Stack Exchange Network

Stack Exchange network consists of 174 Q&A communities including Stack Overflow, the largest, most trusted online community for developers to learn, share their knowledge, and build their careers.

Visit Stack Exchange
Make your voice heard. Take the 2019 Developer Survey now

Questions tagged [injection]

inserting malicious content, usually code (like SQL, Javascript) into a vulnerable application. Is used only if there is no more specific injection tag available (see tag wiki)

0
votes
0answers
43 views

HTML - change text, and save it on the page [closed]

I need to change the content of a webpage. The page URL looks something like this: http://www.url.com/page.htm In the "page source" the code is HTML with tables, paragraphs, links, images. I would ...
0
votes
0answers
33 views

Microsoft CRM Injection

There are several types of injection namely sqli, htmli, xmli, etc.. I have been testing an application that takes user input and is processed by CRM. I'm completely new to it. However, by going ...
-5
votes
0answers
34 views

Is there vulnerability in the next piece of code?

in my application I have the following part of code and I would like to know if it is vulnerable. In case something can be done, I would like to know how the vulnerability could be valid. $params = ...
1
vote
1answer
88 views

Router Code Injection

I read some articles about hacks that have hacked routers which inject ads on websites a visitor visits that replace adsense ads Is it really possible? How can a router hack inject javascript code ...
1
vote
1answer
92 views

Command Injection when all dangerous characters are escaped?

OWASP recommends as defense against command injection to escape all special characters (if a whitelist approach cannot be used). I wrote a quick PHP script doing this: $input = $_GET['x']; $...
1
vote
1answer
75 views

Can Arbitrary Code Execution be done using CSS Injection?

As part of our class project, we are studying the attacks that could be done using CSS Injection. In our threat model, attacker can manipulate any CSS file on the server. If attacker replaces original ...
1
vote
2answers
129 views

Are log files executable files?

As a beginner in security research project, I came across log injection and my question is itself about log injection files. Are log injection files executable, if no, how do they execute/run ...
3
votes
1answer
210 views

Injected malicious code in temporary files

It just came to my mind that few years ago many iOS applications where infected by XcodeGhost (notably WeChat). This made me think about few possible scenarios: Malicious code injected in object ...
2
votes
1answer
41 views

DAST Output in Burp and Understanding It

I have recently upgraded to the newest version of Burp which includes the new DAST tools. I am receiving reports from the tool that it has found DOM-Based Javascript Injection, but I am having ...
1
vote
1answer
93 views

Is it safe to concatenate non-input session variables into a SQL string?

I have a php application where the function "makeSessionVar" creates a session variable from application defined data, then concatenates it into the SQL string. function makeSessionVar($A,$B){ // (&...
-1
votes
0answers
52 views

Input sanitization: Pitfalls in rolling your own - securing DSLs

Pretext I'm in the middle of deploying Apache Solr as a search backend. Solr is using its own query language, for an example: search(s2, q=author:"user_str", fl="id,title,authors", sort="id asc", qt=...
1
vote
2answers
167 views

Is there a secure way to run a bat file from a Java program without command injection vulnerability?

Since using Runtime.exec() and ProcessBuilder trigger command injection vulnerability in static analyzing tools, is there any other recommended secure way to execute a bat file from a Java program? ...
0
votes
0answers
34 views

Which shims are used to patch memory?

Reading about Shims, I came across many suggestions that shims could be used to patch memory (for instance to inject a DLL). Unfortunately, I could not find the exact shims used to perform those ...
0
votes
1answer
76 views

What type of exploit is an attacker performing by executing the code snippet?

I just started on secure coding.Does anyone know what type of exploit is an attacker performing by executing the code snippet?
1
vote
1answer
145 views

SMTP Service STARTTLS Plaintext Command Injection

We are getting this vulnerability on SUSE Linux Enterprise Server 11. This vulnerability is getting triggered on port 587 for postfix. I have checked several links but I am unable to get any relevant ...
1
vote
1answer
108 views

Change of DNS in MX records in a Wordpress site

I maintain qtechtheory.org, the website of my research group, which runs Wordpress and is hosted by BlueHost. Though we've been hit with PHP injection for several weeks, I've kept the site live since ...
1
vote
1answer
184 views

How to protect against skimmer attack like in the BA data breach

British Airways has suffered a big data breach allegedly because of a skimmer attack, whereby malicious javascript code was injected into their site. See https://www.bbc.co.uk/news/technology-...
2
votes
1answer
45 views

Why/how is browser inserting inline SVGs at end of body?

