New answers tagged java
You can read the values of cookies using document.cookie or other client side solutions only if that particular cookie is not flagged as HttpOnly (assuming the browser you're using supports this flag).
There's apparently a remover hosted by the author of jRAT at https://github.com/redpois0n/. I recommend reading the sources and cleaning up yourself rather than running untrusted code though :-) No idea. It could be that it redefined your ls function, but you would normally require a reload of the environment to have the new ls taken into account. Was that ...
Well I can answer my own question now, at least in part. The application I was examining has a default instance of XmlPullParser with only FEATURE_PROCESS_NAMESPACES disabled. I was able to get the Billion Laughs entity attack to work. My issue what I was not putting the entity in the right child element of the expected XML response.
In MySQL: SET GLOBAL general_log = 'ON'; With following Query you can check, where the data is logged, and if the logging is enabled: SHOW VARIABLES LIKE '%general_log%';
Ok, I figured it out. Since the application send local query to local database, in order to capture these queries I should capture lo packets with tcpdump: # tcpdump -xx -i lo This works perfectly.
You can use Jet Profiler for catch your querys and is a cross-platform program and you can download a free version.
This is very difficult to answer, as no one here does know how your application is built. As long as you are not executing (either directly or indirectly) any system commands your application should be save. There is only a risk when you execute commands (either directly or indirectly) in the shell out of your application. This risk is very high if you ...
Ok, so if a hacker gets into your system you want prevent him to seeing the configs? By the logic, IMO this is not possible. The application needs to read the config and it needs to store the config values in the memory. The hacker with root privileges can always dump the memory and reconstruct the config (if the application is running). However, you can ...
Top 50 recent answers are included