title,body,link,tags,view_count,is_answered,score,answer_count
OpenADR2.0 VEN security testing with Test harness,"<p>I and my team are trying to build a VEN PULL implementation. We are using OpenLEADR-python library to build it. We are testing our implementation against the OpenADR 2.0 certification test harness, which we bought from QualityLogic. We are almost done with the implementation. But now facing problems with the security tests. While building both VTN and VEN with OpenLEADR, we could use the certificate and private-key generated with OpenSSL. But we are stuck with the security tests (G1_xxxx_TH_VTN_1) in the test-harness.</p>
<p>We believe we have to use certificate file, private-key file and passphrase. From where should we collect those files? Are those already given inside the test-harness? Or do we have to collect it from QualityLogic or any other source such as <a href=""https://kyrio.com/openadr/"" rel=""nofollow noreferrer"">https://kyrio.com/openadr/</a> ? And how should we configure the OpenLEADR VEN and the Ubuntu environment to support the security tests both with test-harness and the certification?</p>
",https://stackoverflow.com/questions/73854620/openadr2-0-ven-security-testing-with-test-harness,['python'],110,True,2,1
Spring Security testing Endpoint for user without specific role,"<p>I'm writing some integration tests for my Spring MVC Controller.</p>
<p>The controllers are secured by Spring Security.</p>
<p>This is the test class I currently have:</p>
<pre><code>@SpringBootTest(
    webEnvironment = SpringBootTest.WebEnvironment.MOCK,
    classes = GuiBackendApplication.class
)
@AutoConfigureMockMvc
public class ConfigEditorControllerIntegrationTest {

    @Autowired
    private MockMvc mockedMvc;

    @Test
    @WithMockUser(username = &quot;user&quot;, password = &quot;password&quot;, roles = {&quot;admin&quot;})
    public void adminsCanAccessRuntimeConfig() throws Exception {

        this.mockedMvc.perform(get(&quot;/my/custom/api&quot;))
            .andExpect(status().isOk());
    }
}
</code></pre>
<p>This test class ensures that admins can access my endpoint. It works fine.</p>
<p>BUT what if I want to test if ONLY users with the admin role can access my endpoint?</p>
<p>I could write a test that uses @WithMockUsers with all the roles I currently have except the admin role. But that would me awful to maintain. I want my test to ensure that only users with the admin role can access my endpoint, regardless of any new roles.</p>
<p>I checked the Spring Reference Docs and didn't find anything about that. Is there a way to achieve that?</p>
<p>Something like this</p>
<pre><code>@Test
@WithMockUser(username = &quot;user&quot;, password = &quot;password&quot;, roles = {&quot;IS NOT admin&quot;})
public void nonAdminsCannotAccessRuntimeConfig() throws Exception {

    this.mockedMvc.perform(get(&quot;/my/custom/api&quot;))
        .andExpect(status().isUnauthorized());
}
</code></pre>
",https://stackoverflow.com/questions/70953959/spring-security-testing-endpoint-for-user-without-specific-role,"['java', 'spring', 'spring-security', 'spring-test', 'spring-test-mvc']",705,True,0,1
Gitlab Static Application Security Testing (SAST) fails with permission denied,"<p>I am trying to add Static Application Security Testing (SAST) to my ci/cd yaml file.
But when I run it after adding the template <code>Security/SAST.gitlab-ci.yml</code> as instructed in</p>
<p>it fails with this log</p>
<pre><code>[ERRO] [Find Security Bugs] [2022-01-06T13:20:34Z] ▶ Project couldn't be built: Command couldn't be executed: fork/exec /builds/Hoshani/my-awesome-project/mvnw: permission denied

[FATA] [Find Security Bugs] [2022-01-06T13:20:34Z] ▶ Command couldn't be executed: fork/exec /builds/Hoshani/my-awesome-project/mvnw: permission denied
</code></pre>
<p>here is the yaml file for your reference</p>
<pre class=""lang-yaml prettyprint-override""><code>variables:
  MAVEN_OPTS: &quot;-Dhttps.protocols=TLSv1.2 -Dmaven.repo.local=$CI_PROJECT_DIR/.m2/repository -Dorg.slf4j.simpleLogger.log.org.apache.maven.cli.transfer.Slf4jMavenTransferListener=WARN -Dorg.slf4j.simpleLogger.showDateTime=true -Djava.awt.headless=true&quot;
  MAVEN_CLI_OPTS: &quot;--batch-mode --errors --fail-at-end --show-version -DinstallAtEnd=true -DdeployAtEnd=true&quot;

image: maven:3.8.1

cache:
  paths:
    - .m2/repository

stages:          
  - build
  - test
  - deploy

build-job:       
  stage: build
  script:
    - mvn clean install

include:
  - template: Security/SAST.gitlab-ci.yml
  - template: Jobs/SAST-IaC.latest.gitlab-ci.yml

