Hot answers tagged

24

Why does this happen? It's because PHP has loose typing. Take a look at this example: $x = "1e6"; echo strlen($x); // 3 echo $x * 1; // 1 000 000 On the second line, $x is assumed to be a string, and as such is obviously three characters long. On the third line, $x is interpreted as an integer, or 1 000 000 in this case. Is it a problem? This can ...


12

Strictly speaking? No, by itself it isn't a vulnerability. But it does suggest there's potentially a problem that needs further investigation. This is one of the inherent problems with pen testing. You find something ambiguous like this, and don't know if it's exploitable. To even start to find out if this is a vulnerability, you need to understand what ...


8

Are there any caveats to this approach? (security-wise) Yeah, it's not very thorough, you can get a new instance of the constructor from a new window object instead: XMLHttpRequest = null; var iframe = document.createElement('iframe'); iframe.style.display = 'none'; // optional document.body.appendChild(iframe); var XHR = iframe.contentWindow....


6

Unless the site now has access controls on the URLs (requiring that you first authenticate - prove your identity - and then that the server checks whether your identity is authorized to view that URL), no, it is not safe. Obvious problems include people sharing links through a site like this (without redacting the domain), browsers remembering the URL in ...


6

I recommend you to log user id and IP each time someone authenticate. That way, if a user post something, you know where it came from. Having a log like that is also useful for other purposes, like notifying the user in case you identify multiple IPs are connected at the same time, block consecutive attempts, etc. But for your specific example, I think you ...


5

There are a lot of ways. Judging by the main features of your website, an attacker could have used: SQL injection: it is not necessary to have direct access to the database. If you want technical details, this question and its answers explain different ways to obtain a shell from a SQL injection; credential theft: the attacker could have stolen or ...


4

It's a false positive. In both cases, the scanner only searched for "root:", assuming it is part of a passwd file. The line that is found is: root:function(a){return a===o} This is obviously not from a passwd file. It is also very unlikely that any server-side vulnerability exists in a request for a jQuery file, generally they are static files that are ...


4

I need to application 1 make a POST on application 2, but on application 2 I need to make sure that POST comes from the application 1. For the purpose of this post, I'm going to call application 1 the Client, and application 2 is the Server. Let's start with: My biggest worry is Man In The Middle attack. Ensure that when the Client makes a ...


4

Because they are already aware of the issue. This is evident of them making a mention on the exclusion list. Not mentioning it would likely lead to a lot of users pointing it out. And since they are aware you might be wondering why they won't fix it. There really isn't a way to prevent it. If they restrict an email to one sign up they will have to inform ...


4

(tl;dr at bottom) Encryption is essentially free at this point, even on dial-up connections. Almost every major language has it built-in, or has a library for it, etc. The advantage of not using TLS/SSL is a very small fraction of a second start-up time, a very negligible reduction in CPU usage (a small fraction of a percent), and about 4kb of bandwidth ...


4

That type of approach does drastically reduce the scraping because it makes it much more complex to do. Note that there is no ideal way to block it completely since they want the information to be available to the other users. With OCR systems, even placing it as an image is still far from perfect.


4

Is SSL/TSL and HttpOnly enough to be sure that a session cannot be hijacked? Those are the must dos, and they offer good (but not perfect) protection. See question four. Is there a way to use client IP addresses as an extra layer of protection? Just checking that a session ID is used by the IP that created it will break your site for a lot of users, ...


4

This does not look exploitable to me. The only user input here is the location variable. However, it is only used to check if the protocol is HTTPS or not and then change the URL of the included script accordingly. There is no way to sneak any parts of the URL, like a query parameter, into g.src. Also note how it is constructed through concatenating hard ...


4

I think the term HTTP parameter pollution would be the best fit. This type of pollution usually submits the same parameter multiple times with different values in the same request. This results in the parameter being treated as an array of values with the parameter name as the array name as described in this article. The way the web server and programming ...


4

Due to architectural necessity, Web Application Firewalls (WAFs) protect against attacks at other layers as well. However, these protections are largely incidental and not comprehensive. Let me illustrate this with some examples: Presentation Layer - let's assume that the application to be protected uses TLS. If so, the WAF device must by definition* ...


