Encoding is a set of predefined rules to reversibly transform a piece of information in a certain representation into a completely different representation. The other way round is called decoding.
41
votes
6answers
2k views
Virus Encoded in Video
So I'm not familiar at all with IT Security, but I'm a bit curious about something. I was watching a TV show and at one point, a virus spreads through an office. They investigate and find out that the ...
11
votes
3answers
1k views
How do I prevent this type of SQL injection attack?
Our company has been using several tool (Veracode, Appscan, etc) to verify that our applications meet minimum security requirements. I have inherited a legacy application which has several flaws. I've ...
8
votes
4answers
725 views
Is $_SERVER[ ] a safe source of data in PHP?
Can I 100% rely on $_SERVER[] to be a safe source of data that I do not need to sanitized like I do $_GET[] and $_POST[]?
Thanks.
OVERVIEW OF RESPONSES:
So it seems there is a consensus that some ...
6
votes
2answers
199 views
Exploiting PHP via GET params
To be clear, this is in the interest of ethical testing to secure an application on behalf of my work.
Now that that's out of the way, here are the details:
Un-sanitised GET params are used in a ...
5
votes
1answer
5k views
PKCS7 encoding in Java without external libs like BouncyCastle etc
I am working on signing and encoding of CMS/PKCS#7 messages (something similar to C# SignedCms).
I have x509certificate from the keystore, rsa private key,
ContentInfo. ContentType is "oidPkcs7Data".
...
4
votes
2answers
332 views
Canonicalization & Output Encoding
I'm reading OWASP's Secure Coding Practices Checklist and under their "Input Validation" section they have an item that reads:
If any potentially hazardous characters (<>"'%()&+\\'\") ...
4
votes
1answer
166 views
Reducing password length with hash function
Suppose I would like to use a very long string as a password. As an example we can just say this string is 100 characters in length.
However, suppose the application for which I would like to use ...
3
votes
1answer
124 views
Unknown Asian/Chinese registry keys
On a Windows Server 2008 machine found registry key "潓瑦慷敲卜湹潣敶祲" under HKEY_CURRENT_USER of the administrator account. It contains a value "敓癲捩剥湵楮杮" of type REG_DWORD which is set to 0.
I scanned the ...
3
votes
1answer
2k views
URLEncode vs HTMLEncode for XSS prevention
I have one project (in Java) that the programmer used URLEncode to output content as part of HTML instead of HTMLEncode.
What is the risk that it is XSS vulnerable?
(Let’s forget that it’s different ...
3
votes
2answers
151 views
Why some antiviruses detect viruses and some not?
I am curious why some anti-viruses detect viruses and some do not. From what I found online, antiviruses parse the binary files and check the sequence of code which is malicious(exists in virus ...
3
votes
2answers
66 views
SPAM postscript
I have been getting a lot of SPAM lately that have some type of encoded block added to the end. I am wondering if anyone here would know how to decode it. Here is an example:
...
3
votes
1answer
179 views
Base64 encode diffences in BCrypt implemenations
I was reading the source code of several BCrypt implementations and found that two common c implementations have a difference in their base64 encoding of for the salt.
What is the effect, if any, of ...
2
votes
2answers
2k views
Is this JSON encoding vulnerable to CDATA injection?
I ran across an odd notation in the jsfiddle.net generated pages
<script type='text/javascript'>//<
2
votes
1answer
91 views
Encoding HTML email content
Say I have a form on my website.
The input elements of the form are: email address, name and some feedback textarea.
The server-side application that this form is submitted to will send an HTML ...
1
vote
2answers
576 views
HTML encoding to protect against XSS
While going through some references about protection against XSS i found that it is a good practice to encode data (entered by users) before using it to generate a dynamic page. I was not able to find ...
1
vote
2answers
101 views
How was this token decoded?
I've read this interesting comment (about the security level, or lack thereof of some website built by a prominent chip manufacturer, an interesting discussion by it's own virtue, but not my question)
...
1
vote
2answers
163 views
Breaking out of attribute in double quotes
I have a piece of code that allows for
[url]someurl[/url]
BB-Code and replaces it with
<a href="someurl">someurl</a>
It takes two precautions to prevent XSS.
It replaces ...
1
vote
3answers
550 views
RSA encryption : How to create “.arm” certificate file for Public key?
I am required to store a certificate as ".arm" file only for a public key that is intended for use in RSA Encryption.
I am currently able to generate the public key as ".key" file.
P.S I am new to ...
1
vote
0answers
37 views
When using HMAC, does key encoding matter? [migrated]
Given:
H is a good hash function with block size L.
K is a key of length >= L (recommended by RFC 2104).
Khex and Kbase64 are ASCII encodings of K.
In the HMAC algorithm, is there a good reason to ...
1
vote
1answer
152 views
Working of WAF/IDS/IPS payload normalization schemes?
I want to know how WAF/IDS/IPS deals with Payload Transformations. Such payload transformations may be
base64Encode
html EntityDecode
url Encode
Remove whitespaces
I want to know how WAF/IDS/IPS ...
0
votes
1answer
498 views
SHA1 hash encoded with base64 results not consistent?
When i take a hash of user input test123+ i get the following base64 result:-
YaddchSU52yztwIMdtHzkg3p1oA=
The results have been obtained using the online sha1 convertor
I m failing to understand how ...
0
votes
1answer
68 views
Understanding nibbles & encoding using owasp EnDe tool?
I'm using owasp EnDe web-based tool to understand nibbles and encoding in general. This online utility in my knowledge is the best free resource avaiable for anyone who is interested to learn encoding ...
-1
votes
1answer
71 views
What encoding/encryption has been used c052e4a668953a1f2ff9453e36f62044 [closed]
Can anyone decode the string c052e4a668953a1f2ff9453e36f62044? Or at least detect what encoding/encryption has been used?
-2
votes
1answer
140 views
What Type Of Encoding Is This? [closed]
I need help, what type of encoding is this?
It is a popular encoding, not an encryption.
begin 666 Restricted.zip
M4$L#!!0````(`%T[="_]<LYX`P(``'0#```.````4F5S=')I8W1E9"YT>'1M
...
-2
votes
0answers
54 views
Which encoding/decoding is used? [closed]
In an application following encoded data is stored in database.
**Original Number/Character -> Encoded data**
33 --> +FzSFp7OKpU=
39 --> ...
-5
votes
4answers
3k views
How to decrypt LDAP passwords Hashed as MD5? [closed]
I am doing a penetration test, and i would like to know if i can decrypt passwords stored in LDAP. i tried some sites decrypt MD5 , they give me error message tells that the input is not MD5.
Could ...
