Wednesday, 22 February 2012
Saturday, 18 February 2012
Marzec 2012 - Updated 2.03.2012
Po ostatnim tygodniu testów najnowszej wersji Wordpress'a (3.3.1)
w marcu opublikuję tu 0daya.
w sumie to 3 0day'e ... ;)
Do tej pory, używane będą wyłącznie podczas projektów :)
Cheers!
w marcu opublikuję tu 0daya.
/* "W sumie to 4 0day'e ... ;)"
* update 02.03.2012 - w sumie są 3, ponieważ 2 z nich połączyłem, więc... ;)
(...)*/w sumie to 3 0day'e ... ;)
Do tej pory, używane będą wyłącznie podczas projektów :)
Cheers!
phpMyAdmin 3.4.10.1 - released!
It's my pleasure to say that new release of phpMyAdmin is waiting for You! :)
My last post about phpMyAdmin 3.4.9 0day as a matter of fact was about 3.4.10 too.
But I didn't want to write about it until patch release .
Details here.
Now You can try new PMA. 0day fixed! ;)
Once again excellent work with PMA Security Team.
Their speed and practical solutions are amazing!
Thanks again and best regards! ;)
My last post about phpMyAdmin 3.4.9 0day as a matter of fact was about 3.4.10 too.
But I didn't want to write about it until patch release .
Details here.
Now You can try new PMA. 0day fixed! ;)
Once again excellent work with PMA Security Team.
Their speed and practical solutions are amazing!
Thanks again and best regards! ;)
Friday, 17 February 2012
[PL] Notatki z projektów - #01 - "Strony internetowe"
[PL] Notatki z
projektów - #01
Z racji wprowadzania kilku zmian na blogu, ten post będzie w
„naszym” języku ;)
„Notatki z projektów” to mini-seria, którą zamierzam tutaj
prowadzić, opisując wszelkiej maści błędy, które najczęściej spotykam wykonując
dla Was projekty.
Notatkę #01
zacznę od opisania kilku (? Może rozszerzymy to w komentarzach;)) najczęstszych
błędów, jakie spotkałem podczas testowania webaplikacji tworzonych przez firmy
projektujące strony internetowe.
Temat ciekawy jak na czasy konkurencji i technologii w tej branży w Polsce... ;)
Temat ciekawy jak na czasy konkurencji i technologii w tej branży w Polsce... ;)
Aby doprecyzować, opis dotyczy firm, które korzystają
(czasem w dziwny sposób) z gotowych, popularnych
rozwiązań CMS.
Najczęstsze błędy, jakie mogą prowadzić do "włamań na stronę", to:
A) „install”, czyli… :>
B) Cross-Site ScriptingNajczęstsze błędy, jakie mogą prowadzić do "włamań na stronę", to:
A) „install”, czyli… :>
Idealny dla „atakujących” katalog
z plikami instalatora w katalogu WWW, bardzo często z prawami zapisu.
Czyli jak przeklepać „install->enter”
i sprzedać „gotową WWW” bez sprawdzenia „co w trawie piszczy” ;)
C) SQL Injection
„Twoje bazy należą do…” – no właśnie.
Kto bierze odpowiedzialność za wyciek bazy w przypadku gdy „firmową WWW” tworzy
firma trzecia? ;)
Te popularne błędy często przytrafiają się nawet najlepszym, dlatego warto testować swoją witrynę internetową. To ona w XXI wieku jest wizytówką naszej firmy. :)
To tylko krótka piątkowa notka… niedługo kolejna odsłona „PL”
;)
Why I'm testing TOP20 WebApps
Let's say... this post is an answer to all Your questions in all e-mails about:
"why I don't release any PMA/*cms*/etc... 0days?".
So answer is:
because all technical information I sent to Vendor.
I don want to release any of those codes because:
1. A lot of admins on the world, do not upgrade their PMA "for years" (;)).
So "no skid help" here. Even if Vendor release patched version. :*
2. I use this codes to pentest Your server's :P ... after we "sign a papers" to do it ;)
Full (and only) legal ideas, please. Really ;)
More questions? Feel free to ask @ mail / comments.
Cheers!
"why I don't release any PMA/*cms*/etc... 0days?".
So answer is:
because all technical information I sent to Vendor.
