inserting malicious content, usually code (like SQL, Javascript) into a vulnerable application. Is used only if there is no more specific injection tag available (see tag wiki)
1
vote
1answer
90 views
Linux Runtime Memory protection [closed]
I'm searching for a solution to protect process memory at runtime level in Linux (just like GameGuard in Windows). I googled many times but didn't get any useful information.
Does anyone know any ...
0
votes
1answer
116 views
Stopping js malware injection on our Wordpress site
This had been added to our wordpress site, specifically in the footer.php.
hxxp://pkktjuchlrv.peguards.cc/02b31ac5iq/get.js
It is malware as defined by google, i belive it is tracking code.
We have ...
12
votes
2answers
1k views
What does this injected code do?
One of my sites has just been hacked as this code has been inserted into random(?) files and places within the files.
Does anyone understand what it is trying to do? I would welcome anything that may ...
0
votes
1answer
206 views
Sanitizing JavaScript to prevent XSS
I'm going through a vulnerability remediation exercise for a client and am trying to figure out how to best mitigate this particular hole. There's a script on our site that calls up content into a new ...
1
vote
4answers
322 views
Simple solution to XSS
I've got an idea as to how to defeat XSS so simple that it may work and was wondering if anybody had already done something similar.
The goal here is not efficiency but security. In other words I ...
3
votes
1answer
1k views
DOM Based XSS attacks: what is the most dangerous example?
I knew that XSS attacks (“non-persistent” and “persistent”) can hijack user session, deface websites, conduct phishing attack, etc.
However, I can't understand what is dangerous of DOM Based XSS if ...
0
votes
1answer
529 views
“pagesinxt.com” links in the sourcecode, am I being hacked?
At this moment I am being hacked and I do not know to stop it. Let me explain...
My website is hosted in a VPS where I am the only person who has access to it. The page is builtwith ...
7
votes
4answers
583 views
SQL injection Are there any instances where a vulnerable url would not contain an 'equals' (=) symbol
I have a question I'm hoping you could help with?
I am looking to filter/grep a very long list of spidered url's from my site to only get the url's that could possibly be vulnerable to sql injection.
...
-5
votes
2answers
231 views
PHP injection on 777 file [closed]
Some one has modified a PHP file, which had permissions set to 777, on my VPS server.
How can someone do that without administrative access to the server?
What information I can give you?
I know ...
1
vote
1answer
106 views
Os command injection privileges
I have a question about privileges when performing an Operating system command injection.
If an attacker succeeds in getting a reverse shell on a remote server through netcat (netcat -v -e ...
9
votes
1answer
440 views
Android Runtime Code Injection
I'm doing research for a static analysis tool to help detect malware in Android applications. I'm wondering if it is possible to perform code injection on Android without using a class loader. I ...
6
votes
2answers
171 views
Safe YAML parser?
I've recently read that YAML was not "designed to handle malicious user input", because a malicious YAML input "can create instances of all classes defined in the targeted Rails application". ...
2
votes
2answers
179 views
Command injection Windows platform
Let's say there's a site which is vulnerable to user's input.
For example users can ping a specified IP.
Since the site is vulnerable to Os command injection, a user as well as an IP address
...
3
votes
2answers
69 views
Auditing Existing Socket Connection
Is there any way to interact with a program's socket traffic without installing Winpcap?
I understand that the one listening program per port is a restriction regarding TCP/IP, but I guess I'm more ...
7
votes
1answer
303 views
Better way to import Win32 APIs from injected shellcode
I'm injecting native x86 code into a .NET application, via a TLS callback in the binary image. Unfortunately, .NET executables only import mscorlib.dll within the PE, and have kernel32.dll mapped ...
9
votes
1answer
609 views
HQL injection example
Our developers left a surprise in handling user login. Namely:
// java
List users = hibernate.find("from Users where username = '"+formUsername+"'";
if (users.length==0) { return BAD_USER; }
if ...
3
votes
4answers
255 views
javascript self-injection: is it dangerous?
