Tag Info

New answers tagged

0

group_concat is the wrong function. Try this: 'UNION ALL SELECT CONCAT_WS(0x3a,username,password) FROM users-- (note also the order of the arguments. If you want more columns, you can just append them: CONCAT_WS(0x3a,username,password, moreColumns, canBeHere)). This works for MySQL and PostgreSQL. SQL Server doesn't have CONCAT_WS, but it does have ...


0

If the signature parameter is based on user input, it may be possible for a user to insert an & in it and break this functionality. I don't see how this could be exploited, however the best practice is to sanitize the value of parameters affected by user input.


1

The ampersand character is used to separate arguments supplied to the url when multiple argments are used. In your first example the script receives the following arguments signature=xxxxxxxxxxxxxxxxxxxxxxxxxxxx url=http%3A%2F%google.com%2F In your second example the script receives the following arguments: signature=xxxxxxxxxxxxxxxxxxxxxxxxxxxx ...


1

Yes, essentially it is. It is not what it is, but how it was achieved, which is what the hype is about. It is a JavaScript injection attack on a global scale - both in terms of impact and in terms of the technological challenge to make it happen.


1

What the report shows is not the uniqueness of the attack vector, but the systemization of the attack vector as a part of a national defence strategy. GC is an in-path system, capable of not only injecting traffic but also directly suppressing traffic, acting as a full “man-in-the-middle” for targeted flows. ... In addition, in contrast to ...


3

Yes, you are completely open to SQL injection, eg via validUsername' injectionPayload %23, which would give you this query (the # (encoded as %23 cuts of the remaining '): SELECT * FROM users WHERE name='validUsername' injectionPayload #' Into Outfile depending on the rights of the user, you could write content into a file with this payload: -1' UNION ...


4

Have you tried including quotes to break this? From what I see here, it should actually cause a horrible error if a quote is passed in. Sometimes you have to fiddle around a little before the crash happens. $query = mysqli_query($con,"SELECT * FROM users WHERE name='$user'"); Here is my attempt to break this: 'OR 1=1-- It appears you have not used ...


1

To start with, if you can whitelist instead of blacklisting you can save a lot of efforts. You can get a list from ModSecurity, it is not simple to parse on your own but this is probably the most comprehensive you will get publicly.



Top 50 recent answers are included