unit-test-job:   
  stage: test    
  script:
    - mvn test
  artifacts:
    when: always
    reports:
      junit:
        - target/surefire-reports/TEST-*.xml
</code></pre>
<p>any help is appreciated, thanks</p>
",https://stackoverflow.com/questions/70607888/gitlab-static-application-security-testing-sast-fails-with-permission-denied,"['gitlab', 'continuous-integration', 'gitlab-ci', 'gitlab-ci-runner']",615,False,0,1
Spring Security testing: .getPrincipal() returning different objects in app and tests,"<p>I'm making a Reddit clone as one of the projects for my portfolio.</p>
<p>The problem I'm unable to solve (I'm a beginner) is this:</p>
<p>I have a CommentController (REST) that's handling all the api calls regarding comments. There's an endpoint for creating a comment:</p>
<pre><code>@PostMapping
public ResponseEntity&lt;Comment&gt; createComment(@Valid @RequestBody CommentDto commentDto, BindingResult bindingResult) {
    if (bindingResult.hasErrors()) throw new DtoValidationException(bindingResult.getAllErrors());
    URI uri = URI.create(ServletUriComponentsBuilder.fromCurrentContextPath().path(&quot;/api/comments/&quot;).toUriString());
    Comment comment = commentService.save(commentDto);
    return ResponseEntity.created(uri).body(comment);
}
</code></pre>
<p>In my CommentService class, this is the method for saving a comment made by currently logged in user:</p>
<pre><code>@Override
public Comment save(CommentDto commentDto) {
    Object principal = SecurityContextHolder.getContext().getAuthentication().getPrincipal();
    Optional&lt;User&gt; userOptional = userRepository.findUserByUsername((String) principal);
    if (userOptional.isPresent()) {
        User user = userOptional.get();
        Optional&lt;Post&gt; postOptional = postRepository.findById(commentDto.getPostId());
        if (postOptional.isPresent()) {
            Post post = postOptional.get();
            Comment comment = new Comment(user, commentDto.getText(), post);
            user.getComments().add(comment);
            post.getComments().add(comment);
            post.setCommentsCounter(post.getCommentsCounter());
            return comment;
        } else {
            throw new PostNotFoundException(commentDto.getPostId());
        }
    } else {
        throw new UserNotFoundException((String) principal);
    }
}
</code></pre>
<p>The app is running normally with no exceptions, and comment is saved to the database.</p>
<p>I'm writing an integration test for that controller, I used @WithMockUser(username = &quot;janedoe&quot;, password = &quot;password&quot;) on a test class, and I kept getting this exception:</p>
<pre><code>ClassCastException: UserDetails can not be converted to String
</code></pre>
<p>I realized that the problem is with this two lines in save method:</p>
<pre><code>Object principal = SecurityContextHolder.getContext().getAuthentication().getPrincipal();
Optional&lt;User&gt; userOptional = userRepository.findUserByUsername((String) principal);
</code></pre>
<p>What I don't get is why are those to lines throwing exception <em>only</em> in tests. When the app is running, everything is okay.</p>
<p>I guess that for some reason in tests the .getPrincipal() method is not returning a String (username), but the whole UserDetails object. I'm not sure how to make it return username in tests.</p>
<p>What have I tried to solve it:</p>
<ol>
<li><p>Changing @WithMockUser to @WithUserDetails</p>
</li>
<li><p>Using both @WithMockUser and @WithUserDetails on both class- and method-level</p>
</li>
<li><p>Creating custom @WithMockCustomUser annotation:</p>
<pre><code>@Retention(RetentionPolicy.RUNTIME)
@WithSecurityContext(factory = WithMockCustomUserSecurityContextFactory.class)
public @interface WithMockCustomUser {

String username() default &quot;janedoe&quot;;
String principal() default &quot;janedoe&quot;;
</code></pre>
</li>
</ol>
<p>}</p>
<pre><code>
Which just gives me the same ClassCastException with different text:
class com.reddit.controller.CustomUserDetails cannot be cast to class java.lang.String (com.reddit.controller.CustomUserDetails is in unnamed module of loader 'app'; java.lang.String is in module java.base of loader 'bootstrap')

