87
votes
Does blocking keywords prevent code injection inside this interactive Python file?
Simple blacklists are about the worst way to patch a vulnerability. They'll create a lot of false positives and any determined attacker will usually find a way around them.
Web Application Firewalls ...
- 11.5k
36
votes
Accepted
What vulnerability is targeted by an HTTP referer starting with (){ :;};/bin/bash
This is targeting the Shellshock bug (which even has its own tag):
GNU Bash through 4.3 processes trailing strings after function definitions in the values of environment variables, which allows ...
- 779
33
votes
Is it a good idea to use non-ASCII names in the U.S.?
There are even Chinese people in the US. They name their children 李某. Would that be a problem? No. Some systems support these names, some use versions converted to ASCII through romanization (李某 → ...
- 18.4k
32
votes
Accepted
Is 'Internal Server Error' always a sign that there's a SQL Injection vulnerability in a site?
As stated, the answer to the question is "certainly not", HTTP 500 Internal Server Error is used by pretty much every web server in the world for any uncaught exception, which could be ...
- 45.4k
23
votes
Accepted
Exposing database fields names in HTML
It is very common to do this. As you've noticed, there is a significant benefit for keeping code simple.
If you do have an SQL injection vulnerability, an attacker can figure out your database ...
- 33.1k
20
votes
Is it a good idea to use non-ASCII names in the U.S.?
I don't live in the US but I live in a street that has (if written correctly) 2 German Umlauts in their name.
I never had a problem with my passport or with US authorities, visa waiver programs or ...
- 1,092
17
votes
Accepted
PHP code injection using GET and echo
No, it's not possible to inject serverside code just via echoing CGI parameters. But as you say, it allows for a reflected XSS attack.
On the other hand, it's possible there may be other ...
- 18.5k
17
votes
Sucuri detects malware on wordpress but I can't find the malicious code
The malware in question is hosted elsewhere, and is (probably) being added by cross-site-scripting (XSS). If you have a look at the "var src" part, you'll see a long string of Base64-encoded text:
...
- 1,789
13
votes
Are there any security bugs with UTF-8?
The common inherent possible security issues from adding Unicode support (not specific to UTF-8) come from the increased potential for visual spoofing, and issues coming from normalization mismatches.
...
- 1,472
11
votes
Accepted
XSS via JSON: Why does a web application not sanitize either its incoming params hash or its outgoing JSON values of malicious tags like Script?
This is often brought up everywhere, partially because everyone keeps repeating the mantra that input sanitation is the answer. It isn't. It's dangerous, bug-prone, and it needs to go away. Of course, ...
- 22.6k
11
votes
Accepted
Is it safe to redirect to URL parameter without filtering?
The short answer
No. This is not safe, and should not be done. In fact, this is the last one of OWASP Top 10:
A10. Unvalidated Redirects and Forwards
Web applications frequently redirect and forward ...
- 65.2k
9
votes
XSS via JSON: Why does a web application not sanitize either its incoming params hash or its outgoing JSON values of malicious tags like Script?
Making inputs safe is better done as late as possible. That is, when data is output to the page. Globally "sanitizing" input data is bad because it is impossible to distinguish between good data and ...
- 33.9k
9
votes
Is it a good idea to use non-ASCII names in the U.S.?
Posting this relevant link, because (to my surprise) no-one's mentioned it yet:
Falsehoods Programmers Believe About Names
I think it should be compulsory reading for anyone who works on systems ...
- 199
8
votes
Accepted
Is code injection possible in any compiled or interpreted languages?
Yes, this is a real thing. But just like with SQLi you can not just exploit any program, but a poorly written one with insufficient input sanitation could be vulnerable.
Lets look at interpreted ...
- 65.2k
7
votes
PHP filter_input() not protecting from eval()
Which should be the correct way of securing the eval() in the case above?
There is no way to secure input to eval. Just don't use eval on any user-generated data.
