Unanswered 'security+python' Questions

10votes

0answers

12kviews

What is the best way to sanitize inputs with Flask and when using MongoDB?

I'm writing my application backend with Python Flask. As part of the registration process, I have a form that sends the new user's information to my backend and then adds it to my MongoDB database. I'...

GMe

1,041

asked May 11, 2017 at 20:57

6votes

0answers

1kviews

HTTPS TSL Certificate Chain Validation Using Python Requests

I'm running a windows service using python 2.7.9. As part of it i'm trying to connect to a server using HTTPS. I'm using requests model (2.7.0) to do it. I'm also using wincertstore (0.2) model to ...

python security ssl https python-requests

AmitE

854

asked Oct 1, 2015 at 14:36

6votes

0answers

333views

Store Connection Parameters for SQLAlchemy securely

I'm writing an application in Python 2.7 + SQLAlchemy that will need to access hundreds of PostgreSQL databases, each on its own server. To connect using SQLAlchemy, an engine is created by passing ...

python security sqlalchemy

bb9

61

asked Jul 24, 2013 at 20:01

5votes

0answers

413views

What's the best practice to store secret information in memory in Python?

So the problem is that I have some secrets (TOTP/HOTP keys) that need to be used consistently by my program, but I don't want a memory dump to just show them all. I'm talking about common people whose ...

python python-3.x security encryption passwords

The Quantum Physicist

22.7k

asked Mar 26, 2018 at 14:57

5votes

0answers

352views

How do I create an apparmor profile for an application that runs using Python's twisted library?

I'm trying to create an apparmor profile for a networking application with access to ssh and runs using Python's twisted library. I have tried using aa-genprof to generate a profile. In another bash, ...

python security twisted apparmor

Kareem Kamel

51

asked May 2, 2015 at 2:38

5votes

3answers

2kviews

Keep a secret key safe in Python

I am aware that these questions has been asked before several times separately, and most of the answers I've found are "Python is not easy to obfuscate, because that's the nature of the language. If ...

python security oauth obfuscation

user2891462

2,785

asked May 12, 2015 at 12:34

4votes

0answers

397views

What are recommended / minimum parameters for hashlib.scrypt?

The documentation of hashlib.scrypt is a bit short: hashlib.scrypt(password, *, salt, n, r, p, maxmem=0, dklen=64) The function provides scrypt password-based key derivation function as defined in ...

python security password-hash hashlib websecurity

Martin Thoma

105k

asked Oct 17, 2020 at 7:00

4votes

0answers

974views

Logger configuration safety warning by SonarQube

After implementing logging functionality in a microservice, I sent the code thought a SonarQube code-check. SonarQube keeps warning me about a safety issues regarding loggers. I tried several things ...

python python-3.x security logging sonarqube

Christiaan Lamers

51

asked Jun 11, 2020 at 9:23

4votes

0answers

2kviews

Flask Talisman Content Security Policy

I want to use Flask-talisman to secure my app SELF = '\'self\'' talisman = Talisman( app, content_security_policy={ 'default-src': [ 'https://fonts.googleapis.com', ...

python security flask

Dr.DOOM

557

asked Oct 3, 2019 at 4:54

4votes

0answers

1kviews

securely passing a password to subprocess.Popen via environment

I would like to securely ask a password to a user and then pass it to subprocess.Popen to run a command that requires it. I have seen this question and that one, but I wonder if I can securely pass ...

python security passwords subprocess

MagTun

4,973

asked Nov 9, 2018 at 20:14

4votes

1answer

3kviews

Equivalent to python's uuid.uuid4().hex in javascript?

Python has functionality to create hex UUID's like so: >>> import uuid >>> uuid.uuid4().hex '47be94c37e484e13ab04ed3c54a5b681' Is it possible to do the same in client javascript, ...

javascript python security cryptography uuid

raphaelrk

617

asked Apr 5, 2018 at 3:33

4votes

0answers

693views

How to implement a sandbox for an online-judge system?

