inserting malicious content, usually code (like SQL, Javascript) into a vulnerable application. Is used only if there is no more specific injection tag available (see tag wiki)

learn more… | top users | synonyms

-1
votes
1answer
41 views

Is it possible to perform second order SQL injection with email addresses?

Let's imagine a website which allows users to Sign up and login only with their email address. Is it possible to perform a second order SQL injection in that case?
1
vote
0answers
59 views

My ISP is injecting a swf into my webpage. How legal is this? [closed]

I recently saw a pop-up, on a http page. It was the advertisement of some offers provided by the ISP. Here is the code: <td> <object width="480" height="195" ...
1
vote
1answer
105 views

Execute cmd commands with http directory traversal attack

Question Summary: I am trying to create a lab scenario wherein the "attacker" is intended to perform a directory transversal attack from an HTML page and move into the Windows system directories. Can ...
0
votes
0answers
35 views

Why malicious browser extensions along with API hooking

Most malware steals financial data by hooking to browser APIs like PR_Read, PR_write etc.. Also I see some malware like Sinowal use browser extensions along with these API hooks. I believe a user ...
1
vote
3answers
70 views

Risks associated with HTTP content injection?

I'm curious about the risks associated with HTTP content injection, where an ISP injects content to pages accessed over non HTTPS connections. Some examples: ...
0
votes
1answer
79 views

Faking and injecting cryptographic certificates

Suppose as an attacker I provide a fake certificate to a user.A warning pops up on her window but she decides to continue anyways.Is my fake certificate now added in her browser's trusted certificate ...
3
votes
1answer
58 views

Hooking an *unexported* API

I want to know is there any way to hook (inline hook) an unexported API of a PE? I have this binary (PE 32 bit) which does not uses any DLL (A statically linked binary) and I would like to know what ...
0
votes
3answers
87 views

SMTP injection: where am I wrong?

On another thread a user was trying to use SMTP injections and, as a test, trying to inject a supplementary recipient for this email. My understanding of the issue preventing him from succeeding were ...
1
vote
3answers
111 views

SMTP Header Injection

I'm trying to understand SMTP header injection. I'm using Python's SMTPLIB library to proto-type this vulnerability. Here is my code: import smtplib # create variables server = 'smtp.zoho.com' port ...
1
vote
1answer
280 views

How to exploit CRLF Injection?

I was running a few tests on a website when I came across this: Request: GET /accounts?intended_destination=internal_api%2Fcampaigns_dashboard%7Cshow&intended_params=format%3Dhtml HTTP/1.1 ...
1
vote
0answers
52 views

How to identify column types during sql injection with “union all select” construct?

Situation is following: I have identified sql injection attack vector, and have following information about target table: It has six columns. (Identified using "order by"). I can see output of 3 of ...
9
votes
9answers
2k views

Is testing for SQL injection vulnerabilities still relevant in modern web applications?

First some background: I'm an Infrastructural Engineer with 5 years of experience mainly in Virtualization and Networking. I've spent the past year doing a lot of self study about security, passed ...
1
vote
1answer
54 views

how to separate arguments in sql query [closed]

I have this query : 'UNION ALL SELECT group_concat(username,password) from users-- and I want to separate username and password because when I execute the code it prints it all in one long string. ...
1
vote
0answers
135 views

Deobfuscated Malicious PHP Code Comprehensively [closed]

I found 3 php files in a htaccess-password-protected upload folder on my server: 1. default_folders.php 2. factory.php 3. HMAC.php Each of them contains a variable string, eg: ...
0
votes
2answers
107 views

“&” character in url [duplicate]

I think I found a bug in my website but don't know how dangerous it is. My website will redirect you to a warning page whenever you click on a link that is pasted in the comments section. The url ...
1
vote
2answers
94 views

Is Great Cannon essentially a JavaScript injection attack?

