meta user
network profile
| bio | website | |
|---|---|---|
| location | ||
| age | ||
| visits | member for | 11 months |
| seen | 11 hours ago | |
| stats | profile views | 22 |
|
Feb 21 |
comment |
My site just got hit with a SQL injection attack, how can I tell what they were doing? @joshg did you check if your mysql user has the FILE privilege? If it isn't enabled, the chance of full server compromise is very low. |
|
Jan 13 |
comment |
UNION SQL Injection I think you need a space after the double dash. |
|
Nov 22 |
comment |
Public key Infrastructure Signing actually means encrypting the hash of the message with the private key, so yes it's correct. |
|
Nov 10 |
comment |
Can someone figure out the encryption method? @Mike even if you don't have the sources it may be possible to reverse engineer the binaries |
|
Oct 8 |
comment |
sql injection: use WHERE statement in address bar @Siamak.A.M No, but it has a character length limit. See group_concat_max_len |
|
Sep 24 |
comment |
Wheres the salt on the openssl aes encryption? @Polaco Because your computer is little-endian. And od probably just loads the bytes directly into memory so it isn't even aware of the endianess. |
|
Sep 11 |
comment |
Encryption and compression of Data That looks like a question from the coursera cryptography course's exams. |
|
Aug 21 |
comment |
Are there any tools that focus on shellcode analysis? @Polynomial you can disassemble raw blobs using objdump: objdump -mi386 -D -b binary shellcode.bin |
|
Jul 31 |
comment |
Computer decryption algorithms and knowing the solution On block ciphers you can check the padding of the last block. |
|
Jul 23 |
comment |
Find changes and modifications made to system by application or virus, You could try a malware sandbox like cuckoo. |
|
Jul 11 |
comment |
SQL injection explanation Sorry I was replying to @jcubic, there's nothing wrong with your answer. |
|
Jul 11 |
comment |
SQL injection explanation @jcubic, yes mysql can interpret hex literals as strings see Hexadecimal Literals |
|
Jul 11 |
comment |
SQL injection explanation That's not correct. You can put whatever you want in an union when testing the number of columns, as long as it isn't filtered. |
|
Jul 10 |
comment |
Storing password hashes without a correlation to the user account Not to mention all the additional inconveniences, like making your backups grow several GB. Also an attacker could grab the admin salt and insert a new hash in the table. It'd be a completely stealthy backdoor. |
|
Jul 6 |
comment |
Shellcode for higher file privileges Is the stack executable? Have you confirmed the shellcode gets executed (use gdb)? |
|
Jul 6 |
comment |
Knowing Hash Algorithm from Hashed String I don't think so. DES has a 64 bit block size and 56 bit key size. If it were encrypted with DES, it should have a size multiple of 64 bit. |
|
Jul 5 |
comment |
NVidia update service creates local account on system. Does anyone know the users password? Can you dump the password hash from the SAM? |
|
Jul 3 |
comment |
Pcap file inspection What are you exactly looking for? I found a radiohead mp3 being uploaded, it's that what you were looking for? |
|
Jul 2 |
comment |
What user was this spammer trying to authenticate as? With wireshark. I decoded the base64 text, converted it to ascii hex dump and imported it as dummy tcp packet from wireshark. Then I applied the ntlmssp dissector to the dummy packet. |
