Phying News
P非影 中文
Curated security research, vulnerabilities, advisories and tools for practitioners.

SQL Injection: Death by Blacklist

netspi.com | vulnerability | #sql-injection | #web-security | #waf | #whitelist | #blacklist | #xp-cmdshell

Summary

No one can deny that SQL Injection is one of the biggest issues plaguing web applications today. However, there is still some ongoing debate around how to fix it.
Published
Collected

original ↗

Related coverage

vulnerability · labs.cognisys.group
An Interesting XSS-Bypassing WAF
Overview
blog · netspi.com
Thoughts on Web Application Firewalls
Pushes back on the claim that WAFs beat fixing vulnerable code: filters can be bypassed, need lengthy tuning, and have their own flaws, so WAFs belong in defense-in-depth, not code substitution.
blog · netspi.com
What's Happening in the Application Security Arena?
According to Gartner, 75% of the attacks are coming though web applications and not through the network. This means greater emphasis needs to be placed on application security. However, this does not appear to be happening.
blog · labs.cognisys.group
Breaking Login Pages
A walkthrough of common login page bypass techniques—SQL injection, response manipulation, forced browsing, default credentials and credential stuffing—and how defenders should counter them.
vulnerability · netspi.com
Exploiting Second Order SQL Injection with Stored Procedures
This walkthrough covers exploiting second-order SQL injection in an Excel report export feature, chaining stored procedure UNC path injection via xp_dirtree to exfiltrate database details over DNS.
vulnerability · netspi.com
CVE-2024-37888 – CKEditor 4 Open Link plugin XSS
CVE-2024-37888 is an XSS in CKEditor 4's Open Link plugin that lets crafted hyperlinks execute JavaScript in a victim's browser. Found during a client engagement, it affects latest plugin versions.
back