1
vote
1answer
79 views

Code injection in files with 0644 permissions

My subject says it all - I am clueless as to how a file with permissions 0644 can keep getting iframe injections. None of the posts on this site that I saw quite described what I am experiencing. ...
2
votes
2answers
310 views

PHP on IIS 7.5 Hacked - How do I find and fix the XSS Injection?

I discovered that someone had gained access via FileZilla server software to my Windows 2012 Server. It seems like they had created extra accounts and were trying brute force attempts to get in nearly ...
2
votes
2answers
150 views

Unsanitized HTML input

My school uses the website WebAssign for online math and science homework. One of WebAssign's features is a "My Notes" section that allows you to input notes for a problem and come back to it later ...
2
votes
1answer
173 views

Reflected XSS - Automatic understanding of filters

I'm currently facing this possible reflected XSS vulnerability on a webapp: URL = http://www.test.com/login/?login=[PAYLOAD] When a user clicks on this link, it displays a login page that includes ...
1
vote
1answer
206 views

CRLF Injection into Web Page

I was pen-testing a site recently which I found a few issues in, and this continues to a previous question I asked about Null-byte string termination in web applications. I have noticed that the site ...
-2
votes
2answers
175 views

Parameterization strategy for hazardous character injection [closed]

I have a input text field for accepting Email ID. If Email ID is not entered by User, I have a client side validation using Java Script to display error message which reads like, "Please enter valid ...
4
votes
1answer
110 views

If you want to implement a XSS scanner, is it absolutely necessary to use a JS interpreter? Why?

In a recent discussion about a security vulnerability scanner that returns false positives for XSS detection, I noticed that the scanner just inject a string like "this_is_my_string_" (without the ...
0
votes
1answer
531 views

Sanitizing JavaScript to prevent XSS

I'm going through a vulnerability remediation exercise for a client and am trying to figure out how to best mitigate this particular hole. There's a script on our site that calls up content into a new ...
1
vote
4answers
564 views

Simple solution to XSS

I've got an idea as to how to defeat XSS so simple that it may work and was wondering if anybody had already done something similar. The goal here is not efficiency but security. In other words I ...
3
votes
1answer
5k views

DOM Based XSS attacks: what is the most dangerous example?

I knew that XSS attacks (“non-persistent” and “persistent”) can hijack user session, deface websites, conduct phishing attack, etc. However, I can't understand what is dangerous of DOM Based XSS if ...
1
vote
2answers
1k views

header injection + codeigniter

I'm reading through Mozilla's Secure Coding Guidelines, and found this statement: Don't trust any user data (input, headers, cookies etc). Validate it before using it I'm using the codeigniter ...
5
votes
4answers
1k views

Server wide javascript injection

UPDATE: The server was rooted, php.ini was replaced that cause the injection to appear. Still haven't figured out which directive is injecting the javascript. I'm troubleshooting a hacked website ...
4
votes
3answers
5k views

Testing PHP form injection

I'm writing a very small PHP app that takes input via a form. As could be expected for a first revision, the code does no escaping or sanitisation of input: if( $_POST["var"] != "" ) { print ...