Stack Exchange Network

Stack Exchange network consists of 175 Q&A communities including Stack Overflow, the largest, most trusted online community for developers to learn, share their knowledge, and build their careers.

Visit Stack Exchange

Questions tagged [null-byte-injection]

An active exploitation technique used to bypass sanity checking filters in web infrastructure by adding URL-encoded null byte characters (i.e. %00, or 0x00 in hex) to the user-supplied data.

0
votes
0answers
60 views

null-byte-injection not happening at hackthissite realistic level 14

I'm trying to learn something about hacking and I've made it until realistic level 14 at hackthissite.com I have tried many things until I was frustrated and searched for the first step on the ...
0
votes
1answer
489 views

How would someone execute a Perl script on a webpage?

OWASP's XSS Filter Evasion Cheatsheet has a Perl script listed: perl -e 'print "<IMG SRC=java\0script:alert(\"XSS\")>";' > out It also says this above it: Null chars also work as XSS ...
6
votes
1answer
534 views

Cookie that contains NULL byte character (0x00) on new WordPress.org site - any issues?

I installed NinjaFirewall plugin on WP.org v4.7.2. It locked me out of my site. They asked for the log from my hosting company's cPanel, which I got and they report: You have a cookie that ...
1
vote
1answer
210 views

Prevent injection in PHP file

Recently I wrote this code: <?php $path = '../data/about.html'; $handle = fopen($path, 'w') or die('Cannot open file: '. $path); $data = $_POST['name']; fwrite($handle, $data); fclose($handle); ...
1
vote
0answers
370 views

Can you use null byte injection to exploit SQLi in Postgres?

While testing, I do get an error when passing the input asdf%00 to my applications username. The database in the backend spits an error, because Postgre can't handle 0x00 in text fields. <h4>...
1
vote
1answer
580 views

Null byte injection to run PHP?

A website accepts form input and outputs it to the screen, but replaces every <? to <--? turning them to comments. Let's say I POST the following: <?php echo "xy"; /* arbitrary php code */ ...
3
votes
2answers
3k views

Remote OS command injection - tests

ZAP scanner found Remote OS command injection. Is there any foolproof way to check if this works and is not a false positive? I have tried to make it sleep 50 seconds but it's not something I can ...
1
vote
1answer
139 views

Are there still some ssl domains containing the nul character for testing purposes?

Some years ago, there was a bug with host name checking in ssl so that connection towww.paypal.com%00.thoughtcrime.orgwould look aswww.paypal.comat the certificate level. The issue seems to be over ...
4
votes
1answer
2k views

What are the alternatives to null byte injection attack?

Now that Null byte injections no longer work on PHP, what are the alternative attack strategies used by attackers for remote file inclusion ?
2
votes
1answer
2k views

Printf inject 0x00

When performing a format string exploit, how do you inject an address that contains 0x00? #include<stdio.h> int main(int argc,char *argv[]) { char buf[80]; snprintf(buf, 79, argv[1]); ...
1
vote
2answers
2k views

Is string concatenation vulnerable to null character in aspx?

I just see this line of code in VB in one file .aspx FileUpload.SaveAs(sPath & "/" & FileUpload.FileName) This line save a file that an user uploaded. It use the SaveAs method. I was worried ...
1
vote
1answer
3k views

Getting null byte injection attacks to work with PHP 5.2.17

I'm trying to understand how null byte injection attacks in PHP code used to work before it was patched in PHP 5.3.4. I have this sample HTML page that is a somewhat modified version of what's shown ...
3
votes
2answers
12k views

Null byte injection on PHP?

Is it possible to perform null byte injection on PHP code? And, how would vulnerable code look like? Could you give me some examples, as I noticed that: <?php echo $_GET['get']; Will not make ...