Software security is not security software. Here we're concerned with topics like authentication, access control, confidentiality, cryptography, and privilege management.
anyRequest(). Failing to define a fallback check that uses the anyRequest() matcher, might leave endpoints unprotected.
<http auto-config="true">
<intercept-url pattern="/app/admin" access="ROLE_ADMIN" />
<intercept-url pattern="/" access="permitAll" />
</http>
Example 1 above, current or future endpoints such as /admin/panel might be left unprotected.HttpFirewall into its FilterChainProxy, which processes the requests before they are sent through the filter chain. Sprint Security uses the StrictHttpFirewall implementation by default.%2F and ; characters:
<beans:bean id="httpFirewall" class="org.springframework.security.web.firewall.StrictHttpFirewall" p:allowSemicolon="true" p:allowUrlEncodedSlash="true"/>
NoneAuth authentication method to determine the available authentication methods.
client = SSHClient()
client.connect(host, port, auth_strategy=NoneAuth("user"))
remove command to delete the whole data set. Recently, there have been reports of malicious attacks on unsecured instances of MongoDB running openly on the internet. The attacker erased the database and demanded a ransom be paid before restoring it.remove command to delete the whole data set. Recently, there have been reports of malicious attacks on unsecured instances of MongoDB running openly on the internet. The attacker erased the database and demanded a ransom be paid before restoring it.FLUSHALL command can be used by an external attacker to delete the whole data set. Recently, there have been reports of malicious attacks on unsecured instances of Redis running openly on the internet. The attacker erased the database and demanded a ransom be paid before restoring it.<behaviorExtensions/> element of the following WCF configuration file instructs WCF to add a custom behavior class to a particular WCF extension.
<system.serviceModel>
<extensions>
<behaviorExtensions>
<add name="myBehavior" type="MyBehavior" />
</behaviorExtensions>
</extensions>
</system.serviceModel>
NSData *imageData = [NSData dataWithContentsOfFile:file];
CC_MD5(imageData, [imageData length], result);
let encodedText = text.cStringUsingEncoding(NSUTF8StringEncoding)
let textLength = CC_LONG(text.lengthOfBytesUsingEncoding(NSUTF8StringEncoding))
let digestLength = Int(CC_MD5_DIGEST_LENGTH)
let result = UnsafeMutablePointer<CUnsignedChar>.alloc(digestLength)
CC_MD5(encodedText, textLength, result)
...
private static final String salt = "";
...
PBEKeySpec pbeSpec=new PBEKeySpec(password);
SecretKeyFactory keyFact=SecretKeyFactory.getInstance(CIPHER_ALG);
PBEParameterSpec defParams=new PBEParameterSpec(salt,100000);
Cipher cipher=Cipher.getInstance(CIPHER_ALG);
cipher.init(cipherMode,keyFact.generateSecret(pbeSpec),defParams);
...
...
const salt = "";
crypto.pbkdf2(
password,
salt,
iterations,
keyLength,
"sha256",
function (err, derivedKey) { ... }
);
...
CCKeyDerivationPBKDF(kCCPBKDF2,
password,
passwordLen,
"",
0,
kCCPRFHmacAlgSHA256,
100000,
derivedKey,
derivedKeyLen);
...
...
$hash = hash_pbkdf2('sha256', $password, '', 100000);
...
from hashlib import pbkdf2_hmac
...
dk = pbkdf2_hmac('sha256', password, '', 100000)
...
...
dk = OpenSSL::PKCS5.pbkdf2_hmac(password, "", 100000, 256, digest)
...
...
let ITERATION = UInt32(100000)
...
CCKeyDerivationPBKDF(CCPBKDFAlgorithm(kCCPBKDF2),
password,
passwordLength,
"",
0,
CCPseudoRandomAlgorithm(kCCPRFHmacAlgSHA256),
ITERATION,
derivedKey,
derivedKeyLength)
...
define('SECURE_AUTH_SALT', "");
...
import hashlib, binascii
def register(request):
password = request.GET['password']
username = request.GET['username']
hash = hashlib.md5("%s:%s" % ("", password,)).hexdigest()
store(username, hash)
...
require 'openssl'
...
password = get_password()
hash = OpenSSL::Digest::SHA256.digest(password)
...
