inserting malicious content, usually code (like SQL, Javascript) into a vulnerable application. Is used only if there is no more specific injection tag available (see tag wiki)

learn more… | top users | synonyms

1
vote
2answers
116 views

Protecting code injection via chattr on php files?

Recently, a website I hosted (wordpress I think) for a friend got hacked and all php pages had added code at the bottom in the form of "echo base64_encode(...);". Thus there were unwanted ads on very ...
0
votes
1answer
97 views

SAPE link injection into website

I currently have a WordPress website that has been updated to latest version 4.1, also latest theme installed. The problem is this SAPE Russian link network that is injecting malware code into the ...
1
vote
0answers
26 views

How to identify column types during sql injection with “union all select” construct?

Situation is following: I have identified sql injection attack vector, and have following information about target table: It has six columns. (Identified using "order by"). I can see output of 3 of ...
1
vote
0answers
40 views

Secure public API

I'm building a mobile app that will use API created by me on my server. These API will be publicy exposed, but not publicy documented. I want to let the user to use the app without authentication for ...
1
vote
0answers
86 views

How Modification attacks works?

Theoretically... In Active attacks we have "modification attack"...ie "In a message modification attack, an intruder alters packet header addresses to direct a message to a different destination or ...
1
vote
0answers
74 views

Detecting reflective DLL injection any other ways?

any way to detect it? maybe using mcafee hips rules? Are there any known Techniques to detect it ? like walking the VAD tree or something?
1
vote
0answers
75 views

SSRS custom assembly security issues

I want to invoke a custom assembly that uses protected services (like DirectoryServices, etc...) with reporting Services. On the web, I see a recurring example of configuration (inspired by this ...
0
votes
0answers
22 views

Constructing a tainted string for arc injection

I'm new to security and currently referring to Robert Seacord's Secure Coding in C and C++. In chapter 2 of the same, the author talks about arc injection, wherein he passes the flow of control in the ...
0
votes
0answers
220 views

Active Directory Injection attack

Is there a possible way of injecting code to pull data from Active directory? I have written a PHP page that executes Powershell and is able to change passwords to a controlled group of people. ...
0
votes
0answers
93 views

Should I be concerned about the following URLs that were tried to open on my webpage?

I don't know if this is some injection attempt or a weird bot or what ever. An IP opened several pages within my Drupal 7 website with the appendix ...
0
votes
0answers
39 views

How to route RST injections

Lots of security appliances and software support RST injection. Plenty of material exists on the algorithmics of the RST packet(s) (making them fit the context of the targeted TCP connection, ...