Tag Info

Hot answers tagged

51

Yes, that's possible. The malware probably wouldn't be embedded in the video itself, but the video file would be specially crafted to exploit a vulnerability in the codec or media player, to gain code execution. The exploit would then download a file and run it, infecting the machine. These types of exploits have been common amongst popular document ...


26

When this string is decoded from its url-encoded form it becomes the following: 25' having 1=1-- This string, when placed as is into, for example, the following (PHP) database query function: mysql_query("SELECT * FROM users WHERE username = '$username'"); Becomes this: mysql_query("SELECT * FROM users WHERE username = '25' having 1=1--'"); Note ...


22

This is taken from one of my questions on Stack Overflow: Which $_SERVER variables are safe? Server controlled These variables are set by the server environment and depend entirely on the server configuration. 'GATEWAY_INTERFACE' 'SERVER_ADDR' 'SERVER_SOFTWARE' 'DOCUMENT_ROOT' 'SERVER_ADMIN' 'SERVER_SIGNATURE' Partly server controlled These variables ...


11

the registry key is the result of some kind of encoding error. This. 潓瑦慷敲卜湹潣敶祲 encoded in UTF-16LE (Windows's usual encoding for Unicode strings) is the byte sequence: 53 6f 66 74 77 61 72 65 5c 53 79 6e 63 6f 76 65 72 79 Which represents the ASCII string: Software\Syncovery So it would seem Syncovery called a Win32 Unicode API to write a ...


11

(Copied from my answer on StackOverflow ) No. HtmlEncode simply does NOT cover all XSS attacks. Encoding is the correct solution, but not always HTML encoding - you need context-sensitive encoding. For instance, consider server-generated client-side javascript - the server dynamically outputs htmlencoded values directly into the client-side javascript, ...


10

You've generating the base64 encoding of the ASCII hex string, rather than the raw bytes of the hash function's output.


9

Can I 100% rely on $_SERVER[] to be a safe source of data that I do not need to sanitized like I do $_GET[] and $_POST[]? Your question immediately indicates failure. All sources of input must be sanitized. Input is not just considered channels that the user can directly control, but all sources of data outside of your application. Think of it this ...


8

The simplistic scenario would be to try and send --><?php phpinfo();?><!--. If the <?php tag is escaped, then this would result in <!-- --> <?php phpinfo(); <!-- --> (newlines added for clarity). But the presence of <?php ...?> in the HTML page might not be enough; the PHP code needs to be interpreted server side, ...


7

Your MD5 hash {MD5}KdScezWFVZxY7rHb5C4X1w== appears to be base64 encoded. MD5 hashes in the rainbow tables probably would be in hexidecimal, so you should convert the two. In python you can do this with >>> from base64 import b64decode, b16encode >>> b16encode(b64decode('KdScezWFVZxY7rHb5C4X1w==')).lower() ...


7

Risk assessment. If the URLEncoded data is inserted into HTML context (e.g., between tags), I do not know of any way to introduce a XSS attack. URLEncode will escape the <, >, and & characters (to %3C, %3E, and %26, respectively). In modern browsers, I believe this is sufficient to prevent XSS for values inserted between tags. There are some ...


6

There is a pretty nice play-by-play of a real-life example of this on h-online (german it publisher). In this case it's a purposed flash video that contains several different attacks to infect the computer trying to display the video


6

what you're seeing there is a fairly standard SQL Injection attack vector. The code it's adding can modify SQL statements if the input isn't handled correctly by the application (but I guess you worked that out from the title). There's a good description of the problem which mentions this vector in this paper from NGS/NCC. In terms of mitigating the ...


6

After decoding the file, I can see it's from a mod-x.co.uk challenge. You should ask for help on their forums or figure it out yourself.


6

The "search space" has size 2256. It is not enlarged or reduced depending on whether you use hexadecimal or Base64. When you encode a 256-bit string (aka 32 bytes) in Base64, you indeed get 44 characters, but not all combinations of 44 characters (taken in an alphabet of 64) are possible. The 44th character will always be an '=' sign, and there are only 16 ...


5

Not a silly question at all! Many (but not all) of the $SERVER variables are passed from the users browser (or can be influenced by the user), for example the QUERY_STRING, REQUEST_URI and all of the HTTP_* variables. Even the REMOTE_ADDR variable can be spoofed using raw sockets (although only with valid IPs as far as I'm aware). I'd escape them all as a ...


