Hello, welcome to the Monday, December 5th, 2016 edition of the Sandinand Storm Center's Stormcast. My name is Johannes Ulrich,

and I'm recording from Jacksonville, Florida. Gareth Hayes has a really interesting blog post at Portswaker

about how polycloth images can be used to bypass content security policy. Polyclot images

aren't really a new issue, but in particular with cross-site scripting, they're now getting

more and more attention, I think rightfully so, because there are a number of different bypass techniques that can be

triggered, can take advantage of these images. The term polycloth images does refer to images

that are by themselves valid image files, but they can also be interpreted as something else. In our defending web applications

class, for example, we have an example where we do have a valid JPEGM image that's also PHP code.

And really all that's done in that case is to insert PHP code as a comment as part of the XIF data.

Now in this particular example shown by Portsbigger, it's a little bit more complex, but essentially the entire image is also JavaScript by inserting comment characters in the right spot and then using just some 0 bytes for padding.

This Portsmicker blog post also has a number of real great links that sort of introduce you more

into what polyglot images are beyond this particular application of them to bypass content security

policy. Any good pentest class should have told you that as part of your reconnaissance,

you probably want to look for any code that developers have posted on sites like Stack Overflow asking for help.

Well, a researcher now went over all of these postings on Stack Overflow

and tried to figure out how many of them do include SQL Injection vulnerabilities.

He focused on PHP here and essentially wrote a script that went

through Stack Overflow to find all PHP code with a SQL injection vulnerabilities. And he found

that a staggering 40% of code samples in questions did include SQL injection.

Now if you wonder if SQL injection is ever going to go away.

In this particular experiment the data goes back to 2006 and really the rate was amazingly steady around 40%.

Now without any more detailed analysis the data set is a little bit

...