inserting malicious content, usually code (like SQL, Javascript) into a vulnerable application. Is used only if there is no more specific injection tag available (see tag wiki)

learn more… | top users | synonyms

0
votes
2answers
49 views

Can we consider injection of HTML tags without event attributes as XSS?

I'm wondering if we can consider the injection of HTML tags like a, image, img, video, audio, marquee or iframe without an event attribute as XSS? Since no JavaScript is involved and therefor no ...
3
votes
2answers
60 views

How to accept user input for use in terminal safely?

I found a vulnerability, and I'm not sure how to patch it. I currently accept input from the user and use it to create a terminal command which I run on the server. Here's the code simplified. // Get ...
5
votes
1answer
417 views

DVWA - Command Injection (high level)

I am attempting to educate myself further on web securities using DVWA. I am stumped on Command Injection, on the high level The help states The developer has either made a slight typo with the ...
3
votes
0answers
82 views

Calling methods with Expression Language Injection in Spring Framework?

I'm currently on a pentest and I've come across a URL parameter which is vulnerable to Expression Language (EL) injection and I can prove that by accessing properties such as ${pageContext}. However, ...
12
votes
4answers
6k views

Detecting reflective DLL injection

In the past few years, malware (and some pen-test tools like Metasploit's meterpreter payload) have begun to use reflective DLL injection (PDF) to load a DLL into the memory of a process. The benefit ...
2
votes
2answers
142 views

PHP security hacking question, may be more than just PHP

I have an input box for for INSERTing into the database. It is written in PHP PDO. Some one typed in: <"'> and also: ' onClick='alert(1); I'm assuming they were in two different input ...
0
votes
2answers
82 views

Is JQuery 2.1.1 vulnerable to OS command injection?

Barracuda has found multiple instances of OS Command Injection vulnerabilities in a static website. In each instance, the vulnerable URL was the JQuery plugin itself (version 2.1.1). Barracuda rates ...
0
votes
0answers
41 views

What's is a security vulnerability that lets you inject server-side code called?

What is the name for a security vulnerability, that lets you inject server-side code into one of their server-sides pages (say PHP or ASPX)? I have googled 'Code Injection' though I'm not sure this is ...
6
votes
2answers
204 views

What's the best way to test for SQL Injection vulnerabilities? Manual or SQLMap?

As part of my job I test for web application vulnerabilities regularly. When it comes to SQL Injection, my methodology is to start by manually browsing the website and spidering it, then, sending the ...
3
votes
2answers
251 views

Is preventing XSS/HTML Injection really this simple?

A colleague suggested to me just to prevent letter characters from occurring immediately after an opening angle bracket as a way to protect against XSS and HTML injection. Obviously, this doesn't ...
-1
votes
1answer
77 views

Can this prevent XSS?

In PHP, I've always used this to represent inputs and textareas: $foo = trim(htmlentities($_POST['foo'], ENT_QUOTES); // the trim is to prevent empty submissions Can it also be valid to prevent SQL ...
3
votes
2answers
79 views

What happens if you upload code with a file extension that a website permits (PNG for ex)?

Example is GitHub comments that only allow uploading images and PDF. What happens if someone uploads malicious code after he changed the file extension to something like PNG or PDF? Also don't get ...
5
votes
1answer
7k views

Understanding Boolean Based SQL Injection

I am trying to understand the concept of Boolean Based Blind SQL Injection. I have gone through OWASP Guide To SQLi to understand it. However I am confused with how exactly does it work. Below id ...
0
votes
0answers
27 views

Executing JS script in Bootstrap popover without “<” and “>” characters (XSS) [duplicate]

In the system that I am working on I have a simple form. In the form there is an input called "ID". The contents of the input is than displayed in a Bootstrap popover (after clicking the "i" icon) ...
4
votes
2answers
244 views

Protecting code injection via chattr on php files?

Recently, a website I hosted (a wordpress site) for a friend got hacked and all php pages had added code at the bottom in the form of echo base64_encode(...);. Thus there were unwanted ads on very ...
0
votes
0answers
34 views

Why /proc/self/environ no output through injection

What on a CentOS machine would stop a null byte injection from displaying the output of /proc/self/environ and /proc/$PID/environ or /proc/$PID/fd/12 ? According to this article, all folders under /...
5
votes
4answers
381 views

Is it safe to redirect to URL parameter without filtering?

