Command injection: from input to shell
Passing user input to a system shell is one of the shortest roads to command execution. A ; or a $() and it is done.
notes on hacking and technology
|
main menu
user menu
topics
|
latest postsSSTI: server-side template injectionTemplate engines evaluate expressions. If user input lands in the template rather than the data, those expressions become a path to code execution. IDOR/BOLA: when the ID is the only defenceChange a number in the URL and see another user's data. Trivial, extremely common, top of the OWASP API Top 10. Password hashing: bcrypt, scrypt, Argon2Passwords are not encrypted, they are hashed with a slow, salted function. MD5/SHA are wrong here: they are too fast. OAuth 2.0: the recurring pitfallsOAuth delegates access, not identity. Weak redirect_uri, missing state and tokens in the fragment are the errors that keep coming back. SAML attacks: the signature nobody checks properlySAML carries signed XML assertions. XML Signature Wrapping and comment injection exploit the gap between what is signed and what is read. Session fixation: fixing the ID before loginIf the server does not regenerate the session ID at login, the attacker plants a known one and then inherits the victim's authenticated session. Padding oracle: decrypting without the keyIf a server reveals whether a CBC ciphertext's padding is valid, that single bit is enough to decrypt byte by byte. No key needed. Length extension: why H(secret||msg) is not a MACWith MD5/SHA-1/SHA-256, given H(secret||msg) and the length, you can compute H(secret||msg||padding||extra) without knowing the secret. ECB: the mode that draws the penguinECB encrypts each block independently, so identical blocks give identical ciphertext. Plaintext patterns survive encryption. Weak RNG: predictable tokensA reset or session token generated with rand() or based on time is guessable. Cryptographic randomness is not optional. MFA bypass: where the second factor breaksMFA stops password theft, not implementation mistakes: OTP without rate limiting, skippable flow, or notification fatigue. |
latest posts
your IP address:
216.73.216.108
visitor #0
MOTD:
Every abstraction leaks somewhere. Here we look at where. |
topics