3

Theoretically it is possible, but it takes a lot of skill and effort - much more than it is worth. The captchas are created to be hard for machines, and easy for humans. This is the perpetual arms race between spammers and webmasters. It's easier to have a human verify the captcha's for this hypothetical bot network. Gaining rep by fake posts is difficult, ...


3

This is not necessarily directly a security measure. I don't know why this design was made, but I do see an obvious advantage to hiding sensitive information behind an extra click: a non-malicious scraper — such as a search engine — won't include it. So when the listing is gone, so is the private information. If the information was easy to scrape, it could ...


3

Generally in these types of situations, you want to spawn a child process for the shell, or migrate to another process(only possible in windows). You can check out one way of doing this in the Metasploit module for process migration in windows: https://github.com/rapid7/metasploit-framework/blob/master/modules/post/windows/manage/migrate.rb A more general ...


3

Thanks to comments from @Anders (thx!), I'm unsure if the password generator is a shared service or a personal authentication token like digipass or SecureID. Password generator is a shared service In this situation, Alice can only get the signed response H(R,K) by proving to the password generator that she is Alice by presenting her PIN. If Alice knew K, ...


3

Depends how you set it up. If you allow Cross Origin Requests from any domain, then an attacker who finds the image URLs can do anything you can do within your Javascript application - the security is exactly the same as what you have. If you restrict the requests to your specific application server, they shouldn't be able to do anything, just as you can't ...


3

This is the job of a host-based firewall. While IP based rules are so integral to the system that the built~in GNU/Linux Firewall is named Iptables and the basic slement of a firewall is a list of rules (called a chain) that could easily handle whatever packets of the type you describe that aren't handled back at the hardware router/firewall ip layer, I have ...


3

If it is a secure CAPTCHA, the AJAX message will send the user's input to a server. The server will validate the input and return a token. The token will then be inserted into the form by the Javascript. When the form is submitted, the server will validate the token with the CAPTCHA service (this could be a web service call or signature validation). So the ...


3

No, JQuery is a client-side technology, which is really a wrapper for JavaScript for use within a web-browser only JavaScript doesn't have the capability to run OS commands when invoked by a browser, unless security settings are lowered within Internet Explorer. And JQuery cannot provide any additional functionality that circumvents this. This appears to ...


3

Where exactly does the problem exist ? Nowhere. There is no problem. With ping you are working only at the network layer and on this layer there is no such thing as a hostname, there are only IP addresses. And crashsafari.com has the same IP address as s3-website-us-east-1.amazonaws.com because this is just an alias (DNS CNAME): $ dig crashsafari.com ......


3

This sounds very much like your server was compromised, and someone is using it to spread malware with the help of drive by downloads. Consider taking your site offline, as it might be infecting your visitors with malware. To make sure that this is actually the case, I would recommend the following: Ask the person responsible for the site if she knows ...


3

In fact I'm trying to understand what's the standard way for doing that. On a properly configured web server, the web server will log all received requests in a log file (the exact content of this log file is usually more or less configurable, depending on the server software used). There are also standard means to centralize the logs if you want to like ...


3

Try to figure out what software is being used. Most applications have a default admin location (eg WordPress has multiple paths which work: wp-admin, admin, login, wp-login.php). Check if the login page is linked from the website itself. Try common paths, such as admin, login, etc. Note that access may be restricted by IP, so you may get a 403 or 404 even ...


2

This is a great question! I'm also a developer on a c++ product that handles high sensitivity data, and we face this dilemma almost every day. When a production system starts throwing alarms (especially performance or configuration-related ones, thought misbehaving software / bug ones also apply) we often need stack-trace level debugging turned on ...


2

Even if this would work and you could block JavaScript from performing XMLHttpRequests - which as shown by @Alexander is not the case (ActiveXObject would be another alternative) - it doesn't really limit the dangers of XSS. An attacker still has a number of possibilities: Defacement Phishing: For example, add a login form, which sends the entered data ...


2

Search for uploadify on https://www.exploit-db.com and you will notice that the JS-Script is part of your theme and vulnerable to Arbitrary File Upload Vulnerability. You could delete that Script and your theme might still work or better yet use another more secure theme.



Only top voted, non community-wiki answers of a minimum length are eligible