Questions tagged [perl]
Perl is a high-level, general-purpose, interpreted, dynamic programming language.
27
questions
0
votes
1
answer
132
views
Doing a diff between two keystore files
I have a keystore file with certificates and I want to compare if the second keystore has exactly the same contents as the first one.
One approach would be to extract the certificates using keytool ...
- 173
0
votes
1
answer
176
views
Is Template Toolkit safe against arbitrary code execution?
If a template is provided to Perl's Template Toolkit, can you ensure that the code generation inside Template Toolkit is sufficiently subsetted to be safe?
- 2,652
1
vote
0
answers
98
views
For creating tools, Bash, Perl or Python? Which should I invest my time in to? [closed]
Having trouble choosing between the three, I would of course love to learn all three in the future, but right now I'm curious as to which language would be the most beneficial to me.
Also, I'm aware ...
- 325
1
vote
1
answer
179
views
Executing perl scripts without actual file on a cpanel account
Processes with arrows are from same cpanel account let say "charlie"
This account was under control of client.
Last week this server got blacklisted on emails because client run some perl script to ...
- 111
0
votes
1
answer
1k
views
Allow ModSecurity to pass specific HTML tags?
I have a web-server running a Perl site, and I have a WAF (ModSecurity) running. The website has a form. When submitted the request contain HTML tags like so:
<br+/>
<div+style="border:none;...
- 195
1
vote
0
answers
234
views
How I can use perl + burp? [closed]
How can I use [any]-perl script for pentesting (for example: script for subdomains enumeration)?
How to redirect output from a perl-script to burp? This is possible? How can this architecture be ...
- 113
3
votes
3
answers
3k
views
Is this Perl database connection vulnerable to SQL Injection
I have this (stripped down) Perl database query, and I wonder if this can be exploited in any way. This is from a challenge, so I know things could be done different, the task is to exploit this.
To ...
- 858
0
votes
1
answer
791
views
How would someone execute a Perl script on a webpage?
OWASP's XSS Filter Evasion Cheatsheet has a Perl script listed:
perl -e 'print "<IMG SRC=java\0script:alert(\"XSS\")>";' > out
It also says this above it:
Null chars also work as XSS ...
- 109
0
votes
1
answer
765
views
Need to make secure apache while using cgi script in browser
My apache server has cgi module enabled because we need to execute cgi scripts in browser. We have enabled suExec module of apache which allows to execute cgi script as a particular user, In our case ...
- 79
2
votes
1
answer
200
views
Is there any bias in this random selection from a dictionary?
I am generating passwords by selecting random words from a dictionary and counting entropy=words_in_passphrase*log(dictionary_size)/log(2). This algorithm assumes words will be selected from the ...
- 315
1
vote
1
answer
2k
views
SSH "on keyboard interactive devices" brute force vulnerability
I was researching the OpenSSH brute force vulnerability "onkeyborad-interactive devices", however I am not sure how this command really works
ssh -lusername -oKbdInteractiveDevices=`perl -e 'print "...
3
votes
1
answer
2k
views
Is my server vulnerable to a perl exploit?
I have a few worrying entries in my web server logs and I'm wondering if this means that my server is vulnerable.
Firstly, the following seems to fail, receiving a 404 response:
[15/Jan/2016:10:27:...
- 126
3
votes
1
answer
398
views
Malicious RCE functions in CGI and Java
I know there are some functions in CGI and Java that can be abused to perform remote code execution attack.
For example we can see abuse of "eval" function in Movable Type CMS:
sub ...
- 61
1
vote
1
answer
112
views
Does Perl's unpack function have format vulnerabilities?
I'm using Perl for the first time for production software and I have some trust issues with it. When I use the unpack() function, is it safe to use user input in the TEMPLATE string? I'm using a ...
- 326
3
votes
2
answers
2k
views
Sucpicious process running in CentOS server
Following is the output of the "top" command. I have clipped the result. Here, I want to know the detail of the process called httpd.pl.
PID USER PR NI VIRT RES SHR S %CPU %MEM TIME+ ...
- 322
0
votes
2
answers
385
views
If perl/python is not guaranteed to be installed on a target system why are those scripts useful to hackers?
If you don't install perl/python on your system then hackers can't use it (or they would make themselves obvious if they installed it)?
I am just trying to understand why these languages are ...
- 153
2
votes
1
answer
757
views
How easy is it to crack this encryption algorithm? [closed]
When I was about 13 or 14 years old, I was a little interested in cryptography (which is, after all, an interesting field). I learnt quite a lot since that time (it has been about 8 years since then), ...
- 21
1
vote
2
answers
3k
views
Identifying HP Printers with NMAP and then using results in Python/Perl
Great write up on network printer hacking at IronGeek's site here for anyone interested http://www.irongeek.com/i.php?page=security/networkprinterhacking.
Here's what I want to do:
Scan the subnet ...
- 368
3
votes
2
answers
1k
views
Caught this hitting our webmail server, any ideas?
So this was bouncing off our webmail server for the last couple days, I took it home today to look it through. Any ideas as to what is does/is/attempting to do? I have been looking through and would ...
Unholyrattrap
2
votes
1
answer
610
views
Identifying strange Perl CGI script
Recently, while looking at some Perl CGI files, I came across this. I am not familiar enough with Perl to know exactly what it means, but I did attempt to base64 decode the string to no effect. Can ...
- 21
4
votes
2
answers
568
views
Perl CPAN modules in a PCI-DSS environment
We are currently working on implementing the PCI-DSS ruleset in our IT environment, where all of the inhouse software we use is Perl. We have a Perl dev team of about 10 people (inlcuding me) and ...
- 143
1
vote
3
answers
4k
views
Web Application - Cookie Expiry
We are using a web application on cloud. I need a small clarification. We are using Perl with Apache. I see a following issue here for the below scenario. I need some inputs of whether this is most ...
- 11
5
votes
2
answers
4k
views
Tools for analyzing Perl 5 code? [closed]
I'm looking for good tools for analyzing and/or detecting security issues in a large software project written in Perl 5. It could be static or dynamic analysis. I know that Perl is undecidable, but I'...
- 181
24
votes
7
answers
22k
views
How can I avoid putting the database password in a perl script?
I have a cronned Perl script that connects to our database and does various kinds of lookups and integrity checks. The original script was written by someone long ago. My job is to make some changes ...
- 2,237
3
votes
3
answers
1k
views
Need help decoding suspicious Perl .cgi files
I found three (identical) .cgi files in the "cgi-bin" directory of a hacked website account. My knowledge of Perl is insufficient to decode them. I see some regexp with code execution, but I don't see ...
- 81
2
votes
1
answer
2k
views
Can /etc/passwd file be accessed on a cpanel shared hosting account?
Given standard server hardening was performed, can the /etc/passwd be accessed by a shared hosting account by using PHP or Perl scripts which is executed from the public_html of the shared account?
- 2,938
3
votes
3
answers
5k
views
Disable Perl for some/most Linux users?
One of my server's web accounts got hacked a couple of times. Each time someone downloaded a Perl script via some phpBB forum and used the Perl script to do whatever they wanted to do (mostly connect ...
- 49