's packets

[spark heart]

well, yes, but they wouldn't want to play with lag and delay

[fading forge]

although

I would say you read the TOS first

i forgot about that lol

[thorn obsidian]

Well in that case an ip ban isn't so secure aye?

But if those players hate lag

[fading forge]

Well its a good try ig

also

[thorn obsidian]

Yea. Better than nothing

[fading forge]

BombSquad is a competitive af game

I wouldn't guess that the players would use a VPN

that just beats the point

[thorn obsidian]

Hm

[spark heart]

the thing is, if i ban their ID (unique id of their account) they will just create new id and spam the server or abuse

[fading forge]

I would just connect to a diff server

[fading forge]

DDoS?

Ok well

in some countries its easy to file a police report

[spark heart]

so i thought, ip ban is better, but in order to do it this time.. i would like to see where it is
that is why, i wanted ip + country location

so its faster to ban

[fading forge]

If the server is hosted on one of your machines

[spark heart]

manually i will need to constantly check

[fading forge]

you can log their ip

and report to law enforcement

if its too damaging

[spark heart]

haha no its ok

[fading forge]

but if its not

I would just relax

and chill

while they stop

[sand tapir]

how come you need their country if you want to IP ban them

[thorn obsidian]

@spark heart are you running a private server? for family and friends only?

[fading forge]

You don't

its just general info

ig

[thorn obsidian]

You know, you could just make a new server and not tell the people?

If it's easy?

[sand tapir]

i think in some ways it would be overcomplicating a solution

[fading forge]

I assume that would take some time

[spark heart]

because, the players spamming and ruining the game for everyone,. i know which country it is..

[fading forge]

I mean it's ok I'm just chilling and trying to help

[spark heart]

but it would be better, if everytime we capture ip + name of the country

[fading forge]

cause cool ig

looks pog when u get the country prob

[thorn obsidian]

I mean some time spent is pretty better than getting spammed and abused

[fading forge]

Wanted to implement that in my server

for each time someone tries to connect

or bypass the security

[fading forge]

Good point.

[thorn obsidian]

You could scare them by telling them their country and all that. That legal?

[spark heart]

i don't think they care

i mean, they are not to be reasoned with

[fading forge]

Probably not

Plus I wouldn't do that to kids trolling

I mean

If they are abusing the server

[spark heart]

but well, getting ip isn't the hard step.. but getting ip + name along of country

[thorn obsidian]

How bout this?

[fading forge]

then you probably should take an action

[fading forge]

not really

[spark heart]

its a public server

[fading forge]

its the other way around

[thorn obsidian]

Oh

[fading forge]

So weait

wait

[spark heart]

its known much among players

[thorn obsidian]

you can use whois to get the domain info of the ip - it contains address

[fading forge]

it's hosted on BombSquad's servers?

[thorn obsidian]

Why you need the country for?

[spark heart]

hmm yes

[fading forge]

Well then you can't do anything about that

It just sounds like you want to ip log the shit out of every player

[spark heart]

haha no

[thorn obsidian]

Can't you complain to the people who own the servers?

[fading forge]

^

[spark heart]

im not sure if i understood well

[fading forge]

You probably wouldn't want to take the action on yourself

[spark heart]

this part

i mean bombsquad server

its not a server..
ok let me explain

[sand tapir]

do you own the server

[spark heart]

yes

[sand tapir]

right

[spark heart]

i open a dedicated host (ubuntu)

[thorn obsidian]

https://i.imgur.com/idfR0d0.png

:)

[thorn obsidian]

That's like a CIA folder

Redacted

That what most domains have to be honest

[spark heart]

then i put Bombsquad scripts in it, to open a bombsquad server,
then other players inside the game go to "Gather" and they can see my server and play in it

[thorn obsidian]

Then can't you use the script to not allow certain ips to enter?

[thorn obsidian]

yeah, there is that... but in some regions residential IPs do have address of the ISP

[fading forge]

oh

[spark heart]

what about blocking the ip

[thorn obsidian]

That what I mean.

[spark heart]

it works to block.. i tried it. i couldn't enter my server

[fading forge]

what

[spark heart]

but, the thing is, the person who spams.. his ip changes.. but country remains same

[fading forge]

just block certain IPs

[thorn obsidian]

Just setup a firewall and drop everything coming from that IP 🤷

[spark heart]

it is very strange.

although he does come with same name

[thorn obsidian]

Ok how do they troll? If by chatting you can readact certain words aye?

[thorn obsidian]

Then block his account.

[spark heart]

he will create another account

[fading forge]

well

[thorn obsidian]

Hmmm

Block the name?

