@DavidFreitag well you see if I were signed to a producer, I'd be a person who sat in the corner giving ideas but not really doing much in the way of making anything
@DavidFreitag was a manatee hacking screengrab video with a) his photo, b) his IP, c)... couldn't bare it any more but I suspect loads more, I was only 2 minutes into it
the crazy part is that people don't seem to feel that importing libs is a dangerous practice that should be only used if entirely necessary. With package manager security being as poor as it is, it's a risky thing to do...
The devil is in the details ... let's start with how answer in question describes the list of vulnerable character sets:
For this attack to work, we need the encoding that the server's expecting on the connection both to encode ' as in ASCII i.e. 0x27 and to have some character whose final by...
"It gets worse. PDO defaults to emulating prepared statements with MySQL. That means that on the client side, it basically does a sprintf through mysql_real_escape_string() (in the C library), which means the following will result in a successful injection"
@MarkBuffalo im interested in what you would do exactly down to the nitty gritty.... because it sounds like you would use some default catch all, but surely it would depend on what you are needing the data for, to what you do with it?
@Matthew reading the threads about this from HN and similar and the lack of understanding/knowledge about the downsides of including huge numbers of 3rd party dependencies from people who are meant to be professional devs is very sad
@silverpenguin validate that input is not null, and is of the correct length and format, and in some cases, check white list. Use prepared statement on input. Entities on output
@silverpenguin kids dragged a booster to the kitchen... Stood on it, climbed up and pulled down the cake in the cupboards... Got them on the ground and mercilessly tormented the precious cakes.... And now my boy is so hyper he's literally freaking out, running around cackling manically, and spreading cake smears everywhere
Well he was. We cleaned it up an hour ago
Problem is, he smeared my pants, and I only have two pairs. One is being washed. Need to buy more :X
@Simon hey man, also i spend alot of money on suits..my cheapest suit in the range american $$$ is 500 which i got on a black friday sale when in the U.S ... my most exspensive suit would cost about 1200 $$
ALTER TABLE `tablename`
DROP `column1`,
DROP `column2`,
DROP `column3`;
The devil is in the details ... let's start with how answer in question describes the list of vulnerable character sets:
For this attack to work, we need the encoding that the server's expecting on the connection both to encode ' as in ASCII i.e. 0x27 and to have some character whose final by...
should an authentication server using Ersatzpasswords be changed and how to change its password aging policy? Thanks a lot for your help.
