Tag Info

Hot answers tagged

51

Yes, that's possible. The malware probably wouldn't be embedded in the video itself, but the video file would be specially crafted to exploit a vulnerability in the codec or media player, to gain code execution. The exploit would then download a file and run it, infecting the machine. These types of exploits have been common amongst popular document ...


25

When this string is decoded from its url-encoded form it becomes the following: 25' having 1=1-- This string, when placed as is into, for example, the following (PHP) database query function: mysql_query("SELECT * FROM users WHERE username = '$username'"); Becomes this: mysql_query("SELECT * FROM users WHERE username = '25' having 1=1--'"); Note ...


16

This is taken from one of my questions on Stack Overflow: Which $_SERVER variables are safe? Server controlled These variables are set by the server environment and depend entirely on the server configuration. 'GATEWAY_INTERFACE' 'SERVER_ADDR' 'SERVER_SOFTWARE' 'DOCUMENT_ROOT' 'SERVER_ADMIN' 'SERVER_SIGNATURE' Partly server controlled These variables ...


11

(Copied from my answer on StackOverflow ) No. HtmlEncode simply does NOT cover all XSS attacks. Encoding is the correct solution, but not always HTML encoding - you need context-sensitive encoding. For instance, consider server-generated client-side javascript - the server dynamically outputs htmlencoded values directly into the client-side javascript, ...


11

the registry key is the result of some kind of encoding error. This. 潓瑦慷敲卜湹潣敶祲 encoded in UTF-16LE (Windows's usual encoding for Unicode strings) is the byte sequence: 53 6f 66 74 77 61 72 65 5c 53 79 6e 63 6f 76 65 72 79 Which represents the ASCII string: Software\Syncovery So it would seem Syncovery called a Win32 Unicode API to write a ...


8

Can I 100% rely on $_SERVER[] to be a safe source of data that I do not need to sanitized like I do $_GET[] and $_POST[]? Your question immediately indicates failure. All sources of input must be sanitized. Input is not just considered channels that the user can directly control, but all sources of data outside of your application. Think of it this ...


7

Your MD5 hash {MD5}KdScezWFVZxY7rHb5C4X1w== appears to be base64 encoded. MD5 hashes in the rainbow tables probably would be in hexidecimal, so you should convert the two. In python you can do this with >>> from base64 import b64decode, b16encode >>> b16encode(b64decode('KdScezWFVZxY7rHb5C4X1w==')).lower() ...


7

Risk assessment. If the URLEncoded data is inserted into HTML context (e.g., between tags), I do not know of any way to introduce a XSS attack. URLEncode will escape the <, >, and & characters (to %3C, %3E, and %26, respectively). In modern browsers, I believe this is sufficient to prevent XSS for values inserted between tags. There are some ...


7

The simplistic scenario would be to try and send --><?php phpinfo();?><!--. If the <?php tag is escaped, then this would result in <!-- --> <?php phpinfo(); <!-- --> (newlines added for clarity). But the presence of <?php ...?> in the HTML page might not be enough; the PHP code needs to be interpreted server side, ...


6

There is a pretty nice play-by-play of a real-life example of this on h-online (german it publisher). In this case it's a purposed flash video that contains several different attacks to infect the computer trying to display the video


6

what you're seeing there is a fairly standard SQL Injection attack vector. The code it's adding can modify SQL statements if the input isn't handled correctly by the application (but I guess you worked that out from the title). There's a good description of the problem which mentions this vector in this paper from NGS/NCC. In terms of mitigating the ...


5

Not a silly question at all! Many (but not all) of the $SERVER variables are passed from the users browser (or can be influenced by the user), for example the QUERY_STRING, REQUEST_URI and all of the HTTP_* variables. Even the REMOTE_ADDR variable can be spoofed using raw sockets (although only with valid IPs as far as I'm aware). I'd escape them all as a ...


5

The //<![CDATA[ hack is used in XHTML pages that have to parse as both HTML and XML. In the HTML parsing rules, <script> and <style> are special “CDATA elements”, whose contents up to the next </ sequence (HTML4) or </script sequence (HTML5) are raw data, so if (x<y) can be written without any encoding; this would foul up XML ...


5

The "search space" has size 2256. It is not enlarged or reduced depending on whether you use hexadecimal or Base64. When you encode a 256-bit string (aka 32 bytes) in Base64, you indeed get 44 characters, but not all combinations of 44 characters (taken in an alphabet of 64) are possible. The 44th character will always be an '=' sign, and there are only 16 ...


