41–50 of 131 posts
I found a legit repo for this code https://github.com/andresriancho/w3af-moth "A set of vulnerable PHP scripts used to test w3af's vulnerability detection features."
Which points out that the context has to considered as well. E.g., if it's a personal intranet or password protected page, this may not be vulnerability.
88,846 PHP
1,420 HTML+ERB
1,177 JavaScript
1,128 HTML
423 Ruby
250 XML
160 Markdown
117 Emacs Lisp
91 INI
65 Perl88,846 PHP 1,420 HTML+ERB 1,177 JavaScript 1,128 HTML 423 Ruby 250 XML 160 Markdown 117 Emacs Lisp 91 INI 65 Perl
I found a legit repo for this code https://github.com/andresriancho/w3af-moth "A set of vulnerable PHP scripts used to test w3af's vulnerability detection features."
Which points out that the context has to considered as well. E.g., if it's a personal intranet or password protected page, this may not be vulnerability.
Earlier quoted context omitted.
Which points out that the context has to considered as well. E.g., if it's a personal intranet or password protected page, this may not be vulnerability.
What if a hacker would have access to a user of said personal intranet, or would find a way to bypass the password protected page. Then he'd be able to execute anything on the server, even stuff the user he hacked shouldn't be able to access. So no, this is always a vulnerability.
$_GET['name'] = "/dev/null; rm -rf /; echo ";Example from the Github search: How to abuse: $_GET['name'] = "/dev/null; rm -rf /; echo ";
Example from the Github search: How to abuse: $_GET['name'] = "/dev/null; rm -rf /; echo ";
"We've found 99,841 code results" Someone should write a script that automatically raises an issues for each line and each project, it's probably possible, but I'm chronically lazy.