Any help is appreciated :)
</code></pre>
",https://stackoverflow.com/questions/74078683/spring-security-testing-getprincipal-returning-different-objects-in-app-and,"['java', 'spring', 'spring-security', 'spring-test', 'spring-security-test']",121,True,1,1
Changing SHA1 to SHA-256 of firebase package,"<p>I am currently building a flutter app which went ahead for security testing. In the security testing an issue was raised related to firebase package using SHA1 Hashing. Though I have not used Hashing anywhere .I checked the decompiled apk source code and found out that firebase was using SHA1 such as</p>
<p>byte[] digest = MeassageDigest.getinstance(&quot;SHA1&quot;).digest(publicKey.getEncoded());</p>
<p>Is there anyway to change this SHA1 to SHA-256?</p>
<p>Thank you in advance!!!</p>
",https://stackoverflow.com/questions/72710136/changing-sha1-to-sha-256-of-firebase-package,"['java', 'flutter', 'firebase', 'dart', 'sha256']",98,False,0,0
Alternative to geolocator package in flutter with uses a java.security.SecureRandom class,"<p>I am currently building a flutter app which went ahead for security testing.
In the security testing an issue was raised related to geolocator package in flutter which after decompiling the code was showing a java.util.Random class was used and that this class makes the random Number Generation cryptographically weak.</p>
<p>Their recommendation was to use java.security.SecureRandom class for random number
generation.</p>
<p>Is there any other package other then geolocator that uses java.security.SecureRandom class for random number generation or can this be fixed?</p>
<p>Thank you for help in advance</p>
",https://stackoverflow.com/questions/72665708/alternative-to-geolocator-package-in-flutter-with-uses-a-java-security-secureran,"['java', 'flutter', 'dart', 'random', 'geolocator']",362,True,0,1
How many http get requests/minute can we get without being considered attack/spam,"<p>Let's say we have a url fuzzer for security testing writen in Python.</p>
<p>How many Get requests can we have per second or minute without affecting that website ?</p>
<p>For example: Are 200 Requests/Minute too much ?</p>
<p>Thank you.</p>
",https://stackoverflow.com/questions/72159831/how-many-http-get-requests-minute-can-we-get-without-being-considered-attack-spa,"['http', 'python-requests']",78,True,0,1
Gitlab Static Application Security Testing (SAST) fails with permission denied,"<p>I am trying to add Static Application Security Testing (SAST) to my ci/cd yaml file.
But when I run it after adding the template <code>Security/SAST.gitlab-ci.yml</code> as instructed in</p>
<p>it fails with this log</p>
<pre><code>[ERRO] [Find Security Bugs] [2022-01-06T13:20:34Z] ▶ Project couldn't be built: Command couldn't be executed: fork/exec /builds/Hoshani/my-awesome-project/mvnw: permission denied

[FATA] [Find Security Bugs] [2022-01-06T13:20:34Z] ▶ Command couldn't be executed: fork/exec /builds/Hoshani/my-awesome-project/mvnw: permission denied
</code></pre>
<p>here is the yaml file for your reference</p>
<pre class=""lang-yaml prettyprint-override""><code>variables:
  MAVEN_OPTS: &quot;-Dhttps.protocols=TLSv1.2 -Dmaven.repo.local=$CI_PROJECT_DIR/.m2/repository -Dorg.slf4j.simpleLogger.log.org.apache.maven.cli.transfer.Slf4jMavenTransferListener=WARN -Dorg.slf4j.simpleLogger.showDateTime=true -Djava.awt.headless=true&quot;
  MAVEN_CLI_OPTS: &quot;--batch-mode --errors --fail-at-end --show-version -DinstallAtEnd=true -DdeployAtEnd=true&quot;

image: maven:3.8.1

cache:
  paths:
    - .m2/repository

stages:          
  - build
  - test
  - deploy

build-job:       
  stage: build
  script:
    - mvn clean install

include:
  - template: Security/SAST.gitlab-ci.yml
  - template: Jobs/SAST-IaC.latest.gitlab-ci.yml

