I’m not a crypto/security expert and have designed an architecture for encryption/decryption. I’m not sure if its full proof and want to know what people use as industry standard?
I’m trying to perform encryption/decryption in RESTful api …
A webapp has an img tag that partially takes userinput like so:
<img src="/blah/blah/$USERINPUT.jpg">
where the first / is from the root of the domain.
Could there be a vulnerability here? Potentially using ../ and then at…
Now in order to be familiar with a site’s table , I need to dump the last row of a table named "account" . can you please tell me what parameters I can use to dump only the last row of a certain table? Here is the command I’m usi…
I want to build a group chat app where messages are transmitted and stored as securely as they can be, but where the message history is still visible after you or others in the group have changed devices. From my understanding, PFS isn’t p…
I am looking for some compromise with integrating E2E encryption for web app (basic FE and BE).
Basically I read about two concepts which are truly E2E encryption and not that much complicated.
Using two passwords, when one is for login a…
Background
A while ago I started using F strings in Python but remembered seeing some security concerns with using them with user input so I have made a point of not using them for those situations.
Question
Are there security concerns to …
In Cuba the telecoms/ISP monopoly, Etecsa, works with the political police to spy on dissidents, journalists and others.
A common attack in Cuba is therefore SIM Swapping which is easy for them. It is also effective in order to eavesdrop o…
I have GPG agent forwarding via SSH RemoteForward working, up to a point:
I can list my private and public keys on the remote host.
If I try to decrypt a file remotely, the PIN is prompted for but the text is stepped, garbled and the pas…
I have read about MAC vs. DAC in the Internet, but I still fail to understand, what kind of attack it is impossible to protect against if one only uses DAC+capabilities in comparison to MAC+DAC+capabilities. If a process does not run as ro…
A vulnerable C program to stack buffer overflow, requires 112 byte stuffing to get to return address of the calling function. Here the Strcpy() is the vulnerable function.
void f(char *name){
char buf[100];
strcpy(buf, name);
}
void m…
