Hot answers tagged

189

Hacks that work just by changing the URL One legit and one malicious example Some examples require URL encoding to work (usually done automatically by browser) SQL Injection code: $username = $_POST['username']; $pw = $_GET['password']; mysql_query("SELECT * FROM userTable WHERE username = $username AND password = $pw"); exploit (logs in as ...


80

There's an even easier way to bypass the "execute" permission: copy the program into a directory you own and set the "execute" bit. The "execute" permission isn't a security measure. Security is provided at a lower level, with the operating system restricting specific actions. This is done because, on many Unix-like systems (especially in the days of ...


62

You seem to have a pretty clear understanding of the risks. As others have stated it highly encouraged to use a strong password, so if you are running a sensitive service, then by all means, please use strong passwords only. When using a weak password, there are a couple risks that come to mind which you did not mention: There may be other services besides ...


46

You might have guessed this, but never use the terminals pasting functionality to paste things into vim/emacs. It's like sending a batch of commands to the editor, that can do anything. For these reasons, editors have their own copy-pasting functionality, which cannot be injected. For instance, in vim, you should use the + register to exchange data with the ...


43

Yes, something just has to execute it. The X flag hints to the shell that it can be directly executed, but that doesn't stop other programs from executing it if they know how. For example, if you have a file a.sh which is not executable to the shell, you can execute it by calling bash a.sh (which tells bash explicitly to execute it). If you have a non-...


27

Note that as of version 292, xterm removes ASCII control characters except \b, \r, \t, DEL (0x7f) and \n (it converts \n to \rs like other terminals), and you can bring them back with the allowPasteControls resource. VTE (the terminal emulator library used by gnome-terminal, terminator, xfce-terminal...) also does it since October 2015 So in those terminals,...


27

You can set the execute bit, but not the read bit, on an executable file. That way, noone will be able to copy the file, but people can execute it anyway. This is quite pointless today, because a) it works for compiled programs only, not with scripts (on most systems); b) these days, with 90% of all unixes being linux, people can copy executables from just ...


26

From their own FAQ: Q: Has your secure datagram protocol been audited by experts? A: No. Mosh is actively used and has been read over by security-minded crypto nerds who think its design is reasonable, but any novel datagram protocol is going to have to prove itself, and SSP is no exception. We use the reference implementations of AES-128 and OCB, and we ...


24

The (currently) most common way in is through holes in PHP applications. There are dozens of ways in which this could work, but here's a simple, easy one: Imagine the unsuspecting site owner decides to take a shortcut in his code such that http://example.com/site.php?module=xyz actually first loads some template shell and then run "xyz.php" to fill in the ...


22

To answer my own question: It seems that some systems are, or rather were indeed insecure, leaking environment information to other processes. A similar issue to the present one is raised on github by user 'mitchblank' for the 'mosh' application (mobile shell). The author writes: Background: in the process image argv[] and envp[] are stored in the same ...


21

Basically it's using the suid bit. If you check the passwd command in your machine: -rwsr-xr-x 1 root root 43K Feb 15 2011 passwd SUID (Set owner User ID up on execution) is a special type of file permissions given to a file. Normally in Linux/Unix when a program runs, it inherits access permissions from the logged in user. SUID is defined as ...


19

Well, it turns out that my current approach to clipboarding is good at mitigating this. When copy pasting snippets between tabs, I just copy paste normally. However, when copy pasting into a terminal/PuTTY session, I (being a bit averse to editing the text in the terminal), usually assemble it in Notepad++ or Emacs (depending on OS) and then copy-paste ...


18

I could claim that any copy&paste of code snippets is a bad habit, but that's side-stepping the issue. I personally type such code elements instead of copying them, but that's because I usually want to change some things in them, or learn how to do the task at hand; or maybe I am just a raving maniac. What you could do is to automatically sanitize ...


18

Aside what's mentioned by the other users, sudo also keeps the original identity of the user that's executing the command. Meaning that you can track what userid performed the command. If you are using root in a multiuser environment, you will not be able to track the execution of a command to a single user as the uid will be 0.