unit-test-job:   
  stage: test    
  script:
    - mvn test
  artifacts:
    when: always
    reports:
      junit:
        - target/surefire-reports/TEST-*.xml
</code></pre>
<p>any help is appreciated, thanks</p>
",https://stackoverflow.com/questions/70607888/gitlab-static-application-security-testing-sast-fails-with-permission-denied,"['gitlab', 'continuous-integration', 'gitlab-ci', 'gitlab-ci-runner']",615,False,0,1
How to make 403 error is oaky for API testing in Jmeter,"<p>I know In general JMeter automatically treats samplers with HTTP Status Code above 400 as failed , but I am doing the security testing for the API's such as 403 forbidden.</p>
<p>Snice I expect 403 forbidden error, how do I make Report is PASSED for 403 forbidden error.</p>
",https://stackoverflow.com/questions/74778379/how-to-make-403-error-is-oaky-for-api-testing-in-jmeter,"['api', 'jmeter']",95,True,0,1
Artifactory LDAPS to Active Directory not working,"<p>Setting up a new JFROG Artifactory on a Windows server.
Trying to get LDAPS to work with Active Directory. When LDAP is set for port 389 the test user can authenticate, when I Chang it to LDAPS port 636 it fails.
I have the AD CA cert in the jfrog\artifactory\var\etc\security folder and also have it in the cacerts in the third-party\java\lib\security.
Testing LDAPS with ldp.exe passes\works.</p>
<p>Thanks for any assistance</p>
",https://stackoverflow.com/questions/72004313/artifactory-ldaps-to-active-directory-not-working,['ldap'],256,False,0,0
Memory leaks sensitive information - Ionic,"<p>In our application, during the security testing, they were able to get the request and response details from the memory dump.
Please find the following details they were able to get from the dump, is there any option or process we can implement to remove this from happening:</p>
<pre><code>CordovaHttpPlugin
post https:/XXXXXXXXXX/XXXXXXXXXX/login
username: XXXXXXXX
password XXXXXXX
json
Authorization
Bearer
null
Content-Type
application/json
Accept
text
ionic
</code></pre>
<p>Security team is using tool &quot;<strong>fridump</strong>&quot; for getting the memory data.</p>
<p>Is there any possible methods in ionic or tools that we can add to avoid this type of memory dump.</p>
",https://stackoverflow.com/questions/71351073/memory-leaks-sensitive-information-ionic,"['security', 'debugging', 'ionic-framework', 'memory', 'ionic2']",321,True,0,1
Is there charset encoding vulnerability in 2022?,"<p>Does not specifying the charset in the content-type of the http response header lead to vulnerability, even in modern web browsers (Chrome, Firefox, Edge) as of 2022?</p>
<p>I read the following article, but as of 2022, due to the efforts of web browser vendors, XSS attacks using utf-7 are no longer valid, and although garbled characters may occur, they will not be a vulnerability.</p>
<p><a href=""https://owasp.org/www-project-web-security-testing-guide/latest/6-Appendix/D-Encoded_Injection"" rel=""nofollow noreferrer"">https://owasp.org/www-project-web-security-testing-guide/latest/6-Appendix/D-Encoded_Injection</a></p>
<p><a href=""https://stackoverflow.com/questions/33834152/security-vulnerabilities-without-meta-chartset-any-encoding-tag"">Security Vulnerabilities without &lt;meta chartset=&lt;&lt;&quot;any-encoding&quot;&gt;&gt; /&gt; tag?</a></p>
",https://stackoverflow.com/questions/70666458/is-there-charset-encoding-vulnerability-in-2022,"['security', 'character-encoding', 'http-headers', 'xss', 'content-type']",521,True,1,1
How to fix security errors for C# (Insecure Data Storage),"<p>I am getting security issue reported for the below lines in File A and File B. In this file, we read the username and password. This is not getting logged in the log file.</p>
<p>Also, is it possible to catch such issues during the development phase, rather than getting these in the security testing phase which happens later? Any guidelines on how to configure this in visual studio 2022 and sonarqube to catch such issues early?</p>
<pre><code>string serviceUserName = Environment.GetEnvironmentVariable(&quot;Service_UserName&quot;);
string servicePassword = Environment.GetEnvironmentVariable(&quot;Service_Password&quot;);
</code></pre>
<pre><code>log.LogInformation($&quot;Status of Blob trigger function with blob\n Name:{fileName} is: {response.StatusCode}&quot;);
</code></pre>
<p>Categories
OWASP Mobile Top 10 2016: M2-Insecure Data Storage</p>
",https://stackoverflow.com/questions/74730849/how-to-fix-security-errors-for-c-insecure-data-storage,"['security', 'sonarqube']",97,False,0,0
Prevent authentication bypass via response manipulation with ASP.NET Core Identity implementation,"<p>Web application has asp.net core identity implementation, in security testing of our application vulnerability is found-authentication bypass via response manipulation.</p>
<p>For eg: User1 logs in into the system with valid user credentials, and the cookie for that user is copied and the User1 logs out. User1 tries to login with incorrect password ,intercepts the request and uses User1 valid cookie to login into the system and User1 is logged in even with incorrect password.</p>
<p>How to destroy the cookie and invalidate the session for asp.net core identity implementation?</p>
<p>Asp.net Core identity,.net 5.0,asp.net core mvc</p>
",https://stackoverflow.com/questions/71934552/prevent-authentication-bypass-via-response-manipulation-with-asp-net-core-identi,"['c#', '.net', 'asp.net-core', 'asp.net-core-mvc', 'asp.net-core-identity']",1273,True,1,2
Is there a way to send binary data to a C program from within GDB?,"<p>I am debugging a C program inside of GDB on linux. The C program prompts the user and then calls <code>read(0,&amp;user_buffer,24)</code> where <code>user_buffer</code> is a 24-byte char buffer on the stack. I know that I can send binary data to the program from outside of gdb by e.g. <code>echo -e &quot;\x41\x42\x43\x44&quot; | &lt;executable&gt;</code>, but is it possible for me to directly write raw bytes to the prompt from within gdb? I've only ever seen this done externally as shown, or using python like <code>python -c 'print(&quot;\x00\xFF\xAB&quot;)' </code> When I try to type in something like <code>\x41\x42\x43\x44</code> to the prompt within GDB, it interprets them as ascii chars. This is important for my security testing.</p>
",https://stackoverflow.com/questions/74283390/is-there-a-way-to-send-binary-data-to-a-c-program-from-within-gdb,"['c', 'security', 'debugging', 'gdb']",307,True,1,2
AppSweep: How do I remove an uploaded android apk?,"<p>I recently came across a free mobile app security testing tool based on <code>proguard</code> called <a href=""https://www.guardsquare.com/appsweep-mobile-application-security-testing"" rel=""nofollow noreferrer"">AppSweep</a>. I uploaded an android debug apk for security scanning/testing to see any potential vulnerabilities.</p>
<p>It provides a way to upload an apk without signing up or needing an api key and it worked perfectly and I was able to address most of the severe issues.</p>
<p>However, I want to remove an already uploaded <code>app-debug.apk</code> build and I am unable to find an edit or remove functionality. Is this provided <em>and</em> is there a hard limit on the total number of apk uploads?</p>
",https://stackoverflow.com/questions/72607850/appsweep-how-do-i-remove-an-uploaded-android-apk,"['android', 'appsweep']",146,True,0,1
How to write a python program to interact with the browser?,"<p>In my company intranet, any request to an external website X in Internet will be redirected to an internal page containing a button that I have to click on. Then the external website X in Internet will be loaded.</p>
<p>I want to write a program that automatically clicks this button for me (so I don't have to click it manually). After that, the program will make the browser redirect to a re-configured website Y (not X) for the purpose of security testing.</p>
<p>I don't have much experience with Python. So I would be really thankful if someone can tell me how I can write such a program.</p>
<p>Many thanks</p>
",https://stackoverflow.com/questions/71624216/how-to-write-a-python-program-to-interact-with-the-browser,"['python', 'python-3.x', 'google-chrome', 'browser', 'microsoft-edge']",183,False,-1,2
How to know if the form target attribute is self posting or not in http request (apache 2.4 server),"<p>I am trying to block the <strong>self posting</strong> of form on which the url tried to access the page .
Can i know the <strong>&quot;target&quot;</strong> type of form action after receiving the http request ?</p>
<p>For example</p>
<pre><code>abc.com:8080/index.html?data=user
</code></pre>
<p>this is the api url where i post my data , now i can post the data using <code>postman</code> .
I have my code where i get the request from postman and do authentication and authorisation processing ,
When the request completed i get</p>
<pre><code>&lt;html&gt;