OJ(Online Judge)s allow users to upload arbitrary code snippet to execute on the server, but it also has a sandbox to prevent malicious code from running. For instance, on leetcode, if I submit this ...

python security sandbox ptrace

NeoWang

15.2k

asked Sep 4, 2015 at 2:54

4votes

0answers

459views

Embedded python security considerations

I'm embedding Python 3.4 in a C++ application. As an overview (or provide details if you can), what security considerations should I be thinking about if a user of the system is able to submit ...

python c++ security boost-python

zcourts

4,553

asked Aug 11, 2015 at 7:23

3votes

0answers

180views

Perl Moving Target Defense, prevent code injection attacks

I was looking for modern solution about xss prevention, in this page the author uses a technique known as: Moving target defense (MTD), takes advantage of this gap between time of check (exploit ...

python perl security code-injection

Imylor

386

asked Dec 2, 2019 at 21:45

3votes

0answers

247views

Key Kollision in DES3 Implementation of PyCrypto

I'm pretty new to cryptography and only a user really. I stumbled however over a very interesting "vulnerability" of the DES3 Cipher of the PyCrypto library. I experimented with generating Private ...

python security encryption pycrypto

Carl Philipp

161

asked Feb 5, 2018 at 21:06

3votes

0answers

1kviews

Protecting or Licensing a Django Application

I am making a Django application and I am running into an issue. I know Python is interpreted and it would be impossible to completely fight against piracy, however I want to implement some sort of ...

python django security

Mark Barrett

303

asked Apr 11, 2017 at 14:19

3votes

1answer

150views

Is compiling untrusted code in CPython considered safe?

In Python its possible to compile a Python script without executing (using py_compile module, Py_CompileString in C). A lot is written on issues attempting to sand-box CPython (and how difficult it ...

python security python-3.x

ideasman42

34.8k

asked May 30, 2016 at 9:12

3votes

1answer

316views

Django admin form can be manipulated with Cross-Site Request Forgery (CSRF)

In my Django admin site, I run a vulnerability test and it shows the following threat: An effective CSRF (Cross-Site Request Forgery) countermeasure for forms is to include a hidden field with a ...

python django security csrf

Muhammad Naeem Paracha

1,697

asked Jan 17, 2016 at 5:11

3votes

0answers

2kviews

Using urandom in windows

What happens when you use os.urandom(256) in python in windows ? The code shows : def urandom(n): """urandom(n) -> str Return a string of n random bytes suitable for cryptographic use. ...

python security random

asudhak

2,659

asked Feb 13, 2014 at 18:39

3votes

0answers

314views

Android Application Attack Surface Analyzer (A3SA)

I'm working on a report of a security laboratory named quarkslab. They made a report about Android OEM security. -> http://www.quarkslab.com/dl/Android-OEM-applications-insecurity-and-backdoors-...

android python security android-manifest apk

Postnop

55

asked Sep 18, 2013 at 7:19

3votes

1answer

805views

Injecting arbitrary code into a Python SimpleXMLRPC Server

In the python docs of python SimpleXMLRPC Server, it is mentioned: Warning Enabling the allow_dotted_names option allows intruders to access your module’s global variables and may allow intruders to ...

python security simplexmlrpcserver

Nehal J Wani

14.9k

asked Mar 17, 2013 at 14:43

3votes

1answer

755views

Wapiti Security tool: Getting "Invalid Syntax Error "

I followed the following steps: Install Python27 and also download wapiti, placed it inside c:\wapiti-2.2.1 . Set environment variable for python(var name : c:\python27). Open python command prompt. ...

python python-2.7 security wapiti

Ankit

203

asked Dec 5, 2012 at 7:50

3votes

1answer

539views

Python encryption scheme that supports multiple decryption keys

Is there a python library that supports (symmetric) encryption of data with the possibility of using multiple decryption keys. I have (sensitive) user data that must be stored encrypted in a database,...

python security encryption

Martin Thurau

7,370

asked Feb 13, 2012 at 16:10

3votes

1answer

728views

WSGI, Werkzeug and form based authentication

I would like to implement a WSGI/Werzeug based web application and need help implementing the form based authentication. I found repoze.who and think it solves most of my problems. It works fine with ...

python sqlalchemy security wsgi werkzeug

Achim

14.8k

asked Oct 14, 2011 at 12:54

2votes

0answers

42views

Is my extremely simple website safe agains XSS?

