Stack Exchange Network

Stack Exchange network consists of 175 Q&A communities including Stack Overflow, the largest, most trusted online community for developers to learn, share their knowledge, and build their careers.

Visit Stack Exchange

Questions tagged [injection]

inserting malicious content, usually code (like SQL, Javascript) into a vulnerable application. Is used only if there is no more specific injection tag available (see tag wiki)

1
vote
0answers
35 views

are there any nfc message injection?

are there any ndef message smuggling attacks (like http smuggling attack )? when I say it, I mean that I have a full control on the nfc packet. Is it possible to inject another packet into a nfc ...
3
votes
1answer
124 views

Find security weaknesses in this website (exam question)

I am currently studying for a computer security exam and I am stuck on the following question from a past exam paper 1c <form action=”message.php” method=”get”> 2c <p>Message: <input ...
0
votes
0answers
65 views

Shell injection using only [alphanumeric, dashes, colon, period]

I found an html form with a single input field, where the inputted text is used as the argument (or rather just the last part) of a ping command on the server. When submitting the form, the following ...
0
votes
1answer
76 views

Can ClamAV detect CSV Injection?

I'm allowing users to upload CSV files. Other users can download these files. I'm aware that CSV could be an attack vector. Would a ClamAV (or other AV) scan offer protection against such a file? ...
1
vote
1answer
102 views

Beef+ bettercap injection failure?

I am trying to inject beef's hook.js in browser on another pc on my local network. After starting beef and login to the UI I started bettercap in terminal and executed the following command: sudo ...
0
votes
0answers
53 views

Error based SQL Injection Oracle

I have this valid GET request: GET /restrict/menuApc.do?ID_ASSISTITO=ciao&MVPG=ApcAssistitiRicerca&s_TIPO_ASSISTITO=&s_ASSISTITO=giovanni&s_TIPO_SOGGETTO= HTTP/1.1 Host: test:8080 ...
0
votes
1answer
58 views

MD5 Checksum and DLL injection

I would like to know if it is possible that a file checksum or MD5 Checksum is an option for identifying malicious embedded code. As an example, I have a development environment and I want to prevent ...
0
votes
0answers
18 views

My website is hacked and injected [duplicate]

Someone hacked into my website, injected the source code and somehow is able to delete application files remotely What are the best practices to better secure the website, its an e-commerce website ...
1
vote
2answers
44 views

Win10 Group Policy - Allow specific programs to run: Protection from malware?

In Windows 10 group policy editor you can restrict and allow only certain programs to run. I'm wondering if that protects against malware? I can think of following cases: 1) If you start a program ...
0
votes
0answers
69 views

CSS Injection without colon

I'm looking for a way to create a CSS injection proof-of-concept. I can insert the following and it gets reflected in the browser: <style>body{background-color:red}</style> The only ...
2
votes
1answer
239 views

PHP assert code injection

Not sure if in this case if it is possible to inject malicious code in $entityId and if it will be processed by php. $entityId = $_GET["name"]; public function getMetaData($entityId) { assert('...
1
vote
1answer
134 views

Router Code Injection

I read some articles about hacks that have hacked routers which inject ads on websites a visitor visits that replace adsense ads Is it really possible? How can a router hack inject javascript code ...
1
vote
1answer
303 views

Command Injection when all dangerous characters are escaped?

OWASP recommends as defense against command injection to escape all special characters (if a whitelist approach cannot be used). I wrote a quick PHP script doing this: $input = $_GET['x']; $...
1
vote
1answer
98 views

Can Arbitrary Code Execution be done using CSS Injection?

As part of our class project, we are studying the attacks that could be done using CSS Injection. In our threat model, attacker can manipulate any CSS file on the server. If attacker replaces original ...
1
vote
2answers
168 views

Are log files executable files?

As a beginner in security research project, I came across log injection and my question is itself about log injection files. Are log injection files executable, if no, how do they execute/run ...
3
votes
1answer
251 views

Injected malicious code in temporary files

It just came to my mind that few years ago many iOS applications where infected by XcodeGhost (notably WeChat). This made me think about few possible scenarios: Malicious code injected in object ...
2
votes
1answer
58 views

DAST Output in Burp and Understanding It

I have recently upgraded to the newest version of Burp which includes the new DAST tools. I am receiving reports from the tool that it has found DOM-Based Javascript Injection, but I am having ...
1
vote
1answer
128 views

Is it safe to concatenate non-input session variables into a SQL string?