A webpage redirects to an URL given in parameter redirect without filtering it, like this: $newURL=$_GET["redirect"]; header('Location: '.$newURL); login.php?redirect=home.php If it echoes the ...
1
vote
1answer
59 views

Are sqlcmd parameters inherently at risk of SQL injection?

The command line utility sqlcmd has a feature to allow parameter substitution, from command line parameters and environment variables. https://msdn.microsoft.com/en-us/library/ms188714.aspx If an ...
2
votes
2answers
101 views

PHP filter_input() not protecting from eval()

I was updating some PHP code following the advice of not using $_GET and $_POST anymore but instead to switch to the safer filter_input() functions. I was thinking that function would save me in this ...
4
votes
1answer
93 views

Is this sanitization method secure?

I implemented this sanitization fix: function san($str, $type="full") { switch ($type) { case "full": $str = preg_replace("/[^a-zA-Z0-9_\-]/i", "", $str); break; ...
1
vote
1answer
35 views

How to extract data from hackyourself legal site with table and column information?

I am following the Pluralsight SQL injection tutorial. The instructor did not go over actually extracting the data. http://hackyourselffirst.troyhunt.com/CarsByCylinders?Cylinders=V12'AND 1=(SELECT ...
-1
votes
2answers
62 views

Unrestricted File Upload Vulnerability, any solution?

I have a module in which the user can upload images. So I run some test, via tamper data I can change it from .png to .php and it will upload successfully on my server but if I go to the location it ...
0
votes
0answers
42 views

What could be done using Set-Cookie or Cookie Manupulation

I was testing a web application where I can inject the cookie using CR/LF injection. I'm curious to know, What attacker could done only using cookie injection (Set-Cookie) by CR/LF on website like ...
2
votes
5answers
1k views

Simple solution to XSS

I've got an idea as to how to defeat XSS so simple that it may work and was wondering if anybody had already done something similar. The goal here is not efficiency but security. In other words I ...
9
votes
4answers
488 views

Is it possible to Exploit this Line Feed?

During a security assessment on a website I found a a redirection link that was reflecting the values in the Location header. The first thing that came to my mind was CRLF injection so I tried a few ...
2
votes
0answers
43 views

How to Lead to XSS by Response Splitting in this Scenario

I have been pentesting for a company. I found a CRLF Injection that could be done using %E5%98%8D%E5%98%8A instead of %0d%0a. So I'm using %E5%98%8D%E5%98%8A in redirection parameter for CR/LF. Here ...
2
votes
2answers
61 views

Code injection using packet modification

Is code injection possible through packet modification? For example, if a game sent a packet declaring score=99 could I then modify the packet to score=*code* or something similar? I guess a ...
4
votes
1answer
63 views

Is it easy to protect against SSI injection?

SSI injection is, to the best of my understanding, the process of injecting commands into user input fields, e.g. &lt;!--#exec cmd="ls" --&gt; to get the files in the current directory. ...
2
votes
2answers
133 views

Remote OS command injection - tests

ZAP scanner found Remote OS command injection. Is there any foolproof way to check if this works and is not a false positive? I have tried to make it sleep 50 seconds but it's not something I can ...
2
votes
1answer
137 views

How to exploit a Use-After-Free vulnerability?

I want to learn more about use-after-free vulnerabilities and found this tutorial. Yet I don't understand it very well and hope for an explanation of how it works.
2
votes
1answer
95 views

Sqlmap, how to move forward? [duplicate]

So, I'm using Sqlmap for a while now to test the security for my company (we're too small to have IT guy and I'm the closest they got for now), I already managed to access the database remotely and ...
-1
votes
1answer
59 views

Is this MySql query sql-injection protected? [duplicate]

I have small php code, before discovering mysqli real_escape_string i was using a function with some regex rules to clean every user input by symbols, but for an email or a password, this is not a ...
3
votes
3answers
582 views

Lua loadstring, whitelisting against injection

I need to take input from the user of a simple bit of math, they want to solve. Rather than parse there input myself, I want to just use the lua, loadstring function to load their input and evaluate ...
13
votes
1answer
644 views

Is Bluetooth Low Energy Injection possible?

