New answers tagged

0

Use a strict content security policy (CSP). See https://developer.mozilla.org/en-US/docs/Web/HTTP/CSP for more info.


2

It's malicious. Everything about logos and stuff is misdirection. What it's really doing is taking the base64 string, decoding it, some other tricks for obfuscation, then running it through create_function and calling the function (which is the same as just evaling it). For reference, here's a deobfuscated version of pre_term_name, showing that it's ...


0

How do I prevent the cross site scripting? Perform input validation and output encoding. Only allow characters that you expect, for example if you only expect digits, the back-end should not process regular characters. Sometimes you expect a specific length, if the back-end detects it's either smaller or larger, do not process it. Same goes for special ...


1

I would certainly let the site owners know if possible. This looks like a GDPR breach of the other website. First and foremost, their breach, their primary responsibility. You are now responsible for not allowing any personal data (if you have any) to go any further. Although you would probably want to just delete it unless it becomes necessary for ...


2

Question 1: Are in this case WooCommerce, my website’s host, third party security, backup and other plugin providers considered as service providers in case I use URL redirection method or iFrame for payments? Meaning that they should be PCI DSS validated? Or does that apply only to the payment processor/gateway as others are not involved in ...


4

The only way anyone would be able to prove they created the network is by moving Bitcoins out of one of the very first (and oldest) blocks (EDIT: or signing something with their private key). As this is not demonstrated on the website, the fact of whether it is secure, hosted on WordPress or any other indication is irrelevant. I think it's safe to say that ...


6

I assume that it is a MySQL database. 1749 (is greater that 0) and nQtm (valid alias - "variable name" for derived table) were chosen randomly by sqlmap. The problem with sleep(N) is that SQL database evaluates it to 0 and hence post=1 AND 0 will be evaluated to zero (FALSE : 1 AND 0 = 0) too. Value 1749 gets interpreted by SQL database as TRUE (similar ...


0

In general SQL injection depends on the database engine used, I think in your example you provide a sql for MariaDB/MySQL database. The function sleep on PostgreSQL is pg_sleep, so your injection will not work on PostgreSQL. MariaDB [CODINGGROUND]> (SELECT 1749 FROM (SELECT(SLEEP(1)))nQtm) ...


0

Yes, your concern is justifiable. From the Set-Cookie documentation at Mozilla: Path=<path-value> Optional Indicates a URL path that must exist in the requested resource before sending the Cookie header. The %x2F ("/") character is interpreted as a directory separator and sub directories will be matched as well (e.g. path=/docs, "/...


0

The most simplest way is to put your website behind a service like Cloudflare. You can basically do everything you just mentioned + you also get protection against SQLi, XSS, DDOS and many more. Obviously this still allows your web server to be directly accessible without protection, so you need to only allow Cloudflare IP's to be able to access it with a ....


Top 50 recent answers are included