Tag Info

Hot answers tagged

52

Yes, that's possible. The malware probably wouldn't be embedded in the video itself, but the video file would be specially crafted to exploit a vulnerability in the codec or media player, to gain code execution. The exploit would then download a file and run it, infecting the machine. These types of exploits have been common amongst popular document ...


26

When this string is decoded from its url-encoded form it becomes the following: 25' having 1=1-- This string, when placed as is into, for example, the following (PHP) database query function: mysql_query("SELECT * FROM users WHERE username = '$username'"); Becomes this: mysql_query("SELECT * FROM users WHERE username = '25' having 1=1--'"); Note ...


26

This is taken from one of my questions on Stack Overflow: Which $_SERVER variables are safe? Server controlled These variables are set by the server environment and depend entirely on the server configuration. 'GATEWAY_INTERFACE' 'SERVER_ADDR' 'SERVER_SOFTWARE' 'DOCUMENT_ROOT' 'SERVER_ADMIN' 'SERVER_SIGNATURE' Partly server controlled These variables ...


15

I can not make it simpler than this: Essentially, the trouble happens when Enigmail attaches an inline PGP signature to an email in Thunderbird's HTML message composer. The HTML composer is a different component than the plain-text composer, and it performs some "clean up" on the message body after the user hits send. That is an obvious recipe ...


12

the registry key is the result of some kind of encoding error. This. 潓瑦慷敲卜湹潣敶祲 encoded in UTF-16LE (Windows's usual encoding for Unicode strings) is the byte sequence: 53 6f 66 74 77 61 72 65 5c 53 79 6e 63 6f 76 65 72 79 Which represents the ASCII string: Software\Syncovery So it would seem Syncovery called a Win32 Unicode API to write a ...


12

(Copied from my answer on StackOverflow ) No. HtmlEncode simply does NOT cover all XSS attacks. Encoding is the correct solution, but not always HTML encoding - you need context-sensitive encoding. For instance, consider server-generated client-side javascript - the server dynamically outputs htmlencoded values directly into the client-side javascript, ...


10

You've generating the base64 encoding of the ASCII hex string, rather than the raw bytes of the hash function's output.


9

Can I 100% rely on $_SERVER[] to be a safe source of data that I do not need to sanitized like I do $_GET[] and $_POST[]? Your question immediately indicates failure. All sources of input must be sanitized. Input is not just considered channels that the user can directly control, but all sources of data outside of your application. Think of it this ...


8

The simplistic scenario would be to try and send --><?php phpinfo();?><!--. If the <?php tag is escaped, then this would result in <!-- --> <?php phpinfo(); <!-- --> (newlines added for clarity). But the presence of <?php ...?> in the HTML page might not be enough; the PHP code needs to be interpreted server side, ...


8

No, that's not going to fool spambots. I've seen a couple of spambots that were parsing the entire DOM using tools like html5lib or comparables. Of course, many spammers just "guess" at email addresses: the cost of sending emails when you have a botnet is basically 0, so making combinations of username & domains to guess works out well. Slightly ...


7

Your MD5 hash {MD5}KdScezWFVZxY7rHb5C4X1w== appears to be base64 encoded. MD5 hashes in the rainbow tables probably would be in hexidecimal, so you should convert the two. In python you can do this with >>> from base64 import b64decode, b16encode >>> b16encode(b64decode('KdScezWFVZxY7rHb5C4X1w==')).lower() ...


7

Risk assessment. If the URLEncoded data is inserted into HTML context (e.g., between tags), I do not know of any way to introduce a XSS attack. URLEncode will escape the <, >, and & characters (to %3C, %3E, and %26, respectively). In modern browsers, I believe this is sufficient to prevent XSS for values inserted between tags. There are some ...


7

The "search space" has size 2256. It is not enlarged or reduced depending on whether you use hexadecimal or Base64. When you encode a 256-bit string (aka 32 bytes) in Base64, you indeed get 44 characters, but not all combinations of 44 characters (taken in an alphabet of 64) are possible. The 44th character will always be an '=' sign, and there are only 16 ...


6

Not a silly question at all! Many (but not all) of the $SERVER variables are passed from the users browser (or can be influenced by the user), for example the QUERY_STRING, REQUEST_URI and all of the HTTP_* variables. Even the REMOTE_ADDR variable can be spoofed using raw sockets (although only with valid IPs as far as I'm aware). I'd escape them all as a ...


