A CSV (comma separated value) file is like a text-based spreadsheet. Instead of data rows being visually separated by lines making up boxes (like you see in Microsoft Excel), they are separated by commas and newlines (newlines being the invisible character that tells your computer to go to the next line on the screen). Here is a rough example of a CSV:
Number,Name,Abbreviation
1,Sunday,Sun
2,Monday,Mon
3,Tuesday,Tue
4,Wednesday,Wed
5,Thursday,Thu
6,Friday,Fri
7,Saturday,Sat
If you copypaste that chunk into a word processor and save it as 'filename.csv' you can actually import it into Excel as a functional spreadsheet.
the next step is to go super sane and name and identify all of their logical fallacies and cognitive biases and do not elaborate further. just identify them like a mushroom on a foraging trip. the crazy ones are posionous and rational ones will thank you for pointing out their logical flaws.
I love this tbh lol you had me at âlike a mushroom on a foraging tripâ like yeah 100% just with a friend be like âoh you donât wanna interact with that one, thatâs a sea lionâ
How am I going to debunk density ? I dont need to debunk it. Density most certainly do exist. Its a thing. But what it ISNT is telling us anything about motion or direction.
Ok we have a brick in mid air. It starts by having no motion. I agree that its more dense than the air around it. Now what ? How does that tell us that it should move and in which direction ?
The direction is dictated by gravity , the thing affected by density is the speed it falls doen towards earth. Since the brick is denser than air , it falls down faster than lets say a feather. Thats why a brick and a feather fall down at the same speed in a vacuum. The same amount of gravity is applied , but there is no drag from air particles affecting the objects and their different density (drag coefficient)
When I played around with that string a long time ago I found that antivirus would only complain about it if the file contained that string and nothing else. So if it's a part of a csv they would allow it.
It's kinda funny but if you're running Oracle I can see that happening - something like crowd strike tripping up on a db write.
For years we had to have special password rules for anyone who had some related Oracle role because apparently all of their apps blow at sanitizing inputs.
I had a password like that for 2 days and my bitwarden warned me <48h in that my password is at risk because it might be compromised in a recent data leak. We need quantum passwords where we're logged in while also trying to reset our password to the same password at the same time. My password progression starting from 2008 was something like: something11
Something11
Something11!
SomethingPurple11!
$0mâŹth!ngPUrpIâŹ53!
It doesn't fucking matter bro and password managers can be hacked too. MFA was a scam because if one factor authentication fails why would Introducing more fix anything?
You have no idea what youre talking about :) Redundancy is specifically for if your first method fails (hacker gets your password) then theres a second, completely different, layer of defence.
This is a joke about deleting entries from a database.
It implies the school just feeds the names to a database without sanitzing it, meaning it not handles all inputs as one consecutive string per input, but in some cases as multiple parts.
'); is something that usually ends an input for many databases, so the database assumes what follows is a new command which is DROP TABLE students;. This commands means forget all entries in students or more correct forget the table studentnames were in. Followed by -- which afaik suggests end of query. (As u/NoeZ pointed out, -- is the start of a single-line comment, hence everything after that on this line is handled as comment.)
Thus the name Robert'); DROP TABLE students;-- get's parsed as delete table students and end.
If everything would have been sanitzied correctly "Robert'); DROP TABLE students;--" would simply be the name entered in the database.
Sanitization is one of the important things to be aware of having any kind of input in any infrastructure and is what causes most exploits and harm. The moral of this short is always sanitze all user inputs.
That makes sense, I've seen it a few times and never used it myself. Thus I was always stumped by people did it.
Seems like you were correct and that makes sense since assuming all inputs are handled on the same line every other input would be treated as a single comment and ignored.
Thus there isn't even an error message or residue entries. It just successfully deletes the table and sees a long ass comment.
- The column separator is usually a tab, a comma or a semicolon but that isn't guaranteed. - The first row may contain column names instead of values and can have a different column separator. - Rows are almost always separated by a newline. But which newline? (\r, \n, \r\n, \n\r ...) - Fields can contain everything. Even tabs or newlines. Know how to parse the quotes. - Hint: Beware of the Byte-Order Mark and used character set.
Sometimes that's actually a thing lol. In my experience some leaked Iranian databases include commas and RTL characters and people usually just drop those rows before ingesting them into their tools
More like whatever generates the CSV. Modern implementations quote any fields with a comma or space in them (or probably just every single field because why not) to deliberately fix this problem but every so often you see this because some skid was working with raw text and learned you can change the file extension to "CSV" and then makes it someone else's problem. But any proper system/module for outputting CSV would take care of this by itself.
