How to say you’re vulnerable to code injection without saying you’re vulnerable to code injection.
Are they vulnerable though, if they already exclude it at the user input?
I yet have to learn SQL and is there a way to allow passwords with '); DROP TABLE… without being vulnerable to an injection?
nevermind i googled it, and there various ways to do so
I noticed that upper case select, drop etc are not prohibited.
Poorly implemented user input filters are not a valid solution to being vulnerable to injection.
Good old Bobby Tables
This still smells though. Why is the raw, plain text password string getting anywhere near database queries in the first place?
I doubt it is. they probably have a WAF that blocks these strings though and didnt want to bother reconfiguring it
No one in their right mind is storing plain text passwords, or letting them anywhere near the database.
You convert the password to a hash, and store that. And the hash will look nothing like the password the user typed.
You’re right. No one in their right mind would do that.
On the other hand, people not in their right mind often run things. Such as my old professional liability insurance. Which wrote the username and password in the yearly statements…
And also sent you the password through email if you forgot it…
Also you couldn’t change it…
There was a popular companion app to a game I play that’s stored passwords as MD5 hashes for years and when they got hacked they were able to decrypt everything.
Bonus point, the app was released multiple years after md5 was cracked.
Developers (including myself) cannot be trusted to implement the correct process 100% of the time. It’s happened too many times for it to be a single person issue and has transcended into a problem with software engineers
Prepared statements, mostly. You define the query using variables, turn that query into a language-dependent object, assign values to those variables, then execute the statement. The values will be passed verbatim, without any parsing.
Or, since we’re talking about a password, you could encode or encrypt it before inserting it into the query string. The fact that the website could be negatively affected by phrases in the cleartext password is very concerning.
At best, it means they’re storing your password instead of just a salted hash. And that’s horrible.
Maybe they filtered those strings to be safe, and put the notice there to answer the invertible “why won’t it accept my password” queries.
It’s a shitty password engine. But not necessarily uncleansed
If they’re trying to protect themselves from code injection by rejecting certain user input like that, then they don’t actually know how to protect themselves from code injection correctly and there may be serious vulnerabilities that they’ve missed.
(I think it’s likely that, as others have said, they’re using off-the-shelf software that does properly sanitize user input, and that this is just the unnecessary result of management making ridiculous demands. Even then, it’s evidence of an organization that doesn’t have the right approach to security.)
I don’t know, maybe they saw that classic XKCD comic and now they’re thinking “hahah, I’m wise to your tricks, ya little shit”
Some of the strongest and easy to remember passwords are just a few words strung together with a few numbers.
For example: Simpsons7-Purple4-Monkey1-Dishwasher8
Just remember “Simpsons Purple Monkey Dishwasher” and “7418”. You’re probably never going to forget that and I just tossed it into a password strength tester and it said it would take about 46 billion years to randomly guess it.
How about hunter2
It would take me about 5 seconds because you just told me what it is genius
Correct horse battery staple
Anything else and I can’t remember so I’m using this.
I’m told it’s very secure so I must be very secure. Right? Right?
I’ll never understand why spaces are commonly not allowed in passwords.
Now remember these types of passwords, all different for different services. It’s not a realistic expectation. Password managers are a must nowadays if you want to protect your accounts. But these types of passwords are also easier to type out.
So they’re not hashing or salting the passwords too. Cool…
They might be doing it in the DB query, but they’re definitely not sanitized beforehand.
Sanitization has nothing to do with salting and hashing.
Which makes me want to try and insert a password of a few megabytes worth of text. Should be fine, since there is no max lenght defined, right?
If there is no overwrought prohibition of something I know that at least in America that means it’s
- Affirmatively legal and
- Legislatively encouraged by the FREEE Act
So give ’em hell!
Didn’t say anything about truncate!
submits Drop Table as passphrase
Grabs popcorn
Ima just use my butthole with a biometric scanner.
I consider this an invitation.
Oh BobbyTables, you little rapscallion…
Obligatory Little Bobby Tables: https://xkcd.com/327/
And for those who feel like saying they’ve already seen it: https://xkcd.com/1053/
surprised that they let you use
evalWe could still have some fun with ALTER TABLE
I don’t believe this is real. This isn’t real, right?
This is real - I took the screenshot myself.
Little Bobby drop tables
Looking at that I wouldn’t be surprised if those rules are just client-side validation.