6

what you're seeing there is a fairly standard SQL Injection attack vector. The code it's adding can modify SQL statements if the input isn't handled correctly by the application (but I guess you worked that out from the title). There's a good description of the problem which mentions this vector in this paper from NGS/NCC. In terms of mitigating the ...


6

After decoding the file, I can see it's from a mod-x.co.uk challenge. You should ask for help on their forums or figure it out yourself.


6

There is a pretty nice play-by-play of a real-life example of this on h-online (german it publisher). In this case it's a purposed flash video that contains several different attacks to infect the computer trying to display the video


5

package test.pkcs7; import java.io.ByteArrayOutputStream; import java.io.FileInputStream; import java.math.BigInteger; import java.security.KeyStore; import java.security.PrivateKey; import java.security.Signature; import java.security.cert.X509Certificate; import java.util.Enumeration; import sun.security.pkcs.ContentInfo; import sun.security.pkcs.PKCS7; ...


5

The //<![CDATA[ hack is used in XHTML pages that have to parse as both HTML and XML. In the HTML parsing rules, <script> and <style> are special “CDATA elements”, whose contents up to the next </ sequence (HTML4) or </script sequence (HTML5) are raw data, so if (x<y) can be written without any encoding; this would foul up XML ...


5

Well there are more complex obfuscation techniques. For instance metamorphic and polymorphic malware. There is an article on searchsecurity by Margareth Rose detailing how this works: Metamorphic and polymorphic malware are two categories of malicious software programs (malware) that have the ability to change their code as they propagate. ...


5

This exploit is only possible in old versions of Internet Explorer. Modern browsers will not auto detect the encoding as UTF-7. OWASP:- This does not work in any modern browser without changing the encoding type which is why it is marked as completely unsupported. Wikipedia:- To mitigate this problem systems should perform decoding before ...


5

By looking at A= "Tg==" and B= "Tw==" and base 64 decode these values you'll get A= "N" and B= "O" which triggered me as it looks like some sort of substitution. In your case they used double encoding because as it turned out, it is ROT13, which actually stands for ROTate 13 times: Now in order to decode your message, you'll first have to base 64 decode ...


5

This sequence: a b a b a b a b H1 E3 B8 W6 Z4 S0 X1 K4 b b b b b b b b S8 E3 O2 W6 G6 S0 C0 K4 a a a a a a a a H1 L3 B8 H5 Z4 D7 X1 Z8 tells that there is a key being used to scramble the input password, much like XOR, except most uses of XOR would output in hex while this output is base36? This sequence A B A B A B A B B0 ...


4

Take a look into this window's bulletin, which describes a patch to fix the jpeg parser (infected by viewing a jpeg image, ouch). So, it certainly is possible. It is just a matter of finding a hole to execute a custom code. This is usually done by some kind of buffer overflow (see for example here).


4

What is "output encoding", and can someone provide a concrete example of how a validation routine could make use of it? Output encoding means that the data is encoded appropriately for the context into which it is being placed. Example, say you want to dynamically display a name from an untrusted source : Your name is:<b>Foo bar</b> If the ...


4

A blacklist approach will always be flawed. For example, under internet explorer you can use the vbscript: URI to execute vbscript code. There are also ways of encoding javascript: to bypass this check. There have been a large number of itunes exploits that rely upon the itunes: URI to exploit itunes from the browser. This is just two examples, but ...


4

Basically XSS happens when an attacker is successful in executing some kind of unauthorized script on a webpage viewed by a potential victim. So if you HtmlEncode the fields before printing on the webpage, the page will not interpret the data as script. It will interpret the characters as content and the content will be printed on to the page as it is. ...


4

Request from client to server Assuming there are no vulnerabilities in the UTF-8 decoder on the server (e.g. overlong UTF-8 encoding or illegal UTF-8 continuation bytes) that could bypass a filter or other encoding routine I can't imagine any sequence that could be decoded to anything dangerous in itself. It is not like UTF-7 where a sequence such as +ADw- ...


4

This is sort of the source for preventing XSS in ASP.NET (at least from Microsoft): How To: Prevent Cross-Site Scripting in ASP.NET Some important things to glean from the article specific to your question: Use the HttpUtility.HtmlEncode method to encode output if it contains input from the user or from other sources such as databases. use ...


4

If it looks like base64 but isn't quite, it might be base64 with a custom alphabet. This is something that malware writers do to avoid detection (e.g., with data being exfiltrated) and that web application developers do when they think they're being clever (they're usually quite wrong, thinking it's harder to suss out than it is). I haven't tried to do so, ...



Only top voted, non community-wiki answers of a minimum length are eligible