...
PKCS5_PBKDF2_HMAC(pass, strlen(pass), "2!@$(5#@532@%#$253l5#@$", 2, ITERATION, EVP_sha512(), outputBytes, digest);
...
...
private static final String salt = "2!@$(5#@532@%#$253l5#@$";
...
PBEKeySpec pbeSpec=new PBEKeySpec(password);
SecretKeyFactory keyFact=SecretKeyFactory.getInstance(CIPHER_ALG);
PBEParameterSpec defParams=new PBEParameterSpec(salt,100000);
Cipher cipher=Cipher.getInstance(CIPHER_ALG);
cipher.init(cipherMode,keyFact.generateSecret(pbeSpec),defParams);
...
...
const salt = "some constant value";
crypto.pbkdf2(
password,
salt,
iterations,
keyLength,
"sha256",
function (err, derivedKey) { ... }
);
...
CCKeyDerivationPBKDF(kCCPBKDF2,
password,
passwordLen,
"2!@$(5#@532@%#$253l5#@$",
2,
kCCPRFHmacAlgSHA256,
100000,
derivedKey,
derivedKeyLen);
...
...
$hash = hash_pbkdf2('sha256', $password, '2!@$(5#@532@%#$253l5#@$', 100000)
...
...
from hashlib import pbkdf2_hmac
dk = pbkdf2_hmac('sha256', password, '2!@$(5#@532@%#$253l5#@$', 100000)
...
...
dk = OpenSSL::PKCS5.pbkdf2_hmac(password, '2!@$(5#@532@%#$253l5#@$', 100000, 256, digest)
...
...
let ITERATION = UInt32(100000)
let salt = "2!@$(5#@532@%#$253l5#@$"
...
CCKeyDerivationPBKDF(CCPBKDFAlgorithm(kCCPBKDF2),
password,
passwordLength,
salt,
salt.lengthOfBytesUsingEncoding(NSUTF8StringEncoding),
CCPseudoRandomAlgorithm(kCCPRFHmacAlgSHA256),
ITERATION,
derivedKey,
derivedKeyLength)
...
...
crypt(password, "2!@$(5#@532@%#$253l5#@$");
...
...
salt := "2!@$(5#@532@%#$253l5#@$"
password := get_password()
sha256.Sum256([]byte(salt + password)
...
...
Encryptor instance = ESAPI.encryptor();
String hash1 = instance.hash(input, "2!@$(5#@532@%#$253l5#@$");
...
javap -c command to access the disassembled code, which will contain the values of the used salt.
...
crypt($password, '2!@$(5#@532@%#$253l5#@$');
...
...
from django.contrib.auth.hashers import make_password
make_password(password, salt="2!@$(5#@532@%#$253l5#@$")
...
require 'openssl'
...
password = get_password()
salt = '2!@$(5#@532@%#$253l5#@$'
hash = OpenSSL::Digest::SHA256.digest(salt + password)
...
...
Rfc2898DeriveBytes rdb8 = new Rfc2898DeriveBytes(password, salt,50);
...
...
#define ITERATION 50
...
PKCS5_PBKDF2_HMAC(pass, sizeof(pass), salt, sizeof(salt), ITERATION, EVP_sha512(), outputBytes, digest);
...
...
final int iterationCount=50;
PBEParameterSpec pbeps=new PBEParameterSpec(salt,iterationCount);
...
...
const iterations = 50;
crypto.pbkdf2(
password,
salt,
iterations,
keyLength,
"sha256",
function (err, derivedKey) { ... }
);
...
#define ITERATION 50
...
CCKeyDerivationPBKDF(kCCPBKDF2,
password,
passwordLen,
salt,
saltLen
kCCPRFHmacAlgSHA256,
ITERATION,
derivedKey,
derivedKeyLen);
...
