58
Yes, that's possible.
The malware probably wouldn't be embedded in the video itself, but the video file would be specially crafted to exploit a vulnerability in the codec or media player, to gain code execution. The exploit would then download a file and run it, infecting the machine.
These types of exploits have been common amongst popular document ...
51
The Zodiac killer ciphers are an interesting case. As there were four ciphers sent to the local papers, I will address each in turn. They do share some common traits however.
They are each their own cipher, so the 'solution' used for cipher 408 cannot be applied to the other messages.
Each message has a unique character count.
The Zodiac Killer sent these ...
44
This is taken from one of my questions on Stack Overflow: Which $_SERVER variables are safe?
Server controlled
These variables are set by the server environment and depend entirely on the server configuration.
'GATEWAY_INTERFACE'
'SERVER_ADDR'
'SERVER_SOFTWARE'
'DOCUMENT_ROOT'
'SERVER_ADMIN'
'SERVER_SIGNATURE'
Partly server controlled
These variables ...
31
Lets look at this example payload (A), encoded once (B) and twice (C):
A. <script> alert(1) </script>
B. %3Cscript%3E alert(1) %3C%2Fscript%3E
C. %253Cscript%253E alert(1) %253C%252Fscript%253E
Double encoding can be used to bypass XSS filters when different parts of the applicaition makes different assumptions about if a variable is encoded or ...
27
You're assuming that they're actually encrypted. A lot of crazy people have written things that nobody understands. Just because the author thinks they're in code doesn't necessarily mean that the code can be reversed.
26
When this string is decoded from its url-encoded form it becomes the following:
25' having 1=1--
This string, when placed as is into, for example, the following (PHP) database query function:
mysql_query("SELECT * FROM users WHERE username = '$username'");
Becomes this:
mysql_query("SELECT * FROM users WHERE username = '25' having 1=1--'");
Note here ...
17
(Copied from my answer on StackOverflow )
No.
HtmlEncode simply does NOT cover all XSS attacks.
Encoding is the correct solution, but not always HTML encoding - you need context-sensitive encoding.
For instance, consider server-generated client-side javascript - the server dynamically outputs htmlencoded values directly into the client-side javascript, ...
14
Can I 100% rely on $_SERVER[] to be a safe source of data that I do not need to sanitized like I do $_GET[] and $_POST[]?
Your question immediately indicates failure. All sources of input must be sanitized. Input is not just considered channels that the user can directly control, but all sources of data outside of your application.
Think of it this way, ...
14
This exploit is only possible in old versions of Internet Explorer. Modern browsers will not auto detect the encoding as UTF-7.
OWASP:-
This does not work in any modern browser without changing the encoding type which is why it is marked as completely unsupported.
Wikipedia:-
To mitigate this problem systems should perform decoding before validation ...
13
You've generating the base64 encoding of the ASCII hex string, rather than the raw bytes of the hash function's output.
12
the registry key is the result of some kind of encoding error.
This.
潓瑦慷敲卜湹潣敶祲
encoded in UTF-16LE (Windows's usual encoding for Unicode strings) is the byte sequence:
53 6f 66 74 77 61 72 65 5c 53 79 6e 63 6f 76 65 72 79
Which represents the ASCII string:
Software\Syncovery
So it would seem Syncovery called a Win32 Unicode API to write a registry ...
12
The problem
Abusing character encodings is a popular trick to get XSS to work even when there are filters in place. There are a number of different situations when it works, but they all share common prerequesits:
The attacker sends a payload in character encoding A.
The server doing the filtering or sanitazion is working in character encoding B.
The ...
10
Your MD5 hash {MD5}KdScezWFVZxY7rHb5C4X1w== appears to be base64 encoded. MD5 hashes in the rainbow tables probably would be in hexidecimal, so you should convert the two.
In python you can do this with
>>> from base64 import b64decode, b16encode
>>> b16encode(b64decode('KdScezWFVZxY7rHb5C4X1w==')).lower()
'...
