Tag Info

New answers tagged


Its possible to use tcpdump to read localhost-localhost traffic so I would also consider other programs running locally as posibly capable of intercepting the traffic your going to encript.


Load the vulnerable url with phantomjs and detect whether that triggers an alert or not.


I can't look into your problem, as you gave a fake URL for testing XSS. Here's a real URL demonstrating an XSS vulnerabilities: http://www.insecurelabs.org/Task/ Using the first task this is a URL that has an XSS vulnerability: http://www.insecurelabs.org/Task/Rule1?query=%3Cscript%3Ealert%28%27XSS%27%29%3C%2Fscript%3E Using requests python ...


Any program that, at some point, calls bash is affected. In particular the os.system function is vulnerable if the system has bash as /bin/sh, so any program calling it (or some equivalent) is vulnerable too. The popen functions can be vulnerable, depending on the arguments passed. Quoting from the documentation: Also, for each of these variants, on ...


Yes, popen is affected by ShellShock. However, I do not have a comprehensive list to provide you - anything that is backed by a call to /bin/bash (such as a call to /bin/sh which links to /bin/bash - which is assumed in the below quote) is vulnerable. A range of web apps written in PHP, Python, C++ or Java could be vulnerable if they use calls to ...

Top 50 recent answers are included