Tagged Questions

3
votes
2answers
648 views

Code Injection detection on Web Servers

Recently I found one of my web servers hacked with malicious code injected to websites hosted there. It wasn't exactly my fault, as I shared the server with other people and someone put some unsafe ...
0
votes
1answer
392 views

can the value of request.getHeader(“Host”) be faked?

Suppose if there is some code like <a href="<%=request.getHeader("Host")%>/xxx/abc.do>SignIn</a> Can an attacker fake request.getHeader("host") to point 'SignIn' anchor to ...
6
votes
3answers
858 views

PHP mail() Header Injection Prevention

This site nicely explains the problem. Essentially, nearly all php mail() examples that are given are vulnerable to header injection attacks. The referenced site gives a regex sanitation solution ...