I was reading an article on Great Cannon at Ars Technica (http://arstechnica.com/security/2015/04/meet-great-cannon-the-man-in-the-middle-weapon-china-used-on-github/) and it seems to me that this is ...
1
vote
0answers
49 views

Secure public API

I'm building a mobile app that will use API created by me on my server. These API will be publicy exposed, but not publicy documented. I want to let the user to use the app without authentication for ...
2
votes
2answers
431 views

PHP: Am I free from SQL Injection? [duplicate]

Let me preface this by saying this is my first attempt to understand input sanitation, and at the moment I'm still a newbie to PHP. I've put together a quick register/log in website to test some ...
2
votes
0answers
73 views

Is it necessary to protect ATM pins against malware that has no access to the physical card? [closed]

I understand that various types of malware attempt to steal ATM pins . Presumably the attackers have no access to the physical card, so what can they do with the pin? In this case, is it needed to ...
2
votes
1answer
83 views

Suspicious GET request parameter list? [closed]

Is there a public list of common suspicious GET request parameter ? I mean - SQLi, Command Injection, Admin access etc. I am interested in such list, to be used to detect suspicious GET request in ...
1
vote
2answers
105 views

Meterpreter and staged payloads

So starting with the absolute basics - an exploit is the means used to gain access to a vulnerable system and a payload is the actual program/shellcode used to fulfill attacker's intentions A staged ...
0
votes
0answers
25 views

Constructing a tainted string for arc injection

I'm new to security and currently referring to Robert Seacord's Secure Coding in C and C++. In chapter 2 of the same, the author talks about arc injection, wherein he passes the flow of control in the ...
4
votes
2answers
393 views

MongoDB Nosql injection in python code

Here is the code snippet for accessing to MongoDB. client = MongoClient() db = client.test_database collection = db.test # Get data from fields condition = form.getvalue('name') if condition: ...
3
votes
1answer
66 views

Can we join a table in this Ruby on Rails Direct Object Reference?

I am trying to inject a RoR application... I have found a nice command which will allow me to delete things unchecked...but the problem is that its not a problem its a very minor point, to make it a ...
1
vote
0answers
47 views

Unidentified contents injected in include file [closed]

This code was injected into a "include" file on my server. http://pastebin.com/Eueu8unY Any file that included this gave a 301 Moved Permanently error. I wish to know: Is this due to an insecure ...
9
votes
2answers
843 views

Cross site scripting when the greater than and less than signs are escaped?

If a website encodes < to &lt; and > becomes &gt;, is it still possible to perform cross site scripting? What would you enclose the script tags in? For example, on one of my sites I can ...
1
vote
0answers
127 views

How Modification attacks works?

Theoretically... In Active attacks we have "modification attack"...ie "In a message modification attack, an intruder alters packet header addresses to direct a message to a different destination or ...
1
vote
0answers
77 views

Detecting reflective DLL injection any other ways?

any way to detect it? maybe using mcafee hips rules? Are there any known Techniques to detect it ? like walking the VAD tree or something?
3
votes
1answer
374 views

Odd requests from Apache logs

I've been monitoring some weird activity in the access logs for my site and I've noticed a couple of weird attempts against the server. I'm wondering if anyone has seen these before. It's an Apache ...
2
votes
2answers
135 views

Protecting code injection via chattr on php files?

Recently, a website I hosted (wordpress I think) for a friend got hacked and all php pages had added code at the bottom in the form of "echo base64_encode(...);". Thus there were unwanted ads on very ...
0
votes
1answer
114 views

SAPE link injection into website

I currently have a WordPress website that has been updated to latest version 4.1, also latest theme installed. The problem is this SAPE Russian link network that is injecting malware code into the ...
1
vote
2answers
272 views

Is PHP unserialize() exploitable without any 'interesting' methods?

Say that there was a publicly accessible web page with the following PHP code: <?php class NotInteresting { public function noExploits() { echo "Whatever."; } } $unsafe = ...
0
votes
1answer
192 views

Is SQL Injection possible in this PHP registration script? [closed]

I've recently created a PHP registration script for a website that a friend and I are working on. I've read up on the dangers of MySQL injection, and I was wondering if my current code is protected ...
0
votes
2answers
60 views

Calling string functions safely

I wish to implement some user callable functions in my code. I use something like this: function funcTest(){ echo "This is test function"; } if (isset($_GET['cmd'])) { $func = ...
4
votes
1answer
96 views

Should I be worried about this url request I received on my site?