...
$hash = hash_pbkdf2('sha256', $password, $salt, 50);
...
...
from hashlib import pbkdf2_hmac
dk = pbkdf2_hmac('sha256', password, salt, 50)
...
bcrypt_hash = bcrypt(b64pwd, 11)
bcrypt API in Pycryptodome, it is crucial to note that the cost parameter plays a significant role in determining the computational complexity of the underlying hashing process. It is strongly recommended to set the cost parameter to a value of at least 12 to ensure a sufficient level of security. This value directly influences the time taken to compute the hash, which makes it more computationally expensive for potential attackers to carry out brute-force or dictionary attacks.
require 'openssl'
...
key = OpenSSL::PKCS5::pbkdf2_hmac(pass, salt, 50, 256, 'SHA256')
...
let ITERATION = UInt32(50)
...
CCKeyDerivationPBKDF(CCPBKDFAlgorithm(kCCPBKDF2),
password,
passwordLength,
saltBytes,
saltLength,
CCPseudoRandomAlgorithm(kCCPRFHmacAlgSHA256),
ITERATION,
derivedKey,
derivedKeyLength)
...
...
<param name="keyObtentionIterations" value="50"/>
...
CL_ABAP_HMAC->UPDATE which will result in the creation of a hash based on no data:
...
DATA: obj TYPE REF TO cl_abap_hmac.
CALL METHOD cl_abap_hmac=>get_instance
EXPORTING
if_key = 'ABCDEFG123456789'
RECEIVING
ro_object = obj.
obj->final( ).
....
CryptCreateHash, which will result in the creation of a hash based on no data:
...
if(!CryptAcquireContext(&hCryptProv, NULL, MS_ENH_RSA_AES_PROV, PROV_RSA_AES, 0)) {
break;
}
if(!CryptHashData(hHash, (BYTE*)hashData, strlen(hashData), 0)) {
break;
}
...
MessageDigest.update() which will result in the creation of a hash based on no data:
...
MessageDigest messageDigest = MessageDigest.getInstance("SHA-512");
io.writeLine(MyUtilClass.bytesToHex(messageDigest.digest()));
....
null (nil) salt can compromise system security in a way that is not easy to remedy.null (nil) salt. Not only does using a null salt make it significantly easier to determine the hashed values, it also makes fixing the problem extremely difficult. After the code is in production, the salt cannot be easily changed. If attackers figure out that values are hashed with a null salt, they can compute "rainbow tables" for the application and more easily determine the hashed values.null (nil) salt:
...
CCKeyDerivationPBKDF(kCCPBKDF2,
password,
passwordLen,
nil,
0,
kCCPRFHmacAlgSHA256,
100000,
derivedKey,
derivedKeyLen);
...
null salt. After the program ships, there is likely no way to change the null salt. An employee with access to this information can use it to break into the system.null (None) salt can compromise system security in a way that is not easy to remedy.null (None) salt. Not only does using a null salt make it significantly easier to determine the hashed values, it also makes fixing the problem extremely difficult. After the code is in production, the salt cannot be easily changed. If attackers figure out that values are hashed with a null salt, they can compute "rainbow tables" for the application and more easily determine the hashed values.null (None) salt:
import hashlib, binascii
from django.utils.crypto import pbkdf2
def register(request):
password = request.GET['password']
username = request.GET['username']
dk = pbkdf2(password, None, 100000)
hash = binascii.hexlify(dk)
store(username, hash)
...
null salt. After the program ships, there is likely no way to change the null salt. An employee with access to this information can use it to break into the system.null (nil) salt can compromise system security in a way that is not easy to remedy.null (nil) salt. Not only does using a null salt make it significantly easier to determine the hashed values, it also makes fixing the problem extremely difficult. After the code is in production, the salt cannot be easily changed. If attackers figure out that values are hashed with a null salt, they can compute "rainbow tables" for the application and more easily determine the hashed values.null (nil) salt:
...
let ITERATION = UInt32(100000)
...
