nbpoole

18 ms·

121.
by nbpoole 15y ago
Haha, whoops! Sorry about that, back to normal. Anyone who hit that URL in the past 10 minutes would have seen unsanitized HTML, because I was testing the impact of disabling the html_errors INI option (something one of my blog's comments a
122.
by nbpoole 15y ago
> So with this I can XSS myself while in development mode on my development system? That's handy. Or someone can send you a URL that points to your dev server and contains a payload. Or someone can send a URL to the developer across t
123.
by nbpoole 15y ago
> So could PHP perhaps HTML encode error messages? Would this break any error message use cases? For example are there times when error messages appear when they wouldn't be interpreted as HTML encoded? CLI? Browsers loading different
124.
Cross-Site Scripting? In PHP Notices? It's more likely than you think(nealpoole.com)
43 points by nbpoole 15y ago|14 comments
125.
by nbpoole 15y ago
See also: http://news.ycombinator.com/item?id=2844321
126.
by nbpoole 15y ago
That blog post seems to contradict what Tavis Ormandy claimed on Twitter a few days ago, when the patch was released: > Adobe patched around 400 unique vulnerabilities I had sent them in APSB11-21 as part of an ongoing security audit.
127.
by nbpoole 15y ago
Agreed. The older a PHP application is, the more likely it is to have incredibly serious security vulnerabilities. But I've looked at and broken plenty of vulnerable applications that were written within the past couple years.
128.
by nbpoole 15y ago
daeken is arguing, based on quite a bit of experience, that PHP applications (even those written with frameworks) tend to have more security vulnerabilities than Rails apps. I happen to agree with him. One very illustrative example: arbitra
129.
Black Hat 2011: "Attacking Client Side JIT Compilers"(matasano.com)
5 points by nbpoole 15y ago|0 comments
130.
by nbpoole 15y ago
http://whatportis.com/index.php?port=%27 http://php.net/manual/en/security.database.sql-injection.php
131.
by nbpoole 15y ago
IP addresses were already preserved: > (E) telephone or instrument number or other subscriber number or identity, including any temporarily assigned network address; and http://www.law.cornell.edu/uscode/18/usc_sec_18_00002703----...
132.
by nbpoole 15y ago
To be clear, the full text of that portion of the legislation says: --- (a) In General- Section 2703 of title 18, United States Code, is amended by adding at the end the following: `(h) Retention of Certain Records- A provider of an elec
133.
by nbpoole 15y ago
> Normally a couple hundred IPs a day will visit popular bitsquatted destinations. #blackhat https://twitter.com/#!/dakami/status/98910873044791297
134.
by nbpoole 15y ago
You're confusing the issue. This isn't about SSH versus FTP: it's about whether or not the Apache user running your website can also write to the filesystem inside of your document root. The Wordpress update feature is actually able to use
135.
by nbpoole 15y ago
No. The timthumb.php script can be accessed directly by unauthenticated users.
136.
by nbpoole 15y ago
+1 At best, a bounty program gives me the incentive to look more closely at a particular website / application. But I've submitted plenty of vulnerability reports to companies that don't have bounty programs. What this bounty really means:
137.
by nbpoole 15y ago
Why so cheap? Because $500 is the base, not the maximum. $500 is the base reward for Google and Mozilla's web bounty programs as well. Another similar bounty program, from CCBill, lists a maximum payout of $500 (although I can confirm tha
138.
by nbpoole 15y ago
Whoops. I totally misunderstood what that part of the guide was trying to accomplish. In case anyone makes the same mistake I did, the suggestion is to get the column count by reading the error message. I'm used to not being able to read th
139.
by nbpoole 15y ago
There's actually another issue that I missed before. SELECT * returns all of the columns in the table: you can't compare that to a scalar. Tested on MySQL 5.5 on OS X: mysql> use test Database changed mysql> show tabl
140.
by nbpoole 15y ago
Noticed a small mistake in the MySQL section: Error Based: AND (SELECT * FROM SOME_EXISTING_TABLE) = 1 Unless SOME_EXISTING_TABLE has no more than one row, that query will fail. See http://dev.mysql.com/doc/refman/5.0/en/c
141.
by nbpoole 15y ago
" It's not a woman, it's a man. He even cleared that up in this article. " From the blog post: " I do exist. I am a real person using a nickname my parents stuck me with long ago. I do not work for the hotel industry, though I admit I love
142.
by nbpoole 15y ago
He didn't say "it never could": he said "it never really could." The VM feature was always experimental. If you're interesting in reading more, there's some good discussion at http://news.ycombinator.com/item?id=2606096
143.
by nbpoole 15y ago
http://www.reddit.com/r/programming/comments/dst56/today_i_l... One of the code examples from here might be good if you're looking to scare people :-P Edit: I have a more serious suggestion. Why not pick 8 lines from your own codebase?
144.
by nbpoole 15y ago
This is a fairly common issue when people are integrating with third party payment providers: - http://checkout.google.com/support/sell/bin/answer.py?answer... - https://payments.amazon.com/sdui/sdui/helpTab/Amazon-Simple-... - http://
145.
by nbpoole 15y ago
Name.com (one of the registrars mentioned in the blog post) offers two-factor authentication: http://www.name.com/services/namesafe . It's one of the reasons I really like them as a registrar :-)
146.
by nbpoole 15y ago
http://en.wikipedia.org/wiki/Tech_Model_Railroad_Club " The Tech Model Railroad Club (TMRC) is a student organization at the Massachusetts Institute of Technology (MIT), and one of the most celebrated model railroad clubs in the world, be
147.
by nbpoole 15y ago
> I can't comment on the original article. Are comments closed, or am I dumb? It was posted in 2009, so the comments are probably closed :-)
148.
by nbpoole 15y ago
They're notices, not warnings. They can be disabled via a simple call to the error_reporting function. I fundamentally disagree with you though. For me, notices are very useful for identifying typos and other coding mistakes that can lead t
149.
by nbpoole 15y ago
https://wiki.php.net/todo/php54
150.
by nbpoole 15y ago
With the removal of bad legacy features like register_globals, magic_quotes_gpc, and safe_mode combined with new features like array de-referencing and traits, I'm really excited for PHP 5.4. :) For anyone who's curious, here's a list of th

More ›