111 reputation
2
bio website wrongnotes.blogspot.com
location Atlanta, GA
age 39
visits member for 3 years, 9 months
seen Feb 8 at 4:07

Jan
2
comment Can SQL injection lead to remote code execution?
Actually @wireghoul's example exploit is exactly what the op was looking for. Better answer than the accepted answer.
Jan
2
comment Can SQL injection lead to remote code execution?
Interesting exploit thanks for sharing, but it's not the same exploit discussed above. Nothing is using the database to write a file to the database server. In your case it's pulling the php from the log file on the web server. Clever indeed. Just to restate what I said WASN'T implying that separating the database from web server keeps you safe as a general rule just that this exploit discussed in the answer wouldn't work if you did that alone.
Dec
31
comment Can SQL injection lead to remote code execution?
The first part of your comment was exactly what I said. I could change DateTime to MySpecialAttack, but I have to get MySpecialAttack code into a place where the app would load it (ie classpath), but if I could inject something on the class path why would I bother to modify the serialized object? If a serialized class was eval'ing a member I could see why modifying a serialized class might be helpful. But the real weakness is not serialized objects it's the ability for the attacker to add something to your extensions you load. Cut that off and the attacker can't do anything.
Dec
31
comment Can SQL injection lead to remote code execution?
In the serialization case you'd have to modify a pointer to the code, say a class name in the case of Java, to allow for arbitrary code execution. But then you'd have to get your class onto the classpath, and if you could do that then why bother with modifying a serialized object? If you can get something on the classpath you can just execute that code at load time.
Dec
31
comment Can SQL injection lead to remote code execution?
If your database was on another machine separate from your web server then this attack wouldn't be possible. You could create the PHP script but without an accessible PHP container to execute it you couldn't get execute it.
May
20
awarded  Teacher
Sep
24
awarded  Analytical
Jun
7
comment Security implications of storing the password hash along an encrypted AES key
I've re-read Norman's text, and the first bullet point sounds like he IS storing the hashed version of the user's password and it was confirmed in bethlakshmi post. The PKCS#5 standard is only applied to the password used to encrypt the AES key which is derived from the user's password and salt. There are no details about how the user's password is being hashed (algorithm, iterations, etc). I agree bcrypt or scrypt would be a better choice.
Jun
7
answered Security implications of storing the password hash along an encrypted AES key