9
package test.pkcs7;
import java.io.ByteArrayOutputStream;
import java.io.FileInputStream;
import java.math.BigInteger;
import java.security.KeyStore;
import java.security.PrivateKey;
import java.security.Signature;
import java.security.cert.X509Certificate;
import java.util.Enumeration;
import sun.security.pkcs.ContentInfo;
import sun.security.pkcs.PKCS7;
...
9
Risk assessment. If the URLEncoded data is inserted into HTML context (e.g., between tags), I do not know of any way to introduce a XSS attack. URLEncode will escape the <, >, and & characters (to %3C, %3E, and %26, respectively). In modern browsers, I believe this is sufficient to prevent XSS for values inserted between tags.
There are some ...
9
The simplistic scenario would be to try and send --><?php phpinfo();?><!--. If the <?php tag is escaped, then this would result in
<!-- -->
<?php phpinfo();
<!-- -->
(newlines added for clarity). But the presence of <?php ...?> in the HTML page might not be enough; the PHP code needs to be interpreted server side, not ...
9
No, that's not going to fool spambots. I've seen a couple of spambots that were parsing the entire DOM using tools like html5lib or comparables. Of course, many spammers just "guess" at email addresses: the cost of sending emails when you have a botnet is basically 0, so making combinations of username & domains to guess works out well.
Slightly ...
8
The "search space" has size 2256. It is not enlarged or reduced depending on whether you use hexadecimal or Base64. When you encode a 256-bit string (aka 32 bytes) in Base64, you indeed get 44 characters, but not all combinations of 44 characters (taken in an alphabet of 64) are possible. The 44th character will always be an '=' sign, and there are only 16 ...
6
If this is indeed a simple password hash, we might be able to use Google to crack it. Base64 is hard to search for, though, with all those slashes and plus signs, so let's first convert that hash into hexadecimal:
$ perl -MMIME::Base64 -le 'print unpack "H*", decode_base64 "WeJcFMQ/8+8QJ/w0hHh+0g=="'
59e25c14c43ff3ef1027fc3484787ed2
OK, now we can Google ...
6
The //<
6
Not a silly question at all!
Many (but not all) of the $SERVER variables are passed from the users browser (or can be influenced by the user), for example the QUERY_STRING, REQUEST_URI and all of the HTTP_* variables.
Even the REMOTE_ADDR variable can be spoofed using raw sockets (although only with valid IPs as far as I'm aware).
I'd escape them all as a ...
6
what you're seeing there is a fairly standard SQL Injection attack vector. The code it's adding can modify SQL statements if the input isn't handled correctly by the application (but I guess you worked that out from the title). There's a good description of the problem which mentions this vector in this paper from NGS/NCC.
In terms of mitigating the ...
6
After decoding the file, I can see it's from a mod-x.co.uk challenge. You should ask for help on their forums or figure it out yourself.
6
There is a pretty nice play-by-play of a real-life example of this on h-online (german it publisher). In this case it's a purposed flash video that contains several different attacks to infect the computer trying to display the video
6
Chrome and Firefox seem to no longer support UTF-7 in any format. The HTML5 specification says:
User agents must support the encodings defined in the WHATWG Encoding standard. User agents should not support other encodings.
User agents must not support the CESU-8, UTF-7, BOCU-1 and SCSU encodings. [CESU8] [UTF7] [BOCU1] [SCSU]
Support for ...
6
Wordpress is attacked 3.5 times more often than non-CMSes. WPScan is a great tool that's been around since the BackTrack Linux days.
However, there are more tools and techniques available. Here is a list of some newer tools:
https://github.com/RamadhanAmizudin/Wordpress-scanner
https://github.com/enddo/wp-plugin-scanner
https://github.com/0xBADCA7/wp-...
6
The encode() method HTML encodes characters, which is the correct XSS prevention method in this context.
So if a " character was inserted inside of $str to try and break out of the HTML attribute context, this would be converted to " or " which is the HTML representation.
Therefore it is not possible to inject script here, assuming encode ...
Only top voted, non community-wiki answers of a minimum length are eligible
