Perl is a high-level, general-purpose, interpreted, dynamic programming language.

learn more… | top users | synonyms

3
votes
1answer
60 views

Malicious RCE functions in CGI and Java

I know there are some functions in CGI and Java that can be abused to perform remote code execution attack. For example we can see abuse of "eval" function in Movable Type CMS: sub ...
0
votes
0answers
4 views

Perl doesn't print 0x00 [migrated]

I wanted to experiment with the NOP SLED technique. I got the sled and the shellcode into an environment variable and I got its address. So i wanted to execute the vulnerable program and as an ...
1
vote
1answer
26 views

Does Perl's unpack function have format vulnerabilities?

I'm using Perl for the first time for production software and I have some trust issues with it. When I use the unpack() function, is it safe to use user input in the TEMPLATE string? I'm using a ...
13
votes
5answers
8k views

How can I avoid putting the database password in a perl script?

I have a cronned perl script that connects to our database and does various kinds of lookups and integrity checks. The original script was written by someone long ago. My job is to make some changes ...
1
vote
2answers
377 views

Sucpicious process running in centos server

Following is the output of the "top" command. I have clipped the result. Here, I want to know the detail of the process called httpd.pl. PID USER PR NI VIRT RES SHR S %CPU %MEM TIME+ ...
0
votes
2answers
184 views

If perl/python is not guaranteed to be installed on a target system why are those scripts useful to hackers?

If you don't install perl/python on your system then hackers can't use it (or they would make themselves obvious if they installed it)? I am just trying to understand why these languages are ...
1
vote
1answer
239 views

How easy is it to crack this encryption algorithm? [closed]

When I was about 13 or 14 years old, I was a little interested in cryptography (which is, after all, an interesting field). I learnt quite a lot since that time (it has been about 8 years since then), ...
0
votes
2answers
667 views

Identifying HP Printers with NMAP and then using results in Python/Perl

Great write up on network printer hacking at IronGeek's site here for anyone interested http://www.irongeek.com/i.php?page=security/networkprinterhacking. Here's what I want to do: Scan the subnet ...
3
votes
2answers
880 views

Caught this hitting our webmail server, any ideas?

So this was bouncing off our webmail server for the last couple days, I took it home today to look it through. Any ideas as to what is does/is/attempting to do? I have been looking through and would ...
3
votes
3answers
579 views

Need help decoding suspicious Perl .cgi files

I found three (identical) .cgi files in the "cgi-bin" directory of a hacked website account. My knowledge of Perl is insufficient to decode them. I see some regexp with code execution, but I don't see ...
2
votes
1answer
341 views

Identifying strange Perl CGI script

Recently, while looking at some Perl CGI files, I came across this. I am not familiar enough with Perl to know exactly what it means, but I did attempt to base64 decode the string to no effect. Can ...
4
votes
2answers
278 views

Perl CPAN modules in a PCI-DSS environment

We are currently working on implementing the PCI-DSS ruleset in our IT environment, where all of the inhouse software we use is Perl. We have a Perl dev team of about 10 people (inlcuding me) and ...
1
vote
3answers
638 views

Web Application - Cookie Expiry

We are using a web application on cloud. I need a small clarification. We are using Perl with Apache. I see a following issue here for the below scenario. I need some inputs of whether this is most ...
3
votes
2answers
919 views

Tools for analyzing Perl 5 code? [closed]

I'm looking for good tools for analyzing and/or detecting security issues in a large software project written in Perl 5. It could be static or dynamic analysis. I know that Perl is undecidable, but ...
2
votes
1answer
701 views

Can /etc/passwd file be accessed on a cpanel shared hosting account?

Given standard server hardening was performed, can the /etc/passwd be accessed by a shared hosting account by using PHP or Perl scripts which is executed from the public_html of the shared account?
3
votes
3answers
3k views

Disable Perl for some/most Linux users?

One of my server's web accounts got hacked a couple of times. Each time someone downloaded a Perl script via some phpBB forum and used the Perl script to do whatever they wanted to do (mostly connect ...
1
vote
0answers
279 views

Unauthorised Perl Scripts [closed]

One of my servers just had the memory exhausted by a load of Perl scripts, we use plesk and they seem to have appeared under the /var/www/vhosts/domainexample.com/cgi-bin/ directory, I managed to stop ...