&lt;head&gt;
    &lt;base target=&quot;_self&quot;&gt;
&lt;/head&gt;

&lt;body onLoad=&quot;document.myForm.submit()&quot;&gt;&lt;noscript&gt;
        &lt;p&gt;JavaScript is required. Please enable JavaScript.&lt;/p&gt;
    &lt;/noscript&gt;&lt;!--           DO NOT REMOVE            --&gt;
    &lt;!--    loginform renderBrowserView     --&gt;
    &lt;!-- Required for SmartView Integration --&gt;
    &lt;form action=&quot;/index.html?data=user method=&quot;post&quot; name=&quot;myForm&quot; enctype=&quot;application/x-www-form-urlencoded&quot;&gt;&lt;/form&gt;
&lt;/body&gt;

&lt;/html&gt;
</code></pre>
<p>here target is self posting .</p>
<p>Also i haven't created any form inside the <code>index.html</code>. This page is used for get request . But for security testing i am trying to post the data in the url itself.
So how i can avoid the <strong>&quot;url&quot;</strong> which is posting to itself ?</p>
",https://stackoverflow.com/questions/73391607/how-to-know-if-the-form-target-attribute-is-self-posting-or-not-in-http-request,"['http-post', 'httprequest', 'httpresponse', 'apache2.4']",33,False,0,0
What SQL injections can bypass this authentication page?,"<p>I am working on building a login page to demonstrate SQL injections. I've tried my best to build the most &quot;simple&quot; login. I've been using credentials such as <code>1' or '1' = '1</code> for username &amp; password, and getting the &quot;nay&quot; message when logging in, meaning it just recognizes it as incorrect user &amp; pass. I have also tried logging in with <code>1' or '1' = '1'))/*</code> as username and <code>foo</code> as password, and getting a 500 Server error when logging in.</p>
<ul>
<li>Am I implementing the SQL injections incorrectly?</li>
<li>Do I need to &quot;dummy&quot; down the login implementation?</li>
</ul>
<p>Where I got the SQL injection testing: <a href=""https://owasp.org/www-project-web-security-testing-guide/latest/4-Web_Application_Security_Testing/07-Input_Validation_Testing/05-Testing_for_SQL_Injection"" rel=""nofollow noreferrer"">https://owasp.org/www-project-web-security-testing-guide/latest/4-Web_Application_Security_Testing/07-Input_Validation_Testing/05-Testing_for_SQL_Injection</a></p>
<p>Here is my authentication page:</p>
<pre><code>&lt;?php
include('config.php');
$username = $_POST['username'];
$password = $_POST['password'];

$sql = &quot;SELECT * FROM Users WHERE username = '$username' AND password = '$password'&quot;;
$result = mysqli_query($conn, sql);
$row = mysqli_fetch_array($result);
$count = mysqli_num_rows($result);

if($count == 1) {
echo &quot;yay&quot;;
} else {
echo &quot;nay&quot;;
}
?&gt; 
</code></pre>
<p>My issue might be that I am trying to take the inputted username &amp; password and compare to the data stored in my db, which is why it's just recognizing the injections as incorrect usernames &amp; passwords.</p>
",https://stackoverflow.com/questions/71130309/what-sql-injections-can-bypass-this-authentication-page,"['php', 'sql-injection', 'mysql']",751,True,0,1
"Installed module via pip, still get ModuleNotFoundError","<p>I'm trying to use <code>w3af</code> to start doing some routine security testing on a webapp that I'm using. <a href=""http://w3af.org/download"" rel=""nofollow noreferrer"">Install instructions</a> recommend cloning a git repo, then running the python code and seeing what dependencies are unmet then installing them. My first run yielded:</p>
<pre><code>ModuleNotFoundError: No module named 'ConfigParser
</code></pre>
<p>OK, no problem, right?</p>
<pre><code>$ pip install ConfigParser
Collecting ConfigParser
Downloading configparser-5.2.0-py3-none-any.whl (19 kB)
Installing collected packages: ConfigParser
Successfully installed ConfigParser-5.2.0
</code></pre>
<p>Mission accomplished, let's try again!</p>
<pre><code>$ ./w3af_console
Traceback (most recent call last):
  File &quot;./w3af_console&quot;, line 12, in &lt;module&gt;
    from w3af.core.controllers.dependency_check.dependency_check import dependency_check
  File &quot;/Users/westonx/bin/w3af/w3af/core/controllers/dependency_check/dependency_check.py&quot;, line 26, in &lt;module&gt;
    from w3af.core.data.db.startup_cfg import StartUpConfig
  File &quot;/Users/westonx/bin/w3af/w3af/core/data/db/startup_cfg.py&quot;, line 22, in &lt;module&gt;
    import ConfigParser
ModuleNotFoundError: No module named 'ConfigParser'
</code></pre>
<p>Hmmm. Could swear we took care of that. Let's run pip (maybe pip3?) again to be sure?</p>
<pre><code>$ pip3 install ConfigParser
Requirement already satisfied: ConfigParser in /Users/westonx/.pyenv/versions/3.8.2/lib/python3.8/site-packages (5.2.0)
</code></pre>
<p>Seems good. Let's check to see if the import path includes that directory:</p>
<pre><code>$ python -c &quot;import sys; print('\n'.join(sys.path)); import ConfigParser;&quot;

