87 votes

Does blocking keywords prevent code injection inside this interactive Python file?

Simple blacklists are about the worst way to patch a vulnerability. They'll create a lot of false positives and any determined attacker will usually find a way around them. Web Application Firewalls ...
user avatar
  • 10.8k
36 votes
Accepted

What vulnerability is targeted by an HTTP referer starting with (){ :;};/bin/bash

This is targeting the Shellshock bug (which even has its own tag): GNU Bash through 4.3 processes trailing strings after function definitions in the values of environment variables, which allows ...
user avatar
  • 769
33 votes

Is it a good idea to use non-ASCII names in the U.S.?

There are even Chinese people in the US. They name their children 李某. Would that be a problem? No. Some systems support these names, some use versions converted to ASCII through romanization (李某 → ...
user avatar
  • 15.9k
32 votes
Accepted

Is 'Internal Server Error' always a sign that there's a SQL Injection vulnerability in a site?

As stated, the answer to the question is "certainly not", HTTP 500 Internal Server Error is used by pretty much every web server in the world for any uncaught exception, which could be ...
user avatar
  • 39k
23 votes
Accepted

Exposing database fields names in HTML

It is very common to do this. As you've noticed, there is a significant benefit for keeping code simple. If you do have an SQL injection vulnerability, an attacker can figure out your database ...
user avatar
  • 32.6k
21 votes

Cross site scripting when the greater than and less than signs are escaped?

Oh yes it is! Consider this HTML: <a href="{{str}}"> and consider an input like: " onmouseover="alert('GOTCHA')" You get the picture. If your javascript is being injected within a tag ...
user avatar
  • 2,010
20 votes

Is it a good idea to use non-ASCII names in the U.S.?

I don't live in the US but I live in a street that has (if written correctly) 2 German Umlauts in their name. I never had a problem with my passport or with US authorities, visa waiver programs or ...
user avatar
  • 1,092
18 votes
Accepted

Is testing for SQL injection vulnerabilities still relevant in modern web applications?

Actually according to OWASP, SQL Injection is on top of the top 10 Vulnerabilities through Web applications. https://www.owasp.org/index.php/Top_10_2013-Top_10 and there are many papers, article, ...
user avatar
  • 2,694
17 votes
Accepted

PHP code injection using GET and echo

No, it's not possible to inject serverside code just via echoing CGI parameters. But as you say, it allows for a reflected XSS attack. On the other hand, it's possible there may be other ...
user avatar
  • 18.3k
17 votes

Sucuri detects malware on wordpress but I can't find the malicious code

The malware in question is hosted elsewhere, and is (probably) being added by cross-site-scripting (XSS). If you have a look at the "var src" part, you'll see a long string of Base64-encoded text: ...
user avatar
15 votes
Accepted

Is it secure to be using LDAP, or is LDAPS the only secure option?

LDAP, by itself, is not secure against active or passive attackers: Data travels "as is", without encryption, so it can be spied upon by passive attackers. Active attackers can manipulate the stream ...
user avatar
  • 168k
15 votes
Accepted

MongoDB Nosql injection in python code

The $where operator in MongoDB is a feature which is best avoided. Its performance is abysmal, and not just because it doesn't benefit from indexes. Almost every common use-case can be solved much ...
user avatar
  • 48.8k
13 votes

Are there any security bugs with UTF-8?

The common inherent possible security issues from adding Unicode support (not specific to UTF-8) come from the increased potential for visual spoofing, and issues coming from normalization mismatches. ...
user avatar
  • 1,482
11 votes
Accepted

XSS via JSON: Why does a web application not sanitize either its incoming params hash or its outgoing JSON values of malicious tags like Script?

This is often brought up everywhere, partially because everyone keeps repeating the mantra that input sanitation is the answer. It isn't. It's dangerous, bug-prone, and it needs to go away. Of course, ...
user avatar
  • 22.5k
10 votes
Accepted

Is it safe to redirect to URL parameter without filtering?