18

There are valid convenience uses for sudo, but because they are already adequately explained in other posts, I won't elaborate on them much here. I will however point you to sudoers(5), which is the sudo configuration file. It shows some of the extensive configuration possible with sudo. I will be explaining when and why you should not use sudo to elevate ...


16

environ is a pointer to pointer, as it has the type char **environ. You have to try something like: (gdb) x/s *((char **)environ) 0xbffff688: "SSH_AGENT_PID=2107" (gdb) x/s *((char **)environ+1) 0xbffff69b: "SHELL=/bin/bash"


16

No, it's not entirely secure. Let's look at each of the commands: dd if=/dev/urandom bs=256 count=1 2> /dev/null This will read a single 256 byte block from /dev/urandom, a cryptographically secure random source. The problem starts here, and is related to this 256 byte limit. In fact, you do not even need to use dd here. The next command is perfectly ...


14

Normally, when su runs, it runs setuid (as root). When you start it with gdb, the setuid bit doesn't take effect (because it's being ptraced), so even if you convince it that you entered the right password, it won't have permission to actually give you a new UID. The reason for this is to mitigate the exact attack you describe.


13

You do not need a strong password. The advise about password, like so many others, is a safe default that we security professionals give because it is usually a good advise, many people (and companies) don't understand risk very good, and in case of doubt, err on the side of caution. If you not only understand, but already mitigated the risks, you are good....


12

man chmod #Debian Linux RESTRICTED DELETION FLAG OR STICKY BIT The restricted deletion flag or sticky bit is a single bit, whose interpretation depends on the file type. For directories, it prevents unprivileged users from removing or renaming a file in the directory unless they own the file or the ...


12

The MySQL root user is an account inside the database only. It is called root because it is the most privileged user on the database server, and has access to everything. The root user on Linux (or any other Unix) is a completely separate thing. The maximum privilege that a MySQL user can have is equal to the privilege that the MySQL daemon runs at. On most ...


11

There are 2 ways of looking at it, you could focus on the server itself, or focus on the web application that the server is running. As a server, it can have open ports running services that you can connect to and gain access to the server. By using known exploits, you could gain root access. For example, some FTP servers for Unix have vulnerabilities that ...


11

Use Samba 3.3.x+ and set server signing = [auto|mandatory|disabled] in the Global section (disabled by default). Share level SMB encryption is auto by default. This has been tested with WinXP/Win7 and AIX 5.3 running Samba 3.6.7. SMB encryption became available in Samba 3.2 but server signing did not appear until 3.3. These are required for Win7 clients ...


11

Let's say you have the file myscript containing the following: #!/bin/bash echo "Hello, World!" If you make this file executable and run it with ./myscript, then the kernel will see that the first two bytes are #!, which means it's a script-file. The kernel will then use the rest of the line as the interpreter, and pass the file as its first argument. ...


10

To answer your questions in order: You can see all authorized keys by running the following script with root privileges. #!/bin/bash for X in $(cut -f6 -d ':' /etc/passwd |sort |uniq); do if [ -s "${X}/.ssh/authorized_keys" ]; then echo "### ${X}: " cat "${X}/.ssh/authorized_keys" echo "" fi done Any valid user may create ...


9

If someone has physical access to the machine they can modify these files to create a new root account or crack existing password hashes which is useful due to the prevalence of password reuse. Renaming or changing the location would be "(in)security though obscurity" and will provide no appreciable protection against this attack pattern. Steps to protect ...


9

One method which I have seen used: split the password. This was for SSH access to a sensitive server: a number of SSH keys were created, and marked as "authorized" on the server. Each private key was protected with a long passphrase, and every user knew only one half of the passphrase. That's crude but effective as long as there are not too many ...


8

Passwords in unix were originally stored in /etc/passwd (which is world-readable), but then moved to /etc/shadow (and backed up in /etc/shadow-) which can only be read by root (or members of the shadow group). The password are salted and hashed. The default formats are MD5-crypt, bcrypt, sha256-crypt, sha512-crypt, and for historical reasons DES (note DES ...


Only top voted, non community-wiki answers of a minimum length are eligible