New answers tagged

2

I think the scenario you are talking should be called HTML injection. Sometimes, there might be an XSS filter deployed which does not allow any event attribute (the list is huge) as well as script tags. In that case, "getting XSS is hard". Although, blacklists seldom work to prevent XSS.


2

No, I would not call that cross site scripting, since there is no actual scripting involved. But that does not mean it is not a security risk! The correct term for the vulnerability would be "HTML injection", and as you note in your question it can be a dangerous thing. Here's another example, just to show how HTML injection can indeed be used to cause real ...


1

I think that you should do two kind of security measures to prevent injection. 1.Firstly, validate the input data, you should use a white list or black list, think in what is the best way to control your input data, the white list is usually used to validate input data, because it's easier to determine what is the correct format for input data. I recommend ...


1

Php has some escape functions for using user supplied data in commands, escapeshellcmd1 and escapeshellarg2. There are however some limitations when using these functions. If used with a command that has unsafe command line switches. I wrote a detailed blog post about it 3. You should also ensure your imagemagick installation is up to date and configured ...


0

I have done in in a big security product. With VAD walking in kernel mode but also with the help of a feature to detect remote thread. First you detect remote thread to get the memory location. The injected thread will mostly have a start address that is not in any modules loaded by the application. This is not suppose to happen, after that you can go ...



Top 50 recent answers are included