inserting malicious content, usually code (like SQL, Javascript) into a vulnerable application. Is used only if there is no more specific injection tag available (see tag wiki)

learn more… | top users | synonyms

0
votes
2answers
44 views

Is JQuery 2.1.1 vulnerable to OS command injection?

Barracuda has found multiple instances of OS Command Injection vulnerabilities in a static website. In each instance, the vulnerable URL was the JQuery plugin itself (version 2.1.1). Barracuda rates ...
0
votes
0answers
40 views

What's is a security vulnerability that lets you inject server-side code called?

What is the name for a security vulnerability, that lets you inject server-side code into one of their server-sides pages (say PHP or ASPX)? I have googled 'Code Injection' though I'm not sure this is ...
-1
votes
1answer
77 views

Can this prevent XSS?

In PHP, I've always used this to represent inputs and textareas: $foo = trim(htmlentities($_POST['foo'], ENT_QUOTES); // the trim is to prevent empty submissions Can it also be valid to prevent SQL ...
5
votes
2answers
146 views

What's the best way to test for SQL Injection vulnerabilities? Manual or SQLMap?

As part of my job I test for web application vulnerabilities regularly. When it comes to SQL Injection, my methodology is to start by manually browsing the website and spidering it, then, sending the ...
3
votes
2answers
77 views

What happens if you upload code with a file extension that a website permits (PNG for ex)?

Example is GitHub comments that only allow uploading images and PDF. What happens if someone uploads malicious code after he changed the file extension to something like PNG or PDF? Also don't get ...
0
votes
0answers
27 views

Executing JS script in Bootstrap popover without “<” and “>” characters (XSS) [duplicate]

In the system that I am working on I have a simple form. In the form there is an input called "ID". The contents of the input is than displayed in a Bootstrap popover (after clicking the "i" icon) ...
0
votes
0answers
27 views

Why /proc/self/environ no output through injection

What on a CentOS machine would stop a null byte injection from displaying the output of /proc/self/environ and /proc/$PID/environ or /proc/$PID/fd/12 ? According to this article, all folders under ...
5
votes
4answers
328 views

Is it safe to redirect to URL parameter without filtering?

A webpage redirects to an URL given in parameter redirect without filtering it, like this: $newURL=$_GET["redirect"]; header('Location: '.$newURL); login.php?redirect=home.php If it echoes the ...
1
vote
1answer
26 views

How to extract data from hackyourself legal site with table and column information?

I am following the Pluralsight SQL injection tutorial. The instructor did not go over actually extracting the data. http://hackyourselffirst.troyhunt.com/CarsByCylinders?Cylinders=V12'AND 1=(SELECT ...
-1
votes
2answers
52 views

Unrestricted File Upload Vulnerability, any solution?

I have a module in which the user can upload images. So I run some test, via tamper data I can change it from .png to .php and it will upload successfully on my server but if I go to the location it ...
0
votes
0answers
39 views

What could be done using Set-Cookie or Cookie Manupulation

I was testing a web application where I can inject the cookie using CR/LF injection. I'm curious to know, What attacker could done only using cookie injection (Set-Cookie) by CR/LF on website like ...
2
votes
0answers
38 views

How to Lead to XSS by Response Splitting in this Scenario

I have been pentesting for a company. I found a CRLF Injection that could be done using %E5%98%8D%E5%98%8A instead of %0d%0a. So I'm using %E5%98%8D%E5%98%8A in redirection parameter for CR/LF. Here ...
4
votes
1answer
61 views

Is it easy to protect against SSI injection?

SSI injection is, to the best of my understanding, the process of injecting commands into user input fields, e.g. &lt;!--#exec cmd="ls" --&gt; to get the files in the current directory. ...
2
votes
2answers
54 views

Code injection using packet modification

Is code injection possible through packet modification? For example, if a game sent a packet declaring score=99 could I then modify the packet to score=*code* or something similar? I guess a ...
2
votes
2answers
105 views

Remote OS command injection - tests

ZAP scanner found Remote OS command injection. Is there any foolproof way to check if this works and is not a false positive? I have tried to make it sleep 50 seconds but it's not something I can ...
4
votes
1answer
92 views

Is this sanitization method secure?