I made a website that gets your request path and returns it in a <link> tag like this: <link rel="canonical" href="PATH_HERE"> You can go to any path you want and ...

javascript python html security xss

never_doubt

21

asked Mar 22 at 22:47

2votes

0answers

144views

Bandit B404 security issue with subprocess import?

According to Bandit's documentation, importing the subprocess module is considered a low security issue (B404). Unfortunately, it does not provide alternatives or explanation why. Thus, I have 2 ...

python python-3.x security bandit-python

fgoudra

528

asked Oct 26, 2021 at 21:17

2votes

0answers

78views

Stop user from running malicious python code in online compilers

I am developing an online compiler wherein user can run python code.My requirement is to run that python code on server side with exec. So I researched on how can I completely eliminate some user ...

python django security exec linux-security-module

Jay Patel

63

asked Sep 4, 2021 at 17:18

2votes

3answers

159views

how do i make python find words that look similar to a bad word, but not necessarily a proper word in english?

I'm making a cyberbullying detection discord bot in python, but sadly there are some people who may find their way around conventional English and spell a bad word in a different manner, like the n-...

python security

potato123

33

asked May 10, 2021 at 13:52

2votes

1answer

505views

Microservices security with FastAPI

I'm working on a personal project which makes use of Python, FastAPI and a microservices architecture. I want to learn more about security so I'm trying to add some into this. I have read through the ...

python security microservices fastapi

sohaib

73

asked Feb 2, 2021 at 17:14

2votes

1answer

1kviews

Python http server for production

Python docs claim, that "http.server is not recommended for production. It only implements basic security checks." Is there another simple to use python server (like http.server) with "...

python python-3.x security httpserver

Petr Marek

425

asked Nov 30, 2020 at 8:32

2votes

0answers

30views

Finding out how onClick attribute is generated as a client?

I have a pretty interesting question. I wanted to automate reserving timeslots for my university's gym as you need to book 3 days in advance if you want a chance at a workout. I am using a framework ...

javascript python html selenium security

Alejandro Armas

189

asked Nov 8, 2020 at 5:51

2votes

0answers

156views

ARP spoofing using scapy changes my own ARP table

I wrote an ARP spoofer in Python using Scapy which works fine. The only problem with it is that sending the malicious ARP packet also changes my own ARP table, which makes my host think that it is the ...

python python-3.x security scapy arp

Shami735

21

asked Sep 23, 2020 at 15:27

2votes

0answers

41views

How to find where a package is used in Python?

I'm writing program for commercial use and the company vulnerability scan gave me this. Clicking on the links leads me to here https://nvd.nist.gov/vuln/detail/CVE-2018-15560. Now I'm sure I've never ...

python security dependencies package

Xuekai Du

495

asked Aug 11, 2020 at 6:40

2votes

0answers

2kviews

Python subprocess.run in secure way

My Python script has to run binary available only via console, so I use subprocess.run and it looks like this: CMD = [ "C:\\Program Files\\Azure DevOps Server 2019\\Tools\\TFSSecurity.exe", "/...

python security subprocess bandit-python

kagarlickij

5,966

asked May 11, 2020 at 16:48

2votes

0answers

5kviews

(Caused by SSLError(SSLError("bad handshake: Error([('SSL routines', 'tls_process_server_certificate', 'certificate verify failed')])"

I am making an API request, and I've been having issues with the SSL certificate it seems. requests.get(url=full_url, headers=headers,verify =certifi.where()) Gives me the error: Max retries ...

python rest api security request

Chelsea Challacombe

21

asked Feb 27, 2020 at 19:19

2votes

2answers

2kviews

How to secure a Python script SQL Server authentification

I am using a Python script to connect to a SQL Server database: import pyodbc import pandas server = 'SQL' database = 'DB_TEST' username = 'USER' password = 'My password' sql=''' SELECT * FROM ...

python sql-server security password-protection

Catapultaa

160

asked Jan 6, 2020 at 14:10

2votes

0answers

298views

Unauthorized access and token not working

I have been struggling while trying to get Flask Authentication work . I'm using this example: https://github.com/miguelgrinberg/REST-auth/blob/master/api.py I have a user in mysql database, I can ...

python security authentication curl

Souad

4,257

asked Oct 3, 2018 at 9:13

2votes

2answers

166views

Python script not appending my csv with parsed xml data, no errors

I am trying to parse xml data from the National Vulnerability Database (NVD) in order to isolate vulnerabilities what are remotely executable (Access Vector = Network). I have followed other ...

