Questions tagged [injection]

inserting malicious content, usually code (like SQL, Javascript) into a vulnerable application. Is used only if there is no more specific injection tag available (see tag wiki)

Filter by
Sorted by
Tagged with
0 votes
1 answer
33 views

How does this PortSwigger lab's XSS work?

I was doing the following PortSwigger Lab on cross site scripting (XSS). The following payload works perfectly. http://foo?'-alert(1)-' Which is input into the following section of ...
user avatar
0 votes
1 answer
74 views

Why are MySQL injections more limited than MS-SQL attacks?

I was watching the DEFCON 17: Advanced SQL Injection video here. At 15:00, when discussing the various classes and types of SQL injection attackS, the speaker stated With MySQL you really only have ...
user avatar
0 votes
1 answer
32 views

sqlmap is encountering 403 forbidden

I am trying to complete an SQL injection CTF here. I confirmed just adding a single ' mark at the end of the URL caused a MySQL syntax error, and following this tutorial, I could complete this ...
user avatar
0 votes
0 answers
23 views

What are vulnerabilities of saving user input directly in wordpress plugin?

I have a WordPress plugin that helps create an organization chart/tree and then generates a URL where the chart is available to be viewed by the public. The plugin dashboard looks like this the plugin ...
user avatar
0 votes
2 answers
61 views

What are the vulnerabilities of exposing url end point param?

I have a wordpress plugin that helps create an organization chart/tree and then generates a URL where the chart is available to be viewed by the public? Inside the plugin's view in WordPress dashboard....
user avatar
0 votes
0 answers
25 views

How can I inject JavaScript into a url whose contents will be written to the DOM in a way that it could execute?

I'm working with the API for a popular CI/CD app and I found a bug where path variables are being written directly to the DOM without being checked first. The tldr is that to access a project you go ...
user avatar
0 votes
0 answers
16 views

Is possible XXE with XSI modify?

I wonder, is possible XXE attack in this case? The data of request is starting with: <InteractionMessage><Header><SenderApplication>VIP3.0</SenderApplication><...
user avatar
  • 1
0 votes
0 answers
12 views

Is There an MITMf ScreenShotter plugin for modern tools like bettercap?

I am looking for a plugin like the ScreenShotter , which is capable of capturing a screen shot of other local network connected devices opened browsers pages using html5 canvas A demo of ScreenShotter ...
user avatar
0 votes
0 answers
48 views

Is it possible to inject code using physical memory access to jailbreak phones?

Is it possible to inject code into RAM using physical access? For example desolder the RAM chips, solder something between the original RAM chip and the phone motherboard, and use that to directly ...
user avatar
1 vote
1 answer
160 views

How to track which php file executed a malware binary

I have a server that seems to be compromised checking the processes running I see an executable that seems to be a mining malware and the hacker uses it to mine litecoin at the address ...
user avatar
0 votes
1 answer
51 views

Detect http traffic injection

Is there any way to detect injection into unencrypted http traffic, like files, js etc. a. just by traffic analysis b. from the client-side?
user avatar
0 votes
0 answers
19 views

Does process injection through file on a low privilege user considered as a vulnerability

I found a way to cause a low privileged program in Program Files to run any binary I want. I am doing it by changing a configuration file it reads, which I of course have an access to. Is it ...
user avatar
  • 153
0 votes
1 answer
75 views

Is character restriction ever a safe mechanism against code injection / better than input sanitisation?

Many services still restrict the special characters allowed in passwords and similar with the argument that it prevents injection attacks. Now, there are many good arguments against this such as ...
user avatar
  • 103
6 votes
2 answers
364 views

Do antivirus programs increase your attack surface and potentially give more power to malware?

When I was a student one of my professors used to say that an antivirus actually increases your attack surface by injecting itself into system processes and let's say opening more doors for ...
user avatar
0 votes
1 answer
98 views

Would it be useful from a security perspective to harden an interpreter like Python or NodeJS by removing support for unused features?

When hardening a system you want to remove any features that you do not need. I have been thinking about this concept from the perspective of interpreters like Python, NodeJS, PHP etc. and am ...
user avatar
  • 3
0 votes
2 answers
163 views

What is the maximum payload injection size

I have been conducting some minor research into the various forms of exploitation, such as buffer overflows and similar. Most tutorials seem to focus on executing shellcode, that is code which ...
user avatar
0 votes
0 answers
84 views

react.js security from a novice - front-end development security

I am developing a dApp for my dissertation at University. As I do not come from a computer science background, I am unsure of security risks, specifically related to the javascript front-end of my ...
user avatar
0 votes
1 answer
462 views

How does Chrome 78+ block all methods of DLL injection?

