IT Security Stack Exchange
IT Security Stack Exchange

Questions tagged [null-byte-injection]

An active exploitation technique used to bypass sanity checking filters in web infrastructure by adding URL-encoded null byte characters (i.e. %00, or 0x00 in hex) to the user-supplied data.

12 questions
9
votes
2 answers

Null byte injection on PHP?

Is it possible to perform null byte injection on PHP code? And, how would vulnerable code look like? Could you give me some examples, as I noticed that:
black_hat_cat
  • 91
  • 1
  • 1
  • 3
6
votes
1 answer

Cookie that contains NULL byte character (0x00) on new WordPress.org site - any issues?

I installed NinjaFirewall plugin on WP.org v4.7.2. It locked me out of my site. They asked for the log from my hosting company's cPanel, which I got and they report: You have a cookie that contains the NULL byte character (0x00). That’s very odd…
James
  • 61
  • 2
5
votes
1 answer

What are the alternatives to null byte injection attack?

Now that Null byte injections no longer work on PHP, what are the alternative attack strategies used by attackers for remote file inclusion ?
Ray
  • 71
  • 1
  • 3
4
votes
2 answers

Remote OS command injection - tests

ZAP scanner found Remote OS command injection. Is there any foolproof way to check if this works and is not a false positive? I have tried to make it sleep 50 seconds but it's not something I can visually see, also the page does not seem to take…
k1308517
  • 1,272
  • 14
  • 27
2
votes
1 answer

Printf inject 0x00

When performing a format string exploit, how do you inject an address that contains 0x00? #include int main(int argc,char *argv[]) { char buf[80]; snprintf(buf, 79, argv[1]); printf(buf); } How would you get a ret to libc if,…
robertkin
  • 277
  • 2
  • 6
1
vote
2 answers

Is string concatenation vulnerable to null character in aspx?

I just see this line of code in VB in one file .aspx FileUpload.SaveAs(sPath & "/" & FileUpload.FileName) This line save a file that an user uploaded. It use the SaveAs method. I was worried about the sPath because the user can edit it. The user…
Rodrigo
  • 317
  • 1
  • 3
  • 13
1
vote
1 answer

Getting null byte injection attacks to work with PHP 5.2.17

I'm trying to understand how null byte injection attacks in PHP code used to work before it was patched in PHP 5.3.4. I have this sample HTML page that is a somewhat modified version of what's shown here: '; $file =…
gsgx
  • 1,225
  • 2
  • 12
  • 13
1
vote
1 answer

Prevent injection in PHP file

Recently I wrote this code: I heard that…
MucaP
  • 113
  • 4
1
vote
0 answers

Can you use null byte injection to exploit SQLi in Postgres?

While testing, I do get an error when passing the input asdf%00 to my applications username. The database in the backend spits an error, because Postgre can't handle 0x00 in text fields.

PersistencyException

…
user857990
  • 903
  • 1
  • 9
  • 21
1
vote
1 answer

Null byte injection to run PHP?

A website accepts form input and outputs it to the screen, but replaces every
Rápli András
  • 2,124
  • 11
  • 24
1
vote
1 answer

Are there still some ssl domains containing the nul character for testing purposes?

Some years ago, there was a bug with host name checking in ssl so that connection towww.paypal.com%00.thoughtcrime.orgwould look aswww.paypal.comat the certificate level. The issue seems to be over for web browsers. But some tools and popular…
user2284570
  • 1,402
  • 1
  • 14
  • 33
0
votes
1 answer

How would someone execute a Perl script on a webpage?

OWASP's XSS Filter Evasion Cheatsheet has a Perl script listed: perl -e 'print "";' > out It also says this above it: Null chars also work as XSS vectors but not like above, you need to inject them directly…
anonymous
  • 109
  • 4