I implemented this sanitization fix: function san($str, $type="full") { switch ($type) { case "full": $str = preg_replace("/[^a-zA-Z0-9_\-]/i", "", $str); break; ...
2
votes
1answer
97 views

How to exploit a Use-After-Free vulnerability?

I want to learn more about use-after-free vulnerabilities and found this tutorial. Yet I don't understand it very well and hope for an explanation of how it works.
2
votes
1answer
83 views

Sqlmap, how to move forward? [duplicate]

So, I'm using Sqlmap for a while now to test the security for my company (we're too small to have IT guy and I'm the closest they got for now), I already managed to access the database remotely and ...
-1
votes
1answer
57 views

Is this MySql query sql-injection protected? [duplicate]

I have small php code, before discovering mysqli real_escape_string i was using a function with some regex rules to clean every user input by symbols, but for an email or a password, this is not a ...
2
votes
2answers
85 views

PHP filter_input() not protecting from eval()

I was updating some PHP code following the advice of not using $_GET and $_POST anymore but instead to switch to the safer filter_input() functions. I was thinking that function would save me in this ...
1
vote
1answer
53 views

Are sqlcmd parameters inherently at risk of SQL injection?

The command line utility sqlcmd has a feature to allow parameter substitution, from command line parameters and environment variables. https://msdn.microsoft.com/en-us/library/ms188714.aspx If an ...
1
vote
0answers
64 views

How to check if /run timeout /T 5 remote command execution worked in page html?

I was scanning a website using Zed Attack Proxy, when I found it is vulnerable to remote command execution, specifically timeout with the Referer header (shown in the request below). I have no idea ...
6
votes
1answer
85 views

How can I exploit a PHP endpoint that lets me instantiate an arbitrary class?

PHP lets you instantiate classes from variables or array entries, like this: class Foo {} $className = 'Foo'; new $className(); $someArray = ['class_name' => 'Foo']; new ...
1
vote
2answers
117 views

PHP security hacking question, may be more than just PHP

I have an input box for for INSERTing into the database. It is written in PHP PDO. Some one typed in: <"'> and also: ' onClick='alert(1); I'm assuming they were in two different input ...
17
votes
3answers
2k views

Exposing database fields names in HTML

I quite often see opportunities to optimise server-side code if HTML form names are exactly the same as the database field names they eventually update. The drawback obviously is that this is ...
2
votes
1answer
82 views

Are PHP magic methods really necessary for PHP object injection?

I'm trying to understand the PHP Object Injection flaw in vBulletin 5.1.x (CVE 2015-7808) and I stumbled across the requirements for Object Injection as stated by OWASP: The application must have ...
4
votes
2answers
533 views

PHP code injection using GET and echo

I have found a piece of this code in a web application (simplified): <?php $password="very-secret-password"; $param = $_GET["param"]; ?> <html> ... Param: <?php echo $param; ?> ... ...
5
votes
1answer
321 views

DVWA - Command Injection (high level)

I am attempting to educate myself further on web securities using DVWA. I am stumped on Command Injection, on the high level The help states The developer has either made a slight typo with the ...
6
votes
2answers
288 views

XSS via JSON: Why does a web application not sanitize either its incoming params hash or its outgoing JSON values of malicious tags like Script?

Recently working on a Rails-based web application for a company, I had to look into XSS vulnerability. It turns out that the application, in some places, could take an HTML tag (e.g., jscodehere ...
4
votes
1answer
108 views

Likely Sources of MITM Attack over Public Internet SSH

Earlier today when attempting to ssh into my remote server, I got the standard man in the middle warning relating to inconsistent public keys. In fact the key-type wasn't even correct. My server uses ...
1
vote
1answer
136 views

how to prevent scripts being injected on my website [closed]

I have an API server on Digitalocean. Yesterday they told me I have "a large flood of traffic from one or more of your servers that is disrupting the normal traffic flow for other users." I checked ...
2
votes
1answer
56 views

SOP for SQL Injection Attack

What should (or) how an Incident Handler do (or) follow when an SQL injection attack is reported? Initial Response Analysis Action Aiming to make a procedure guide to follow for myself and my ...
21
votes
2answers
2k views

What vulnerability is targeted by an HTTP referer starting with (){ :;};/bin/bash

I found this code, followed by several bash commands downloading and running a payload from the web, in the referer field in my apache error logs. The attack appears to work by converting a command ...
4
votes
1answer
198 views

As a result of attack; random folders and files in public_html. What kind of attack is this?

