[deleted]
Password may not contain: select, insert, update, delete, drop
181–190 of 254 posts
Re: Password may not contain: select, insert, update, delete, drop
#182Earlier quoted context omitted.
Hah, I hacked Nettby in school too, good days. Nettby had no HTTPS, so I did an ARP poisoning MITM and stole everybody's passwords. Then I posted random nonsense from people's accounts and watched the chaos ensue(did no snooping, even 14yo me had a semblance of ethics somehow).
Eli5 this attack pla
I've no idea what nettby is.
But ARP is how computers figure out what IP address is associated with a hardware / ethernet address, so they know what ethernet address to use for sending packets to a specific IP.
ARP poisoning means you flood the network with fake ARP packets saying your ethernet address has the gateway IP or whatever IP. So then the other devices will forward packets to your machine instead of the intended destination.
As nettby didn't use HTTPS it would then be trivial to capture / read the packets and figure out everyones' passwords. I.e. the messages would be plain text, unencrypted.
Not exactly Eli5, but hope it helps.
Re: Password may not contain: select, insert, update, delete, drop
#183If I were an adversary this would certainly pique my interest.
Re: Password may not contain: select, insert, update, delete, drop
#184Can not contain "script". I hacked a big social platform in my early teens (Nettby.no), since they just did a removal of all banned words, including . I instead wrote ipt> in my profile bio, and after their removal I had a valid html tag injected into the webpage and full control of anyone visiting my page..
Interesting, can you explain 'full control'?
You can run any JavaScript.
So you can show a popup saying the user needs to log in again, and then log their credentials on your own server instead.
Re: Password may not contain: select, insert, update, delete, drop
#185Earlier quoted context omitted.
Hah, I hacked Nettby in school too, good days. Nettby had no HTTPS, so I did an ARP poisoning MITM and stole everybody's passwords. Then I posted random nonsense from people's accounts and watched the chaos ensue(did no snooping, even 14yo me had a semblance of ethics somehow).
Eli5 this attack pla
It should also be said that HTTPS was seldom used outside of especially sensitive applications until ~2010 when someone packaged a HTTP MITM attack up into a handy Firefox extension. I think that Facebook used HTTPS for the actual login credential exchange, snd then bounced back to HTTP, which meant that the session cookie/s were still MITMable.
It’s insane how long it took to see widespread HTTPS adoption.
Re: Password may not contain: select, insert, update, delete, drop
#186Makes me ponder the question - what’s the worst you could do to a sql database without using those strings (at least not directly).
They don’t prohibit semi colons so there’s still some potential here.
Re: Password may not contain: select, insert, update, delete, drop
#187Oooh! I put that string there! It was a request by management, and I still don't know why. This site doesn't store any passwords, it's basically just a nice interface to external account management. I heard a rumour that some legacy apps have weird validation on their login fields, so students wouldn't be able to log in with passwords containing certain strings. But I don't actually know of any examples.
On the contrary, make all of your passwords “DROP TABLE users;”. You’ll quickly sort out which passwords are being handled so insecurely by your vendors. This would mean they both don’t sanitize user input and don’t hash or otherwise obscure your password. They are a menace to society.
Re: Password may not contain: select, insert, update, delete, drop
#188the only place situation where such rules can matter is if you already _massively_ messed up security (most fundamental rule of handling passwords is to never store them anywhere, never log them either, b etc. they should go straight to the hashing function and no where else)
It matters if your stupid WAF blocks anything that looks like SQL.
Re: Password may not contain: select, insert, update, delete, drop
#189Earlier quoted context omitted.
Eli5 this attack pla
I've no idea what nettby is. But ARP is how computers figure out what IP address is associated with a hardware / ethernet address, so they know what ethernet address to use for sending packets to a specific IP. ARP poisoning means you flood the network with fake ARP packets saying your ethernet address has the gateway IP or whatever IP. So then the other devices will forward packets to your machine instead of the int…
This is pretty much the reply I'd write, so I'll just add my endorsement.
Couple more tidbits of information:
Nettby was a Norwegian Myspace clone and it was all the rage back when I was in middle school(around 2007-2009 or thereabouts).
ARP stands for Address Resolution Protocol.
ARP has no security built in by default. This combined with the plaintext passwords made the attack trivial.Re: Password may not contain: select, insert, update, delete, drop
#190Can not contain "script". I hacked a big social platform in my early teens (Nettby.no), since they just did a removal of all banned words, including . I instead wrote ipt> in my profile bio, and after their removal I had a valid html tag injected into the webpage and full control of anyone visiting my page..
Well, duh: they needed to make sure to run the script twice.
Make it 3 times, you never know how clever those hackers folks could be!