CCKeyDerivationPBKDF(CCPBKDFAlgorithm(kCCPBKDF2),
password,
passwordLength,
nil,
0,
CCPseudoRandomAlgorithm(kCCPRFHmacAlgSHA256),
ITERATION,
derivedKey,
derivedKeyLength)
...
null salt. After the program ships, there is likely no way to change the null salt. An employee with access to this information can use it to break into the system.null salt (NULL) contradicts its intended objective and can compromise system security in a way that is not easy to remedy.null salt (NULL). Not only does a null salt contradicts its intended objective but all of the project's developers can view the salt. It makes fixing the problem extremely difficult because after the code is in production, the salt cannot be easily changed. If attackers know the value of the salt, they can compute "rainbow tables" for the application and easily determine the hashed values.null salt:
...
define('SECURE_AUTH_SALT', NULL);
...
null salt. An employee with access to this information can use it to break into the system.null salt (None) defeats its own purpose and may compromise system security in a way that is not easy to remedy.null salt (None). Not only does a null salt defeats its own purpose but it allows all of the project's developers to view the salt and it also makes fixing the problem extremely difficult. After the code is in production, the salt cannot be easily changed. If attackers know the value of the salt, they can compute "rainbow tables" for the application and more easily determine the hashed values.null salt (None):
from django.utils.crypto import salted_hmac
...
hmac = salted_hmac(value, None).hexdigest()
...
null salt. An employee with access to this information can use it to break into the system.
...
byte[] passwd = Encoding.UTF8.GetBytes(txtPassword.Text);
Rfc2898DeriveBytes rfc = new Rfc2898DeriveBytes(passwd, passwd,10001);
...
...
let password = getPassword();
let salt = password;
crypto.pbkdf2(
password,
salt,
iterations,
keyLength,
"sha256",
function (err, derivedKey) { ... }
);
function register(){
$password = $_GET['password'];
$username = $_GET['username'];
$hash = hash_pbkdf2('sha256', $password, $password, 100000);
...
import hashlib, binascii
def register(request):
password = request.GET['password']
username = request.GET['username']
dk = hashlib.pbkdf2_hmac('sha256', password, password, 100000)
hash = binascii.hexlify(dk)
store(username, hash)
...
require 'openssl'
...
req = Rack::Response.new
password = req.params['password']
...
key = OpenSSL::PKCS5::pbkdf2_hmac(password, password, 100000, 256, 'SHA256')
...
...
string hashname = ConfigurationManager.AppSettings["hash"];
...
HashAlgorithm ha = HashAlgorithm.Create(hashname);
...
Example 1 will run successfully, but anyone who can get to this functionality will be able to manipulate the hash algorithm by modifying the property hash. After the program ships, it can be nontrivial to undo an issue regarding user-controlled algorithms, as it is extremely difficult to know if a malicious user determined the algorithm parameter of a specific cryptographic hash.
...
Properties prop = new Properties();
prop.load(new FileInputStream("config.properties"));
String algorithm = prop.getProperty("hash");
...
MessageDigest messageDigest = MessageDigest.getInstance(algorithm);
messageDigest.update(hashInput.getBytes("UTF-8"));
...
Example 1 will run successfully, but anyone who can get to this functionality will be able to manipulate the hash algorithm by modifying the property hash. After the program ships, it can be nontrivial to undo an issue regarding user-controlled algorithms, as it is extremely difficult to know if a malicious user determined the algorithm parameter of a specific cryptographic hash.
require 'openssl'
require 'csv'
...
CSV.read(my_file).each do |row|
...
hash = row[4]
...
digest = OpenSSL::Digest.new(hash, data)
...
end
Example 1 will run successfully, but anyone who can get to this functionality will be able to manipulate the hash algorithm by modifying the hash from the CSV file. After the program ships, it can be nontrivial to undo an issue regarding user-controlled algorithms, as it is extremely difficult to know if a malicious user determined the algorithm parameter of a specific cryptographic hash.