I was checking the weekend logs of my IIS server and noticed a strange request which was blocked: ...
1
vote
1answer
714 views

PHP unserialize() object injection

So I came across with this authentication bypass security notice and the fix for it was just simply changing all serialization to json encoding. I am just wondering how this really is exploitable? ...
0
votes
0answers
238 views

Active Directory Injection attack

Is there a possible way of injecting code to pull data from Active directory? I have written a PHP page that executes Powershell and is able to change passwords to a controlled group of people. ...
2
votes
0answers
654 views

PHP - Need help to understand injected code [duplicate]

I discovered a lot of requests to a fishy file in a plugin on my Wordpress site. There, I found a long string, a mapping function for each character used in the string, and an excecution of the ...
2
votes
1answer
180 views

Is preventing XSS/HTML Injection really this simple?

A colleague suggested to me just to prevent letter characters from occurring immediately after an opening angle bracket as a way to protect against XSS and HTML injection. Obviously, this doesn't ...
1
vote
1answer
91 views

Force DNS to attach bad IP address

The question is not professional, but what I'm trying to say is... Is there any way to inject or force the DNS server to attach/change an IP address for some site. For example, I'm running an apache ...
0
votes
1answer
195 views

Malicious JavaScript — Troj/JSRedir — Gumblar

I have a client with a website receiving AV warnings from Microsoft Security Essentials. A further investigation revealed that the site is blacklisted by Yandex.com, due to a report that the site ...
-1
votes
1answer
90 views

Why injecting a php tag with XSS dosn't work? [closed]

So you all know about the XSS vulnerability but what I cannot understand is how come injecting a <?php ?> tag doesn't work? eg.: suppose there is a Stored XSS vulnerability in the index.php of a ...
0
votes
1answer
300 views

Why can't all wireless cards perform packet injection?

If a wireless card can send packets, why can't it inject packets? All have to do to inject a packet is create a raw socket, construct a packet with the spoofed headers and then send the packet ...
0
votes
1answer
114 views

What is the main function of xp_cmdshell in SQL Server and what are its related security issues?

I was researching on Injection issues in MS SQL Server. I came to read about xp_cmdshell. I think this must be enabled in the SQL server for attackers to perform many exploits. Actually what is this ...
1
vote
1answer
196 views

Is Java javax.servlet.http.HttpServletResponse sendRedirect() auto replace the carriage return(%0d%0a) to prevent Http Header Splitting attack?

I just tried to demonstrate a simple Web app program to simulate the Http Header Splitting attack but I failed. I realise that this sendRedirect() function has filtered my carriage return and replace ...
-1
votes
1answer
162 views

Scanner / tool to generate a list with all forms and input fields of a website [closed]

I'm not very experienced with information security but know some basics about injection attacks and other web based attacks. Is there a tool / crawler to find all forms and input fields of a whole ...
0
votes
1answer
225 views

Is PHP FILTER_VALIDATE_IP secure enough to $_GET an IP address?

I need to pass an IP to a PHP page, and it would be convenient to be able to use GET, but I know that's sort of asking for trouble, so I want to triple-check that I'm handling it securely. ...
0
votes
0answers
94 views

Should I be concerned about the following URLs that were tried to open on my webpage?

I don't know if this is some injection attempt or a weird bot or what ever. An IP opened several pages within my Drupal 7 website with the appendix ...
0
votes
1answer
204 views

How were hackers able to alter the text of my pages without a form or querystring?

I maintain a small site that runs old-fashioned classic ASP pages with an Access backend. Recently, the site got hacked. The attacker managed to add a large quantity of code to the index.asp page. ...
1
vote
1answer
51 views

Scan interpreted code for long lines to detect code injection?

As http://security.stackexchange.com/a/11935/35886 states: the best protection against code injection is to prevent it but often you see posts on SO or here that goes like I found "long line of ...