Tag Info

New answers tagged

2

In this particular example there's very little you could do, even if you hadn't magic_quotes. That's because a SQL injection normally can only add to the query string. Since the string is an INSERT command, you can only INSERT something. In theory, if the SQL server behind supported "chained commands", you could transform a command in two: INSERT INTO ... ...


1

That SQL injection don’t work on your server may be due to magic quotes, which escape certain characters in incoming data with backslash escape sequences: […] all ' (single-quote), " (double quote), \ (backslash) and NULL characters are escaped with a backslash automatically. This is identical to what addslashes() does. These are exactly the characters ...


1

Further to Kevin Li's answer, testing your session IDs for randomness is covered here: How to test session identifier strength with OWASP WebScarab You need to request loads of session tokens and perform a statistical analysis on them to determine if they appear to exhibit the desired level of randomness. 10^4 session IDs would be a good minimal starting ...


1

You can't actually determine how random a number is, because it's the nature of randomness. However, if you had a series of values, you could perform statistical randomness tests on the values and possibly find patterns/weaknesses in the random number generator. Certain patterns may give away what random generator was used. But even supposing the numbers ...


8

The bug only affects TLS connections that enable Heartbeats, not other parts of OpenSSL. Unaffected parts include key generation, certificate signing, generating digests, random bytes generation, etc. Also, in no way can a certificate be "infected" by this bug such that it carries a risk to other components. For example, certificates generated by OpenSSL ...


1

I agree that the plugins and themes can be problematic, but want to add three more suggestions relating to the use of plugins: You should make sure you're running the latest version of WordPress AND plugins. Go through your plugins and delete anything you really don't need. Try and replace plugins with code wherever possible. Be more choosy about ...


2

If you're trying to protect data-in-transit between two servers, please just use SSL/TLS certificates instead of rolling a new encryption scheme. Note that SSL/TLS technically uses symmetric encryption as well, but the shared session keys are encrypted with asymmetric keys during the initial exchange (hence the need for certificates). One of the huge ...


3

I wouldn't say that the root cause of the problem is Wordpress, but rather the fact that: There is so many themes/plugins for Wordpress available from 3rd party developers, and people usually don't audit them before installing them. Since the entry barrier for PHP is very low, a lot of those 3rd party developers have no/poor IT security knowledge I think ...


1

I might be not as good in explaining the concept of an hash collision as good as this external doc so if it becomes not clear you can have a look at it. In principle the POST and GET data is using a key-value structure. When receiving the data in a request and when accessing $_POST then php will need to convert the list given as a string which could look ...


0

Zend Framework offers an Escaper component to escape output and defend from XSS Symfony provides an automatic output escaping feature CakePHP before version 2.4 provided a sanitization class I recommend you the following lectures for further information: Secure Application Development with Zend framework


0

These kind of scans are more or less normal nowadays. I sometimes get dozens of them a day. Just make sure your server is hardened, especially the php installation. If you want to be on the safe side you may want to use a web application firewall like http://www.modsecurity.org/


2

Since I use php as an Apache module instead of CGI, and the http code was 404, I think nothing bad happened, right? right What was the attacker trying to do (or, if he was successful, what did he do) to my system? it was probably the first stage in a multi-stage-attacke(script); this is just the first scan, if you system is vulnerable or not.


0

Based on existing comments, answers, and some more elaboration from you, I'd say your scenario is something that Microsoft tried to create a solution to with Next-Generation Secure Computing Base (NGSCB) which was also formerly known as Palladium. Without encrypting everything (code, memory, data in the processor, data traveling on the bus, data moving ...


0

I know I am three years late to the party, but I like to point out something I missed in the answers for those finding this in Google. Most "leaks" from hacked websites are the result of SQL Injection, and much less from a root-ed server where the hacker has full access to the raw database files. SQL injection is an attack technique where the hacker can ...


3

What is the best method for securing PHP scripts that contain database passwords? One common approach is to put these sort of details into an own file, which is not directly accessible through the webserver, e.g. something like a config directory outside the webserver's document root. You can always include this file whereever it is needed. If for ...


0

Private exploits exist for many famous software out there, and the fact that a software is open-source, popular or many years old doesn't change a thing. A vanilla Wordpress installation without additional modules is less likely to be exposed, but again, it is very possible that exploits exist for it. Now, the question is more: does your friend have the ...


-2

First of all he's a script kiddie since WordPress isn't a webapp launched yesterday. The whole community is working to make it better. Now the only point is that WordPress sites get compromised because of misconfigured servers wherein an attackers might be able to carry out a SymLink Attack and then take it down.


1

While you may never run the code locally on your server, it may be possible to upload malicious JavaScript code. Then the attacker can point to your site when he needs to reference the code in other attacks (e.g., XSS). There may also be rare situations where PHP or other server side code may be consumed from this image. There may be misconfigurations in ...


0

see if the below code provides a fairly significant level of security It's difficult to give suggestions when it's not clear what kind of attacks you're trying to protect against. My answer is that these settings would be annoying. $_SERVER['HTTP_REFERER'] !== "http://server.com/somePage.php" This would prevent people from bookmarking your ...


-1

I'm not aware of any risks to a server from images with malicious embedded code, but Internet Explorer has a well-known "feature" where it will ignore a file's extension and MIME type, and instead analyze the file to figure out what type it is. Images with embedded HTML will be treated as web pages, and can be used to execute an attack on IE.


-1

In order to manipulate the EXIF JPEG metadata fields, I will use the command line jhead tool. There exist many other tools out there with similar functionality to choose for your needs. Now that we have our metadata manipulation tool lets pick up a random jpeg image and read the metadata. root@testbed:~# jhead image.jpg File name : image.jpg File size ...


-3

in law it is: in dubio pro reo, in it sec it's: in dobio pro h4x0r, /me thinx. i remember some attacks using this method, but i cant recall the apps beeing used. are you 100% sure the attacker has no way to execute this code? if the target is not you, but your visitiors, then an attacker might hide malicious stuff that doesnt harm you, but your visitors; i ...


2

Like Lucas Kauffman said: Please use sessions for this. Everything stored in the $_SESSION array is neither sent nor visible to the user.



Top 50 recent answers are included