background preloader

Attacks

Facebook Twitter

Hash - Using MD5 for malware ids: collision attack risks. First off -- you are right that it would be better to use SHA1, SHA256, SHA2, or some more modern hash function.

hash - Using MD5 for malware ids: collision attack risks

However, I don't think the risk is very high. To explain why I have to give a little bit of background about attacks on hash functions. There are two kinds of attacks to worry about: SQL Injection Attacks by Example. A customer asked that we check out his intranet site, which was used by the company's employees and customers.

SQL Injection Attacks by Example

This was part of a larger security review, and though we'd not actually used SQL injection to penetrate a network before, we were pretty familiar with the general concepts. We were completely successful in this engagement, and wanted to recount the steps taken as an illustration. "SQL Injection" is subset of the an unverified/unsanitized user input vulnerability ("buffer overflows" are a different subset), and the idea is to convince the application to run SQL code that was not intended. Void 0. Hyperlinks like this one entice visitors to click because they know clicking it will lead them to a new page.

Void 0

However, sometimes when you are making a script, you would like to add functionality to your website that lets a hyperlink to be clicked and perform a useful action like update the sums on the webpage, without loading a new page. It's these types of programming solutions that will utilize the JavaScript Void 0 programming tool. This lesson will teach you some of the reasons to use the JavaScript Void 0programming strategy in your scripts.

Web browsers allow you to execute JavaScript statements directly by entering JavaScript code into the browser's URL text field. All you need to do is place a JavaScript: before your code to inform the browser you wish to run JavaScript.