[fading forge]

You probably can't block them then

that's too hard to accomplish

ig

[spark heart]

apart from trolling, the person is also uses bad words

and there are kids in the server

brb

[thorn obsidian]

Well I suggest you get his ip, go to https://www.iplocation.net and find out his country, the region etc. Then ban it specifically

And if anyone else from that region exists, include a email or something so they can complain there

Then allow their ip to enter

Can't think anything better

Cya later

[spark heart]

sorry back

[fading forge]

You could probably use a way to verify

although I wouldn't guess that players will be ok with that

[spark heart]

yea

personally, i have no interest in ip, or even thought about it, but things gotten abit heated up

ig the person is asking for it

[fading forge]

which ip

your server's?

[spark heart]

no

[fading forge]

Btw

[spark heart]

people connecting

[fading forge]

I wouldn't recommend you run a server without knowing basic cyber sec

if they have access to the server's ip

they probably gonna scan the shit out of the server

till they find vulnerablities

[fading forge]

oh

that's a weird thing to ask for

That sounds like someone is having trouble with someone else

[spark heart]

well not reaally

i think there was a command in ubuntu, which showed ip with country

but u had to use geoip too

but im not familiar with that

[fading forge]

hmm

well

The IP of which machine?

the clients connected?

[spark heart]

yes

clients connecting to the game's ip

[fading forge]

to the server's IP*

please make sure you're using the right terms

[spark heart]

yes

sorry

[fading forge]

as they can change the whole situation

ok so

there are ways to log connected IPs

[spark heart]

as you can see , server ip sends (packets?) to these ip

[fading forge]

to your server

[spark heart]

yes

[fading forge]

there

[spark heart]

u can use ufw logging

[fading forge]

so you want to the know the country?

[spark heart]

yes

[fading forge]

alright hol on

[spark heart]

shown with ip

[fading forge]

also imo

you should block connection from low ping proxies

and tor nodes

so like try to detect proxy chains

as they can be used by bad people

only allow VPNs and responsive proxy IPs ig

I mean some people care about security

ok wait

[spark heart]

hmm

[fading forge]

nvm what i said

now anyways

automate this site ig

https://whatismyipaddress.com/ip-lookup

try to make requests to it

[spark heart]

ohom

[fading forge]

to automate the process of looking up the IP

[spark heart]

im fairly new to these things 😅

[fading forge]

wait nvm

"With the exception of Google, Yahoo!, Bing, AOL, and Ask, You agree that You will not use any spider, crawler, robot, or other computer program to copy or index this Website or any content contained therein in any way."

you can't scrape the website

ig you can use pyautogui tho

[spark heart]

what is that?

[fading forge]

a library that automates mouse and keyboard actions

You can run a lightweight VM and set up some pyautogui actions

so that

it doesn't interfere with your distro

[spark heart]

i see

but from a terminal

[fading forge]

iirc there aren't ways to know the location from terminal

lemme check tho

[spark heart]

hmm i think they do

because, long time ago, a friend of mine tried it

[fading forge]

ok nvm u can do this

curl https://ipvigilante.com/<your ip address>

this what i found on the internet

it gives country and stuff

[spark heart]

yes

[fading forge]

so then

[spark heart]

but it shows your ip

[fading forge]

pipe the output to a script

and make it show it in a more readable way

[fading forge]

it shows country and stuff

wait

why do you want country tho?

[spark heart]

curl -s https://ipvigilante.com/$(curl -s https://ipinfo.io/ip) | jq ' .data.country_name'

this also exist

[fading forge]

i forgot to ask you that

[fading forge]

oh yea

[spark heart]

because its easier to detect where ip is coming from

and

[fading forge]

so like

to make an abuse prevention system?

[spark heart]

kinda

[fading forge]

so for example if many IPs are coming from the same location

you block the certain location for some time?

[spark heart]

more or less "yes"

but the thing i don't get it

[fading forge]

ok sounds legit

[spark heart]

is, its from the same country,, just ip is changed by 1 or 2 digits sometimes

[fading forge]

i see

[spark heart]

that's how i know its the same country

[fading forge]

well

the DHCP will probably give a whole different IP

ISPs aren't dumb

but like

[spark heart]

to make life easier.. i thought about running the command.. and getting ip directly with country (rather to have to search manually which takes time)

[fading forge]

you can end up blocking every player in existance

[spark heart]

damn

[fading forge]

oh wait

i just realized that

[spark heart]

ngl, im not a professional codder or even "decent" one
i just want to make it pleasant for players to enjoy the game

[fading forge]

IP addresses can be in different location with just 2 digits different

[fading forge]

it's ok lol

[spark heart]

yes, or that's what i saw once

[grizzled lake]

you'd want to use docker-compose for orchestrating containers. that said, you might also want to go "old school" and just run them on two separate VPS instances

so you could use docker-compose for orchestration while running your local dev instance, and then use something else to stand up the production system (still using docker, but maybe not compose)

[iron wadi]

What makes you say I shouldnt do that for production? So that I can learn things or because its hard to do properly?