4

package test.pkcs7; import java.io.ByteArrayOutputStream; import java.io.FileInputStream; import java.math.BigInteger; import java.security.KeyStore; import java.security.PrivateKey; import java.security.Signature; import java.security.cert.X509Certificate; import java.util.Enumeration; import sun.security.pkcs.ContentInfo; import sun.security.pkcs.PKCS7; ...


4

Take a look into this window's bulletin, which describes a patch to fix the jpeg parser (infected by viewing a jpeg image, ouch). So, it certainly is possible. It is just a matter of finding a hole to execute a custom code. This is usually done by some kind of buffer overflow (see for example here).


4

What is "output encoding", and can someone provide a concrete example of how a validation routine could make use of it? Output encoding means that the data is encoded appropriately for the context into which it is being placed. Example, say you want to dynamically display a name from an untrusted source : Your name is:<b>Foo bar</b> If the ...


4

Basically XSS happens when an attacker is successful in executing some kind of unauthorized script on a webpage viewed by a potential victim. So if you HtmlEncode the fields before printing on the webpage, the page will not interpret the data as script. It will interpret the characters as content and the content will be printed on to the page as it is. ...


4

Well there are more complex obfuscation techniques. For instance metamorphic and polymorphic malware. There is an article on searchsecurity by Margareth Rose detailing how this works: Metamorphic and polymorphic malware are two categories of malicious software programs (malware) that have the ability to change their code as they propagate. ...


3

There is no such thing as "a safe source of data". You should always make sure data is in the correct format when passing it on to something else. If you are outputting to SQL inside an apostrophe (') delimited string[1], you should escape apostrophes (or anything else that may break out the string). If you are outputting to a Javascript apostrophe ...


3

A blacklist approach will always be flawed. For example, under internet explorer you can use the vbscript: URI to execute vbscript code. There are also ways of encoding javascript: to bypass this check. There have been a large number of itunes exploits that rely upon the itunes: URI to exploit itunes from the browser. This is just two examples, but ...


3

There's no difference here. Niels' implementation just goes one step further to verify that the correct bits are set/unset, by using & as a bitmask: 10010111 >> 4 = 00001001 (OpenWall's outputs this value) 0x0F = 00001111 00001001 & 00001111 = 00001001 (Niels' implementation outputs this value) 11010111 >> 6 = 00000010 (OpenWall's ...


3

Besides @Polynomial's buffer overflow possibility, the "video file" could actually be a trojan executable. Here's a simple example: An executable file is named such that it appears to be a video, like: "movie.avi .exe" The executable extracts the video data embedded in it, starts your video player, and meanwhile deploys its malicious ...


3

Short answer, replacing the characters < and > globally with \u003c and \u003e will allow embedding in HTML <script> elements safely, and can be performed on valid JSON without breaking it. To embed it in XML, you need to make sure the JSON only contains characters that can appear in XML. Specifically, XML can only contain non-control ...


3

Base64 encoding encodes arbitrary data into an alphabet of mixed-case alphanumeric and 2 symbols (frequently + and /) with padding of between 0 and 3 = symbols. It's pretty easy to recognize a string that matches these characteristics, especially the = at the end.


3

There is probably nothing to decode there. Spammers are engaged in a continuous war with antispam filters so they try to include in their spams some "text" which will make some antispam filters think that it is not really spam after all. It is probable that there is, out there, one antispam software (at least) which currently gets fooled by such extra ...


3

Sounds like it is vulnerable, and you have hit the anti-XSS filter in modern browsers. For testing I suggest you disable the filter. When reporting these issues to clients, I take the line that you can't be sure whether a user will have such a browser, and report anyway. That has been ok so far, although I can see in the future I will need to distinguish ...


2

In order to try and identify the password that gives you a particular hash, the only real way is to try all passwords and hash them to see what you get. What those websites have done is already tried a huge number of passwords and stored the calculated hashes so when you input your hash they quickly look up their database and provide you with an answer. ...


2

I think the best way to describe canonicalization is to remember that it stems from canon, meaning an authentic piece of writing. What they're talking about is taking untrusted data and formatting it as an unambiguous representation, such that it can never be misrepresented by any software process. The first step is to take your input and store it ...



Only top voted, non community-wiki answers of a minimum length are eligible