Sql injection cross site scripting vulnerability

SQL Injection: Tutorial Part 1

http://digitalpbk.blogspot.com/2009/06/hacking-sql-injection-tutorial.html SQL Injection: Tutorial Part 1 SQL InjectionWhat? What is SQL ? SQL stands for Structured Query Language, It is the most widely used database querying language. Before reading on I must say that this is an old technique and I dint want this to be posted because most sites have patched up this hole. I am posting this for the few websites I came across that had this vulnerability. If you have a website or planning to build one or administrates one please read on and fix the security holes ...

XSS on GrazeIt.com

http://digitalpbk.blogspot.com/2007/01/xss-on-grazeitcom.html XSS on GrazeIt.com Recently while grazing over the net, I found this site grazeit.com. This is a site which keeps a database of good websites found on the net by netizens. But there is an XSS hole (Cross site scripting ) on the site which allow users to redirect the page to any desired location.Of course this hack does not work on the secure browser Mozilla Firefox. If you are not using Firefox, download for free (The link is given bottom right).Probably you arrived at this page from grazeit ...

Wordpress nextGEN gallery XSS (Cross site scripting) Cookie Stealing Vulnerability

http://digitalpbk.blogspot.com/2009/07/wordpress-nextgen-gallery-xss.html Wordpress nextGEN gallery XSS (Cross site scripting) Cookie Stealing Vulnerability IntroNow I need not tell what actually an XSS is, for that refer to here. To see what I mean check out the links given below. If you are using NextGen wordpress plugin, you are probably infected.the VulnerabilityThe vulnerability on this wordpress plugin is seen in the pid, album, gallery GET variables. http://www.example.com/wordpress/next-gen-gallery/?album=1&pid=3&gallery=2The GET variables on most ...

Introduction to XSS Part 1

http://digitalpbk.blogspot.com/2006/12/introduction-to-xss-part-1.html Introduction to XSS Part 1 This document is purely for illustrative purposes only. I am not responsible for any losses arising to the websites mentioned below. Webmasters please be more alert...What is it?XSS stands for cross site scripting (CSS) Since CSS is already taken by Cascaded Style Sheets, it is named XSS X standing for a Cross. It is a kind of hacking which allows you to deface websites, loggin as another user etc. IntroductionLet us start by looking how websites work. Starting ...

XSS - Part 2 (Cookie stealing and Defacement)

http://digitalpbk.blogspot.com/2006/12/xss-part-2-cookie-stealing-and.html is used to manage sessions in browsers. Each person logged in gets a unique cookie, it is like a key to the site. So if you can get hold of this cookie, you have the key to enter the site. The site will welcome as the person from whom you stealed the cookie. Now let us look how to grab the cookie using cross site scripting. For cookie stealing there must be an xss hole which can be injected through the url of the page like the one on propmart.com we discussed in first part.Getting a cookie ...

XSS on Yaari.com

http://digitalpbk.blogspot.com/2007/04/xss-on-yaaricom.html XSS on Yaari.com Lots of friendship network sites are coming up these days following the success of orkut. Another one supposedly originating from the same stanford university is yaari.com targeted at mainly Indian users. The site looks and functionality seems fine but is full of XSS holes (Cross Site Scripting). Almost all the fields can be bugged. Only thing that amazes me is that the site has used PHP. PHP has such a wonderful list of functions that can take care of the XSS problem. I wonder ...

Protect yourselves from phishing

http://digitalpbk.blogspot.com/2007/01/get-smart-against-phishing.html Scripting holes) vulnerabities in your site. A fraud/hacker can manipulate the site and put fake login pages on your server. So all XSS vulnerabilities must be scanned and removed.Related+ Intro to XSS+ Mirroring character+ Protect yourselves from PhishingSpread the wordPlease spread the info to help protect yourselves and those near and dear from this peril !Any more info to share? Leave a comment... ...

XSS on JustDial.com

http://digitalpbk.blogspot.com/2007/04/xss-on-justdialcom.html XSS on JustDial.com JustDial.comSaw the ad a few days back on the TV, so thought could play with it. As expected, they haven't thought/bothered about Cross Site Scripting !Just search for our usual keyword : alert("XSS"); and you can get alerts.The reason for most XSS holes is due to the use of Microsoft's Active Server Pages (ASP). ASP does not have much default functions or modules to combat XSS. Whereas PHP has a number of functions to do the same.Happy Hacking ... ...

Resolve Net::MySQL Hang problem if the database result has only 1 row or is empty

http://digitalpbk.com/perl/solve-netmysql-hang-problem-if-database-result-has-only-1-row-or-empty WHERE id = 1'); if ($mysql->has_selected_record) { my $record_set = $mysql->create_record_iterator; while(my $record = $record_set->each) { printf "First column: %s \n", $record->[0]; } } else { print "not found"; } $mysql->close; This script would hang since the result set contains just one row. This is due to incorrect detection of the end of packet message on Net::MySQL module. The last 5 bytes of the end of packet is usually FE 00 00 22 00 ...

FTPCHK3 : Virus that adds malicious scripts to your website.

http://digitalpbk.blogspot.com/2009/10/ftpchk3-virus-php-pl-hacked-website.html FTPCHK3 : Virus that adds malicious scripts to your website. IntroThis virus changes all your web files, php, html javascript and tpl files in prominent CMS systems to add a malicious script into your site. This injection allows the attacker to remotely execute PHP code on your website if the php infected code is running on your pages. Its supposedly called Bagle. But who cares about the name? It's nasty and start fixing.How it got in ?This can be due to potential security holes in your FTP ...