Hot answers tagged

56

Yes, that's possible. The malware probably wouldn't be embedded in the video itself, but the video file would be specially crafted to exploit a vulnerability in the codec or media player, to gain code execution. The exploit would then download a file and run it, infecting the machine. These types of exploits have been common amongst popular document ...


43

The Zodiac killer ciphers are an interesting case. As there were four ciphers sent to the local papers, I will address each in turn. They do share some common traits however. They are each their own cipher, so the 'solution' used for cipher 408 cannot be applied to the other messages. Each message has a unique character count. The Zodiac Killer sent these ...


30

This is taken from one of my questions on Stack Overflow: Which $_SERVER variables are safe? Server controlled These variables are set by the server environment and depend entirely on the server configuration. 'GATEWAY_INTERFACE' 'SERVER_ADDR' 'SERVER_SOFTWARE' 'DOCUMENT_ROOT' 'SERVER_ADMIN' 'SERVER_SIGNATURE' Partly server controlled These variables ...


26

When this string is decoded from its url-encoded form it becomes the following: 25' having 1=1-- This string, when placed as is into, for example, the following (PHP) database query function: mysql_query("SELECT * FROM users WHERE username = '$username'"); Becomes this: mysql_query("SELECT * FROM users WHERE username = '25' having 1=1--'"); Note ...


22

You're assuming that they're actually encrypted. A lot of crazy people have written things that nobody understands. Just because the author thinks they're in code doesn't necessarily mean that the code can be reversed.


14

(Copied from my answer on StackOverflow ) No. HtmlEncode simply does NOT cover all XSS attacks. Encoding is the correct solution, but not always HTML encoding - you need context-sensitive encoding. For instance, consider server-generated client-side javascript - the server dynamically outputs htmlencoded values directly into the client-side javascript, ...


12

the registry key is the result of some kind of encoding error. This. 潓瑦慷敲卜湹潣敶祲 encoded in UTF-16LE (Windows's usual encoding for Unicode strings) is the byte sequence: 53 6f 66 74 77 61 72 65 5c 53 79 6e 63 6f 76 65 72 79 Which represents the ASCII string: Software\Syncovery So it would seem Syncovery called a Win32 Unicode API to write a ...


10

Can I 100% rely on $_SERVER[] to be a safe source of data that I do not need to sanitized like I do $_GET[] and $_POST[]? Your question immediately indicates failure. All sources of input must be sanitized. Input is not just considered channels that the user can directly control, but all sources of data outside of your application. Think of it this way, ...


10

You've generating the base64 encoding of the ASCII hex string, rather than the raw bytes of the hash function's output.


9

No, that's not going to fool spambots. I've seen a couple of spambots that were parsing the entire DOM using tools like html5lib or comparables. Of course, many spammers just "guess" at email addresses: the cost of sending emails when you have a botnet is basically 0, so making combinations of username & domains to guess works out well. Slightly ...


8

The "search space" has size 2256. It is not enlarged or reduced depending on whether you use hexadecimal or Base64. When you encode a 256-bit string (aka 32 bytes) in Base64, you indeed get 44 characters, but not all combinations of 44 characters (taken in an alphabet of 64) are possible. The 44th character will always be an '=' sign, and there are only 16 ...


8

The simplistic scenario would be to try and send --><?php phpinfo();?><!--. If the <?php tag is escaped, then this would result in <!-- --> <?php phpinfo(); <!-- --> (newlines added for clarity). But the presence of <?php ...?> in the HTML page might not be enough; the PHP code needs to be interpreted server side, ...


7

Your MD5 hash {MD5}KdScezWFVZxY7rHb5C4X1w== appears to be base64 encoded. MD5 hashes in the rainbow tables probably would be in hexidecimal, so you should convert the two. In python you can do this with >>> from base64 import b64decode, b16encode >>> b16encode(b64decode('KdScezWFVZxY7rHb5C4X1w==')).lower() '...


7

Risk assessment. If the URLEncoded data is inserted into HTML context (e.g., between tags), I do not know of any way to introduce a XSS attack. URLEncode will escape the <, >, and & characters (to %3C, %3E, and %26, respectively). In modern browsers, I believe this is sufficient to prevent XSS for values inserted between tags. There are some ...


6

After decoding the file, I can see it's from a mod-x.co.uk challenge. You should ask for help on their forums or figure it out yourself.