/Users/westonx/.pyenv/versions/3.8.2/lib/python38.zip
/Users/westonx/.pyenv/versions/3.8.2/lib/python3.8
/Users/westonx/.pyenv/versions/3.8.2/lib/python3.8/lib-dynload
/Users/westonx/.pyenv/versions/3.8.2/lib/python3.8/site-packages
Traceback (most recent call last):
  File &quot;&lt;string&gt;&quot;, line 1, in &lt;module&gt;
ModuleNotFoundError: No module named 'ConfigParser'
</code></pre>
<p>So... we know the sys.path includes the directory pip says the module is installed in, but when we import it, python insists it's not there.</p>
<p>configparser-5.2.0.dist-info and configparser.py are indeed in my ~/.pyenv/versions/3.8.2/lib/python3.8/site-packages directory, so it doesn't look like pip telling me something that's not true. But it sure looks like python is.</p>
<p>I'm using pyenv on MacOS 10.14, not sure if that makes a difference. Anyone have ideas of what next steps should be?</p>
",https://stackoverflow.com/questions/73014634/installed-module-via-pip-still-get-modulenotfounderror,"['python', 'pip', 'pyenv', 'configparser']",159,True,0,2
Why there is difference in Active scan report for same application in ZAP TOOL,"<p>I am using ZAP TOOL for security testing and
Doing two active scans for the same application without changing anything, the results are different.
For example, in the first scan for the same url it shows me a possible SQL injection in some parameters and when I launch it a second time for the same url it shows me the possible injection in other parameters. I don't know if the data used to make the request can also influence, or the data in the database</p>
<p>If haven't changed on application, I have done manual scan using Active scan and every time i got different result for same application . Can anyone have any idea why is happening ?</p>
<p>Is the Zaps tools uses the different scripts/attack files every time for Active scan.
I would like to know what factors influence different results and where can I find out how active scanning actually works. Thanks</p>
",https://stackoverflow.com/questions/71870418/why-there-is-difference-in-active-scan-report-for-same-application-in-zap-tool,"['security', 'testing', 'zap']",233,False,0,1
Using mKeyguardManager for lockscreen only displays when opening the application,"<p>In Java, I am trying to implement a feature where only the admin (person who knows the device password) can access an information screen and when they click on a button within the app in the MainActivity, the lock screen will appear as a form of authentication and display another activity screen on success. Is this possible?</p>
<p>So far, I noticed that the authentication only displays when I open the app and not when I press the button in an onClickListener. Most of the solutions I've seen are doing it this way. I have the code in MainActivity within an <code>onCreate()</code> method.</p>
<p>MainActivity</p>
<pre><code>ActivityResultLauncher&lt;Intent&gt; activityResultLaunch = registerForActivityResult(
        new ActivityResultContracts.StartActivityForResult(),
        new ActivityResultCallback&lt;ActivityResult&gt;() {
            @Override
            public void onActivityResult(ActivityResult result) {
                if (result.getResultCode() == Activity.RESULT_OK) {
                  // There are no request codes
                  Intent data = result.getData();
                } else {
                  finish();
                }
            }
        });

start_end_button_add.setOnClickListener(new View.OnClickListener() {
    @Override
    public void onClick(View view) {

      authScreen(activityResultLaunch);

    }
});

private void authScreen(ActivityResultLauncher&lt;Intent&gt; activityResultLaunch) {
    KeyguardManager mKeyguardManager = (KeyguardManager) getSystemService(Context.KEYGUARD_SERVICE);
    if (!mKeyguardManager.isKeyguardSecure()) {
      // Show a message that the user hasn't set up a lock screen.
    } else {
      Intent intent = mKeyguardManager.createConfirmDeviceCredentialIntent(null, null);

      if (intent != null) {
        startActivityForResult.launch(intent, REQUEST_CODE_CONFIRM_DEVICE_CREDENTIALS);
      }
    }

    Intent intent = new Intent(DetectorActivity.this, SearchActivity.class);

    startActivity(intent);
    finish();