5

The //<![CDATA[ hack is used in XHTML pages that have to parse as both HTML and XML. In the HTML parsing rules, <script> and <style> are special “CDATA elements”, whose contents up to the next </ sequence (HTML4) or </script sequence (HTML5) are raw data, so if (x<y) can be written without any encoding; this would foul up XML ...


5

This exploit is only possible in old versions of Internet Explorer. Modern browsers will not auto detect the encoding as UTF-7. OWASP:- This does not work in any modern browser without changing the encoding type which is why it is marked as completely unsupported. Wikipedia:- To mitigate this problem systems should perform decoding before ...


5

No, that's not going to fool spambots. I've seen a couple of spambots that were parsing the entire DOM using tools like html5lib or comparables. Of course, many spammers just "guess" at email addresses: the cost of sending emails when you have a botnet is basically 0, so making combinations of username & domains to guess works out well. Slightly ...


4

Take a look into this window's bulletin, which describes a patch to fix the jpeg parser (infected by viewing a jpeg image, ouch). So, it certainly is possible. It is just a matter of finding a hole to execute a custom code. This is usually done by some kind of buffer overflow (see for example here).


4

What is "output encoding", and can someone provide a concrete example of how a validation routine could make use of it? Output encoding means that the data is encoded appropriately for the context into which it is being placed. Example, say you want to dynamically display a name from an untrusted source : Your name is:<b>Foo bar</b> If the ...


4

package test.pkcs7; import java.io.ByteArrayOutputStream; import java.io.FileInputStream; import java.math.BigInteger; import java.security.KeyStore; import java.security.PrivateKey; import java.security.Signature; import java.security.cert.X509Certificate; import java.util.Enumeration; import sun.security.pkcs.ContentInfo; import sun.security.pkcs.PKCS7; ...


4

A blacklist approach will always be flawed. For example, under internet explorer you can use the vbscript: URI to execute vbscript code. There are also ways of encoding javascript: to bypass this check. There have been a large number of itunes exploits that rely upon the itunes: URI to exploit itunes from the browser. This is just two examples, but ...


4

Basically XSS happens when an attacker is successful in executing some kind of unauthorized script on a webpage viewed by a potential victim. So if you HtmlEncode the fields before printing on the webpage, the page will not interpret the data as script. It will interpret the characters as content and the content will be printed on to the page as it is. ...


4

Well there are more complex obfuscation techniques. For instance metamorphic and polymorphic malware. There is an article on searchsecurity by Margareth Rose detailing how this works: Metamorphic and polymorphic malware are two categories of malicious software programs (malware) that have the ability to change their code as they propagate. ...


4

Request from client to server Assuming there are no vulnerabilities in the UTF-8 decoder on the server (e.g. overlong UTF-8 encoding or illegal UTF-8 continuation bytes) that could bypass a filter or other encoding routine I can't imagine any sequence that could be decoded to anything dangerous in itself. It is not like UTF-7 where a sequence such as +ADw- ...


3

There's no difference here. Niels' implementation just goes one step further to verify that the correct bits are set/unset, by using & as a bitmask: 10010111 >> 4 = 00001001 (OpenWall's outputs this value) 0x0F = 00001111 00001001 & 00001111 = 00001001 (Niels' implementation outputs this value) 11010111 >> 6 = 00000010 (OpenWall's ...


3

The majority of Antivirus technologies use Signature based detection. Essentially a list of known viruses and their variants at a given point in time. Signature based detection can be very effective, but cannot identify malware unless it already knows and has created a signature for this piece of malware. As a result, this detection method is not useful ...


3

You described one type of anti-virus software: signature based AVs. These anti-viruses look for suspicious sections of binaries that match known viruses. However, each AV has it's own list of "known viruses", so they may catch different viruses. There is no universal list of viruses that each AV can check against. The other type of anti-virus looks for ...


3

There is no such thing as "a safe source of data". You should always make sure data is in the correct format when passing it on to something else. If you are outputting to SQL inside an apostrophe (') delimited string[1], you should escape apostrophes (or anything else that may break out the string). If you are outputting to a Javascript apostrophe ...


3

Short answer, replacing the characters < and > globally with \u003c and \u003e will allow embedding in HTML <script> elements safely, and can be performed on valid JSON without breaking it. To embed it in XML, you need to make sure the JSON only contains characters that can appear in XML. Specifically, XML can only contain non-control ...



Only top voted, non community-wiki answers of a minimum length are eligible