Skip to main content
OverflowAI is here! AI power for your Stack Overflow for Teams knowledge community. Learn more
87 votes

Does blocking keywords prevent code injection inside this interactive Python file?

Simple blacklists are about the worst way to patch a vulnerability. They'll create a lot of false positives and any determined attacker will usually find a way around them. Web Application Firewalls ...
nobody's user avatar
  • 11.6k
33 votes

Is it a good idea to use non-ASCII names in the U.S.?

There are even Chinese people in the US. They name their children 李某. Would that be a problem? No. Some systems support these names, some use versions converted to ASCII through romanization (李某 → ...
Esa Jokinen's user avatar
31 votes
Accepted

Is 'Internal Server Error' always a sign that there's a SQL Injection vulnerability in a site?

As stated, the answer to the question is "certainly not", HTTP 500 Internal Server Error is used by pretty much every web server in the world for any uncaught exception, which could be ...
CBHacking's user avatar
  • 48.9k
20 votes

Is it a good idea to use non-ASCII names in the U.S.?

I don't live in the US but I live in a street that has (if written correctly) 2 German Umlauts in their name. I never had a problem with my passport or with US authorities, visa waiver programs or ...
nvoigt's user avatar
  • 1,653
15 votes

Are there any security bugs with UTF-8?

The common inherent possible security issues from adding Unicode support (not specific to UTF-8) come from the increased potential for visual spoofing, and issues coming from normalization mismatches. ...
Macil's user avatar
  • 1,491
11 votes
Accepted

Is it safe to redirect to URL parameter without filtering?

The short answer No. This is not safe, and should not be done. In fact, this is the last one of OWASP Top 10: A10. Unvalidated Redirects and Forwards Web applications frequently redirect and forward ...
Anders's user avatar
  • 65.6k
9 votes

Is it a good idea to use non-ASCII names in the U.S.?

Posting this relevant link, because (to my surprise) no-one's mentioned it yet: Falsehoods Programmers Believe About Names I think it should be compulsory reading for anyone who works on systems ...
gidds's user avatar
  • 199
8 votes

Are there any security bugs with UTF-8?

AgentME's answer describes two important classes of Unicode-related vulnerabilities: visual similarity, and normalization. I won't go over them. There are also vulnerabilities related to UTF-8 ...
Gilles 'SO- stop being evil''s user avatar
8 votes
Accepted

Is code injection possible in any compiled or interpreted languages?

Yes, this is a real thing. But just like with SQLi you can not just exploit any program, but a poorly written one with insufficient input sanitation could be vulnerable. Lets look at interpreted ...
Anders's user avatar
  • 65.6k
8 votes
Accepted

Does "=cmd" CSV injection still exist in 2020?

Finally found the reason why the payload were not executing: DDE launch was disabled in Excel options. If someone has the same issue, this setting can be found in File → Options → Trust Center → ...
Scaum's user avatar
  • 301
7 votes
Accepted

Is this sanitization method secure?

Is a generic input filter enough? No, input sanitation is not the proper defense against any attacks, so just because you do have some filters is no reason to call it a day. You do need proper ...
tim's user avatar
  • 29.6k
7 votes

This is a working SQL-injection. What could the server side query string look like?

In MySQL, the # symbol can be used as a comment marker. Quote marks in comments don't have to balance. Not all SQL instances run on Microsoft databases.
John Deters's user avatar
  • 34.2k
7 votes
Accepted

What does "injection proxy" mean in RCS of HackingTeam?

An injection proxy is a man-in-the-middle application that actively monitors traffic and injects (malicious) content based on predefined rules. This is roughly the attack scenario outlined in the ...
Arminius's user avatar
  • 44.8k
7 votes
Accepted

Security implications of Suprocess executing with a active shell vs no shell

The major difference is the way you construct your commands: subprocess.Popen("ls -l /tmp", shell=True) vs subprocess.Popen(['ls', '-l','/tmp']) The first example is one string and works with ...
Lucas Kauffman's user avatar
7 votes
Accepted