[grizzled lake]

no, because i don't think it's possible to use docker-compose to orchestrate containers on 2 different remote hosts 😛

maybe it is!

[iron wadi]

I see. Are they not containerized then if the services are written together with compose?

[grizzled lake]

ah wait it actually is possible i think

[iron wadi]

yeah i thought it would be but idk either

[grizzled lake]

compose is basically a wrapper around docker itself

so you still have two separate container images: one for your python app, one for your database

docker compose just makes it easier to start/stop them together, set up bind bounds, set up ports, etc

[iron wadi]

right.

[grizzled lake]

https://www.docker.com/blog/how-to-deploy-on-remote-docker-hosts-with-docker-compose/ it does look possible, would have to sift through some docs though

[iron wadi]

I tried it once before and it didn't work, mostly because i was not reading the documentation on the docker compose file. I was just looking at other files and trying to mimic it

[grizzled lake]

yeah it has a lot of features, e.g. profiles

[thin cosmos]

Can you hack with python?

[iron wadi]

im not super good with nginx config but ive done it once. I had a server that... worked by the grace of god after much fighting.

Another thing I found when i looked into it a few months ago, is if you search for a docker compose file for this purpose...

not a single person is going to give you a similar file.

so i dont know who to believe

it probably is best if i just go through and do it myself and not rely on someone to write the file for me because of that

or to template it

[thorn obsidian]

Sure.

[solid mica]

Hi, I'm new to Python due to the needs for my final year project. For what I chosen was a keylogger project. So I follow some guides on Youtube but in the end the script doesn't seems to work that I couldn't find the error which makes that I can't compile it to .exe format. Can any senpai guide me or check it for me please? Thanks for reading' this thread.

[past star]

Hey @solid mica!

It looks like you tried to attach a Python file - please use a code-pasting service such as https://paste.pythondiscord.com

[thorn obsidian]

Can you send the code in a file or a link? And are you getting any error messages with it when you run it as a Python script? As well as when you try to convert it to an exe.

[solid mica]

I'll send it over to you in dm

[thorn obsidian]

Bet.

[thorn obsidian]

How do you define "hack"

Asking a question like that is like asking "Can you code in Python"

Of course you can. But based on what you want to do:

1. Python is not the solution
2. You don't need a programming language at all

"Hacking" is not coding a script, execute it and you have the access to a machine - it's much much more complex

[thin cosmos]

I think u just tried to sound super smart rn

[raven frost]

Krypton is just trying to be helpful. The concerns are valid there, the question is too general to answer. If you want a better answer you'll need to be more specific.

[thorn obsidian]

Anyone help me plz

[signal goblet]

hello, im trying to make simple sign up form in console, but how can i save it (not talking about txt files) and make it secure ?

[raven frost]

Save the data to disk securely? You could encrypt it and save the encrypted data

Look at AES for example. Depends on your needs but you could encrypt it and save that down then load it and decrypt it at runtime to use the data.

[signal goblet]

i forgot to mention it but i want it to be on network

so like i can access it from another pc

[raven frost]

That doesn’t really have anything to do with saving it on disk securely though

[signal goblet]

yeah

[raven frost]

What you do with the data after it’s loaded into memory and decrypted is a separate issue (in your case you want to send it)

If you’re asking how to send it securely, you could for example use TLS or SSH

[signal goblet]

i dont know how to make Data to be accessible from other devices that's my problem

[thorn obsidian]

Is ur data in LAN?

[signal goblet]

nope

for now im just using json to save it

do i need to use sql ?

[thorn obsidian]

what u r looking for?

[signal goblet]

i just wanna make database so i will be able to access it with other devices

[thorn obsidian]

Ok, do u know networking?

[signal goblet]

nope

[thorn obsidian]

We put data in a server(computer)

and u want to access it from browser ?

[signal goblet]

no from console

[thorn obsidian]

Console?

u mean play station ?

or Xbox?

[signal goblet]

Terminal

me bad

ok so i will tell you fully want im trying to make. first i wanna make log in from where person will be able to login. then it will load his/her Data there.

