Collaborate Disseminate
Granulate released new Kubernetes filters feature to the company’s gProfiler. gProfiler is an open-source production profiling solution that measures the performance of code in production applications to facilitate computing optimization, improve code … Continue reading Granulate adds Kubernetes filtering feature to open-source gProfiler
I am using PBKDF2 on NodeJS to authenticate a user who submits username & password. To do this, when the user first registers, I generate a salt, I use 200000 iterations, I specify a key length of 32 bytes, and I use sha256 as the dige… Continue reading Use PBKDF2 for both authentication and decryption on NodeJS
I have a keypair:
Publickey –> xpub6Gayxakssmp5B ….
Privatekey –> xprvA3bdZ5Dz3QFmyC6Y7tKeJ …
How can I generate hex privatekey from those?
I need to create transactions for filecoin so I need to use transactionSign(unSignedM… Continue reading Create privatekey & publickey from (Xprv) [closed]
How would one go about fixing vulnerabilities in indirect 3rd party libraries? Let’s say that the vulnerability is introduced via the following chain:
Introduced through:
example-app› express-prometheus-middleware@0.9.6 › prometheus-gc-sta… Continue reading Handling indirect vulnerable 3rd party dependencies
I’m exposing port 8080 through an Express server, which received a request that Express Morgan is reporting as:
GET http://jophiel.map.qq.com/proxy/?proxy=aaa.bb.ccc.ddd:8080&uuid=default 404 11.464 ms – 145
Where aaa.bb.ccc.ddd is … Continue reading Attack exposing residential 8080 port with Express server [closed]
I’m testing on application which runs on NodeJS, and discovered unrestriced file upload vulnerability, path traversal is not possible.
Uploaded file is visitable, I can upload .html to perform XSS attack, however I want something more. I’m… Continue reading NodeJS, unrestricted file upload, RCE [closed]
I am using CryptoJS AES 256 encryption:
CryptoJS.AES.encrypt(realData, generateKey(passphrase), {iv: iv});
The secret is generated through:
function generateKey(passphrase) {
const salt = CryptoJS.lib.WordArray.random(128 / 8);
cons… Continue reading How safe is AES 256bitkey encoded in HEX, Base64?
How does prototype pollution in javascript pose a danger to data and how it does happen?
Continue reading How prototype pollution works? Need simple explanation [closed]
I wonder is these npm packages are secure enough to be used commerical projects?
it shows lots of security issues and npm audit fix sometimes dont fix them
Continue reading Is express.js and express-session is secure?
How can you do a CRSF attack on express if it only accepts JSON?
Sample Node app:
const express = require(‘express’);
const app = express();
app.use(express.json());
app.post(‘/item’, (req, res, next) => {
console.log(‘posting i… Continue reading CSRF attack when form data isn’t parsed