Tagged Questions
12
votes
2answers
1k views
What does this injected code do?
One of my sites has just been hacked as this code has been inserted into random(?) files and places within the files.
Does anyone understand what it is trying to do? I would welcome anything that may ...
1
vote
4answers
323 views
Simple solution to XSS
I've got an idea as to how to defeat XSS so simple that it may work and was wondering if anybody had already done something similar.
The goal here is not efficiency but security. In other words I ...
7
votes
4answers
585 views
SQL injection Are there any instances where a vulnerable url would not contain an 'equals' (=) symbol
I have a question I'm hoping you could help with?
I am looking to filter/grep a very long list of spidered url's from my site to only get the url's that could possibly be vulnerable to sql injection.
...
6
votes
2answers
819 views
Is it possible to do HTTP header injection if CR/LF are stripped?
In HTTP response there is the following header with attacker controlled content:
Content-Disposition:attachment; filename="attacker_controlled.html"
The only characters that can't appear in ...
0
votes
2answers
436 views
How to encode letters in multipart/form-data to include CR/LF characters?
Part of HTTP request that should be sent to server with Content-Type: multipart/form-data; looks like:
------WebKitFormBoundaryQ7KGYev31biaJTW8
Content-Disposition: form-data; name="subject"
...
1
vote
3answers
805 views
Could some one please explain - Remote Post SQL Injection
Would anyone be able to post a link to an article which explains how to do a Remote Post SQL Injection and how to prevent anything bad happening. Or even just explain on here.
Any help would be ...
6
votes
1answer
378 views
Injecting ampersand to the url
Let's say there is a program sending some data to server via GET:
http://server.com/gateway?value1=abc&value3=def
Then the server sends these values further, adding value2: (python code)
...
3
votes
4answers
653 views
SQL query sanitation (black list)
I have a following problem/challenge:
Web application (ASP.NET 3.5) installed on corporate LAN and operates on SQL Server DB needs to provide ability to generate custom reports.
These reports can be ...
15
votes
2answers
352 views
What risks should I be aware of before allowing advertisements being placed on my website?
The thought of having a 3rd party send javascript, and images to end users seems to be a scary thought, but that is exactly what we are doing when I place advertisements onto my site.
Does serving ...
3
votes
1answer
105 views
Attacker reinjecting form options?
I take form input all over my site, and use query parameters to sanitize data. When an invalid data type is passed, a simple (not detailed) notice is thrown and I receive an email with what was ...
2
votes
2answers
361 views
Is it possible to take down a site using javascript in the URL bar?
If a site is written poorly enough, is it possible to take it down or severely mess with it using only javascript in the URL bar?
