Security

Null Byte Injection

An attack that embeds a NULL byte or character in input so the layer validating a string and the layer consuming it disagree about where it ends. It is commonly used to defeat filename extension checks, letting a disallowed file type pass a guard that only inspected the truncated name (CWE-158).

Deep dive

Learn Article

How an Arbitrary File Write Becomes Code Execution Through ld.so.preload

Writing a file is not running one, yet attackers bridge the two every day. How the dynamic linker, web roots and scheduler files turn a file-write primitive into a persistent implant.

intermediate 5 min read

Back to glossary