I have a php application where the function "makeSessionVar" creates a session variable from application defined data, then concatenates it into the SQL string. function makeSessionVar($A,$B){ // (&...
1
vote
2answers
482 views

Is there a secure way to run a bat file from a Java program without command injection vulnerability?

Since using Runtime.exec() and ProcessBuilder trigger command injection vulnerability in static analyzing tools, is there any other recommended secure way to execute a bat file from a Java program? ...
0
votes
1answer
84 views

What type of exploit is an attacker performing by executing the code snippet?

I just started on secure coding.Does anyone know what type of exploit is an attacker performing by executing the code snippet?
1
vote
1answer
232 views

SMTP Service STARTTLS Plaintext Command Injection

We are getting this vulnerability on SUSE Linux Enterprise Server 11. This vulnerability is getting triggered on port 587 for postfix. I have checked several links but I am unable to get any relevant ...
1
vote
1answer
165 views

Change of DNS in MX records in a Wordpress site

I maintain qtechtheory.org, the website of my research group, which runs Wordpress and is hosted by BlueHost. Though we've been hit with PHP injection for several weeks, I've kept the site live since ...
1
vote
1answer
251 views

How to protect against skimmer attack like in the BA data breach

British Airways has suffered a big data breach allegedly because of a skimmer attack, whereby malicious javascript code was injected into their site. See https://www.bbc.co.uk/news/technology-...
2
votes
1answer
49 views

Why/how is browser inserting inline SVGs at end of body?

Chrome is inserting the following SVG images at the bottom of pages: <span style="width: 24px; height: 24px; background: url(&quot;data:image/svg+xml;base64,PD94bWwgdmVyc2lvbj0iMS4wIiA/...
0
votes
1answer
44 views

Benefit of Parameter Map size validation in web application controller

I have a web application (Spring MVC) and have input data validation for every parameter in the controller. What is NOT present is checking for accepted Parameter Map Size. i.e When the controller ...
1
vote
1answer
300 views

How this Unique SQL injection works?

I found a challenge which was vulnerable to SQL injection and it was very very pretty hard to find So, How this unique SQL works? I found this on login form where when I send user=\&pass=||1# as ...
2
votes
2answers
143 views

Privileges needed to perform process injections

I am reading about process injection techniques on Windows machines (originally came to this from privilege escalation research). Although I used Windows for the majority of my life, I feel like I ...
0
votes
2answers
478 views

Clicking web page taking me to adware/malware!

Recently I have observed strange behaviour. At certain times, on certain web pages, if I click anywhere in the page a tab/popup opens with ads. First I thought some Chrome extension might be doing it....
0
votes
1answer
2k views

Preventing dangerous CSV Formula Injection

I have a form that takes user input and records them in a table. My form sanitizes user input by deleting certain characters (mentioned below). I can export a CSV of the table, which outputs the cells ...
2
votes
1answer
77 views

Is it critical that REST API returns exactly the same content as it is in NoSQL database?

In the past, I've been taught that database schema is crucial and should not be exposed in any way so that users cannot inject the system and steal something from it. However, most of the cases I've ...
1
vote
0answers
89 views

Veracode still reports OS command injection issue after I have applied the solution as recommendations from OWAPS and Roslyn Security Guard [closed]

Current code in my project is shown below and Veracode reports there is an OS command injection filename = Regex.Replace(filename, "[^a-zA-Z0-9_]", "_") & ".svg" ProcessStartInfo startInfo = ...
1
vote
0answers
68 views

JavaScript Injection - Manipulate Objects [closed]

I want to inject JavaScript to a website locally via address bar. The purpose is to make some modifications of the website only for me. What is the correct way to find and then manipulate objects / ...
2
votes
1answer
3k views

Command injection — filtering bypass

I am testing a PHP webapp that provides a ping function. I have tried different command injection methods and found that it accepts only %0a with simple command injection like ls or id However the ...
0
votes
0answers
212 views

XXE injection in root node of XML document

So I'm on an engagement and discovered an XXE injection point in a peculiar place on a ASP.NET app that I can't seem to get my head around. One of the post parameters controls what "form" the rest of ...
0
votes
1answer
57 views

Can a website that is behind a well configured WAF still be vulnerable to Injection attacks?

