News for 27.11.2012

Hi there,

thanks for watching and all your emails! ;)

Finally I decide to publish here some news for you, so watch me carefully,
changes soon.

cheers
o/

News for 09.2012

Hi ;]

As You can see, blog is not updated since last few days.
It's all because of my new job! :)

So if You have any questions, ask me directly via e-mail please.
I will answer (as always) asap.

Cheers! o/

[EN] Persistent XSS in Concrete5.5.2.1 - 31.08 updated

* persistent xss

+ sql leak

... still testing so more - soon! ;]

* updated at 00:33 *

BIG thanks to Concrete5 Team for a fast reply, and fix! :)
Impressive!



* updated at 31.08 *

Check  some changes here and here.
Also You can try new version of Concrete5 here.

[EN] TomatoCart 1.1.7 vulnerable to XSS

 For example:

../tomatocart/ext/securimage/example_form.ajax.php:39:

           new Ajax.Request('<?php echo $_SERVER['PHP_SELF'] ?>',

Cheers o/

[EN] Reflected XSS in latest e107 CMS (1.0.1)

Hi ;)

Some one asked me about this case in mail, so here is the answer:


1. Go to 'register' page:

2. As Your e-mail confirmation, add yourm@il +  code from screen nr 3:

3. View from Burp Proxy:

4. ... and another one, parameters:

Cheers ;)

o/

[EN] phpBB 3.0.10 with 'stopped MySQL' funny one

Hi ;]

Check it out: when You ('for example') have some 'troubles'* with Your database,
then 'me as a pentester' can get some 'usefull' information, when You have also installed phpBB. Idea is crazy but... it's just a talk, so ... ;)

Anyway, looks like this:

'Idea'-info...

... and we can do it like that:

Two (paranoid;)) scenarios:
- first: Your database (port) is ddosed/maybe crashed by some 'time limit'/to-many-connection-from-webapp-situations, and so on...
- second: database stopped in this or other way.

...and now: "plus" 'all above', if You have installed (default) phpBB 3.0.10,
You can get this information: "this maybe is default installed 'all'-server-soft"...

:) So, like I said, this 'could be' valuable information for tester, because now
he/she can 'hit' other "defaults", for example, with DirBuster, nmap, and so on.

How to repair that? Maybe quick-fix should be to remove 'adding' line about
where is .sock-file?

Let me know what do You think :)

Enjoy Your weekend!
o/

[EN] JavaScript Payload - GET Idea (1)

Hi,

maybe You'll get the idea of 'how XSS can be used at your page'
after a lecture this sample code:)

Enjoy and remember to test Your webapps! ;)

Code @ pastebin
o/

[EN] This week TODO

Hi,

to the end of this week, I will publish here few posts about what I'm doing right now. For now, it'll be:
- my new presentation about web security (will be here today/tommorow),
- few examples of XHR attacks,
- maybe some new bugs (if time permits... ;) ).

So - see You soon! ;)

Have a nice day
o/

[EN] phpBB3 3.0.10 "Text-insertion bug"

Hi,

I found weird bug in phpBB3 (3.0.10).

Once again, when I'm doing webapp pentests,
vulnerable parameter is 'connected' with date (functions).

Here You have some source code from text added (permanently) to phpBB board:

Example 1:

Example 2:

If You need more details about it, let me know via comments or e-mail.

Cheers! :)

[EN] 2 codes for building payloads

Hi,

If You like playing with Burp or Paros, probably You will get the idea
of :

/*
 * ascii2html.c - simple payload coder
 */

#include <stdio.h>
int main(){
    char ch;
   
    printf("what to say:\n");
    while((ch = getchar()) != NULL){
        printf("&#%d",ch);
    }
    return 0;
}

 and:

/*
 * ascii2url.c - simple payload coder(2)
 */

#include <stdio.h>
int main(){
 char ch;

 printf("what to say:\n");
 while((ch = getchar()) != NULL){
  printf("%%%x",ch);
 }
 return 0;
}

Idea is simple, so maybe it will helps ;) Enjoy o/