}
</code></pre>
<p>Currently, the app immediately goes to the SearchActivity class without having the lock screen displayed in between. Even if I get into the app after PIN code entered is a success, it still doesn't get into the activityResultLaunch success condition as per the new implementation referenced <a href=""https://stackoverflow.com/questions/62671106/onactivityresult-method-is-deprecated-what-is-the-alternative"">here</a> by user Martin Zeitler.</p>
<p>Reference:
<a href=""https://mobile-security.gitbook.io/mobile-security-testing-guide/android-testing-guide/0x05f-testing-local-authentication#:%7E:text=In%20Android%2C%20there%20are%20two,and%20the%20Biometric%20Authentication%20flow"" rel=""nofollow noreferrer"">https://mobile-security.gitbook.io/mobile-security-testing-guide/android-testing-guide/0x05f-testing-local-authentication#:~:text=In%20Android%2C%20there%20are%20two,and%20the%20Biometric%20Authentication%20flow</a>.</p>
",https://stackoverflow.com/questions/73568967/using-mkeyguardmanager-for-lockscreen-only-displays-when-opening-the-application,"['java', 'android-studio', 'android-intent']",43,False,1,0
Logging with a p12 certificate on a SOAP API server,"<p>Hi I am testing an app using SOAPUI and Postman to authenticate to a SOAP API service.</p>
<p>The web service uses the OASIS Web Service Security (WS-Security) specifications in its version 1.0, using as authentication standard UserNameToken (with password of type
PasswordText).</p>
<p>In the documentation provided to me they only make reference to a request using <strong>UserNameToken</strong></p>
<pre><code> &lt;soapenv:Header&gt;
 &lt;wsse:Security xmlns:wsse=&quot;http://docs.oasis-open.org/wss/2004/01/oasis-200401-wsswssecurity-secext-1.0.xsd&quot; &gt;
 &lt;wsse:UsernameToken&gt;
 &lt;wsse:Username&gt;user&lt;/wsse:Username&gt;
 &lt;wsse:Password&gt;password&lt;/wsse:Password&gt;
 &lt;/wsse:UsernameToken&gt;
 &lt;/wsse:Security&gt;
 &lt;/soapenv:Header&gt;
</code></pre>
<p>Using SOAPUI I have configured the credentials with the certificate and I always get this error:</p>
<pre><code>The referenced security token could not be retrieved; WSE590: The following key information could not be resolved
</code></pre>
<p>This service has a frontend, a simple web to make transactions and the API is a complement to automate them. From the frontend you can authenticate using a certificate, without having to log in with username and password.</p>
<p>In the API server documentation indicates that the login credentials used in the authentication, must be the same as those used to access the web application: username and password (but having the certificate I do not have username and password).</p>
<p>The question is: <strong>is there any way to use this certificate to authenticate myself in the requests to the API server?</strong></p>
<p>As I have already said I have tried configuring it as the SOAPUI documentation says. Here are some links:
<a href=""https://www.soapui.org/docs/security-testing/ws-security-settings/"" rel=""nofollow noreferrer"">https://www.soapui.org/docs/security-testing/ws-security-settings/</a>
<a href=""https://pglezen.github.io/was-config/html/soapui.html"" rel=""nofollow noreferrer"">https://pglezen.github.io/was-config/html/soapui.html</a></p>
",https://stackoverflow.com/questions/73192856/logging-with-a-p12-certificate-on-a-soap-api-server,"['api', 'soap', 'certificate', 'soapui']",142,False,0,0
How to integrate pvs-studio in a TI CCS project,"<p>I'm trying to use pvs-studio to analyze a TI Code Composer Studio project. As mentionned in the documentation I ran strace to get the trace files out of my build process. Here the command I used :</p>
<pre><code>pvs-studio-analyzer trace -- /ti-ccs/ccs/utils/bin/gmake -f /code/i2c_led_blink_am64x-sk_r5fss0-0_freertos_ti-arm-clang/Debug/makefile -k -j 1 all -O
</code></pre>
<p>It produced no error and exited with the 0 error code. It also produced a strace_out file that can be used with the analyzer. Then I used this command the analyze the trace :</p>
<pre><code>pvs-studio-analyzer analyze -l ~/.config/PVS-Studio/PVS-Studio.lic -j 2 -C tiarmclang=tiarmcgt
</code></pre>
<p>At the beginning of the analysis it said :</p>
<pre><code>Using tracing file: strace_out
Source file can't be preprocessed!
</code></pre>
<p>Which I'm not sure to understand, then it parsed the commands and had multiple stderr output (on every command in fact) :</p>
<pre><code>Stderr:
tiarmclang: error: unsupported option '--no_warnings'; did you mean '--no-warnings'?
tiarmclang: error: unsupported option '--preproc_only'
tiarmclang: error: unsupported option '--preproc_with_line'
tiarmclang: error: unsupported option '--output_file=/code/i2c_led_blink_am64x-sk_r5fss0-0_freertos_ti-arm-clang/main.PVS-Studio.i'
</code></pre>
<p>I don't know if they are important or not. What's strange is that my project builds correctly otherwise. Then the analysis finishes and the results are saved in PVS-Studio.log. However, upon reading the file with plog-converter, I get no information apart from:</p>
<p>Analyzer log conversion tool.
Copyright (c) 2022 PVS-Studio LLC</p>
<p>PVS-Studio is a static code analyzer and SAST (static application security
testing) tool that is available for C and C++ desktop and embedded development,
C# and Java under Windows, Linux and macOS.</p>
<p>Total messages: 13
Filtered messages: 13</p>
<p>Did I do something wrong in my configuration or in my process ? Thank you for the help.</p>
",https://stackoverflow.com/questions/74139058/how-to-integrate-pvs-studio-in-a-ti-ccs-project,"['c', 'static-analysis', 'texas-instruments', 'code-composer', 'pvs-studio']",65,False,0,0
What is the best way to to access custom OIDC attributes (claims) via Spring Security in a type safe way,"<p>We have a web application using OpenID Connect / Spring Security 5 to authenticate users.
Integration is really simple with the out-of-the-box OIDC support in Spring Security using the oauth2 authentication support (<code>oauth2Login</code>)</p>
<p>The Identity Provider exposes some attributes via the userInfo endpoint that we need a lot in our business logic (preferably in a type-safe way). These attributes are in some cases lists of rich objects, something difficult to access using a generic <code>Map&lt;String,Object&gt;</code></p>
<p>The attributes from that userInfo endpoint are merged with the attributes from the id token in the default <code>OidcUserService</code>, and put on the <code>DefaultOidcUser</code> (so that it becomes part of the <code>OAuth2AuthenticationToken</code>)</p>
<ul>
<li><code>@AuthenticationPrincipal DefaultOidcUser defaultOidcUser</code> = a DefaultOidcUser that contains all of these attributes (using Maps)</li>
<li><code>java.security.Principal</code> = <code>OAuth2AuthenticationToken</code> (that in turn contains a principal, being our <code>DefaultOidcUser</code>)</li>
<li><code>SecurityContextHolder.getContext().getAuthentication()</code> = again the same <code>OAuth2AuthenticationToken</code></li>
</ul>
<p>So to access the custom attributes I can</p>
<ol>
<li>cast the Principal (or SecurityContextHolder.getContext().getAuthentication())</li>
</ol>
<pre><code>public void doSomething(Principal principal) {
   OAuth2AuthenticationToken oAuth2AuthenticationToken = (OAuth2AuthenticationToken)principal;
   Map&lt;String, Object&gt; attributes = oAuth2AuthenticationToken.getPrincipal().getAttributes();
  ...
}
</code></pre>
<p>Downside here is I need to cast, and would need to convert the Map into a Pojo &quot;somewhere&quot; in the code, preferably only once.</p>
<ol start=""2"">
<li>Inject a <code>@AuthenticationPrincipal DefaultOidcUser</code> to avoid casting and access the attributes.</li>
</ol>
<pre><code>public void doSomething(@AuthenticationPrincipal DefaultOidcUser defaultOidcUser) {
    Map&lt;String, Object&gt; attributes = defaultOidcUser.getAttributes();
    ...