[thorn obsidian]

U log in from terminal ?

[signal goblet]

yes

[thorn obsidian]

ok ok

so I guess ur using Linux ?

If yes use Apache server to host ur login page and the data what ever it is

[signal goblet]

i mean this

something like this which will save

[signal goblet]

windows

[thorn obsidian]

well.... u have to install a software that will host the data on LAN(Local Area Network)

Install Apache then on windows

[signal goblet]

alright then

thankss

[thorn obsidian]

keep in mind when ur machine is turned off u will not be available to access the data since its playing the role of a server

[signal goblet]

Is it possible to be available when my machine is off? Or is it paid to host that?

[raven frost]

@signal goblet note you are asking about a lot of large topics here. Databases, data security, networking, there are entire books on every one of these things. So just be patient with yourself and learn those topics and libraries

This is not a 1 hour type of thing

[thorn obsidian]

hosting on LAN it’s not but on the internet (WAN) u have to pay

buy a raspberry pi for that

[signal goblet]

okeyy thank you guys

[dark socket]

(any old computer you've got laying around that you don't use can work too, if you're willing to leave it on all the time @signal goblet )

[thorn obsidian]

Is there a easy one way to do 1 way encryption

There are quite a lot of ways

[wise pecan]

Most people use a one way hash and a salt

md5 when I actually had to do it myself, most people use some sha variant I think? these days

Ah so google says NIST is recommending HMAC-SHA-256 these days

https://github.com/pyca/bcrypt
^ This might be the easiest way if you just need 1 way password encryption, but someone correct me if brycpt is not recommended anymore. But pretty sure its what underlies the 1 way password hashing on linux.

This is a bit of code I had using it back in the day:

import bcrypt


class Hasher:

    # Used in check to mitigate leaking information about users having / not having passwords via timing attacks.  This
    # is just a salt without any password hash, it will not match empty strings with bcrypt
    _NO_PASS = '$2b$10$5xBXVFvUAdID3SG3Aq0C9u'
    _SALT_ROUNDS = 10

    @staticmethod
    def hash(password: str) -> str:
        salt = bcrypt.gensalt(rounds=Hasher._SALT_ROUNDS)
        return bcrypt.hashpw(password.encode('utf-8'), salt).decode()

    @staticmethod
    def check(password: str, hashed: str = None) -> bool:
        if not hashed:
            hashed = Hasher._NO_PASS
        return bcrypt.checkpw(password.encode(), hashed.encode())```

(I had a situation where the user may not have a password set because they might be using like Oauth, so that's why I do a "no pass" thing)

[sinful cliff]

1-way encryption isn't really encryption, the point with encryption is that you in some way or another can reverse it
however, you have hashing and different kinds of 1-way functions
which kind you should use depend on what you are going to use it for

[wise pecan]

Yeah, encryption implies decryption (reversal), but most people mean "hashing" when they say it "one way encryption"

[sinful cliff]

i would definitely recommend scrypt over bcrypt, scrypt is used by lots of crypto currencies, which is a double edged sword, on one hand it's tried and true but on the other hand many also have hardware optimized for it, that hardware can often be used for bcrypt, sha2 and others as well

[wise pecan]

I read somewhere, that bcrypt was a little less amiable to GPU cracking cause of the implementation

[sinful cliff]

i would recommend using one of the three available flavors of Argon2 to over anything else, and when in doubt use the Argon2id flavor

Argon2 was the winner of PHC and is very resistant to many type of such attempts to optimize the algorithm for brute force against it

[wise pecan]

Are crypto currencies particularly interested in algorithms that aren't crackable? Doesn't seem like a necessary concern for them since its related to ledgers and there's not a particular reason to obscure whats being hashed there

Like, you hash the block, but everyone knows the block in BC for example

[sinful cliff]

all crypto currencies are interested in it, the one way hashing isn't used for hiding the data just to sign it, if you can crack the algorithm you can take other people's money

[wise pecan]

I suppose, I'm not seeing how that would work tbh, but I'm also not someone technically versed in most crypto currencies.

[sinful cliff]

anyways, crypto currencies was just a rabbit hole, I just mentioned them to way that there are readily available optimized hardware for some 1-way functions due to them, which might be a concern

several linux distros are changing to using yescrypt for storage of the passwords
yescrypt was one of the finalists of the PHC which Argon2 won, they are probably both good algorithms

[sinful cliff]

in short: use Argon2id (pythons passlib has support for it) or maybe yescrypt

[fair trail]

I have a hypothetical question. Say you have a table with 50 hashed and salted passwords and all 50 are salted with the same value. Then say a hacker knows 25 of 50 passwords. Can the hacker use the known password information to determine the salt and then knowing the salt use that to decrypt the remaining passwords?

