Posts

Synchronizer-Token-Patterns

Image
Synchronizer Token Patterns. The Encrypted Token Pattern is a defense mechanism against Cross Site Request Forgery (CSRF) attacks, and is an alternative to its sister-patterns; Synchroniser Token, and Double Submit Cookie. Each of these patterns has the same objective: To ensure that any given HTTP request originated from a trustworthy source To uniquely identify the user that issued the HTTP request In the first instance, the need to ensure that requests originate from a trustworthy source is an obvious requirement. Essentially, we need to guarantee that any given request has originated not only from the user’s web-browser, but also from a non-malicious link, or connection. Once you have verified that the request appears to be the same origin request so far, we recommend a second check as an additional precaution to really make sure. This second check can involve custom defense mechanisms using CSRF specific tokens created and verified by your applicati
Post a Comment
Read more

Double-Submit-Cookies-Patterns

Image
Double Submit Cookie  Double Cookie Submit For Prevent CSRF What is Double Submit Cookie? If storing the CSRF token in session is problematic, an alternative defense is the use of a double submit cookie. ... A cross-origin attacker cannot read any data sent from the server or modify cookie values, per the same-origin policy. In the event that putting away the CSRF token in session is hazardous, an elective guard is the utilization of a twofold submit treat. A twofold submit treat is characterized as sending an irregular incentive in both a treat and as a demand parameter, with the server checking if the treat esteem and demand esteem match. when a client confirms to a site, the site ought to create a (cryptographically solid) pseudorandom esteem and set it as a treat on the client's machine isolate from the session id. The site does not need to spare this incentive in any capacity, in this manner evading server-side state. The site at that point requires that each exc
Post a Comment
Read more

WEB-App--RESTful-API-

Image
Oauth and Resource Server Role of OAuth resource server Resource owner Resource server Client application Authorization server Resource Owner This entity can grant access to a protected resource or a service. The resource owner is a person (like an end user), an application that owns the service, or a security policy. The resource owner is depicted in the illustration that follows as a person, which is probably the most common situation. Resource Server This is the server hosting the protected resource or service. The resource server can accept and respond to protected resource requests. In Oracle Cloud, a resource server represents an application hosting cloud services. Client Application This is an application or service that can make protected resource requests on behalf of the resource owner. The client application is the application requesting access to resources stored on the resource server. The client application also obtains authorization from
Post a Comment
Read more

Magniber Ransomware

Image
Magniber Ransomware Wants to Infect Only the Right People Exploit kit (EK) utilize has been on the decay since late 2016; in any case, certain action stays steady. The Magnitude Exploit Kit is one such case that keeps on influencing clients, especially in the APAC locale. In Figure 1, which depends on FireEye Dynamic danger Intelligence (DTI) reports partook in March 2017, we can see the locales influenced by Magnitude EK action amid the most recent three months of 2016 and the initial three months of 2017. This pattern proceeded until late September 2017, when we saw Magnitude EK concentrate basically on the APAC district, with an extensive lump focusing on South Korea. Extent EK action at that point tumbled off the radar until Oct. 15, 2017, when it returned and started concentrating exclusively on South Korea. Already it had been conveying Cerber ransomware, however Cerber circulation has declined (we have additionally observed a decrease of Cerber being approp
Post a Comment
Read more

Lets Make a Simple Keylogger

Image
Make Simple Keylogger Using Python This is a basic keylogger that can made utilizing python. I attempted to make one in cluster or vbs, yet it is basically unthinkable. So I needed to utilize python.  All of you see on the web, keyloggers, a then you download it and introduce it to spy or screen somebody (Windows 10 even has a worked in keylogger) . In any case, the issue is, is that you presumably likewise introduced a huge amount of infection of other garbage simultaneously.  I will demonstrate to you industry standards to make your own, or you can download mine beneath: (in the event that you are uncertain about downloading, I'll send you evidence that it isn't malignant) Step 1 : Installing Python Step 2 : Creating the code When you have the greater part of the python stuff introduced, open up sit still and make another content. At that point enter in the accompanying code: Then save it as something.pyw Step 3 : Test Presently dou
1 comment
Read more

SQL injection

Image
What is SQL Injection? SQL injection (SQLi) is an application security shortcoming that enables aggressors to control an application's database – giving them a chance to get to or erase information, change an application's information driven conduct, and do other unfortunate things – by deceiving the application into sending startling SQL orders.  SQL injection shortcomings happen when an application utilizes untrusted information, for example, information went into web shape fields, as a component of a database question. At the point when an application neglects to appropriately disinfect this untrusted information before adding it to a SQL question, an assailant can incorporate their own particular SQL charges which the database will execute. Such SQLi vulnerabilities are anything but difficult to counteract, yet SQLi remains a main web application chance, and numerous associations stay helpless against conceivably harming information breaks coming about because of
Post a Comment
Read more

PIN vs Pattern Locker

Image
Your Android lock screen pattern isn’t as safe as a PIN code What's more secure? Utilizing a numeric PIN code to open your Android cell phone or depending on a finger squiggle?🔐 Recently discharged research proposes that, in any event when somebody close by could investigate your shoulder, you may be more secure with an out-dated PIN. The exploration, exhibited in a paper entitled "Towards Baselines for Shoulder Surfing on Mobile Authentication" by the United States Naval Academy and the University of Maryland, tried what could best secure cell phones from alleged "shoulder surfing assaults". All in all, in case you're stressed over somebody looking behind you while you open your telephone, would you be more shrewd to utilize a PIN or an example? As indicated by this exploration at any rate, the response to that inquiry is really evident. Prowlers who have a solitary perception of your screen as you open it with a swipe examp
Post a Comment
Read more