Earlier quoted context omitted.
> The question is, what do we do about it once we see something like that? Run away and stay as far away from their products and services as possible.
It's a university
Ok don't go there to study CS :)
Password may not contain: select, insert, update, delete, drop
161–170 of 254 posts
Re: Password may not contain: select, insert, update, delete, drop
#162Instead of making sure SQL injection is not possible at all by using proper stored procedures and other techniques, they just limit a few keywords and hope hackers don't come up with something that they haven't thought of like some escaping trick. Yeah that would probably work for a while. Until someone proves it doesn't :P It's not really rocket science anymore to make sure user input doesn't mix with your SQL. This…
You realize, don’t you, that the fact that this made the front page tells us that you are explaining things that are obvious to this audience?
Of course!
I was being sarcastic :) It's ridiculous that this kind of thing still happens.
Re: Password may not contain: select, insert, update, delete, drop
#163Earlier quoted context omitted.
> Also not storing hashes of passwords, because then it wouldn't matter what the input is. That only tells you they don't hash the passwords in the client. Likely the protection ("protection") is for the input validation layer, not the password backend itself.
Is it a slow sunday for me or... If you hash the password on the client and send the hash then hash is the password. And if you then have, for example, a DB leak with username and hashes, you don't need the password anyway because you can just send the hash and log in? (but then it's sunday and I need more coffee so I may be wrong)
You're not the first to come up with that exploit-
Re: Password may not contain: select, insert, update, delete, drop
#164I once couldn't register for a website because my last name contained the word "user". Yes, it does. Given the choice between changing my name, lying about my name, or signing up with a competitor instead, I chose the dignified option.
Re: Password may not contain: select, insert, update, delete, drop
#165Worked on a system like this once. Nobody wanted to fix the actual backend problem so this limitation was a requirement. But I figured that advertising these little "quirks" in the login flow would give hackers ideas, so instead I just added a function to transform the "bad input" into an alternative set of characters that wouldn't have a negative effect on upstream. Since you couldn't view the saved password, nobody realized they were being transformed behind the scenes. Stupid yet effective.
Re: Password may not contain: select, insert, update, delete, drop
#166Earlier quoted context omitted.
There are various schemes where the password is salted, hashed or prehashed on the client side, to various effectiveness. They have never been really popular and the advent of ubiquitous https probably made them even less common, but they do exist. They do help protect you from your own WAF though.
can you elaborate on this? Or link something that does? My intuition is that whatever gets sent over the wire is effectively the password. Not sure how the server could validate some rolling hash of the password (based on like a timestamp or something) without having to store the pre-image(i.e. the raw password).
The SRP Authentication and Key Exchange System does not send the password from the client to the server. This scheme is supposedly used by Blizzard when authenticating users in some of their online games.
https://www.rfc-editor.org/rfc/rfc2945
https://security.stackexchange.com/questions/18461/how-secur...
Re: Password may not contain: select, insert, update, delete, drop
#167Earlier quoted context omitted.
It's normal for them to make it to an executed SQL query.
No, it isn't. If a user's password leaves the web application in any form other than a hash, something nonstandard and probably bad is going on.
Hashing can be done in a stored procedure. Maybe the organization decided that it's better for the DBA to handle hashing. Nonstandard maybe but not necessarily bad.
Re: Password may not contain: select, insert, update, delete, drop
#168I once couldn't register for a website because my last name contained the word "user". Yes, it does. Given the choice between changing my name, lying about my name, or signing up with a competitor instead, I chose the dignified option.
So… what’s your new last name?
Re: Password may not contain: select, insert, update, delete, drop
#169I work at an auth company (Stytch) and sometimes developers ask me about input restrictions on passwords in our API.
I've had folks ask me if we support emoji, "code/SQL" like in this example, Chinese characters etc.
So fun to see and hear from folks on all sorts of stacks, especially legacy systems where layers of cruft have accreted over time to produce Byzantine requirements like this.