2,986 reputation
1029
bio website software-talk.org
location Germany
age 28
visits member for 3 years, 1 month
seen 14 hours ago

-.-


May
20
comment Preventing reflected XSS in URL
possible duplicate of How to prevent XSS from url. See also this general question about what is xss, and this xss prevention cheat sheet (to summarize: html encode user input, except for some locations where you shouldn't put it at all).
May
15
comment SQL Injection explain this query
I can't flag it as a duplicate again, but Error-based SQL injection is an exact duplicate of this question.
May
15
comment SQL Injection explain this query
@AbeMiessler You are probably right. Normally, I'm careful what I flag, but here I might have jumped the gun a bit. The question also got improved a bit already, and I still think it could be improved further (what CONCAT does seems trivial, but eg why is there FLOOR(rand(0)*2) in addition to having min might be an interesting question).
May
15
comment SQL Injection explain this query
possible duplicate of What is SQL injection?
May
11
comment Store password using sha1
possible duplicate of How to securely hash passwords? and/or Is it a good idea to use the user's username as a salt when hashing a password like hash(username_str + password_str)?
Apr
30
comment Are these access.log entries successful wordpress login attempts?
and regarding @JanDoggen point, you will probably get a lot of hits for 200 /wp-admin/, so you would need to filter out your ip address (or possibly user agent, if it's unique enough) and maybe remove all duplicate entries with the same ip address for easier readability.
Apr
30
comment Are these access.log entries successful wordpress login attempts?
@user4668401 you could add code to log successful logins. You could also look in your apache log for 200 repsonses to /wp-admin/, as only logged in users get those, others get a 302 (I didn't check if non-logged in users can somehow also generate 200, but it's not the default). But this assumes that the attacker actually followed the redirect from the login (which probably doesn't happen when they use a bruteforce tool, only when they use the bruteforced credentials).
Apr
30
answered Are these access.log entries successful wordpress login attempts?
Apr
29
reviewed Approve PTES: Diferences between Internet Footprint, OSINT and footprinting
Apr
27
awarded  Enlightened
Apr
27
awarded  Nice Answer
Apr
26
answered Should password reset tokens be hashed when stored in a database?
Apr
26
revised Bypassing XSS filter
added 780 characters in body
Apr
26
awarded  Cleanup
Apr
26
revised Bypassing XSS filter
rolled back to a previous revision
Apr
26
revised Bypassing XSS filter
added 749 characters in body
Apr
26
comment Bypassing XSS filter
@user2650277 that behavior doesn't really match your description, and at this point we would have to guess as to what the filter actually is. It would be a lot easier if you could post the actual code.
Apr
25
answered Bypassing XSS filter
Apr
25
awarded  Civic Duty
Apr
25
comment How to make my PHP website vulnerable to SQL injection
It would be helpful if you added more context to your question (otherwise it's a duplicate of the more general "what's SQL injection" question). What is your code? You say one attack worked: What does that attack look like? And what does the attack look like which doesn't work?