Stack Exchange Network

Stack Exchange network consists of 174 Q&A communities including Stack Overflow, the largest, most trusted online community for developers to learn, share their knowledge, and build their careers.

Visit Stack Exchange

Perl is a high-level, general-purpose, interpreted, dynamic programming language.

0
votes
0answers
12 views

perl SSL mysql configuration [migrated]

We have an application written in Perl and I need to configure it to "talk SSL" with MySQL. mysq_ssl mysql_ssl_ca_file The path to a file in PEM format that contains a list of trusted SSL ...
1
vote
0answers
47 views

How I can use perl + burp? [closed]

How can I use [any]-perl script for pentesting (for example: script for subdomains enumeration)? How to redirect output from a perl-script to burp? This is possible? How can this architecture be ...
3
votes
3answers
335 views

Is this Perl database connection vulnerable to SQL Injection

I have this (stripped down) Perl database query, and I wonder if this can be exploited in any way. This is from a challenge, so I know things could be done different, the task is to exploit this. To ...
0
votes
1answer
283 views

How would someone execute a Perl script on a webpage?

OWASP's XSS Filter Evasion Cheatsheet has a Perl script listed: perl -e 'print "<IMG SRC=java\0script:alert(\"XSS\")>";' > out It also says this above it: Null chars also work as XSS ...
0
votes
1answer
216 views

Need to make secure apache while using cgi script in browser

My apache server has cgi module enabled because we need to execute cgi scripts in browser. We have enabled suExec module of apache which allows to execute cgi script as a particular user, In our case ...
2
votes
1answer
119 views

Is there any bias in this random selection from a dictionary?

I am generating passwords by selecting random words from a dictionary and counting entropy=words_in_passphrase*log(dictionary_size)/log(2). This algorithm assumes words will be selected from the ...
1
vote
1answer
728 views

SSH “on keyboard interactive devices” brute force vulnerability

I was researching the OpenSSH brute force vulnerability "onkeyborad-interactive devices", however I am not sure how this command really works ssh -lusername -oKbdInteractiveDevices=`perl -e 'print "...
3
votes
1answer
867 views

Is my server vulnerable to a perl exploit?

I have a few worrying entries in my web server logs and I'm wondering if this means that my server is vulnerable. Firstly, the following seems to fail, receiving a 404 response: [15/Jan/2016:10:27:...
3
votes
1answer
213 views

Malicious RCE functions in CGI and Java

I know there are some functions in CGI and Java that can be abused to perform remote code execution attack. For example we can see abuse of "eval" function in Movable Type CMS: sub ...
1
vote
1answer
44 views

Does Perl's unpack function have format vulnerabilities?

I'm using Perl for the first time for production software and I have some trust issues with it. When I use the unpack() function, is it safe to use user input in the TEMPLATE string? I'm using a ...
2
votes
2answers
2k views

Sucpicious process running in CentOS server

Following is the output of the "top" command. I have clipped the result. Here, I want to know the detail of the process called httpd.pl. PID USER PR NI VIRT RES SHR S %CPU %MEM TIME+ ...
0
votes
2answers
296 views

If perl/python is not guaranteed to be installed on a target system why are those scripts useful to hackers?

If you don't install perl/python on your system then hackers can't use it (or they would make themselves obvious if they installed it)? I am just trying to understand why these languages are ...
2
votes
1answer
575 views

How easy is it to crack this encryption algorithm? [closed]

When I was about 13 or 14 years old, I was a little interested in cryptography (which is, after all, an interesting field). I learnt quite a lot since that time (it has been about 8 years since then), ...
1
vote
2answers
2k views

Identifying HP Printers with NMAP and then using results in Python/Perl

Great write up on network printer hacking at IronGeek's site here for anyone interested http://www.irongeek.com/i.php?page=security/networkprinterhacking. Here's what I want to do: Scan the subnet ...
3
votes
2answers
1k views

Caught this hitting our webmail server, any ideas?

So this was bouncing off our webmail server for the last couple days, I took it home today to look it through. Any ideas as to what is does/is/attempting to do? I have been looking through and would ...
2
votes
1answer
540 views

Identifying strange Perl CGI script

Recently, while looking at some Perl CGI files, I came across this. I am not familiar enough with Perl to know exactly what it means, but I did attempt to base64 decode the string to no effect. Can ...
4
votes
2answers
428 views

Perl CPAN modules in a PCI-DSS environment

We are currently working on implementing the PCI-DSS ruleset in our IT environment, where all of the inhouse software we use is Perl. We have a Perl dev team of about 10 people (inlcuding me) and ...
1
vote
3answers
1k views

Web Application - Cookie Expiry

We are using a web application on cloud. I need a small clarification. We are using Perl with Apache. I see a following issue here for the below scenario. I need some inputs of whether this is most ...
5
votes
2answers
2k views

Tools for analyzing Perl 5 code? [closed]

I'm looking for good tools for analyzing and/or detecting security issues in a large software project written in Perl 5. It could be static or dynamic analysis. I know that Perl is undecidable, but I'...
21
votes
7answers
17k views

How can I avoid putting the database password in a perl script?

I have a cronned Perl script that connects to our database and does various kinds of lookups and integrity checks. The original script was written by someone long ago. My job is to make some changes ...
3
votes
3answers
876 views

Need help decoding suspicious Perl .cgi files

I found three (identical) .cgi files in the "cgi-bin" directory of a hacked website account. My knowledge of Perl is insufficient to decode them. I see some regexp with code execution, but I don't see ...
2
votes
1answer
1k views

Can /etc/passwd file be accessed on a cpanel shared hosting account?

Given standard server hardening was performed, can the /etc/passwd be accessed by a shared hosting account by using PHP or Perl scripts which is executed from the public_html of the shared account?
4
votes
3answers
4k views

Disable Perl for some/most Linux users?

One of my server's web accounts got hacked a couple of times. Each time someone downloaded a Perl script via some phpBB forum and used the Perl script to do whatever they wanted to do (mostly connect ...