As a result of attack there are random folders and php files inside them in public_html directories. Sites are Wordpress, Opencart or just HTML. All sites exposed to attack. Screenshot of the ...
3
votes
1answer
41 views

XSS Injection invalidate meta redirection tag

When injecting into the url part of an HTML META redirect like this: <meta http-equiv='refresh' content='0;URL=$URL' where $URL (note the missing quotes) is the part I can inject, is there any ...
5
votes
1answer
241 views

SQLmap injection not working, manually it works fine

I have built a vulnerable web application to demonstrate SQL injection. I want to show both manual injection and automated injection. The injection requires a) the user to be logged in (session ...
3
votes
0answers
51 views

MongoDB injection, reading and writing to files

I've been playing around with Nosql and specifically MongoDB injection on a few challenges and my lab. If you have an injection point you can easily enumerate and dump the database. But can you go ...
4
votes
1answer
100 views

XSS through modifying a UI element value?

I send an AJAX request and when the HTML loads back, I retrieve the values of some UI elements at the client side and present them to the user, like so: var displ="<h1>"+$( "#myslider" ...
-1
votes
1answer
99 views

Understanding HTTP response from Linux Server

I am working through a question that involves someone using a vulnerability in a Linux server in order to gain access to it. The first part of the question states In monitoring the network activity ...
2
votes
1answer
73 views

Defeating code injection attacks in x86

In x86 systems, there are three requirements for a code injection attack to work: write attack payload to memory attack payload to be executable divert control-flow to payload How can we prevent ...
3
votes
1answer
157 views

Common attacks when no ports are open

If you have a web server with all ports closed (except, of course, the necessary HTTP) what kind of attacks can an attacker use to hack into the system? Are the only vulnerabilities stuff like ...
1
vote
2answers
117 views

Injection/SQL Injection Attacks in Layman Terms

I'm having trouble figuring out what SQL injection attacks are, or in more general terms, what injection attacks are. Most explanations out there on the internets are kinda hard to understand. Could ...
2
votes
1answer
229 views

Memory injection in games

I'm currently researching memory injection attacks on games in Windows 7/10. After reviewing several threads on this topic, there's a few questions which are still unclear. DLL injection can be ...
1
vote
1answer
75 views

Some tags I'm worried about when parsing html doc for xxs

I'm building a web app where users can make post which consist of an html doc. An user can change the document via the dev tool for example. So the document consists of literally any user input. I'm ...
0
votes
0answers
212 views

Injecting meterpreter/reverse_tcp into apache2 with msfvenom results in seg fault of apache2

I've been trying to use msfvenom with the linux/x86/meterpreter/reverse_tcp payload and an apache2 binary. My intent is to create a tainted version of apache2 to establish a persistent backdoor on the ...
1
vote
2answers
473 views

What is this URL Injection piece of code mean?

I don't know if it's considered or not to include a single piece of code that might be malicious. But recently my site was a victim of some URL injection. I was wondering if anyone can tell me what ...
2
votes
0answers
1k views

How to disable injection JavaScript into browsers? [closed]

I am using Kaspersky Antivirus and recently I've updated it to Kaspersky Total Security 16.0.0.614. When I checked my browsers I realized Kaspersky injects remote JavaScript into all my pages even ...
1
vote
3answers
1k views

In NodeJS, what is a good way of ensuring user submitted data in (text input) forms is not malicious?

In addition to scanning user uploaded files, I would also like to ensure that forms for user profiles, comments, etc. cannot be misused to submit malicious script. What are some known good methods of ...
0
votes
1answer
64 views

Examples of in-band signalling hacks? [closed]

In-band signalling or the mixing of control and metadata on the same channel is what allowed the early phone phreakers to obtain free calls on telecommunications systems. By sending control tones ...
0
votes
0answers
56 views

How to prevent injection attacks powerscript scripts when dealing with user made variables

I have a large number of scripts with code looking like this: task "$argument" Which is then called by: powershell.Runspace.SessionStateProxy.SetVariable(argument, UserMadeValue); ...