ohgodwhat posted:

Relatively tame but this guy's not off to a good start:
http://security.stackexchange.com/questions/147216/hacker-used-picture-upload-to-get-php-code-into-my-site

Roughly, "I don't know how this hacker is getting PHP files past my client side validation!"

quote:

I can tell that the picture upload box was definitely the problem based on the file name of the PHP code that was uploaded. Example, I ended up with logo1234567.php (tells me it's coming from the File Upload box that handles logo pics When I store data from edit boxes, I use all three of PHP's functions to clean it:

code:

$cleanedName = strip_tags($_POST[name]); // Remove HTML tags 
$cleanedName = htmlspecialchars($cleanedName); // Allow special chars, but store them safely. 
$cleanedName = mysqli_real_escape_string($connectionName, $cleanedName);

jre posted:

Volmarias posted:

You're just training the user to hit the enter key after doing an autofill without reading what it says.

ohgodwhat posted:

Relatively tame but this guy's not off to a good start:
http://security.stackexchange.com/questions/147216/hacker-used-picture-upload-to-get-php-code-into-my-site

Roughly, "I don't know how this hacker is getting PHP files past my client side validation!"

Volmarias posted:

You're just training the user to hit the enter key after doing an autofill without reading what it says.

COACHS SPORT BAR posted:

as has been said many times before, security often comes at the expense of convenience. solution: patch autofill out of all of these browsers

Trabisnikof posted:

Browsers have all the information required to determine if fields are visible, even if implementing a solution ends in heuristic whack-a-mole

vOv posted:

uncheck them by default i guess? though that won't stop users from just blindly clicking everything

Wheany posted:

our tester was trying to connect to a server with winscp. it gave a warning about changed fingerprint and posted a screenshot "the new fingerprint is wh:at:ev:er:th:ef:uc:k"

i tried if my connection still worked. it did.

so i tried to find the fingerprint. maybe i'm just dumb, but i just can't find it anywhere in either winscp or putty ui.

putty stores some super loving long hex string in the registry that looks nothing like the one shown in the dialog.

i finally found out the fingerprint by enabling logging in winscp and looking at the log file. it didn't match

negromancer posted:

screenshot or didn't happen

I believe you I just want to see it

Phone posted:

you actually just quarantined the bad discussion, so like the malposts are technically still infecting your system. with this new form of shitposting, you can't take an anti virus approach to these sorts of things and flattening and reinstalling doesn't work.

James Baud posted:

You're taking that too literally, the fingerprints are hex, unless that's a really dumb winscp placeholder message.

Wheany posted:

yes, the fingerprint wasn't literally whateverthefuck, i'm not going to transcribe some screenshot for a yospost

the point was that as far as i can tell, there is no way of finding out the saved fingerprint for a given server so that i can compare them

well, with putty you can get some really long hex string from the registry, but its way too long and it's not in the same format as the one in the dialog. (two hex digits, colon, two hex digits, colon etc)

so the warning is "YOUR poo poo MIGHT HAVE BEEN HACKED, check this fingerprint:" and there is no way to get a known-good value from another instance of winscp or putty to compare them.

Wheany posted:

yes, the fingerprint wasn't literally whateverthefuck, i'm not going to transcribe some screenshot for a yospost

the point was that as far as i can tell, there is no way of finding out the saved fingerprint for a given server so that i can compare them

well, with putty you can get some really long hex string from the registry, but its way too long and it's not in the same format as the one in the dialog. (two hex digits, colon, two hex digits, colon etc)

so the warning is "YOUR poo poo MIGHT HAVE BEEN HACKED, check this fingerprint:" and there is no way to get a known-good value from another instance of winscp or putty to compare them.

uncurable mlady posted:

wait, I'm high, isn't that literally just the pubkey? and the thing that's displayed is the md5 hash?

uncurable mlady posted:

im pretty sure you can convert the fingerprint to the hash or w/e, it's the same thing that's in authorized_keys

Storysmith posted:

authorized_keys stores client keys for authentication. you're thinking of the known_hosts file, which stores server keys you've connected to, and is implemented as a flat file (that you need to use ssh-keygen to interact with on modern openssh installs because they hash hostnames to make the files less useful for folks who hack a box and pivot)

putty/winscp apparently don't use that mechanism and figuring out an existing stored hash is difficult

I say "apparently" here because I am trusting you people at your word that there isn't some known_hosts file lurking about

minivanmegafun posted:

storing that in the windows registry sounds like something putty would do

negromancer posted:

that's why you use mobaxterm on windows and stop using putty and winscp like it's 2004.

negromancer posted:

that's why you use mobaxterm on windows and stop using putty and winscp like it's 2004.

negromancer posted:

YES! it's stored in ~/.ssh/authorized_keys I thought?

see, that's why I only run scripts at night, and write them in the daytime. The strength of weed I get from my friend ranges from "nice realizing high" to "I might be in a coma so I'm gonna watch Oceans Eleven on repeat".

negromancer posted:

that's why you use mobaxterm on windows and stop using putty and winscp like it's 2004.

Fergus Mac Roich posted:

i use extraputty with awful lua scripts right now. there's even a portable version of this. thank you for pointing out this program and ending my nightmare.

jre posted:

gently caress, that looks good. How long has that existed ?

negromancer posted:

that's why you use mobaxterm on windows and stop using putty and winscp like it's 2004.

negromancer posted:

that's why you use mobaxterm on windows and stop using putty and winscp like it's 2004.

Ur Getting Fatter posted:

why do all of these sites about tools to connect securely to your server via SSL refuse to implement https on their loving geocities website?

i love giving out my private keys to .exes i got off some unauthenticated ftp server

Ur Getting Fatter posted:

why do all of these sites about tools to connect securely to your server via SSL refuse to implement https on their loving geocities website?

i love giving out my private keys to .exes i got off some unauthenticated ftp server

negromancer posted:

not sure what you're referring to.

jre posted:

gently caress, that looks good. How long has that existed ?

Heresiarch posted:

the mobaxterm site is http and their download is http

Heresiarch posted:

the mobaxterm site is http and their download is http

Wheany posted:

that does look good, but i don't feel like paying over $50 per year(?) to replace putty (and to a lesser extent, winscp)

anthonypants posted:

i'm still trying to get my coworkers to stop using filezilla