How does Chrome block all methods of code injection past version 78? It even blocks signed DLLs it doesn't have in a static list.
user avatar
-1 votes
5 answers
3k views

Is 'Internal Server Error' always a sign that there's a SQL Injection vulnerability in a site?

If so, is trying to exploit through a time-based injection enough to prove there's a vulnerability in said site?
user avatar
0 votes
0 answers
53 views

AppCertDLLs does not work in GUI apps, why?

I was trying to automatically inject a dll to every process (including GUI) whenever it is started by a user . My DLL hooks DoDragDrop method of winapi and communicates with server to decide allow or ...
user avatar
1 vote
1 answer
227 views

Weird entry in SQL Server database, is this a result of SQL Injection?

I stumbled upon a case where several database entries were updated. And the update is rather unusual. For example if I have an entry named: Watermelon The updated version is: Watermelon<IMG SRC=&...
user avatar
0 votes
1 answer
443 views

Javascript injection bettercap2 over HTTPS

I use bettercap2 http proxy and arp spoof to inject one-line js alert into http pages. It works fine, however what about https? I couldn’t find any working method to inject it without the browser’s ...
user avatar
3 votes
0 answers
146 views

Process Injection and Process Isolation by OS

If the OS is responsible for ensuring that one process cannot access another process memory space, and the point of process isolation is to keep processes separate from one another, then how can a ...
user avatar
0 votes
0 answers
83 views

Injection inside double quoted section of script element

For a test to find vulnerabilities I found the following code in a page and I am looking for ways to manipulate it: <script> func({ "key1": "value", "...
user avatar
  • 1
0 votes
0 answers
89 views

Allowing users to add arbitrary JavaScript in published articles

It would be nice if sites like Medium or Substack allowed users to not only add text, images, code snippets, etc., but also custom scripts that allowed readers to run a little piece of code. For ...
user avatar
8 votes
3 answers
6k views

Does blocking keywords prevent code injection inside this interactive Python file?

We recently had issues with people messing around inside our system. To prevent code injections within my python code, I implemented the following if block: #! /usr/bin/python3 #-*- coding:utf-8 -*- ...
user avatar
1 vote
1 answer
496 views

Blind XXE - Exfiltration Data via OOB

My lab Kali Linux:192.168.171.134 bWApp Server: http://192.168.171.131 I want to do an exfiltration data via HTTP on this Blind XXE. I'll use the Portswigger Payload. This is the External.DTD: &...
user avatar
1 vote
2 answers
200 views

Are positional parameters vulnerable to command injection?

I am trying to find if the following shell script is vulnerable to command injection #!/bin/sh set -x dig +noall +answer TXT $2._domainkey.$1 Now when I try something like this, sh script.sh "...
user avatar
1 vote
0 answers
77 views

Implications of Python fmtstr injection without secrets passed to the formatter

There are two ways I can think of to format strings in Python where user input may make its way into the format string input: >>> a = input() >>> print(a % ()) >>> a = ...
user avatar
8 votes
1 answer
287 views

Is this Windows local code execution bug also a security vulnerability?

I stumbled on a Windows bug leading to code execution. I believe it should be categorized as a vulnerability but Microsoft does not recognize it as such. I would like to read other opinions. ...
user avatar
1 vote
1 answer
88 views

CLI application running user defined command periodically [closed]

For a toy CLI application I'm writing, I'd like to store a string with an user defined command that will be executed periodically (like shell -c <command_string>). I have seen other applications ...
user avatar
  • 113
1 vote
0 answers
721 views

Purpose of SeDebugPrivilege for DLL injection

I have been recently working on a little DLL injection program in Go. While the program works and I am able to successfully inject into a remote process, Windows permissions system still seems to ...
user avatar
1 vote
1 answer
184 views

How does malware avoid AV's when using a simple DLL injection technique?

As far as I understand it, a simple approach for a malware DLL injection would require 2 DLLs. The first for the DLL side loading, while the malicious DLL remains encrypted. And then this 'loader' ...
user avatar
2 votes
1 answer
156 views

I discovered a Client Side Template Injection (CSTI), and after?

