The scripting tag has no wiki summary.
18
votes
3answers
796 views
NoScript: How to determine which sites/scripts to whitelist?
NoScript is a great plug-in, both for security and for ad blocking. However, I've found it's not always easy to figure out what scripts need to be permitted on certain pages, to be able to use the ...
10
votes
5answers
619 views
Can a .sh file be malware?
Can a .sh file be a virus or something harmful? Is it like .exe files on Windows? If yes can someone read this script and tell me if it safe and is it effect any how on gpg security. It gives me an ...
9
votes
4answers
376 views
How to avoid scripts with hardcoded password?
I have some scripts on Ubuntu Linux machine that logs in to a database server to run some maintenance daily. To login to the database, I need a password and right now it is hardcoded in the script.
...
8
votes
1answer
406 views
How is a public scriptable site like codepad or ideone manages it's sandboxing?
I've researched this stuff a lot in the recent months but i can't grasp any solid basis on how they achieve runing unsafe scripts in so many languages without a problem!
I'm sure they are running ...
6
votes
1answer
185 views
What is the security impact of changing PowerShell's PSLanguageMode?
A vendor is asking me to change the PSLanguageMode from within IIS on my Exchange server(s).
What potential vulnerabilities am I opening myself up to?
I'm surprised to see this option present within ...
5
votes
5answers
1k views
How can I avoid putting the database password in a perl script?
I have a cronned perl script that connects to our database and does various kinds of lookups and integrity checks. The original script was written by someone long ago. My job is to make some changes ...
4
votes
2answers
10k views
How is PowerShell's RemoteSigned execution policy different from AllSigned?
I'm still pretty new to PowerShell, and recently read this in a blog posting about creating and using PowerShell scripts.
To prevent the execution of malicious scripts, PowerShell enforces an ...
4
votes
5answers
2k views
Preferred UAC configuration in Enterprises that use Login scripts to map drives
In Windows 7, Vista and newer OS's, UAC will prevent logon scripts from mapping hard drives so that the following logon script code won't work:
Dim WshNetwork
Set WshNetwork = ...
3
votes
3answers
3k views
Facebook spam / phishing attempt?
I got this sent by a friend on facebook and i dont think its a genuine message
___ shared a link on your Wall.
This will leave you speechless)
...
2
votes
2answers
304 views
Is XSS possible here? Challenge
Is possible to bypass my regex and execute any javascript?
<script>
function json(a){
if (/^\s*$/.test(a) ? 0 : /^[\],:{}\s\u2028\u2029]*$/.test(a.replace(/\\["\\\/bfnrtu]/g, ...
2
votes
3answers
313 views
Are there any addons that disable only some functionality of scripts?
Tor comes bundled with NoScript. Correct me if I'm wrong but that's because client sided scripts can determine the originating IP address regardless of who the traffic is passed through. But NoScript ...
2
votes
1answer
2k views
Does Google Chrome protect against cross site scripting (XSS)?
In Firefox I've been using the NoScript extension to protect myself from certain malware attacks. NoScript is well known as it's a very powerful extension for Firefox and introduced protection from ...
2
votes
1answer
50 views
What can I do to separate users best way if they are allowed to run their ruby (python) code
I have Ubuntu server 12.04 on VDS and I allow users to run their own Rails applications on behalf their own accounts. That means:
They can use any shell they want
They can upload what they want, ...
1
vote
4answers
281 views
Are malicious scripts in batch files detected by antiviruses?
we have many scripts in shared folders in our IT Department.
Are malicious scripts in batch files detected by antiviruses?
1
vote
1answer
289 views
Is this enough to tackle script / malicious code insertion in GET, POST requests?
I've got legacy PHP code which attempts to prevent script / SQL injection with the following:
if (!empty($_POST)) {
reset($_POST);
while (list($k,$v)=each($_POST)) {
...
1
vote
1answer
379 views
scanning my site for JavaScript/XSS vulnerabilities
It have had a report that my site may have a security issue and there is some JavaScript loading 10 times per second.
www.ayrshireminis.com
Is there anyway that I can "scan" my site to check if ...
1
vote
2answers
347 views
Looking for a tutorial on meterpreter extensions
A simple custom DLL source would be sufficient. All of the links I find on google are dead. I don't mind reading some clear source if there's a tut DLL floating about.
I tried for meterpreter and ...
0
votes
2answers
145 views
What is Greasemonkey / Userscripts and how does it relate to IT Security?
I came across http://userscripts.org/ and learned that it is popular among web-users to install something called "Greasemonkey" to allow client side scripts to run.
What are the benefits of ...
0
votes
2answers
143 views
Is a browser with disabled scripts and disabled java enough against malware
Is a browser like Firefox with disabled scripts (for example via a plugin like no-script) and disabled java enough to be protected against dryve-by-malware from the internet.
Of course this does not ...
0
votes
1answer
1k views
Best efficient windows hardening audit script
Do anyone know of a script that uses no 3rd party executables (preferably a batch file) that can be used to audit windows machine state securitywise? (including best practices features - gpo, ...
-2
votes
1answer
56 views
How to secure a script that generates an HTML file from other websites?
I have a ksh script (Korn Shell Script) that generates a static HTML file from websites. How can I ensure that the output HTML file will not contain any bad <script>'s (bad JavaScript)? It's OK ...
