Tag Info

New answers tagged

1

There are cases of SQL Injections leveraging the implicit conversion of Unicode homoglyphs from Unicode character string types (NCHAR, NVARCHAR) to character string types (CHAR, VARCHAR). A character such as ΚΌ (U+02BC) in NVARCHAR may slip through the escaping routine and get translated to ' (U+0027) in VARCHAR, which may result in an SQL Injection when such ...


2

Please, please, please, please do not use a handmade regex for preventing SQL injection. You should never be writing your own escaping, filtering, or sanitizing functions to prevent SQL injection, XSS, shell injection or the like. These are things you rely on built in and vetted libraries for. Where you can avoid it, don't even use a standard library ...


2

If you're looking at how unicode can be exploited, see this question, if you're looking for a solution, there are really only two that can be considered really secure: parameterized queries and encoding all of your input into hex or base64 or some other encoding that doesn't leave open the possibility changing the context of the value. I would seriously ...


2

The one thing you need most to stop SQL injection is a semi-colon (;). However, it isn't always simple to just eliminate them. You will have situations where a semi-colon is used in a text field as a character, not as a SQL command terminator. There are plenty of articles that go into detail about how to both inject and prevent SQL in your queries. ...


8

Here is an example of a PHP mail-generating script that is vulnerable to a CRLF-injection attack. In essence, the problematic code was: $email=$_POST['email']; $headers="From: {$email}\r\nReply-To: {$email}"; //create headers mail('opps@example.com',$subject,$content,$headers); //mails it In that case, a poorly designed PHP API was difficult to use ...


11

Depending on how your application creates the actual RAW email request, it may be possible to insert line feeds to modify the recipients, CC, BCC etc. Check out this example: In this context, the target is to be able to send anonymous emails to other recipients. There are numerous additional fields that can be specified in the mail headers (see [ ...


1

While you may never run the code locally on your server, it may be possible to upload malicious JavaScript code. Then the attacker can point to your site when he needs to reference the code in other attacks (e.g., XSS). There may also be rare situations where PHP or other server side code may be consumed from this image. There may be misconfigurations in ...


-1

I'm not aware of any risks to a server from images with malicious embedded code, but Internet Explorer has a well-known "feature" where it will ignore a file's extension and MIME type, and instead analyze the file to figure out what type it is. Images with embedded HTML will be treated as web pages, and can be used to execute an attack on IE.


-1

In order to manipulate the EXIF JPEG metadata fields, I will use the command line jhead tool. There exist many other tools out there with similar functionality to choose for your needs. Now that we have our metadata manipulation tool lets pick up a random jpeg image and read the metadata. root@testbed:~# jhead image.jpg File name : image.jpg File size ...


-3

in law it is: in dubio pro reo, in it sec it's: in dobio pro h4x0r, /me thinx. i remember some attacks using this method, but i cant recall the apps beeing used. are you 100% sure the attacker has no way to execute this code? if the target is not you, but your visitiors, then an attacker might hide malicious stuff that doesnt harm you, but your visitors; i ...



Top 50 recent answers are included