Tag Info

New answers tagged

0

POODLE is a vulnerability in the SSLv3 protocol, specifically in how it handles padding for block ciphers (RC4, being a stream cipher, isn't vulnerable, but it has its own weaknesses). Do the client and server talk to each other using SSLv3? Can a man-in-the-middle attacker coerce them into talking using SSLv3? If the answer to either of the above ...


0

So basically, the server will generate a key-pair for each user that signs up. It will give the user the private key, and keep the public key to encrypt anything that it receives for the user. When information is sent to the server (in plaintext) for the user to obtain, the server will encrypt the data with the public key, and when the information is ...


2

You can read the values of cookies using document.cookie or other client side solutions only if that particular cookie is not flagged as HttpOnly (assuming the browser you're using supports this flag).


0

There's apparently a remover hosted by the author of jRAT at https://github.com/redpois0n/. I recommend reading the sources and cleaning up yourself rather than running untrusted code though :-) No idea. It could be that it redefined your ls function, but you would normally require a reload of the environment to have the new ls taken into account. Was that ...


0

Well I can answer my own question now, at least in part. The application I was examining has a default instance of XmlPullParser with only FEATURE_PROCESS_NAMESPACES disabled. I was able to get the Billion Laughs entity attack to work. My issue what I was not putting the entity in the right child element of the expected XML response.


0

In MySQL: SET GLOBAL general_log = 'ON'; With following Query you can check, where the data is logged, and if the logging is enabled: SHOW VARIABLES LIKE '%general_log%';


1

Ok, I figured it out. Since the application send local query to local database, in order to capture these queries I should capture lo packets with tcpdump: # tcpdump -xx -i lo This works perfectly.


0

You can use Jet Profiler for catch your querys and is a cross-platform program and you can download a free version.


0

This is very difficult to answer, as no one here does know how your application is built. As long as you are not executing (either directly or indirectly) any system commands your application should be save. There is only a risk when you execute commands (either directly or indirectly) in the shell out of your application. This risk is very high if you ...



Top 50 recent answers are included