}
</code></pre>
<p>Here I don't need to cast, but still don't have the attributes as a pojo.</p>
<p>What would be the best way to have easy access to these attributes in a type-safe way ?</p>
<p><a href=""https://docs.spring.io/spring-security/reference/servlet/oauth2/login/advanced.html#oauth2login-advanced-map-authorities-oauth2userservice"" rel=""nofollow noreferrer"">The documentation</a> mentions the <code>OAuth2UserService</code>, where we have a hook to return a <code>OidcUser</code> that could be a custom object, exposing our attributes in a type safe way.</p>
<p>Leading me to option nr 3</p>
<ol start=""3"">
<li>Create a custom <code>oidcUserService</code></li>
</ol>
<pre><code>
    private OAuth2UserService&lt;OidcUserRequest, OidcUser&gt; oidcUserService() {
        final OidcUserService delegate = new OidcUserService();

        return (userRequest) -&gt; {
            // Load original user
            OidcUser oidcUser = delegate.loadUser(userRequest);

            // Parse custom claims
            CustomTypedAttributes customTypedAttributes = objectMapper.convertValue(oidcUser.getClaims(), CustomTypedAttributes.class);

            // Expose them as new custom user
            return new CustomOidcUser(oidcUser.getAuthorities(), oidcUser.getIdToken(), oidcUser.getUserInfo(), customTypedAttributes);
        };
    }
</code></pre>
<p>Advantage is we have type-safe access to our custom attributes, via <code>customOidcUser.getCustomTypedAttributes()</code>, they only need to be converted once (after login).</p>
<p>However, it doesn't feel &quot;right&quot; to wrap an <code>OidcUser</code> like this, just to expose a type safe attribute map.</p>
<p>Are there alternative ways of dealing with custom attributes in application code where the requirements are :</p>
<ul>
<li>Easy access to custom attributes in a type safe way</li>
<li>Making use of the standard Spring Security building blocks</li>
<li>Test-friendly (using spring security testing)</li>
</ul>
",https://stackoverflow.com/questions/72543493/what-is-the-best-way-to-to-access-custom-oidc-attributes-claims-via-spring-sec,"['java', 'spring', 'spring-boot', 'spring-security', 'openid-connect']",705,False,0,0
