Tag Info

New answers tagged

2

I think the point you're missing is this: SMTP header isn't an attack on a mail server. It is an attack on a web server, or other application that controls a mail server at the back end. See the OWASP page on Testing for IMAP/SMTP Injection. In your question, your definition of a "secure SMTP server" is one that does not support pipelining. Pipelining is ...


0

The process of sending the email encompasses the generation of the mail envelope and the mail body. Anything that is not part of the DATA chunk is the mail envelope. This is classic separation of control messages and the data payload itself. And also in similar fashion to other standards, the resultant mail as delivered by the local delivery agent is in all ...


1

The SMTP protocol is based on a series of commands and replies. RFC 821 (April 1982) expected that the client read each reply before proceeding. This way, if I send an email to Alice, Bob and Carol, there are many roundtips, as I mut do: "RCPT Alice" (wait for reply), "RCPT Bob" (wait for reply), "RCPT Carol" (wait for reply), . Later, RFC 1854 (October ...


2

The most common form of SMTP header injection is adding a To:, CC:, or BCC: header to send the email to an unintended recipient. This works with SMTP libraries that take a complete email with headers and parse it to figure out the recipients (most notably, the command-line sendmail invoked with the -t option and some invocations of the PHP mail() function). ...


-2

As Uwe Plonius explained, the article seems wrong in its explanation, however to me the concept remains valid. Instead of the 20 sources cited in this article, I will rely only on one: RFC 821, section 3, defining the mail sending procedure. Two things need to be noted there: Each command must end with a <CRLF>, and not just <LF> as in your ...


3

Simple case: You do not send the email to victim@test.com. The headers of the email are not used by the SMTP server. You add a CC: to the email header but the SMTP server does not read this header. The SMTP server only sees what you transmit with your line smtpserver.sendmail(user, to, msg). Basically the communication is as follows (S: server, C: ...


1

As @Gumbo has said, CRLF are properly encoded with %0d%0a in the resulting URL, as you may see. If it had set headers as you had passed as parameters, you would have seen those headers separately. You may try different encoding instead, like %E5%98%8A%E5%98%8D :) The ability of attacker to construct arbitrary HTTP responses permits a variety of resulting ...


1

If your running linux, there's an XML parser, xmllint. You may use it to parse xml documents, and to expand entity references use --noent option. For example: xmllint --noent xxe.xml And, yes. The file permission does come into play. If you don't have sufficient permission to read the file, you'll encounter an error. For example, assuming you're on a ...


0

Finding SQL injections today it iss very easy, and anyone can do it. There have been many developers and researchers predicting the end of SQL Injection, however, year after year we see it still in the OWASP Top 10. SQL injection is everywhere and lack of education or knowledge (or maybe bad habits) how to write secure code is a problem. For example in ...


0

It depends on what platform an application is built on. I don't think that Drupal or Wordpress will be a mature developer's choice of tool to design an App. And you as an experienced software engineer in your analysis probably don't face low quality applications like that. I don't want to say that if one uses Wordpress he will get an SQL injection or XSS ...


4

I am not sure what exactly is meant by a modern application. Yes, many frameworks, ORMs, Entity Framework, etc. decompose queries and may apply some default filtering. However, in more complex scenarios that require custom coding, or where the ORM or library functions won't do exactly what you want, you will open up the door to SQL injection or other ...


2

Many applications have grown over the years. Unless the code is refactored once in a while to reflect current best practices (i. e., in case of SQL injections: parameterization), many applications contain quite much legacy code that hasn’t been touched in years. And chances are that it won’t be touched as other parts depend on it. Refactoring costs time and ...


2

Now, is this the case for other security enthusiasts? In my experiences, No - SQL injection is still prevalent. I perform on average 30-50 web application assessments per quarter and I can vouch that SQL injection is still an issue with modern applications. With that being said my assessments are approximately 85% automated with 15% manual followup / ...


0

The classic, old-school 'or 1=1 # SQL injections are long gone; but sophisticated ones will creep up once in while. That's one way that TrustWaves makes money by keeping its ModSecurity rulesets updated. Most modern web apps go through a 'security deployment checklist' and are usually also tested for known vulnerabilities before production deployment. ...


4

SQL injection is definitely not something I would skip over when testing for security. According to the Ponemon Institute Breach Report, SQL injection accounts for 30% of malicious or criminal breaches, the most of any attack vector that resulted in a breach. My company uses a variety of methods to find SQL injection vulnerabilities in our proprietary ...


18

Actually according to OWASP, SQL Injection is on top of the top 10 Vulnerabilities through Web applications. https://www.owasp.org/index.php/Top_10_2013-Top_10 and there are many papers, article, news about concerns in this subject and every day there is a news about SQL injection attack against famous web applications such as for example Joomla,Wordpress ...


3

OWASP has some information about how to fins SQL inhections, as to not beeing present. A recent Drupal SQL injection shows that that is simply not true (even in a mature environment as Drupal.) The way you find these things is often simply employing fuzzers and sending random garbage to the web app.



Top 50 recent answers are included