I have a toy web app that can be described roughly as a per-user key-value store. After logging in, the user can view and modify her set of key-value pairs. The keys and values are stored in a DB on ...
3
votes
2answers
238 views
Can a whitespace regex character be used to perform a javascript injection?
if I want to validate the input of a <textarea>, and want it to contain, for example, only numerical values, but even want to give users the possibility to insert new lines, I can selected ...
4
votes
1answer
344 views
Is ASP.NET Event Validation completely secure?
I am currently testing a ASP.NET web application for its security. Doing so I came across the event validation mechanism.
Is there some way to bypass it? How much assurance is there that it cannot be ...
8
votes
1answer
1k views
Detecting reflective DLL injection
In the past few years, malware (and some pen-test tools like Metasploit's meterpreter payload) have begun to use reflective DLL injection (PDF) to load a DLL into the memory of a process. The benefit ...
2
votes
1answer
468 views
Hosted Email Hacked, SQL injection maybe?
I have a hosted website using a free hosting service, I received an email this afternoon saying that I have been suspended because my account has been compromised.
Basically, someone is using my ...
3
votes
1answer
127 views
Malicious php scripts in word press theme folder?
I am running a server on Ubuntu 10.04 running a word press website, and recently a virus scan revealed that I have several malicious scripts sitting in the word press folder. In particular they are in ...
10
votes
2answers
733 views
Security of Log Files - Injecting malicious code in Log files
As part of my course project I'm trying to understand various security frameworks and best practices.
One of the very popular approach is to maintain Logs. My question is about the security of the ...
3
votes
1answer
677 views
Header opening a PDF file, can someone hack a website from there?
Can someone hack a website that uses this kind of header to open a pdf?
<?php
header("Content-type:application/pdf");
// It will be called downloaded.pdf
...
9
votes
1answer
378 views
Cracking PCI terminal using a trojan based on the card
I have come across an article which states the following:
According to MWR InfoSecurity, cybercriminals can use fake cards
containing a software code to gain access not only to a customer's PIN
...
1
vote
1answer
512 views
HTTPS and cache injection
I understand the downside of this attack and what wrong can be done.
But I dont understand how is it done ?
Well, I need to educate myself, any pointers would be useful.
6
votes
2answers
819 views
Is it possible to do HTTP header injection if CR/LF are stripped?
In HTTP response there is the following header with attacker controlled content:
Content-Disposition:attachment; filename="attacker_controlled.html"
The only characters that can't appear in ...
0
votes
2answers
436 views
How to encode letters in multipart/form-data to include CR/LF characters?
Part of HTTP request that should be sent to server with Content-Type: multipart/form-data; looks like:
------WebKitFormBoundaryQ7KGYev31biaJTW8
Content-Disposition: form-data; name="subject"
...
2
votes
4answers
1k views
Detecting or preventing process memory injections on Windows (anti-hack)
Standard hacking case. Hack injects into a started game process and writes over process memory using WriteProcessMemory call.
The situation is like this:
we are hosting a game server
clients join ...
1
vote
3answers
804 views
Could some one please explain - Remote Post SQL Injection
Would anyone be able to post a link to an article which explains how to do a Remote Post SQL Injection and how to prevent anything bad happening. Or even just explain on here.
Any help would be ...
2
votes
1answer
338 views
Advice if safe from mail header injection PHP [duplicate]
Possible Duplicate:
PHP mail() Header Injection Prevention
Since I only started learning about header injection in the PHP mail() function, am uncertain if the form/code below is vulnerable ...
0
votes
1answer
534 views
How do I sanitize LDAP input and prevent injection attacks? What LDAP injection scenarios are possible?
In the following C# example I'm querying AD's configuration container for Exchange overrides. If the domain name in unsanitised the end user could get LDAP to read a different object then intended.
...
4
votes
2answers
277 views
Class.forName injection and constructor invocation
If a Java-based webpage takes a user-supplied parameter and instantiates an object using Class.forName(parameter)
What's the worst possible consequence?
The attacker does obtain stack traces. After ...