6

Not a silly question at all! Many (but not all) of the $SERVER variables are passed from the users browser (or can be influenced by the user), for example the QUERY_STRING, REQUEST_URI and all of the HTTP_* variables. Even the REMOTE_ADDR variable can be spoofed using raw sockets (although only with valid IPs as far as I'm aware). I'd escape them all as a ...


6

what you're seeing there is a fairly standard SQL Injection attack vector. The code it's adding can modify SQL statements if the input isn't handled correctly by the application (but I guess you worked that out from the title). There's a good description of the problem which mentions this vector in this paper from NGS/NCC. In terms of mitigating the ...


6

package test.pkcs7; import java.io.ByteArrayOutputStream; import java.io.FileInputStream; import java.math.BigInteger; import java.security.KeyStore; import java.security.PrivateKey; import java.security.Signature; import java.security.cert.X509Certificate; import java.util.Enumeration; import sun.security.pkcs.ContentInfo; import sun.security.pkcs.PKCS7; ...


6

There is a pretty nice play-by-play of a real-life example of this on h-online (german it publisher). In this case it's a purposed flash video that contains several different attacks to infect the computer trying to display the video


6

This exploit is only possible in old versions of Internet Explorer. Modern browsers will not auto detect the encoding as UTF-7. OWASP:- This does not work in any modern browser without changing the encoding type which is why it is marked as completely unsupported. Wikipedia:- To mitigate this problem systems should perform decoding before ...


5

The //<![CDATA[ hack is used in XHTML pages that have to parse as both HTML and XML. In the HTML parsing rules, <script> and <style> are special “CDATA elements”, whose contents up to the next </ sequence (HTML4) or </script sequence (HTML5) are raw data, so if (x<y) can be written without any encoding; this would foul up XML parsers....


5

Well there are more complex obfuscation techniques. For instance metamorphic and polymorphic malware. There is an article on searchsecurity by Margareth Rose detailing how this works: Metamorphic and polymorphic malware are two categories of malicious software programs (malware) that have the ability to change their code as they propagate. ...


5

By looking at A= "Tg==" and B= "Tw==" and base 64 decode these values you'll get A= "N" and B= "O" which triggered me as it looks like some sort of substitution. In your case they used double encoding because as it turned out, it is ROT13, which actually stands for ROTate 13 times: Now in order to decode your message, you'll first have to base 64 decode ...


5

This sequence: a b a b a b a b H1 E3 B8 W6 Z4 S0 X1 K4 b b b b b b b b S8 E3 O2 W6 G6 S0 C0 K4 a a a a a a a a H1 L3 B8 H5 Z4 D7 X1 Z8 tells that there is a key being used to scramble the input password, much like XOR, except most uses of XOR would output in hex while this output is base36? This sequence A B A B A B A B B0 ...


5

It's an IP address in octal format, followed by an arbitrary path, which happens to be formed of elements that look like query parameters. You can generate octal representations of IP addresses using various online tools: 0xD83AD60E should link to Google at 216.58.214.14. They're not inherently malicious, but the fact that you received it from a spammer ...


4

There's no difference here. Niels' implementation just goes one step further to verify that the correct bits are set/unset, by using & as a bitmask: 10010111 >> 4 = 00001001 (OpenWall's outputs this value) 0x0F = 00001111 00001001 & 00001111 = 00001001 (Niels' implementation outputs this value) 11010111 >> 6 = 00000010 (OpenWall's ...


4

Take a look into this window's bulletin, which describes a patch to fix the jpeg parser (infected by viewing a jpeg image, ouch). So, it certainly is possible. It is just a matter of finding a hole to execute a custom code. This is usually done by some kind of buffer overflow (see for example here).


4

Besides @Polynomial's buffer overflow possibility, the "video file" could actually be a trojan executable. Here's a simple example: An executable file is named such that it appears to be a video, like: "movie.avi .exe" The executable extracts the video data embedded in it, starts your video player, and meanwhile deploys its malicious ...


4

What is "output encoding", and can someone provide a concrete example of how a validation routine could make use of it? Output encoding means that the data is encoded appropriately for the context into which it is being placed. Example, say you want to dynamically display a name from an untrusted source : Your name is:<b>Foo bar</b> If the name ...



Only top voted, non community-wiki answers of a minimum length are eligible