inserting malicious content, usually code (like SQL, Javascript) into a vulnerable application. Is used only if there is no more specific injection tag available (see tag wiki)

learn more… | top users | synonyms

0
votes
0answers
53 views

Why does Windows Explorer connect to some IP address? [duplicate]

I recently found that my Windows Explorer is connected to some IP address from Spain. As I know that Windows Explorer should not connect to the Internet, I installed an antivirus and firewall, which ...
1
vote
2answers
36 views

Why do websites still suffer from OS injections if by default web-servers are not assigned a shell?

So even if there is some poor php written which allows a shell_exec() and that someone disabled safe mode on it, what exactly are the risks? Do admins just change the default group or are most attacks ...
2
votes
1answer
55 views

Man-in-the-middle packet injection

I'm currently studying the possibility of a man-in-the-middle attack in a network consisting of a switch and 3 computers: Server/Host Client Man In The Middle The server and the client will change ...
0
votes
2answers
56 views

Can we consider injection of HTML tags without event attributes as XSS?

I'm wondering if we can consider the injection of HTML tags like a, image, img, video, audio, marquee or iframe without an event attribute as XSS? Since no JavaScript is involved and therefor no ...
3
votes
2answers
64 views

How to accept user input for use in terminal safely?

I found a vulnerability, and I'm not sure how to patch it. I currently accept input from the user and use it to create a terminal command which I run on the server. Here's the code simplified. // Get ...
3
votes
0answers
104 views

Calling methods with Expression Language Injection in Spring Framework?

I'm currently on a pentest and I've come across a URL parameter which is vulnerable to Expression Language (EL) injection and I can prove that by accessing properties such as ${pageContext}. However, ...
0
votes
2answers
109 views

Is JQuery 2.1.1 vulnerable to OS command injection?

Barracuda has found multiple instances of OS Command Injection vulnerabilities in a static website. In each instance, the vulnerable URL was the JQuery plugin itself (version 2.1.1). Barracuda rates ...
0
votes
0answers
44 views

What's is a security vulnerability that lets you inject server-side code called?

What is the name for a security vulnerability, that lets you inject server-side code into one of their server-sides pages (say PHP or ASPX)? I have googled 'Code Injection' though I'm not sure this is ...
-1
votes
1answer
81 views

Can this prevent XSS?

In PHP, I've always used this to represent inputs and textareas: $foo = trim(htmlentities($_POST['foo'], ENT_QUOTES); // the trim is to prevent empty submissions Can it also be valid to prevent SQL ...
6
votes
2answers
276 views

What's the best way to test for SQL Injection vulnerabilities? Manual or SQLMap?

As part of my job I test for web application vulnerabilities regularly. When it comes to SQL Injection, my methodology is to start by manually browsing the website and spidering it, then, sending the ...
3
votes
2answers
82 views

What happens if you upload code with a file extension that a website permits (PNG for ex)?

Example is GitHub comments that only allow uploading images and PDF. What happens if someone uploads malicious code after he changed the file extension to something like PNG or PDF? Also don't get ...
0
votes
0answers
28 views

Executing JS script in Bootstrap popover without “<” and “>” characters (XSS) [duplicate]

In the system that I am working on I have a simple form. In the form there is an input called "ID". The contents of the input is than displayed in a Bootstrap popover (after clicking the "i" icon) ...
0
votes
0answers
41 views

Why /proc/self/environ no output through injection

What on a CentOS machine would stop a null byte injection from displaying the output of /proc/self/environ and /proc/$PID/environ or /proc/$PID/fd/12 ? According to this article, all folders under /...
5
votes
4answers
442 views

Is it safe to redirect to URL parameter without filtering?

A webpage redirects to an URL given in parameter redirect without filtering it, like this: $newURL=$_GET["redirect"]; header('Location: '.$newURL); login.php?redirect=home.php If it echoes the ...
1
vote
1answer
38 views

How to extract data from hackyourself legal site with table and column information?

I am following the Pluralsight SQL injection tutorial. The instructor did not go over actually extracting the data. http://hackyourselffirst.troyhunt.com/CarsByCylinders?Cylinders=V12'AND 1=(SELECT ...
-1
votes
2answers
75 views

Unrestricted File Upload Vulnerability, any solution?