1
vote
2answers
1k views
header injection + codeigniter
I'm reading through Mozilla's Secure Coding Guidelines, and found this statement:
Don't trust any user data (input, headers, cookies etc). Validate it before using it
I'm using the codeigniter ...
6
votes
1answer
378 views
Injecting ampersand to the url
Let's say there is a program sending some data to server via GET:
http://server.com/gateway?value1=abc&value3=def
Then the server sends these values further, adding value2: (python code)
...
3
votes
2answers
684 views
How to check for null byte injection in Java webapp
Looks like Null Byte Injection is possible in Java apps. see: Is null-byte injection possible in Java filenames?
So how does one protect against it? Inspect all the bytes of the filename for a 0 ...
3
votes
2answers
648 views
Code Injection detection on Web Servers
Recently I found one of my web servers hacked with malicious code injected to websites hosted there. It wasn't exactly my fault, as I shared the server with other people and someone put some unsafe ...
3
votes
4answers
652 views
SQL query sanitation (black list)
I have a following problem/challenge:
Web application (ASP.NET 3.5) installed on corporate LAN and operates on SQL Server DB needs to provide ability to generate custom reports.
These reports can be ...
0
votes
1answer
2k views
Wireless Adapters for Testing with BackTrack
I would like to begin testing and working with BackTrack. I have heard that the Alfa AWUS036H wireless adapter works well with BackTrack and allows for packet injection. This adapter, however, is ...
4
votes
1answer
421 views
Code Review on a Header Injection In Java : any help?
I'm auditing a piece of Java code that might be vulnerable to header injection :
String headerValue =request.getParameter("headerVal");
//escaping CRLF
headerValue = headerValue.replace("\n", "");
...
0
votes
1answer
393 views
can the value of request.getHeader(“Host”) be faked?
Suppose if there is some code like
<a href="<%=request.getHeader("Host")%>/xxx/abc.do>SignIn</a>
Can an attacker fake request.getHeader("host") to point 'SignIn' anchor to ...
6
votes
1answer
466 views
Yahoo! Messenger injection attack
Just five minutes ago I had an injection attack through Yahoo! Messenger. The only visible effect was the change of my status message. I also got a dialog message saying that a script cannot continue ...
4
votes
4answers
728 views
Server wide javascript injection
UPDATE: The server was rooted, php.ini was replaced that cause the injection to appear. Still haven't figured out which directive is injecting the javascript.
I'm troubleshooting a hacked website ...
13
votes
4answers
11k views
How to inject executable, malicious code into PDF, JPEG, MP3, etc.?
I wanted to know if its generally possible to inject executable code into files like PDFs or JPEGs etc., or must there be some kind of security hole in the application?
And if so, how would one do ...
15
votes
2answers
350 views
What risks should I be aware of before allowing advertisements being placed on my website?
The thought of having a 3rd party send javascript, and images to end users seems to be a scary thought, but that is exactly what we are doing when I place advertisements onto my site.
Does serving ...
3
votes
1answer
105 views
Attacker reinjecting form options?
I take form input all over my site, and use query parameters to sanitize data. When an invalid data type is passed, a simple (not detailed) notice is thrown and I receive an email with what was ...
4
votes
2answers
151 views
What perils are there in allowing user input of parts of an ODBC connect string?
I'm developing an application that allows user to input hostnames, database names, usernames, and passwords for database access. The application will construct a ODBC connect string by filling in the ...
3
votes
2answers
3k views
Testing PHP form injection
I'm writing a very small PHP app that takes input via a form. As could be expected for a first revision, the code does no escaping or sanitisation of input:
if( $_POST["var"] != "" ) {
print ...
6
votes
2answers
505 views
GET with additional parameters leads to “code injection” in html displayed
We got a security review done of our PHP code and the security company sent this in their report:
Request
GET ...
6
votes
3answers
859 views
PHP mail() Header Injection Prevention
This site nicely explains the problem. Essentially, nearly all php mail() examples that are given are vulnerable to header injection attacks. The referenced site gives a regex sanitation solution ...
