IT Security Stack Exchange
IT Security Stack Exchange

Questions tagged [python]

High-level dynamic language developed by Guido van Rossum, particularly popular for server-side web programming and scripting.

Originally released in 1991, Python is a multi-paradigm programming language. Object-oriented programming and structured programming are fully supported, and many of its features support functional programming and aspect-oriented programming.

An important goal of Python's developers is keeping it fun to use. This is reflected in the language's name—a tribute to the British comedy group Monty Python—and in occasionally playful approaches to tutorials and reference materials, such as examples that refer to spam and eggs (from a famous Monty Python sketch) instead of the standard foo and bar.

Most Python implementations (including CPython) include a read–eval–print loop (REPL), permitting them to function as a command line interpreter for which the user enters statements sequentially and receives results immediately.

The language's core philosophy is summarized in the document The Zen of Python (PEP 20), which includes aphorisms such as:

  • Explicit is better than implicit
  • Simple is better than complex
  • Complex is better than complicated
  • Readability counts

Questions with this tag should relate to or include the Python programming language.

Sources:

373 questions
117
votes
3 answers

Does bcrypt have a maximum password length?

I was messing around with bcrypt today and noticed something: hashpw('testtdsdddddddddddddddddddddddddddddddddddddddddddddddsddddddddddddddddd', salt) Output:…
d0ctor
  • 1,273
  • 2
  • 9
  • 7
45
votes
1 answer

I have the ability to run arbitrary Python code on the 'apache' user. What damage can I do?

So, due to bad programming on the part of one of my former colleagues, one of our internal web apps allows the user to upload and run an arbitrary Python file. This recently came to light via an anonymous tip. So far I haven't done anything too…
ian93
  • 481
  • 1
  • 5
  • 6
40
votes
3 answers

Unable to understand why the web app is vulnerable to a Directory traversal attack

I was working with this web-app, when someone pen-tested it and sent me a huge report that says my app is vulnerable to a Directory traversal attack. Here is one sample: Testing Path: http://127.0.0.1:80/??/etc/issue <- VULNERABLE! I put…
Batman
  • 845
  • 1
  • 8
  • 13
30
votes
1 answer

Django SECRET_KEY security, how are methods more secure

I am nearing a point where I will deploy my Django application to the hostile environment otherwise known as "the internet" and I'm trying to better understand the ramifications of the Django SECRET_KEY. One of the standard procedures it seems is to…
James
  • 545
  • 2
  • 5
  • 8
23
votes
6 answers

Is it important for an ethical hacker to know the C language in-depth nowadays?

I'm interested in becoming an ethical hacker someday. I've been reading articles saying the Python language is very popular in hacking activity because of the extent of its modules (including network). Nowadays, lots of applications are web…
Cronos
  • 233
  • 2
  • 5
19
votes
2 answers

Are python's popen (and similar) functions affected by Shellshock?

Basically which python's functions trigger bash (and might be impacted by shellshock), and which don't ? I have come up with this question by seeing in some scripts the popen() function. My question relates to both Python 2 and 3.
Grzegorz Wierzowiecki
  • 657
  • 1
  • 6
  • 15
19
votes
6 answers

Do high level languages allow for buffer / heap overflow?

I'm learning about basic x86 overflows in C but normally I code with Python. Is there anyway that programs written in higher level languages can suffer from buffer/heap overflow?
blank
  • 225
  • 1
  • 3
12
votes
4 answers

What are the pros and cons of using sha256 to hash a password before passing it to bcrypt?

I recently became aware of the fact that bcrypt truncates passwords to 72 characters. Practically speaking my intuition is that this does not pose any major security problems. However, I understand that it does mean any software libraries that use…
Dan Tao
  • 281
  • 2
  • 6
12
votes
3 answers

Are there any Security Concerns to using Python F Strings with User Input

Background A while ago I started using F strings in Python but remembered seeing some security concerns with using them with user input so I have made a point of not using them for those situations. Question Are there security concerns to using…
MikeSchem
  • 2,266
  • 1
  • 13
  • 33
12
votes
3 answers

Does python's pip provide cryptographic authentication and integrity validation?

Does python's pip package manager cryptographically validate its payload's authentication and integrity for all packages after downloading them and before installing them? I see a lot of guides providing installation instructions with steps asking…
Michael Altfield
  • 826
  • 4
  • 19
12
votes
1 answer

Is it safe to use Python package managers like pip, easy_install or conda?

I know it is unsafe to install software (including Python packages) from not trusted or compromised sources. However I wonder how safe I am when I am installing a trusted package from Python Package Index or from Anaconda repository (which I also…
abukaj
  • 273
  • 2
  • 7
11
votes
2 answers

MongoDB Nosql injection in python code

Here is the code snippet for accessing to MongoDB. client = MongoClient() db = client.test_database collection = db.test # Get data from fields condition = form.getvalue('name') if condition: where = {"$where": "this.name == '"+condition+"'"…
Yang Yu
  • 439
  • 3
  • 5
  • 12
11
votes
1 answer

Python's http.server library "basic security checks"

According to: https://docs.python.org/3/library/http.server.html Warning http.server is not recommended for production. It only implements basic security checks. It doesn't state what security vulnerabilities the server is exposed to. I'm a…
user227415
  • 111
  • 1
  • 3
10
votes
3 answers

Safely load a pickle file?

In our Python app, we are using pickle.load to load a file named perceptron.pkl. A HP Fortify static scan raises a high vulnerability, "Dynamic Code Evaluation - Unsafe Pickle Deserialization", at the same line. How can I remediate this? Is there…
Pro
  • 241
  • 3
  • 4
9
votes
2 answers

Securing API keys for a Twitter account for a program to be run on other PC's

I've created a method to allow my project EditVideoBot to be 'decentralised', where rather than the program processing and uploading all video editing requests on my own central server, users can volunteer to run this program on their computer and…
pigeonburger
  • 671
  • 1
  • 4
  • 12
1
2 3
…
24 25