I have a module in which the user can upload images. So I run some test, via tamper data I can change it from .png to .php and it will upload successfully on my server but if I go to the location it ...
0
votes
0answers
42 views

What could be done using Set-Cookie or Cookie Manupulation

I was testing a web application where I can inject the cookie using CR/LF injection. I'm curious to know, What attacker could done only using cookie injection (Set-Cookie) by CR/LF on website like ...
2
votes
0answers
60 views

How to inject XSS using Response Splitting in the following scenario?

I have been pentesting for a company. I found a CRLF injection that could be done using %E5%98%8D%E5%98%8A instead of %0d%0a. So I'm using %E5%98%8D%E5%98%8A in redirection parameter for CR/LF. Here ...
4
votes
1answer
65 views

Is it easy to protect against SSI injection?

SSI injection is, to the best of my understanding, the process of injecting commands into user input fields, e.g. &lt;!--#exec cmd="ls" --&gt; to get the files in the current directory. ...
2
votes
2answers
68 views

Code injection using packet modification

Is code injection possible through packet modification? For example, if a game sent a packet declaring score=99 could I then modify the packet to score=*code* or something similar? I guess a ...
2
votes
2answers
199 views

Remote OS command injection - tests

ZAP scanner found Remote OS command injection. Is there any foolproof way to check if this works and is not a false positive? I have tried to make it sleep 50 seconds but it's not something I can ...
4
votes
1answer
97 views

Is this sanitization method secure?

I implemented this sanitization fix: function san($str, $type="full") { switch ($type) { case "full": $str = preg_replace("/[^a-zA-Z0-9_\-]/i", "", $str); break; ...
2
votes
1answer
287 views

How to exploit a Use-After-Free vulnerability?

I want to learn more about use-after-free vulnerabilities and found this tutorial. Yet I don't understand it very well and hope for an explanation of how it works.
2
votes
1answer
114 views

Sqlmap, how to move forward? [duplicate]

So, I'm using Sqlmap for a while now to test the security for my company (we're too small to have IT guy and I'm the closest they got for now), I already managed to access the database remotely and ...
-1
votes
1answer
65 views

Is this MySql query sql-injection protected? [duplicate]

I have small php code, before discovering mysqli real_escape_string i was using a function with some regex rules to clean every user input by symbols, but for an email or a password, this is not a ...
2
votes
2answers
115 views

PHP filter_input() not protecting from eval()

I was updating some PHP code following the advice of not using $_GET and $_POST anymore but instead to switch to the safer filter_input() functions. I was thinking that function would save me in this ...
1
vote
1answer
72 views

Are sqlcmd parameters inherently at risk of SQL injection?

The command line utility sqlcmd has a feature to allow parameter substitution, from command line parameters and environment variables. https://msdn.microsoft.com/en-us/library/ms188714.aspx If an ...
1
vote
0answers
95 views

How to check if /run timeout /T 5 remote command execution worked in page html?

I was scanning a website using Zed Attack Proxy, when I found it is vulnerable to remote command execution, specifically timeout with the Referer header (shown in the request below). I have no idea ...
6
votes
1answer
97 views

How can I exploit a PHP endpoint that lets me instantiate an arbitrary class?

PHP lets you instantiate classes from variables or array entries, like this: class Foo {} $className = 'Foo'; new $className(); $someArray = ['class_name' => 'Foo']; new $someArray['class_name']();...
2
votes
2answers
148 views

PHP security hacking question, may be more than just PHP

I have an input box for for INSERTing into the database. It is written in PHP PDO. Some one typed in: <"'> and also: ' onClick='alert(1); I'm assuming they were in two different input ...
17
votes
3answers
2k views

Exposing database fields names in HTML

I quite often see opportunities to optimise server-side code if HTML form names are exactly the same as the database field names they eventually update. The drawback obviously is that this is ...
2
votes
1answer
96 views

Are PHP magic methods really necessary for PHP object injection?

