Reputation
7,658
Top tag
Next privilege 10,000 Rep.
Access moderator tools
Badges
1 23 46
Newest
 passwords
Impact
~112k people reached

Apr
28
comment PHP null byte exploit through cookie
@Jacco but not if the variable already starts with "rpts/" as is the case here, right?
Apr
28
comment PHP null byte exploit through cookie
@DustyBoshoff because it does execute PHP in a given file. But that doesn't apply here, as you can't just give it any file, just files that are already on the server (it would help if you had a file upload functionality on the server).
Apr
22
awarded  passwords
Apr
21
answered Sending server-generated password by email
Apr
21
comment How can I report a new vulnerability to cve.mitre.org such that they assign a CVE ID to it?
The MITRE request a cve info page says to first try to contact the other CNAs and only ask MITRE directly if that is not possible. Looking at the response time and rate of MITRE, this also makes sense (I'm not sure if all the CNAs are better, but I would imagine that they receive a lot less requests).
Apr
21
revised How can I report a new vulnerability to cve.mitre.org such that they assign a CVE ID to it?
added 649 characters in body
Apr
21
answered How can I report a new vulnerability to cve.mitre.org such that they assign a CVE ID to it?
Apr
20
comment XSS between tags when only < and > are encoded?
I would say no, it's not possible (maybe in combination with other vulnerabilities, eg the encoding issue Polynomial mentioned, but I would say that that is very limited). But when you say "With that said, if I place an apostophe as the value, nothing is shown" it seems that the encoding of < and > isn't the only thing happening. You need to figure out what is actually happening to bypass it.
Apr
20
comment XSS between tags when only < and > are encoded?
@Polynomial do you have any references or examples for your character encoding example? I can't really imagine one that doesn't exploit other bugs (such as user input inside meta tags (which itself can lead to XSS) or header splitting (which also may lead to XSS itself)). If this actually is a problem, I'm not sure how to defend against it. The recommended approach - HTML encoding - doesn't work anymore, and filtering is the weaker option. Encoding aware filtering is even more complex than other filtering, so I don't really see it as a viable option.
Apr
20
comment Bypass char filtering - security shephard
@puzzlepalace your first example doesn't really make sense. i is substituted for ., but not the other way around, so why would <scr.pt> become <script>?
Apr
20
answered Bypass char filtering - security shephard
Apr
18
comment Is a HTML form tag more exploitable than a HTML link in user submitted content?
@IsmaelMiguel good point. I didn't mention it, because I assumed that the filter OP uses filters for protocols, but it's always good to mention this explicitly.
Apr
18
answered Is a HTML form tag more exploitable than a HTML link in user submitted content?
Apr
17
awarded  Reviewer
Apr
17
reviewed Leave Open Do software companies intentionally upload fake/infected versions of their own software to file sharing networks as a means to combat piracy?
Apr
17
reviewed Leave Open Why would I sign my git commits with a GPG key when I already use an SSH key to authenticate myself when I push?
Apr
17
reviewed Close Exploiting C99 VLAs to cause stack overflow
Apr
17
reviewed Leave Open Security Protocols for a Blog
Apr
17
reviewed Leave Open Avast AV could read Firefox saved passwords
Apr
16
comment Is it possible for XSS to occur in src attribute?
To get good answers, you should clarify your question. It is currently completely unclear where the user input is. Is the string importjavascript.js user controlled? Or the content (or part of the content) of that script? Or is nothing user controlled, and you are worried that someone might still change the script?