python xml security elementtree

lanceDamage

21

asked Mar 26, 2018 at 17:15

2votes

0answers

362views

How to make a tensorflow GAN model that attack an OCR model

I was using the the attacks algorithm in the Cleverhans to do an OCR attacks. Basically, I am attacking a black-box mobile phone app that recognize the ID numbers from picture. I found C++ tesseract ...

python c++ security machine-learning tensorflow

Ximin Lin

79

asked Oct 5, 2017 at 1:00

2votes

0answers

558views

GET STIX data from TAXII server based on indicators (IP and Hash)

I am working on a project where I need to retrieve the STIX data from TAXII server(HailaTaxii in my case) and parse the data for indicators and TTP's. I am facing the below problem. 1) Unable to ...

python xml security

Shravan

21

asked Apr 25, 2017 at 7:34

2votes

0answers

294views

create a relatively safe eval

I read this Q&A and I'm not convince it applies here. I have an application where I want to allow mostly preset formulas to be set in widgets: for instance return last part of a string using str....

python security eval

Jean-François Fabre♦

131k

asked Mar 10, 2017 at 13:48

2votes

2answers

952views

Flask Security rest API

Context I'm creating a quote generation script using Python and Digital Ocean server (Ubuntu 16.04). Here's how it works: End user fills out a form on HubSpot hosted website the form submission ...

python security post flask

rheemy

21

asked Jul 31, 2016 at 1:07

2votes

0answers

169views

Django: Make log-in time invariable to avoid user enumeration attack

Currently I'm having an issue where anyone can check if a user exists or not, simply by trying to log-in with the username and timing how long it takes to error out (non-existent usernames take a ...

python django security

Cisplatin

2,562

asked Mar 28, 2016 at 20:21

2votes

0answers

3kviews

DLL Injection - CreateRemoteThread

Hello again at StackOverflow! I return for help on implementing DLL injection using Python, and the results have been fairly successful. I am using non-reflective injection ('CreateRemoteThread') to ...

python windows security dll dll-injection

RandomHash

619

asked Feb 5, 2016 at 11:05

2votes

1answer

710views

Security considerations with server side urllib2.urlopen with url from user

I'd like users to be able to upload images from the web by providing a URL. I don't think I can get the client to fetch the image and upload it due to possible CORS issues and hotlink prevention, so I'...

python django security urllib2 ssrf

jozxyqk

15.2k

asked Nov 1, 2015 at 12:44

2votes

1answer

437views

Confirm if Ddos attack and how to block ip using django and apache http.conf

UPDATE I've edited the conf file to this but the ip's are still hitting the server, we are hosted on a webfaction shared server. ServerRoot "/home/kbuzz/webapps/django/apache2" LoadModule ...

python django apache security

user4910881

asked Oct 16, 2015 at 13:34

2votes

0answers

2kviews

Impersonation for Windows in Python 3 using win32security

I've been working on a way to access and modify privileges to a file on Windows via Python 3, more precisely with the win32security library. From those 2 answers How to authorize/deny write access to ...

python windows security python-3.x impersonation

user3311142

315

asked Feb 3, 2015 at 15:30

2votes

1answer

122views

Restrict python script locations

I'm wondering if there is a way of controlling from where python scripts are allowed to run? So that only scripts in certain locations are allowed to be run by python. We are running a windows ...

python security

andpou

21

asked Jan 13, 2015 at 11:31

2votes

0answers

258views

What privileges should I give my MySQL database user for my Flask application?

Is there a standard set of privileges that should be given to the user used to access a Flask SQLAlchemy database. For example with application.config['SQLALCHEMY_DATABASE_URI'] = 'mysql://app@127.0....

python mysql security database-connection flask-sqlalchemy

orome

39.4k

asked Jan 4, 2015 at 17:44

2votes

1answer

254views

Django: Is this a viable alternative method for including CSRF tokens in template forms?

I usually add CSRF tokens to forms in templates in the format specified by the Django documentation: <form action="" method="post">{{ csrf_token }} ... </form> However, I've seen ...

python django security csrf

w00

21

asked Aug 30, 2014 at 4:25

All Questions

Related Tags