The short answer No. This is not safe, and should not be done. In fact, this is the last one of OWASP Top 10: A10. Unvalidated Redirects and Forwards Web applications frequently redirect and forward ...
user avatar
  • 64.2k
9 votes
Accepted

Understanding boolean based SQL injection

Is my understanding of the above correct ? Yes, your understanding is correct. ‍ If yes, then in the query, $Id=1' AND ASCII(SUBSTRING(username,1,1))=97 AND '1'='1, what is the need of the bold ...
user avatar
  • 2,003
9 votes

XSS via JSON: Why does a web application not sanitize either its incoming params hash or its outgoing JSON values of malicious tags like Script?

Making inputs safe is better done as late as possible. That is, when data is output to the page. Globally "sanitizing" input data is bad because it is impossible to distinguish between good data and ...
user avatar
8 votes

MongoDB Nosql injection in python code

Can anyone give me an example like what input may cause the issues For your concrete piece of code this should work: '; while(1);var foo='bar '; is used to escape the string and the statement, ...
user avatar
  • 29k
8 votes
Accepted

Is code injection possible in any compiled or interpreted languages?

Yes, this is a real thing. But just like with SQLi you can not just exploit any program, but a poorly written one with insufficient input sanitation could be vulnerable. Lets look at interpreted ...
user avatar
  • 64.2k
8 votes

Is it a good idea to use non-ASCII names in the U.S.?

Posting this relevant link, because (to my surprise) no-one's mentioned it yet: Falsehoods Programmers Believe About Names I think it should be compulsory reading for anyone who works on systems ...
user avatar
  • 189
7 votes

How do I hack this login page by using SQL injection?

You should ensure that you have the right skill set before offering to perform work for a client. This means that you looking at the website will be worthwhile and you won't give the client a false ...
user avatar
  • 612
7 votes

Is it secure to be using LDAP, or is LDAPS the only secure option?

The LDAP protocol is by default not secure, but the protocol defines an operation to establish a TLS session over an existing LDAP one (the StartTLS extended operation). Alternately, some ...
user avatar
7 votes

PHP filter_input() not protecting from eval()

Which should be the correct way of securing the eval() in the case above? There is no way to secure input to eval. Just don't use eval on any user-generated data.
user avatar
7 votes
Accepted

Is this sanitization method secure?

Is a generic input filter enough? No, input sanitation is not the proper defense against any attacks, so just because you do have some filters is no reason to call it a day. You do need proper ...
user avatar
  • 29k
7 votes

This is a working SQL-injection. What could the server side query string look like?

In MySQL, the # symbol can be used as a comment marker. Quote marks in comments don't have to balance. Not all SQL instances run on Microsoft databases.
user avatar
  • 33.6k
7 votes
Accepted

What does "injection proxy" mean in RCS of HackingTeam?

An injection proxy is a man-in-the-middle application that actively monitors traffic and injects (malicious) content based on predefined rules. This is roughly the attack scenario outlined in the ...
user avatar
  • 43.7k
7 votes
Accepted

Security implications of Suprocess executing with a active shell vs no shell

The major difference is the way you construct your commands: subprocess.Popen("ls -l /tmp", shell=True) vs subprocess.Popen(['ls', '-l','/tmp']) The first example is one string and works with ...
user avatar
7 votes
Accepted

Difference between Code Injection, Command Injection and Remote Code Execution

Hmm let me try: Code injection consists of modifying an executable / compilation unit / script so that it contains malicious code on top of it´s intended functions. Code can be injected locally into ...
user avatar
  • 547
7 votes
Accepted

Q: Need help understanding hacked site that only impacts AT&T LTE users

Is the page server over https? If not it could be AT&T intercepting and injecting ads. See https://www.pcworld.com/article/2976298/websites/att-wi-fi-hotspot-caught-injecting-ads-into-web-pages....
user avatar
  • 2,802
7 votes
Accepted

Some doubts about SQL Injection examples, how exactly works?

You've misread the injection, specifically this part: ""="" This isn't checking if the Name is an equal sign, but rather if an empty string is equal to an empty string. It's effectively the same ...
user avatar

Only top scored, non community-wiki answers of a minimum length are eligible