[sinful cliff]

the salt isn't generally a secret, it's typically stored in plain text together with the hashed password
the whole point of the hash is to introduce extra data so that the hashes can't be pre-computed as with rainbow tables, hence the same salt should not be reused for several entries
as then an attacker only needs to hash a guessed password once with that salt and then can compare the hashed value to all the accounts using the same salt
if you instead have unique salts you will force the attacker to either concentrate on one account or do the whole hashing for that password for every account they want to guess the password for

[wise pecan]

Yeah the salt makes rainbow table look ups and similar attacks harder, why would anyone use the same salt all the time though anyway?

[sinful cliff]

for someone designing a system and knowing what the whole purpose with a salt is, they wouldn't

and for an unknown salt, guessing it would be just as hard as guessing the password

[wise pecan]

well not if you tack it on to every hash

I just meant, computationally salts seem pretty cheap

I dunno why you'd be like
MUH_SALT = ...

[sinful cliff]

depends on the length of the salt

but that isn't the a use for a salt anyways

[wise pecan]

I can see someone on low lvl hardware maybe hard coding a salt I guess

They might think its reasonably secure / secret enough, like if someones got to crack the thing open and read the firmware out, and find it in that. And then you still have to generate a rainbow table for that

[sinful cliff]

maybe, but that would be a bad implementation

[wise pecan]

Yeah, but I know hardware guys are not particularly known for their good implementations

[sinful cliff]

sure, better than no salt at all

[wise pecan]

Look at industrial control systems lol

[sinful cliff]

lol, yeah

[wise pecan]

"What do you mean someone could send me a packet that tells the turbine to spin at a rate above stress specifications?!"

"Who would do such a thing?!"

[sinful cliff]

classic

[wise pecan]

"Hackers!? In MY secure air gaped network?!" -- Some Iranians probably

flicks NSA data tap I'm not a terrorist

[sinful cliff]

yeah, it's really a classic story

[wise pecan]

Well at least the industrial guys are taking it seriously now since then

[sinful cliff]

but it highlight how one should not be narrow minded

if something can be abused, sometime in the future it probably will be

[wise pecan]

Yeah, just like you know systems of governance, natural laws, ect ect, f*cking about and exploiting things is why we aren't sitting in bushes slinging crap at each other over bananas

To bad we turn it on ourselves half the time

but now Im being philosophical

[sinful cliff]

humans are curious by nature, otherwise we wouldn't be where we are today, for better or worse

unfortunately intelligence doesn't automatically come with wisdom

but i think we are getting a bit off the channel topic now 😉

[thorn obsidian]

hey'

can anyone test the security of this web app im making'

[fair trail]

My actual use case isn't related to passwords. I want to publicly show hashes of several, more or less private, pieces of information. The information itself is to some extend guessable. Think of something like an age. So in order to make it more difficult to guess I was thinking of adding a salt to the hash. So the question is, can I use a single salt for all the pieces of information?

[sinful cliff]

use a HMAC algorithm for that

[fair trail]

I will look into that.

[sinful cliff]

but as every instance of the same guessable string will end up as the same hash it's still weak

in the example with an age, if i know one age, like my own or of a friend i will be able to see which people share that age

and if i can create more profiles or data entries with the different ages i can decode all other ages as well

[fair trail]

To be clear, the salt or "key" will be different across users, but remain constant across pieces of information. eg:
user1 has key "123" and thus I hash "123 + location", "123+age", "123+date"
user2 has key "456"and thus I hash "456 + other-location", "456+other-age", "456+other-date"

If someone knows user1's age and location, can they determine the "key" and the date?

[sinful cliff]

only by finding the key by brute force, if the key is long enough with sufficient random bits it will be hard to do, if it's short it will be very easy

should probably call that a key rather then a salt, as a salt is used for something totally else

[fair trail]

How can one quantify "long enough"? I assume this would be similar to password strength?

[sinful cliff]

it depends on the security you require for the system, 256 bits is generally viewed as secure today when used with a good HMAC algorithm

[fair trail]

Ok thanks

[sinful cliff]

i guess you are going to store it in a database table or something together with the user entry?

[fair trail]

Yes the raw data will be in a the db with the hashes, and the hashes will shown on a public web page.

[sinful cliff]

you know that the hashes will become quite long, right?
unless you shorten them, and then you have a much higher chance of collisions, which might or might not be of concert to you
any thoughts of how to represent the hash, like hex, base64 or something else?