Siber Güvenlik – Page 11 – Mehmet INCE

One git command may cause you hacked ( CVE-2014-9390 Exploitation for Shell )

19/12/2014 by mehmet ince

Hello

CVE-2014-9390 is one of the hilarious vulnerability I’ve ever seen. One single git may cause you hacked! I won’t dive into the details of this vulnerability because of official announcements can be found here ( https://github.com/blog/1938-git-client-vulnerability-announced and http://article.gmane.org/gmane.linux.kernel/1853266 ) . In short, if you use case insensitive operating system like Windows or OSX you have to update your git client, do it right now! Otherwise attackers can insert their own pre hooks into your git directory.

Let’s analyze this vulnerability from penetration tester perspective.

Python Markdown2 XSS Vulnerability and Prevention

02/11/2014 by mehmet ince

Hey

As we all know, we usually use one or more 3th party application in our Django project and we rarely consider these applications security. In this article I will describe what I found in Markdown python library and how we can use markdown2 without having security issue.

XSS Security in Django

31/10/201428/10/2014 by mehmet ince

You know output encoding is most important thing when topic comes to XSS. Today I’ve decided to write a article about how to secure your Django application against XSS vulnerabilities. Handing XSS cases with Django is more easy than other frameworks. Your Django app is approximately secure against XSS even if you developed it without security mind. Therefore Django is try to encode specific characters in order to prevent yourself from cross-site scripting. But Django going to be fail under the some circumstances.

PS : If you think any part of this article needs update or changes, feel free to leave comment.

Django is a high-level Python Web framework that encourages rapid development and clean, pragmatic design.

IBM DB2 SQL Injection Saldırıları

15/10/2014 by mehmet ince

Merhaba

MsSQL, MySQL veya PostgreSQL gibi alışılmış veri tabanına sistemlerini kullanan uygulamalar üzerinde sql injection saldırıları gerçekleştirmek biraz kolaydır. Çünkü hemen hemen tüm veri tabanı sistemlerinin kendi içerisinde geri dönük destek verme mekanizmaları bulunmaktadır. Örneğin MySQL 5.X ailesinde tablo isimlerini tutan yapı information_schema’dır ve farklı versiyonlara yönelik değişiklik göstermemektedir.