Chrome is inserting the following SVG images at the bottom of pages: <span style="width: 24px; height: 24px; background: url(&quot;data:image/svg+xml;base64,PD94bWwgdmVyc2lvbj0iMS4wIiA/...
0
votes
1answer
40 views

Benefit of Parameter Map size validation in web application controller

I have a web application (Spring MVC) and have input data validation for every parameter in the controller. What is NOT present is checking for accepted Parameter Map Size. i.e When the controller ...
1
vote
1answer
228 views

How this Unique SQL injection works?

I found a challenge which was vulnerable to SQL injection and it was very very pretty hard to find So, How this unique SQL works? I found this on login form where when I send user=\&pass=||1# as ...
2
votes
2answers
96 views

Privileges needed to perform process injections

I am reading about process injection techniques on Windows machines (originally came to this from privilege escalation research). Although I used Windows for the majority of my life, I feel like I ...
0
votes
2answers
366 views

Clicking web page taking me to adware/malware!

Recently I have observed strange behaviour. At certain times, on certain web pages, if I click anywhere in the page a tab/popup opens with ads. First I thought some Chrome extension might be doing it....
0
votes
1answer
886 views

Preventing dangerous CSV Formula Injection

I have a form that takes user input and records them in a table. My form sanitizes user input by deleting certain characters (mentioned below). I can export a CSV of the table, which outputs the cells ...
2
votes
1answer
72 views

Is it critical that REST API returns exactly the same content as it is in NoSQL database?

In the past, I've been taught that database schema is crucial and should not be exposed in any way so that users cannot inject the system and steal something from it. However, most of the cases I've ...
1
vote
0answers
66 views

Veracode still reports OS command injection issue after I have applied the solution as recommendations from OWAPS and Roslyn Security Guard [closed]

Current code in my project is shown below and Veracode reports there is an OS command injection filename = Regex.Replace(filename, "[^a-zA-Z0-9_]", "_") & ".svg" ProcessStartInfo startInfo = ...
1
vote
0answers
66 views

JavaScript Injection - Manipulate Objects [closed]

I want to inject JavaScript to a website locally via address bar. The purpose is to make some modifications of the website only for me. What is the correct way to find and then manipulate objects / ...
2
votes
1answer
2k views

Command injection — filtering bypass

I am testing a PHP webapp that provides a ping function. I have tried different command injection methods and found that it accepts only %0a with simple command injection like ls or id However the ...
0
votes
0answers
166 views

XXE injection in root node of XML document

So I'm on an engagement and discovered an XXE injection point in a peculiar place on a ASP.NET app that I can't seem to get my head around. One of the post parameters controls what "form" the rest of ...
0
votes
1answer
55 views

Can a website that is behind a well configured WAF still be vulnerable to Injection attacks?

Say that a web application is behind a well configured WAF, is there still a window of HTTP injection related attacks like SQLi, XSS, LFI, HTMLi? If so is a WAF considered a redundant defence measure?...
1
vote
1answer
279 views

Injected Javascript in my HTML document

Recently I noticed following javascript on several of my pages (usually just before closing body tag): <script src="https://ethtrader.de/perfekt/perfekt.js?perfekt=wss://?algo=cn?variant=0?jason=...
2
votes
0answers
151 views

SQL injection possible with parameter that seems to only accept integers

a similar question to this was already asked but it is not the same case. I am talking about this one Is SQL injection possible via integer? In my case, I already have the confirmation of this ...
1
vote
0answers
40 views

Odd rails filter allows <script> tag but not <% %>

I am on a pentest for a client and they have a custom rails app that allows admin accounts to change page contents. While the front end editor filters script tags the backend does not, so using Burp I ...
1
vote
1answer
105 views

Why isn't XXE part of Injection in the OWASP Top 10?