As part of a bounty bug, I discovered a Client Side Template Injection (CSTI). I would like to create more "impressive" payload to increase the risk of the vulnerability. The framework ...
user avatar
  • 274
1 vote
1 answer
94 views

WebApp Windows Command Injection without "||"

I've found an application that allows arbitrary file upload (client side validation on file extensions), however those files are not stored in a folder which is accessible by the webserver, so a web ...
user avatar
  • 638
0 votes
1 answer
335 views

How can I execute a base64 encoded exe stored as a variable, inside a powershell script without writing any files?

Basically if I have exe1 encoded with base64 and I copy that encoded source into a powershell script as a variable. I want to be able to decode it and execute the source exe without writing the exe to ...
user avatar
  • 3
1 vote
0 answers
145 views

Can you do a code injection in asp.net with Eval()?

I am trying to understand code injection via eval in the context of different technologies. In the case of asp.net, is it possible to be vulnerable to code injection if i am using eval? E.g.- <asp:...
user avatar
0 votes
0 answers
18 views

JavaScript injection minimal example using node/express not working: <script> not executed [duplicate]

I want to create a minimal example where JavaScript injection/XSS is working. This is my example server: const express = require("express"); const path = require("path"); const ...
user avatar
  • 101
4 votes
3 answers
638 views

Source code being injected into every website

I had a client contact me today because a website I developed (that deals with sensitive information) wasn't loading correctly on one computer on Chrome. After poking around for a while it appears to ...
user avatar
  • 141
4 votes
2 answers
205 views

Ensuring that non-executable files are not malicious

Let's say that I have been sent some maliciously-crafted audio files by an attacker that use an unpatched security exploit somewhere in my system to compromise it. How can I reprocess the actual audio ...
user avatar
0 votes
1 answer
196 views

How are games and software executables injected with custom code & without breaking offset?

Introduction – Context Everyone has seen so called "Injectors" or "Cracks" for certain programs & games at some point in their life. These applications inject their own code ...
user avatar
0 votes
1 answer
145 views

How to trace script injection/infection in php app

This is about a PHP7.4 based shopping platform (opencart (v3.0)). For testing purposes I had a dummy set up at site.com/xyz. The admin page of that was site.com/xyz/admin. The login and pw for the ...
user avatar
  • 413
0 votes
1 answer
121 views

ModSecurity Command Injection not working

I am testing web application firewall and I have installed ModSecurity 2.9 runs Core ModSecurity Rule Set ver.2.2.9 and to test on Web application I also install DVWA Platform: Windows and trying ...
user avatar
-1 votes
1 answer
219 views

Can't bypass filter [closed]

Trying some malicious injection against bWAPP and came across bypass captcha Filter validating captcha is if($_POST["captcha_user"] == $_SESSION["captcha"]) Tried input 1' || '2 ...
user avatar
1 vote
1 answer
124 views

How to prevent HTTP header injection attack in J2EE Web application? Is there any library (Maven dependency) available for this purpose?

My J2EE application is vulnerable to HTTP header injection attack. I want to make it secure from this vulnerability. Also, I am searching if any library (Maven dependency) available for this.
user avatar
  • 11
0 votes
2 answers
174 views

hide_my_wp wordpress plugin is activated with php eval function that might trying to read /etc/passwd? Is it true?

When I install this plugin and activate in wordpress, hide_my_wp put some eval codes in wp_options and I see the following code being injected in a new row with the ID called 76624: upload-dir=./../../...
user avatar
  • 137
0 votes
1 answer
117 views

How to send SQL or HTML data over HTTP without triggering WAF rules? [closed]

I'm working on securing an application that receives SQL and HTML-like information that is actually proprietry formulas in some cases, and parts of XML documents in other cases. So the WAF thinks some ...
user avatar
0 votes
2 answers
672 views

SQL Injection update query

I have a sqli and i can dump data from the DB with the query below func=REC&lastid=7491&start=3&uid=56+union+all+select+1,2,3,4,5,6,7,8,9,10,11,12,13,14,15,16,17,18,concat(uid,':',email,':...
user avatar
  • 3
1 vote
0 answers
181 views

Process hollowing and the Import Address Table

I have been learning and implementing Process Hollowing attacks, and even after I got the thing work, I have some questions. Why aren't we building the IAT when we load our injected PE? All we do is ...
user avatar
1 vote
1 answer
176 views

Multi-byte character exploit

I read this answer, It explains how a multi-byte character exploit works in a decent way, the only way I could think of avoiding this problem is whitelisting all single-byte characters because of the ...
user avatar

1
2 3 4 5
9