Tag Info

Hot answers tagged

191

Hacks that work just by changing the URL One legit and one malicious example Some examples require URL encoding to work (usually done automatically by browser) SQL Injection code: $username = $_POST['username']; $pw = $_GET['password']; mysql_query("SELECT * FROM userTable WHERE username = $username AND password = $pw"); exploit (logs in as ...


24

The (currently) most common way in is through holes in PHP applications. There are dozens of ways in which this could work, but here's a simple, easy one: Imagine the unsuspecting site owner decides to take a shortcut in his code such that http://example.com/site.php?module=xyz actually first loads some template shell and then run "xyz.php" to fill in the ...


23

You might have guessed this, but never use the terminals pasting functionality to paste things into vim/emacs. It's like sending a batch of commands to the editor, that can do anything. For these reasons, editors have their own copy-pasting functionality, which cannot be injected. For instance, in vim, you should use the + register to exchange data with the ...


21

"Exploiting" an application means making it do, with the privileges under which it is running, some things that it was not meant to do. passwd runs as root because it needs to read and modify files (in particular /etc/shadow) that can be read and written only by root. The normal behavior of passwd is to alter the password of the user who runs it (passwd is ...


13

This is a poorly phrased question. For instance, it does not define what is meant by "secure". That makes it harder to provide a useful answer. Here are three possible security concerns, and how X11 fares: Isolation between apps. X11 does not isolate apps from each other. If one app is malicious, it can grab all keystrokes, tamper with other apps ...


12

The first point I'd make is that the number of hits on a given vulnerability/exploit db is not a reliable indicator of overall security. This could largely be defined by other factors such as the focus of security researcher's efforts or disclosure policies. Even a quick read over the project websites provides an indicator of the likely comparative security ...


12

When you copy a file to a different filesystem, what's going on under the hood is that a you create a new file and copy the contents. Moving a file to a different filesystem is done by copying then removing the source. So you have no more privileges when copying a file than at any other time you're creating a file. When you create a file, it belongs to you. ...


12

The MySQL root user is an account inside the database only. It is called root because it is the most privileged user on the database server, and has access to everything. The root user on Linux (or any other Unix) is a completely separate thing. The maximum privilege that a MySQL user can have is equal to the privilege that the MySQL daemon runs at. On most ...


12

Well, it turns out that my current approach to clipboarding is good at mitigating this. When copy pasting snippets between tabs, I just copy paste normally. However, when copy pasting into a terminal/PuTTY session, I (being a bit averse to editing the text in the terminal), usually assemble it in Notepad++ or Emacs (depending on OS) and then copy-paste ...


11

Regardless of whether this should apply specifically to Unix, I would say that it is not safe to assume no access just because there are no open ports. To wit, ICMP is usually listened to, even if no TCP or UDP ports are available. And before you say, "But ICMP is just a simple Ping! It's irrelevant to attack using that!" check these out: Ping of Death ...


11

Very frightening! As a risk, this should be raised to the board - effectively an attacker on the internet only needs to find out that username and password (or an SSH 0-day) and your entire corporate network should be considered compromised. Could the business run without it? Is there anything sensitive on it? This is a bad idea in so many ways: It ...


11

There are 2 ways of looking at it, you could focus on the server itself, or focus on the web application that the server is running. As a server, it can have open ports running services that you can connect to and gain access to the server. By using known exploits, you could gain root access. For example, some FTP servers for Unix have vulnerabilities that ...


10

@rook : you should run a diff on the two kernels, after all those years (17 since the split) of divergence there isn't that much that is still common, however there is still cross-breeding between projects and a really good idea will spread all around. OpenBSD got way more in the way of security architecture, as in compiler support to prevent buffer ...


9

If someone has physical access to the machine they can modify these files to create a new root account or crack existing password hashes which is useful due to the prevalence of password reuse. Renaming or changing the location would be "(in)security though obscurity" and will provide no appreciable protection against this attack pattern. Steps to protect ...


9

To answer my own question: It seems that some systems are, or rather were indeed insecure, leaking environment information to other processes. A similar issue to the present one is raised on github by user 'mitchblank' for the 'mosh' application (mobile shell). The author writes: Background: in the process image argv[] and envp[] are stored in the same ...