- 196k
7
votes
Accepted
Is this sanitization method secure?
Is a generic input filter enough?
No, input sanitation is not the proper defense against any attacks, so just because you do have some filters is no reason to call it a day.
You do need proper ...
- 29.4k
7
votes
This is a working SQL-injection. What could the server side query string look like?
In MySQL, the # symbol can be used as a comment marker. Quote marks in comments don't have to balance.
Not all SQL instances run on Microsoft databases.
- 34.1k
7
votes
Accepted
What does "injection proxy" mean in RCS of HackingTeam?
An injection proxy is a man-in-the-middle application that actively monitors traffic and injects (malicious) content based on predefined rules.
This is roughly the attack scenario outlined in the ...
- 44.5k
7
votes
Accepted
Security implications of Suprocess executing with a active shell vs no shell
The major difference is the way you construct your commands:
subprocess.Popen("ls -l /tmp", shell=True)
vs
subprocess.Popen(['ls', '-l','/tmp'])
The first example is one string and works with ...
- 54.3k
7
votes
Accepted
Difference between Code Injection, Command Injection and Remote Code Execution
Hmm let me try:
Code injection consists of modifying an executable / compilation unit / script so that it contains malicious code on top of it´s intended functions. Code can be injected locally into ...
- 547
7
votes
Accepted
Q: Need help understanding hacked site that only impacts AT&T LTE users
Is the page server over https? If not it could be AT&T intercepting and injecting ads. See https://www.pcworld.com/article/2976298/websites/att-wi-fi-hotspot-caught-injecting-ads-into-web-pages....
- 2,801
7
votes
Accepted
Some doubts about SQL Injection examples, how exactly works?
You've misread the injection, specifically this part:
""=""
This isn't checking if the Name is an equal sign, but rather if an empty string is equal to an empty string. It's effectively the same ...
- 30.8k
7
votes
Accepted
Does "=cmd" CSV injection still exist in 2020?
Finally found the reason why the payload were not executing: DDE launch was disabled in Excel options.
If someone has the same issue, this setting can be found in
File → Options → Trust Center → ...
- 281
7
votes
Is it a good idea to use non-ASCII names in the U.S.?
There are two answers to this question. One involves talking about "Is it possible?" the other involves talking about "What are the costs & concerns?".
The first will greatly enlighten the ...
- 232
6
votes
Accepted
PHP filter_input() not protecting from eval()
filter_input is designed to filter out things that may cause issues with HTML output: from the PHP manual "Strip tags, optionally strip or encode special characters."
phpinfo() doesn't include any ...
- 27.3k
6
votes
Remote OS command injection - tests
Automatic vulnerability scanners often produce false positives with timing based payloads.
This is because the scanner only checks if the request takes longer than the injected pause. If there is ...
- 29.4k
6
votes
Is it safe to redirect to URL parameter without filtering?
Current versions of PHP detect and prevent newline injections in the header function, see How to avoid HTTP Header Injection (new lines characters). In older versions pf PHP you could probably do ...
- 196k
6
votes
Accepted
Is jQuery 2.1.1 vulnerable to OS command injection?
It's a false positive.
In both cases, the scanner only searched for "root:", assuming it is part of a passwd file. The line that is found is:
root:function(a){return a===o}
This is obviously not ...
- 29.4k
6
votes
Are there any security bugs with UTF-8?
AgentME's answer describes two important classes of Unicode-related vulnerabilities: visual similarity, and normalization. I won't go over them.
There are also vulnerabilities related to UTF-8 ...
6
votes
Accepted
jquery.js Dynamic Code Evaluation: Code Injection on setTimeout() line
It's a false positive.
Reporting false code injection vulnerabilities is a well-known problem with HP Fortify and has confused developers before. Fortify just does basic static analysis of the ...
- 44.5k
Only top scored, non community-wiki answers of a minimum length are eligible