Hacker News Board Hacker News, browsed like a classic message board
Live data from Hacker News

SQL injection search

github.com

Post reply on HN
Print view View original

51–60 of 114 posts

Re: SQL injection search

#51

Post by a1a »

timothya wrote: post #42
a1a wrote: post #11

While we are at it.. XSS search: https://github.com/search?q=extension%3Aphp+%3C%3F%3D%24_GET...

Is it an XSS if you can only make it output code to your own browser? I can already execute whatever JavaScript I want in the console, so what's the advantage of having the server deliver that code to (only) me? I can definitely see the issue if the server saves the unfiltered input and tries to print that out for other uses, but it seems to me that outputting a raw $_GET variable will only go to the requester and th…

Yes. They are referred to as "reflective" or "non-persistent" XSS vulnerabilities. The attacker might exploit these using for example an "invisible" iframe on a different website, and thus loading the vulnerable website, in the background, with the desired parameters. This will result in the malicious javascript being executed "on the vuln. website", in the victims browser.

This (http://web.math.jjay.cuny.edu/fcm791/web2.0_Vulnerabilities....) is a pretty good paper (jump to page 7) if you are interested.

Re: SQL injection search

#52

Post by olalonde »

diminoten wrote: post #38

There is a huge need in the space for a well marketed quality assurance contractor who can find problems like this and fix them. "We found these issues, and we can fix them all. Pay us for finding them or pay us some more for fixing them, too." sort of thing. Why don't you see QA shops popping up like this?

I guess one of the reasons is that it's much easier to fix those problems than to find them.

Re: SQL injection search

#53

Post by zprit »

diminoten wrote: post #38

There is a huge need in the space for a well marketed quality assurance contractor who can find problems like this and fix them. "We found these issues, and we can fix them all. Pay us for finding them or pay us some more for fixing them, too." sort of thing. Why don't you see QA shops popping up like this?

Cigital does exactly this and more. We've even got a plugin for Eclipse that will provide suggestions on secure coding for Java.

Info about the QA/Security Consulting: http://www.cigital.com/services/

Secure coding plugin - http://www.cigital.com/products/secureassist/

Re: SQL injection search

#54

Post by adelevie »

diminoten wrote: post #38

There is a huge need in the space for a well marketed quality assurance contractor who can find problems like this and fix them. "We found these issues, and we can fix them all. Pay us for finding them or pay us some more for fixing them, too." sort of thing. Why don't you see QA shops popping up like this?

Looks like Code Climate is providing an automated service like this for Rails apps: https://codeclimate.com/security-monitor

Re: SQL injection search

#56

Post by mgkimsal »

timothya wrote: post #42
a1a wrote: post #11

While we are at it.. XSS search: https://github.com/search?q=extension%3Aphp+%3C%3F%3D%24_GET...

Is it an XSS if you can only make it output code to your own browser? I can already execute whatever JavaScript I want in the console, so what's the advantage of having the server deliver that code to (only) me? I can definitely see the issue if the server saves the unfiltered input and tries to print that out for other uses, but it seems to me that outputting a raw $_GET variable will only go to the requester and th…

Or bit.ly/shortener links - you got it. I used to think like you did - what harm is there in 'exploiting' my own browser? Took a while for the penny to drop in my case.

Re: SQL injection search

#57

Post by pjscott »

tptacek wrote: post #37

There's a joke to be made here about "broken crypto search".

I'll make that joke, but it won't be very funny.

https://github.com/search?p=2&q=MD5+password+extension%3...

https://github.com/search?q=CURLOPT_SSL_VERIFYHOST+NOT+depre...

There's more low-hanging fruit, if you're willing to use more specialized searches. For example, guess what mode of operation the PyCrypto library uses by default for all its block ciphers if you don't explicitly pick a sane one:

https://github.com/search?p=1&q=extension%3Apy+crypto+ci...

Re: SQL injection search

#58

Post by sage_joch »

This is a potentially great idea. You could make your build process include submitting your code to a search engine like this (perhaps in some obfuscated manner) and making illegal patterns fail if not manually "approved". Just because the halting problem exists doesn't mean there's not a low hanging fruit in approaching it.

Re: SQL injection search

#60

Post by tptacek »

pjscott wrote: post #57
tptacek wrote: post #37

There's a joke to be made here about "broken crypto search".

I'll make that joke, but it won't be very funny. https://github.com/search?p=2&q=MD5+password+extension%3... https://github.com/search?q=CURLOPT_SSL_VERIFYHOST+NOT+depre... There's more low-hanging fruit, if you're willing to use more specialized searches. For example, guess what mode of operation the PyCrypto library uses by default for all its block ciphers if you don't explicitly pick a sane one: https://github.co…

The joke was more like:

https://github.com/search?p=2&q=AES&ref=searchresult...

Post reply on HN