I'm trying to explain to myself why XXE doesn't fall under the Injection category, as it is a form of XML injection. XML External Entity is an attack that manipulates the XML parser/interpreter, to ...
0
votes
1answer
367 views

Injecting javascript into an alert

I have a function like this where json is a json object that is in this form err: someNumber, and I want to inject javascript into that alert so that maybe i could inject ajax in there or something ...
4
votes
1answer
196 views

Exfiltrate data by injecting functions in Excel 2007 file rendered with PHP

I need to extract data from inside an Excel fille using Excel 2007 functions. The concept is somewhat related to stored XSS type of data exfiltration only that I need to use Excel 2007 functions (...
4
votes
1answer
325 views

Run bash command when spaces and '`/\<>?&| are filtered?

I have some PHP code that run bash commands, and it has a bug that may make it vulnerable to remote code execution. The executed command would be $(id), but if I execute any other command like ls -la ...
1
vote
0answers
235 views

Could not load library libcutils.so while injecting shellcode

I am working on my school thesis. I am trying to inject some shellcode into a shared library using Dirty Cow vulnerability on Android x86. My shellcode is written in asembly and only calls ...
3
votes
1answer
268 views

Are there any known Python pickle viruses?

I have recently read a post about vulnerability of Python pickle module which allows to execute arbitrary Python code on unpickling: https://intoli.com/blog/dangerous-pickles/ The docs are suggesting ...
1
vote
1answer
769 views

How does ProcessBuilder avoid OS command injection?

while I understand that OS command injection needs to have the untrusted input to be validated, I see that people have been suggesting to use ProcessBuilder(...).start() over Runtime.getRuntime().exec(...
1
vote
2answers
93 views

After a full web vulnerability scan, do we need to test each & every similar field for possible injections?

I ran a zap scan for my project and found some medium & low level vulnerabilities. But going through some posts, I found that we should run injections (sql, xss, command) on text fields also. But ...
-1
votes
1answer
867 views

How a connection string injection attack is performed? [closed]

I would like to know how a connection string injection attack is performed? The connection string is a set of key/value pair separated by a semi-colon. They are used by the web applications to ...
2
votes
1answer
188 views

(Issue) Unusual ads on HTTP websites

Most of the things written here is based on my current knowledge of networking, Any kind of help would be appreciated. I am facing an issue regarding ads on websites not secured with HTTPS (this is ...
6
votes
2answers
2k views

Is PHP's eval() function vulnerable to code injection when executing a string built from an array?

I'm trying to learn more about PHP eval() exploitation and I came across this scenario: <?php $test = array(); $test[0] = "command0 "; $test[1] = $_GET["cmd1"]; $test[2] = "command2 "; $test[3] = ...
3
votes
1answer
329 views

PHP object injection in the absense of source code?

I know the process of exploiting PHP object injection. I read somewhere that it can only be exploited when the attacker knows the internal code. Really? If I found a PHP object injection vulnerability ...
3
votes
1answer
132 views

Q: Need help understanding hacked site that only impacts AT&T LTE users

I'm almost certain my (new) client's wordpress site is hacked. The home page is fine, but every subdirectory on the page loads with very sketchy content seemingly injected into the page. But here's ...
2
votes
1answer
368 views

Testing for CCS Injection

I'm trying to test for a CCS Injection. I have found two prevailant methods to do so Use nmap's ssl-ccs-injection nse script Tripwire's OpenSSL-CCS-Inject-Test Both are pretty simple to use, however,...
6
votes
1answer
261 views

What are the security measures taken on websites that allow online scripting such as jsfiddle and codepen?

As asked in the title, I have been wondering this for a while. These sites allow the user to write scripts and store them too. Are they not vulnerable to attacks such as cross-site scripting or any ...
4
votes
1answer
66 views

Are command injections examples of confused deputies?

In a command injection you trick a service into doing something for you that it would not normally do. Does that mean that command injections are examples of (exploiting) confused deputies? Does the ...
0
votes
1answer
86 views

Security category of command injection attacks?

To which (STRIDE/CIA+AAA) security category do command injection attack belong? Or is my question too simplistic? Does it depend on the specifics of the injection attack (trying to get at ...
0
votes
1answer
1k views

Host Header Attack -> Password Reset Poisoning -> ASP.NET Web API 2 hosted as Azure App Services

I'm currently testing a site where the host header is used for creating a recovery email link. However, when I try to manipulate the host header in Burp I get an HTTP 400 message saying I'm using an ...