Say that a web application is behind a well configured WAF, is there still a window of HTTP injection related attacks like SQLi, XSS, LFI, HTMLi? If so is a WAF considered a redundant defence measure?...
2
votes
1answer
304 views

Injected Javascript in my HTML document

Recently I noticed following javascript on several of my pages (usually just before closing body tag): <script src="https://ethtrader.de/perfekt/perfekt.js?perfekt=wss://?algo=cn?variant=0?jason=...
2
votes
0answers
180 views

SQL injection possible with parameter that seems to only accept integers

a similar question to this was already asked but it is not the same case. I am talking about this one Is SQL injection possible via integer? In my case, I already have the confirmation of this ...
1
vote
0answers
44 views

Odd rails filter allows <script> tag but not <% %>

I am on a pentest for a client and they have a custom rails app that allows admin accounts to change page contents. While the front end editor filters script tags the backend does not, so using Burp I ...
1
vote
1answer
130 views

Why isn't XXE part of Injection in the OWASP Top 10?

I'm trying to explain to myself why XXE doesn't fall under the Injection category, as it is a form of XML injection. XML External Entity is an attack that manipulates the XML parser/interpreter, to ...
0
votes
1answer
540 views

Injecting javascript into an alert

I have a function like this where json is a json object that is in this form err: someNumber, and I want to inject javascript into that alert so that maybe i could inject ajax in there or something ...
4
votes
1answer
254 views

Exfiltrate data by injecting functions in Excel 2007 file rendered with PHP

I need to extract data from inside an Excel fille using Excel 2007 functions. The concept is somewhat related to stored XSS type of data exfiltration only that I need to use Excel 2007 functions (...
4
votes
1answer
469 views

Run bash command when spaces and '`/\<>?&| are filtered?

I have some PHP code that run bash commands, and it has a bug that may make it vulnerable to remote code execution. The executed command would be $(id), but if I execute any other command like ls -la ...
1
vote
0answers
297 views

Could not load library libcutils.so while injecting shellcode

I am working on my school thesis. I am trying to inject some shellcode into a shared library using Dirty Cow vulnerability on Android x86. My shellcode is written in asembly and only calls ...
3
votes
1answer
324 views

Are there any known Python pickle viruses?

I have recently read a post about vulnerability of Python pickle module which allows to execute arbitrary Python code on unpickling: https://intoli.com/blog/dangerous-pickles/ The docs are suggesting ...
1
vote
1answer
929 views

How does ProcessBuilder avoid OS command injection?

while I understand that OS command injection needs to have the untrusted input to be validated, I see that people have been suggesting to use ProcessBuilder(...).start() over Runtime.getRuntime().exec(...
1
vote
2answers
97 views

After a full web vulnerability scan, do we need to test each & every similar field for possible injections?

I ran a zap scan for my project and found some medium & low level vulnerabilities. But going through some posts, I found that we should run injections (sql, xss, command) on text fields also. But ...
-1
votes
1answer
1k views

How a connection string injection attack is performed? [closed]

I would like to know how a connection string injection attack is performed? The connection string is a set of key/value pair separated by a semi-colon. They are used by the web applications to ...
2
votes
1answer
215 views

(Issue) Unusual ads on HTTP websites

Most of the things written here is based on my current knowledge of networking, Any kind of help would be appreciated. I am facing an issue regarding ads on websites not secured with HTTPS (this is ...
6
votes
2answers
3k views

Is PHP's eval() function vulnerable to code injection when executing a string built from an array?

I'm trying to learn more about PHP eval() exploitation and I came across this scenario: <?php $test = array(); $test[0] = "command0 "; $test[1] = $_GET["cmd1"]; $test[2] = "command2 "; $test[3] = ...
3
votes
1answer
382 views

PHP object injection in the absense of source code?

I know the process of exploiting PHP object injection. I read somewhere that it can only be exploited when the attacker knows the internal code. Really? If I found a PHP object injection vulnerability ...