I don want to release any of those codes because:
1. A lot of admins on the world, do not upgrade their PMA "for years" (;)).
So "no skid help" here. Even if Vendor release patched version. :*
2. I use this codes to pentest Your server's :P ... after we "sign a papers" to do it ;)
Full (and only) legal ideas, please. Really ;)
More questions? Feel free to ask @ mail / comments.
Cheers!
Tuesday, 14 February 2012
phpMyAdmin 3.4.9 0day
After 2 days of coding, there is an 0day for phpMyAdmin 3.4.9.
No public details this time.
* Update 15.02.2012 *
* 18:00 *
After few hours of this post I saw new (3.4.10) release of phpMyAdmin...
You must check it out and update at www.phpMyAdmin.net !
Enjoy ;)
No public details this time.
* Update 15.02.2012 *
* 18:00 *
After few hours of this post I saw new (3.4.10) release of phpMyAdmin...
You must check it out and update at www.phpMyAdmin.net !
Enjoy ;)
* 19:44 *
Security Team was informed. :)
* Weekend updates *
This weekend phpMyAdmin Team released new version, so a little update here or here ;)
Gwibber (Ubuntu 11.04) XSS/DoS
I was wondering if there is something similar to one Skype XSS attack in new Ubuntu Linux.
Tested program is called Gwibber and it is installed default for Ubuntu 11.04.
Vulnerable seems to be "Search" engine:
to verify persistent XSS put in "search" this example code:
<script>alert('XSS'); </script>
Lookout, this code will be stored in Gwibber permanently.
If You add this to Your Gwibber, and re-run it, apps will show XSS, and crash because of DoS.
Found: 11.01.2012.
Vendor was informed: 19.01.2012.
Enjoy! ;)
(Thanks, if You would confirm it with Your versions.)
Cheers
Tested program is called Gwibber and it is installed default for Ubuntu 11.04.
Vulnerable seems to be "Search" engine:
to verify persistent XSS put in "search" this example code:
<script>alert('XSS'); </script>
Lookout, this code will be stored in Gwibber permanently.
If You add this to Your Gwibber, and re-run it, apps will show XSS, and crash because of DoS.
Found: 11.01.2012.
Vendor was informed: 19.01.2012.
Enjoy! ;)
(Thanks, if You would confirm it with Your versions.)
Cheers
Sunday, 12 February 2012
OSSEC Cool Dashboard - New release!
Once upon a time I found a OCD at SourceForge.
After few mails, about a little bug I've found, Jess Portnoy decided
to release new version of her UI.
"OCD is a simple web UI written in PHP [and little CSS].
It displays dashboard of current OSSEC activity.
Originally written to allow NOC to monitor OSSEC events in realtime."
New release is available at:
http://sourceforge.net/u/jessrpm/profile/
or http://sourceforge.net/p/ocd01/.
Good job Jess! :)
After few mails, about a little bug I've found, Jess Portnoy decided
to release new version of her UI.
"OCD is a simple web UI written in PHP [and little CSS].
It displays dashboard of current OSSEC activity.
Originally written to allow NOC to monitor OSSEC events in realtime."
New release is available at:
http://sourceforge.net/u/jessrpm/profile/
or http://sourceforge.net/p/ocd01/.
Good job Jess! :)
Sunday, 5 February 2012
Who want's an 0day for e107? ;)
Advisory in progress... :)
*Update - 14.02.2012*
Scenario of attack : registered user can add content to e107.
In this case, we can get two situations: sql injection and/or xss.
Still in progress (because of other projects, sorry ;))
To be continued...
*Update - 14.02.2012*
Scenario of attack : registered user can add content to e107.
In this case, we can get two situations: sql injection and/or xss.
Still in progress (because of other projects, sorry ;))
To be continued...
Friday, 3 February 2012
Joomla Disclosure (finally updated;))
Last days I wrote few notes about Joomla Security.
Few minutes ago one of You send me a nice information
about "my finding" ;P
Like I saw, someone find "Joomla XSS" before me, so
"mine" are only "information disclosure" bugs listed.
Good. :)
So... Let's install latest Joomla! ;)
Once again: big thanks to Joomla Security Team.
For response. For knowledge. For patient.
Cheers!
Few minutes ago one of You send me a nice information
about "my finding" ;P
Like I saw, someone find "Joomla XSS" before me, so
"mine" are only "information disclosure" bugs listed.
Good. :)
So... Let's install latest Joomla! ;)
Once again: big thanks to Joomla Security Team.
For response. For knowledge. For patient.
Cheers!
Subscribe to:
Posts (Atom)