Difference between Code Injection, Command Injection and Remote Code Execution

Hmm let me try: Code injection consists of modifying an executable / compilation unit / script so that it contains malicious code on top of it´s intended functions. Code can be injected locally into ...
flohack's user avatar
  • 547
7 votes
Accepted

Q: Need help understanding hacked site that only impacts AT&T LTE users

Is the page server over https? If not it could be AT&T intercepting and injecting ads. See https://www.pcworld.com/article/2976298/websites/att-wi-fi-hotspot-caught-injecting-ads-into-web-pages....
David Waters's user avatar
  • 2,801
7 votes
Accepted

Preventing dangerous CSV Formula Injection

I don't think that stripping some characters can be a strong solution, especially if you develop the functionality by yourself: someone could manage to bypass this check by encoding these characters ...
meliot's user avatar
  • 86
7 votes
Accepted

Some doubts about SQL Injection examples, how exactly works?

You've misread the injection, specifically this part: ""="" This isn't checking if the Name is an equal sign, but rather if an empty string is equal to an empty string. It's effectively the same ...
Conor Mancone's user avatar
7 votes

Is it a good idea to use non-ASCII names in the U.S.?

There are two answers to this question. One involves talking about "Is it possible?" the other involves talking about "What are the costs & concerns?". The first will greatly enlighten the ...
Walter's user avatar
  • 232
6 votes
Accepted

Is jQuery 2.1.1 vulnerable to OS command injection?

It's a false positive. In both cases, the scanner only searched for "root:", assuming it is part of a passwd file. The line that is found is: root:function(a){return a===o} This is obviously not ...
tim's user avatar
  • 29.6k
6 votes

Is it safe to redirect to URL parameter without filtering?

Current versions of PHP detect and prevent newline injections in the header function, see How to avoid HTTP Header Injection (new lines characters). In older versions pf PHP you could probably do ...
Steffen Ullrich's user avatar
6 votes

Remote OS command injection - tests

Automatic vulnerability scanners often produce false positives with timing based payloads. This is because the scanner only checks if the request takes longer than the injected pause. If there is ...
tim's user avatar
  • 29.6k
6 votes
Accepted

jquery.js Dynamic Code Evaluation: Code Injection on setTimeout() line

It's a false positive. Reporting false code injection vulnerabilities is a well-known problem with HP Fortify and has confused developers before. Fortify just does basic static analysis of the ...
Arminius's user avatar
  • 44.8k
6 votes
Accepted

Is it possible for unprivileged user to modify/inject into other user's (root) process?

This is far from being a simple task thanks to memory protection techniques. In the old times of MS-DOS, Windows 9x and equivalent home computing systems, the memory was indeed equally shared amongst ...
WhiteWinterWolf's user avatar
6 votes

My ISP (BSNL India) is injecting ads using Phozeca which spoils websites and makes them unresponsive, can anything be done?

I had similar issues. I have a simple trick but it is temporary, but it is working for me and stopped BSNL ISP from tracking and pushing malware AD popup. I added a host entry in my computer for bsnl....
Preetham Hegde's user avatar
6 votes

My ISP (BSNL India) is injecting ads using Phozeca which spoils websites and makes them unresponsive, can anything be done?

It looks like the malware has evolved. It now uses an IP and is injecting itself into js files of 'http' websites (used a proxy for analyzing). For example in case of bbc.co.uk, when browser ...
Ravindra HV's user avatar
6 votes
Accepted

Injection of code into executable - Size question

Binary modification is a complex subject and requires some understanding of the system's application binary interface (ABI), process layout in virtual memory, the runtime environment, and the ...
julian's user avatar
  • 1,299
6 votes

Ensuring that non-executable files are not malicious

There is a new and growing technology area called Content Disarm and Reconstruction (CDR). This does what you are asking for in general, however not all CDR solutions tackle all file types (like audio ...
schroeder's user avatar
  • 130k
6 votes

Source code being injected into every website

tl/dr: It's definitely a plugin doing this, and is almost certainly a privacy-focused plugin that is trying to randomly obfuscate your user agent and plugin list to hide you from sites performing ...
Conor Mancone's user avatar

Only top scored, non community-wiki answers of a minimum length are eligible