Mike Ryan claims that it is possible to inject packets (probably with Ubertooth) in an ongoing BLE conversation. His attempt to do so lead to jamming the connection (Sources 1 and 2). The Bluetooth ...
27
votes
4answers
61k views

How to inject executable, malicious code into PDF, JPEG, MP3, etc.?

I wanted to know if its generally possible to inject executable code into files like PDFs or JPEGs etc., or must there be some kind of security hole in the application? And if so, how would one do ...
6
votes
1answer
91 views

How can I exploit a PHP endpoint that lets me instantiate an arbitrary class?

PHP lets you instantiate classes from variables or array entries, like this: class Foo {} $className = 'Foo'; new $className(); $someArray = ['class_name' => 'Foo']; new $someArray['class_name']();...
1
vote
0answers
79 views

How to check if /run timeout /T 5 remote command execution worked in page html?

I was scanning a website using Zed Attack Proxy, when I found it is vulnerable to remote command execution, specifically timeout with the Referer header (shown in the request below). I have no idea ...
2
votes
1answer
91 views

Are PHP magic methods really necessary for PHP object injection?

I'm trying to understand the PHP Object Injection flaw in vBulletin 5.1.x (CVE 2015-7808) and I stumbled across the requirements for Object Injection as stated by OWASP: The application must have ...
17
votes
3answers
2k views

Exposing database fields names in HTML

I quite often see opportunities to optimise server-side code if HTML form names are exactly the same as the database field names they eventually update. The drawback obviously is that this is ...
4
votes
2answers
565 views

PHP code injection using GET and echo

I have found a piece of this code in a web application (simplified): <?php $password="very-secret-password"; $param = $_GET["param"]; ?> <html> ... Param: <?php echo $param; ?> ... &...
5
votes
1answer
263 views

SQLmap injection not working, manually it works fine

I have built a vulnerable web application to demonstrate SQL injection. I want to show both manual injection and automated injection. The injection requires a) the user to be logged in (session cookie)...
6
votes
2answers
336 views

XSS via JSON: Why does a web application not sanitize either its incoming params hash or its outgoing JSON values of malicious tags like Script?

Recently working on a Rails-based web application for a company, I had to look into XSS vulnerability. It turns out that the application, in some places, could take an HTML tag (e.g., jscodehere ...
-1
votes
1answer
106 views

Understanding HTTP response from Linux Server

I am working through a question that involves someone using a vulnerability in a Linux server in order to gain access to it. The first part of the question states In monitoring the network activity ...
2
votes
2answers
1k views

Is it possible to take down a site using javascript in the URL bar?

If a site is written poorly enough, is it possible to take it down or severely mess with it using only javascript in the URL bar?
0
votes
2answers
3k views

Wireless Adapters for Testing with BackTrack

I would like to begin testing and working with BackTrack. I have heard that the Alfa AWUS036H wireless adapter works well with BackTrack and allows for packet injection. This adapter, however, is ...
3
votes
1answer
165 views

Common attacks when no ports are open

If you have a web server with all ports closed (except, of course, the necessary HTTP) what kind of attacks can an attacker use to hack into the system? Are the only vulnerabilities stuff like ...
4
votes
1answer
112 views

Likely Sources of MITM Attack over Public Internet SSH

Earlier today when attempting to ssh into my remote server, I got the standard man in the middle warning relating to inconsistent public keys. In fact the key-type wasn't even correct. My server uses ...
1
vote
1answer
139 views

how to prevent scripts being injected on my website [closed]

I have an API server on Digitalocean. Yesterday they told me I have "a large flood of traffic from one or more of your servers that is disrupting the normal traffic flow for other users." I checked ...
2
votes
1answer
56 views

SOP for SQL Injection Attack

What should (or) how an Incident Handler do (or) follow when an SQL injection attack is reported? Initial Response Analysis Action Aiming to make a procedure guide to follow for myself and my team....
2
votes
1answer
270 views

SAPE link injection into website

I currently have a WordPress website that has been updated to latest version 4.1, also latest theme installed. The problem is this SAPE Russian link network that is injecting malware code into the ...