New answers tagged vulnerability
0
With GNU/Linux, this should be possible simply by mounting the / file system read-only and adding tmpfs file systems (that saves the data on RAM) for /var/log etc. that needs to be writable.
There are some caveats with this approach, though:
Any process with root privileges might mount the file system as read/write. An optical medium solves this, as it's ...
1
Don't assume you can trust the variable
Philipp has already given the examples on how to abuse this in his answer and there's no need to repeat that. Despite it depends on whether the $id comes directly from the user input or not, you shouldn't assume it will stay that way during the whole lifecycle of the application. If the ID currently e.g.
comes from a ...
3
When $id is a variable which is obtained from user input, then this is a textbook example of an SQL injection.
Your code will work if the $id is a numeric string like 42. But imagine what will happen if someone enters this string as their id:
' OR 1 = 1 --
Then the SQL query sent to the database will read:
SELECT id, username FROM users WHERE id='' OR 1 = 1 ...
0
For myself and other people who want a brief overview of the things discussed I will answer my own question for the sake of clarity.
The confusion arose when I read that the address ESP points to (after overflowing EIP) can’t be used to effectively jump to the shellcode as the address changes dynamically. At the same time, I was working with the debugger to ...
0
"As soon as you're displaying content from another domain, you're basically trusting that domain not to serve-up malware.
There's nothing wrong with iframes per se. If you control the content of the iframe, they're perfectly safe." - Shamelessly stolen from this thread.
However your web app could be vulnerable if there is XSS vulnerability inside ...
3
[why can't you] inject JMP ESP directly into the address of EIP, why do you need to
find an address that performs this call?
First of all, EIP is a register in x86. It itself does not have an address pointing to it. What you mean to say is more along the lines of "the value on the stack that will be popped into EIP at time of return". This is ...
Top 50 recent answers are included
