Collaborate Disseminate
Im working on a project where I automate security tests for CI environment. I want to automate injection attack (XSS and SQL injection), Are there open-source tools can be used for the automation process where the output is JSON?
Any sugg… Continue reading tools to automate injection attack (xss, sql injection) [closed]
Can you use fork() in a SSI command instead of exec(), e.g: <!–#fork cmd=”***” –>?
<input type=”email”
class=”form-control”
name=”email address”
id=”signinEmail”
placeholder=”Email address”
aria-label=”Email address”
value=”INPUT”
required=””
data-msg=”Please enter a valid email address.”
data-error-class=”u-has-error… Continue reading SQL vulnerable if input type = email check is enabled
I’m trying to understand something I came accross when looking through documentation for HttpRuntimeSection.RequestValidationMode property.
In ASP.NET 4.0 and later, to disable the built in request validation two things have to happen:
… Continue reading Breaking request validation where requestValidationMode property is set to 2.0
I was reviewing code of an application that uses the following piece of Java code and wanted to know if the the use of exec() was susceptible to command injection.
public class FindFileInDir {
public static void main(String[] args){
… Continue reading Safe usage of Runtime.getRuntime.exec(String[])
Is there a way to bypass the – while running any command? In other words, I have an input that is filtering some characters in a website, one of them is the -. So I am looking for a way to run some commands that needs the -. Is there an al… Continue reading bypassing – while running a bash command [closed]
I’m trying to crack my wifi (WPA-CCMP) password to test its strength and security, I’m using the commview for wifi and aircrack-ng software on windows 10. I’ve three laptops, Windows 10 (64bit) with dual boot ubuntu 18.04, only Windows 10(… Continue reading wifi cracking using a network adapter which doesn’t support packet injection
I’m wondering if the following code is vulnerable to command injection in bash:
sumo /bin/netflash -Uk $CONTROLED_OPTION 2>&1
I’m thinking since it’s not included in ” ” it should be vulnerable but I’m not sure since I can’t m… Continue reading Is this bash command vulnerable to code injection?
I have a fundamental theory question. Is looking for cross-site scripting a solved computer science problem? Or is it an open problem? Does it approximate the halting problem, injection problem or similar known CS problems?
Or is XSS not … Continue reading Is ‘looking for all XSS in my code’ a solved computer science problem?
Often, in different websites, when I input text into a field with JavaScript (for the sake of automating form filling):
document.querySelector(“#username”).value = “USERNAME”;
I encounter the following problem.
My problem
The very inp… Continue reading What can make a web application not recognizing inputting values with JavaScript? [closed]