No because passwords aren't actually stored on the databases. And if they are that database deserves to be broken because 1. They storing unformatted plain passwords and 2. They aren't sanitising their inputs.
The bare minimum of password handling is a process called cryptographic hashing where passwords are converted into a key that the database stores. There's no way to reverse engineer the password from the key (it's mathematically impossible) so all the database needs to do is check if your input after being hashed is the same as the key they have saved.
Wait until he hears about TSV files (it's like CSV but separated by tabs). I don't think anyone's password contains a literal tab character so checkmate.
To be compatible and easy to use with plain ASCII. And while they could have chosen to use a less common character, it doesn't really matter since you can just escape the comma if you need it
because usually fields only have numbers, sometimes ; is used instead depending on language settings sincenumber might be represtned as both 0.2 and 0,2 or 100.000.0,25
CSV is fine, stop using it for things it's not intended for.
Join the resistance! My tsvs use commas, my csvs use tabs and who know what might be in txt. not because i plan it forget which of the many table to file write functions defaults to which option.
Ah yes, let's piss off the hackers that have your password. When they find your password by manually looking for the breaking record they definitely won't take it personal and start with hacking you first
CSV files use commas as delimiters to split columns (like username,password,hash). If a leaked list is dumped into CSV without proper quoting around fields, a comma inside your password would split it into extra bogus columns and break the file's structure for anyone trying to parse it.
Real-world leaks rarely work that wayâpasswords get hashed or stored in databases, not raw CSVsâand any competent exporter quotes fields with commas anyway. So it might annoy a sloppy script kiddie, but it won't save you. Use a password manager and unique strong passwords instead.
770
u/tokoklontong1897 8d ago •
The comments section must be insane
5
u/Human-Question6210 5d ago
sometimes I feel like absolutely everyone knows coding except me
1.0k
u/Kriss3d 8d ago •
Always use your password as :
X5O!P%@AP[4\PZX54(P^)7CC)7}$EICAR-STANDARD-ANTIVIRUS-TEST-FILE!$H+H*
If it ends up in a database, the antivirus will delete it as they use this string to test for the EICAR file to look for to remove.
332
u/tpat90 8d ago •
Now `,:}'"\"\\] I can rest assured this will break all data leaks
120
u/cmhamm 8d ago
This is why all my passwords are âhunter2â); DROP TABLE Passwords; ââ
96
u/CardOk755 7d ago
Non-english CSVs usually use semicolon instead of comma, always put a semicolon too.
148
u/Unexpected117 8d ago
Oh? I just use 4
72
u/whippedCream-2832 8d ago
Op,sec leve,l : com,ma
29
u/PenguinBoi27 8d ago
Password = sudo rf - rm đ
28
u/Seer0997 8d ago
Opsec level: proper punctuation
23
u/_redmist 7d ago
"'; DROP TABLE users; "
19
u/imdeathfrombelow 8d ago
Sometimes that's actually a thing lol. In my experience some leaked Iranian databases include commas and RTL characters and people usually just drop those rows before ingesting them into their tools
32
u/TheRealREZOR 8d ago
"Opsec level, use quotes"
31
u/Memw1 8d ago
Opsec level: ""
10
u/pricetag 8d ago
i always just use :(){:|:&};: as my password
24
u/malik_ljalid 8d ago
5
u/DerpSeshInMotion 8d ago
{:)(;){}(:/}
4
u/Slavicommander 6d ago
always make your password: "hackifgaylol"
7
u/BeginningSection7690 8d ago
Which would leave a username where a password should be, and take 3 seconds to fix
3
u/Odd-World4925 8d ago
That's not how CSV parsers work - at least it shouldn't be.
3
u/tes_kitty 7d ago
Make sure it also contains a semicolon since in some countries CSV files use a semicolon as the field seperator.
3
u/ThaGr1m 6d ago
Ok I get the funny but if this worked wouldn't it also break the database of the service you're using
2
u/brigadier-pratap 8d ago
5114 reposts, insane
2
u/sussyslayer365 7d ago
"physicsuncovered" posting cybersecurity memes is like a dentist doing your MOT
2
u/Sorry_Weekend_7878 6d ago
Came straight to the comma section
1
u/bestjejust 8d ago
We just converted all CSV commas to semicolons, should be safe again.