8

What type of attacks are there that do not use open TCP or open UDP ports? This is way too general of a question. I'm answering this very literally, not to be a jerk, but because in security it's best to assume nothing. Here are some classes of attacks that do not use open TCP or UDP ports: Social engineering: get someone to connect outbound from the ...


8

It all comes down to the threat model. It depends on the risks and the likelihood of an attack. It depends on what the workstation does. It depends on the clients involved. How is this any different from running SSH on an actual server? If the service account doesn't have permissions to do much then the attack can't get very far. If the service account ...


8

One method which I have seen used: split the password. This was for SSH access to a sensitive server: a number of SSH keys were created, and marked as "authorized" on the server. Each private key was protected with a long passphrase, and every user knew only one half of the passphrase. That's crude but effective as long as there are not too many ...


8

I could claim that any copy&paste of code snippets is a bad habit, but that's side-stepping the issue. I personally type such code elements instead of copying them, but that's because I usually want to change some things in them, or learn how to do the task at hand; or maybe I am just a raving maniac. What you could do is to automatically sanitize ...


8

No, it isn't necessary. With modern (less than 10 year old) hard drives, it is not required to overwrite a disk more than once. There is an often cited paper which says that you need to overwrite data at least 10 times to be sure, but that paper is over 20 years old and thus applies to outdated hard drives. Modern hard drives use much weaker magnetic ...


7

The Short Answer This might not be the right question. A hacker... ...is a social engineer. They are more interested in their interactions with people than their interactions with computers. A hacker would far rather have you hand him your password, than have to brute force it. ...is seeking knowledge... ...and knows that knowledge is power. A hacker ...


6

man chmod #Debian Linux RESTRICTED DELETION FLAG OR STICKY BIT The restricted deletion flag or sticky bit is a single bit, whose interpretation depends on the file type. For directories, it prevents unprivileged users from removing or renaming a file in the directory unless they own the file or the ...


6

I agree the risks should be low, for the reasons @pepe mentions in his answer, but do not believe the solution is "foolproof". A better solution for cleaning media safely may be to run a Live CD without any local storage (no non-volatile storage) or connectivity (network or shared resources) to other systems. In theory, you can reboot the host post-cleaning ...


6

On one hand, it increases the attack surface, on the other it increases manageability. So, it could be a net positive for the risk profile if that's what's being used to manage systems and apply updates. In this particular case, it's just for convenience, and it's on a high risk target. The questions here need to be: Is the risk worth it for the ...


6

The fundamental problem of these classes of attacks is not within TCP or UDP protocols themselves, it is with the requirement of applications to process data from an untrusted (or less trusted) source, and faulty design and/or QA within said applications. If your server is running any applications which process input from a source which does not have the ...


6

getlogin() works by checking a property of stdin. However, a malicious attacker can start your program with stdin redirected to some other user's controlling terminal, and that will fool getlogin(). Don't use getlogin() for security purposes. You'll want to look at getuid(), geteuid(), getpwuid(), and similar methods.


6

The first problem is that it's not threadsafe, and the string buffer that is used doesn't contain a trustworthy value; i.e., you can't be sure the value you get back is any good. US-CERT goes into some detail. The results of getlogin() should not be trusted. The getlogin() function returns a pointer to a string that contains the name of the user ...


6

environ is a pointer to pointer, as it has the type char **environ. You have to try something like: (gdb) x/s *((char **)environ) 0xbffff688: "SSH_AGENT_PID=2107" (gdb) x/s *((char **)environ+1) 0xbffff69b: "SHELL=/bin/bash"


6

Netcat does not support IP-spoofing. Also, when there is one or more routers in between, the odds that IP-spoofing will be working is zero. When using 192.168.1.x and 192.168.0.y having a router in between is very likely. Also 7.7.7.7 is a publicly assigned address. You cannot use it for your own. If you want to experiment with other IP-addresses, use ...


6

SETUID means that the executable can run under different permissions than the user who has executed it. Certain applications are set like this so the users can run with low permissions but a specific application they need to run with higher permissions can be. SETUID 0 or root means that when the program is run it is as if root ran it - which leaves you ...



Only top voted, non community-wiki answers of a minimum length are eligible