I'm trying to understand the PHP Object Injection flaw in vBulletin 5.1.x (CVE 2015-7808) and I stumbled across the requirements for Object Injection as stated by OWASP: The application must have ...
4
votes
2answers
611 views

PHP code injection using GET and echo

I have found a piece of this code in a web application (simplified): <?php $password="very-secret-password"; $param = $_GET["param"]; ?> <html> ... Param: <?php echo $param; ?> ... &...
5
votes
1answer
519 views

DVWA - Command Injection (high level)

I am attempting to educate myself further on web securities using DVWA. I am stumped on Command Injection, on the high level The help states The developer has either made a slight typo with the ...
6
votes
2answers
439 views

XSS via JSON: Why does a web application not sanitize either its incoming params hash or its outgoing JSON values of malicious tags like Script?

Recently working on a Rails-based web application for a company, I had to look into XSS vulnerability. It turns out that the application, in some places, could take an HTML tag (e.g., jscodehere ...
4
votes
1answer
120 views

Likely Sources of MITM Attack over Public Internet SSH

Earlier today when attempting to ssh into my remote server, I got the standard man in the middle warning relating to inconsistent public keys. In fact the key-type wasn't even correct. My server uses ...
1
vote
1answer
141 views

how to prevent scripts being injected on my website [closed]

I have an API server on Digitalocean. Yesterday they told me I have "a large flood of traffic from one or more of your servers that is disrupting the normal traffic flow for other users." I checked ...
2
votes
1answer
57 views

SOP for SQL Injection Attack

What should (or) how an Incident Handler do (or) follow when an SQL injection attack is reported? Initial Response Analysis Action Aiming to make a procedure guide to follow for myself and my team....
21
votes
2answers
2k views

What vulnerability is targeted by an HTTP referer starting with (){ :;};/bin/bash

I found this code, followed by several bash commands downloading and running a payload from the web, in the referer field in my apache error logs. The attack appears to work by converting a command ...
4
votes
1answer
217 views

As a result of attack; random folders and files in public_html. What kind of attack is this?

As a result of attack there are random folders and php files inside them in public_html directories. Sites are Wordpress, Opencart or just HTML. All sites exposed to attack. Screenshot of the ...
3
votes
1answer
46 views

XSS Injection invalidate meta redirection tag

When injecting into the url part of an HTML META redirect like this: <meta http-equiv='refresh' content='0;URL=$URL' where $URL (note the missing quotes) is the part I can inject, is there any ...
5
votes
1answer
308 views

SQLmap injection not working, manually it works fine

I have built a vulnerable web application to demonstrate SQL injection. I want to show both manual injection and automated injection. The injection requires a) the user to be logged in (session cookie)...
3
votes
0answers
66 views

MongoDB injection, reading and writing to files

I've been playing around with Nosql and specifically MongoDB injection on a few challenges and my lab. If you have an injection point you can easily enumerate and dump the database. But can you go ...
4
votes
1answer
112 views

XSS through modifying a UI element value?

I send an AJAX request and when the HTML loads back, I retrieve the values of some UI elements at the client side and present them to the user, like so: var displ="<h1>"+$( "#myslider" ).slider(...
-1
votes
1answer
107 views

Understanding HTTP response from Linux Server

I am working through a question that involves someone using a vulnerability in a Linux server in order to gain access to it. The first part of the question states In monitoring the network activity ...
2
votes
1answer
76 views

Defeating code injection attacks in x86

In x86 systems, there are three requirements for a code injection attack to work: write attack payload to memory attack payload to be executable divert control-flow to payload How can we prevent 2)...
3
votes
1answer
173 views

Common attacks when no ports are open

If you have a web server with all ports closed (except, of course, the necessary HTTP) what kind of attacks can an attacker use to hack into the system? Are the only vulnerabilities stuff like ...
1
vote
2answers
129 views

Injection/SQL Injection Attacks in Layman Terms

I'm having trouble figuring out what SQL injection attacks are, or in more general terms, what injection attacks are. Most explanations out there on the internets are kinda hard to understand. Could ...
2
votes
1answer
262 views

Memory injection in games

I'm currently researching memory injection attacks on games in Windows 7/10. After reviewing several threads on this topic, there's a few questions which are still unclear. DLL injection can be ...
1
vote
1answer
83 views

Some tags I'm worried about when parsing html doc for xxs

I'm building a web app where users can make post which consist of an html doc. An user can change the document via the dev tool for example. So the document consists of literally any user input. I'm ...