Tag Info

New answers tagged

1

Any software needs to be maintained. Honeypots are no exception. Because honeypots are designed to be probed and hacked, they need to be placed in a separate and secured environment with the understanding that they may be completely overtaken. Make sure the servers that honeypots are running on are part of your regular patch management process, and make ...


3

They're just as vulnerable as any other software would be to a vulnerability, so to your specific question it would be just as vulnerable. Remember though that in the case of shellshock the honeypot would have to be passing input to a bash shell to be vulnerable. Of course, is another component on the system is vulnerable, the honeypot could still be ...


2

No, you are missing something. SQL injection can be done on any field that a user can possibly alter. This not only includes your username and your password field, but also any hidden fields that may be stored on the website and passed in to the server (as the user can alter their webpage contents). If the value is coming from the user's computer in any ...


1

First off, you should not be rolling your own SQL Injection filter. The idea of doing this has been covered at length in the security community and the consensus is that it is almost never a good idea. My question is all we actually have to filter is the input the user/attacker tries to input in the userID field right? Not really (but maybe). Why ...


0

Not sure if i understood it correctly but here is what i think. As long as you are using parameterized queries you should be safe in your case. Avoid relying solely on filters as these can be bypassed. But if you are going to use filters, special character you are allowing will cause filtering limitations as well. In such your case You can filter usernames ...


1

As DarkLighting said in comments, the mysql schema is always available because it's part of the installation, just as information_schema. If a user can't see the mysql DB, it means he has no privileges. Likely he has the privilege USAGE. So in order to be able to get the users' credentials, first the attacker should leverage some privilege escalation ...


6

I don't think it will open you up to SQL Injection. That said - while I am not an expert on Prestashop or it's code base, I got the impression that the sanitize function you linked to is not just used to prevent SQL Injection, but multiple kinds of vulnerabilities (notice the call to strip_tags on line 102). If this is true you should be careful that you ...



Top 50 recent answers are included