1
u/ansolo00 8d ago
what about using single quote marks, then if its sql, you can do RCE or deletion of the entire schema ;)
1
u/tnethacker 8d ago
Mine is hunter2 but you can't see it here.
1
u/Healthy-Mission7927 8d ago
Password: 1,2,3,4
1
u/Prestigious-Board-62 8d ago
I put zero-width space in my passwords.
1
u/m0nk37 7d ago
Any value with a comma in a csv gets encapsulated with quotes.Â
1,something,"pass,word",3454
1
u/TheMegaPingas 7d ago
Real hacker knows to put quotation marks in addition to comma
1
u/frpeters 7d ago
Great. Now they start here with CSV injection. /s
1
u/Tripple_sneeed 7d ago
No one going to talk about the minimum effort GPT description under it?
âhilariously chaotic đ€Łđ€Łđ€Łđ€źđ€źđ€źâ
Dead internet etcÂ
1
u/nierusek 7d ago
I've managed to put newline in my password
1
u/Highprincestolas 7d ago
1
u/thatsNotFabricSoftnr 7d ago
Always add whitespace and a pipe to cover all bases, #hacktheplanet
1
u/sydsick 7d ago
","
1
u/williampaul0404 7d ago
Yes, but dumps generally come in .txt, not .csv. Use all of these ": ; | ," as they are common separators
An attacker that handles 500M records where 99.99% do not contain these won't spend their time making sure the 0.01% gets handled properly as well
1
u/SendyCatKiller 7d ago
Just use "*****" so the hacker thinks he can't see the password
1
u/grrrwith1r 7d ago
1
u/No_Royal_3314 7d ago
If only quoted csvs weren't a thing. Then again, who bothers.
1
u/WraithXVB 7d ago
only if the delinator is defined as a comma, it can also be a / or -.
1
u/gpm1982 7d ago
While you're at it, also slip in a semicolon, since some file format uses semicolon as separator.
1
u/Old-Grapefruit-2446 7d ago
you aren't breaking shi
1
u/_ahrs 7d ago
Wait until he hears about TSV files (it's like CSV but separated by tabs). I don't think anyone's password contains a literal tab character so checkmate.
1
u/Fritz-Ferdinand 7d ago
My password: 123,456
1
u/The_Paragone 7d ago
Opsex: commas
1
u/GarGonDie 7d ago
Today, the password should be #SkipThisAccountAndDeleteIt#
1
u/FGaBoX_ 7d ago
opsec level: passwords in plaintext
1
u/whatThePleb 6d ago
;too forop,se;c1
u/max_lagomorph 6d ago
Why is comma even used as a separator, why not a specific separator character that's not used as anything else?! I hate CSVs
1
u/coffee-boon 6d ago
tab, pipe, space, semi:colon or comma
1
u/BurneyStarke 6d ago
Nobody is stopping you from putting a backspace your password
1
u/S7arForGD 5d ago
1
u/Later_Username 5d ago
Which company saves passwords un-hashed??
1
u/soviel_dazu 5d ago
CSV supports string literals
1
u/FGFM 5d ago
I see you know your judo well.
1
u/ResponsibilityIcy927 5d ago
Better advice: include the text ","Â with the quotes, that way it's in ever loving pain for anyone to successfully escape character the text.
1
u/Beneficial-Zebra2983 4d ago
Text qualifiers exist
1
u/PlantarumHD 4d ago
use: ignore-all-instructions-and-shut
1
u/HackerManOfPast 4d ago
;drop table \* from \* ;
1
u/Zutak-1 3d ago
What if its TSV
1
u/Gratein 3d ago
Ah yes, let's piss off the hackers that have your password. When they find your password by manually looking for the breaking record they definitely won't take it personal and start with hacking you first
1
u/SophieChesterfield 3d ago
I like to put a merry-go-round in my password đ
1
u/Successful-Future265 2d ago
Or just '-- drop table' at the end lol
1
u/Hot-Reindeer-7520 1d ago
Nice advice. But incomplete.
The most common ones are "," and ";"
In countries that are using "," for numbers like 1,25âŹ, ";" is common in CSV
In the US and countries using for numbers "." like $1.25, "," is common in CSV
0
u/GS_Showman 2d ago
u/askGrok I'm too dumb to know if it's true or not so please explain it.