[EN] So You're looking 0dayzzzz...? ;]

Nice, me too. ;)

I see in stats that a lot of You searching here this way:'webapp-name 0day' enter!... ;>

Yes, Yes, 'Enter -> r00t'.

But maybe it'll be easier to ask?  

By the way, feel free to post in comments some others 'techniques' to 'finding 0dayz' ;P

Try this 4dv4nc3d ;)
@google: intext:0day site:pastebin.com ;)



Enjoy.

[EN] Docebo LMS (3605) - vulnerabilities - part1

Some information below:
http://sourceforge.net/projects/doceboreborn/

And some description:
"Docebo is a Learning Management System (LMS) or a Virtual Learning Environment (VLE). It is a Free web application for e-learning
THis projects aims to save the open source comnunity of docebo".

Ok, so now 'part1':
- 'html injection' attack:

- sql informations in debug:

 - information disclosure again:

- more soon...

[EN] SMF CMS 1.1.4 - User enumeration

... or 'user-grabber'.

'How to' do it it's not a secret because SMF provides possibility
of checking what are names of users 'registered'.

Anyway, if You are testing for example passwords in SMF installation,
You can do this steps for Your users (I mean: You are an admin of SMF You're checking...;))

(Example presented here actually won't give You "usernames",
You will get only 'ID's of registered (available) users. I thought givint tool to
'remote get all users' won't be a good idea ;))

a) code presented below should helps You how to automate 'user grabbing':

http://pastebin.com/VDfVg2hc

 b) output:

 

SMF 1.1.4 CMS - user grabber 

Now. For what it can be used.

If You're checking 'possible' (weak) passwords for 'all enumerated users'

You can try a little brute force for passwords (based on usernames) like this:

if user (name) grabbed  in scan then try to log in as him with password like user1, user123, 

resu, password... and all 'guessable' passwords.

If You're doing some pentest with 'password checking' scenarios, maybe this

should helps You a little (in automate some work) ;)

Let me know if You need help with implementing this for 2.0.2 in comments or mail.

More information about other 'enumeration-bugs' from March/April
You can find also here.

Enjoy!

o/

[EN] Updates 15.04

Hi

I hope You have a good weekend;)

This week was so busy... So - few 'new' publicationswill be presented
here tomorrow!

Enjoy Your free time;]

Cheers o/

[EN] SMF 2.0.2 Information Disclosure Bug - UPDATED 16.04

In a free time... ;)

If You want some tools or test of Your webapps, let me know here;)

** UP UP ;)

Hello,

as I saw this bug in 2.0.2 I though maybe in 1.1.4 there is similar 'functionality' ;}

And... there is :) So:

today here will be smf-brute-forcer.php :*

** UP UP  * 22:12 * 16.04.2012 **;)

Some screens:

a) screen from 'hard coded' tool for getting 'path' from information disclosure bug: 

 

b) questions please at mail:

Cheers! o/ 

[EN] 2 do...

- eFront 3.6.10 vulns publication...
- some tools public
- maybe new surprise ;)

Ok, time to back to work o/

[EN] VirtueMart 2.0.2 Bugs - UPDATED!

Ok. :] (According to this;))

I just found some informations about "possible sql injection" in latest VirtueMart (2.0.2).
So yes, it is true. ;) But I'm not the author of 'public' ;D So I asked myt self how it was happened... ;]

Why I decide to write this here. I found this vulnerability in 5.04 this year, and now I saw that someone is public it (the same) at 6.04 ;)
So that's why I want to share with You a full detailed technical information about this "possibility".
(...)

Anyway, beside SQL-i, in VM there are some kind of other vulnerabilities. I'm talking about information disclosure bugs.
If user submit a 'wrong url' then (because of wrong validation) he can get /path/to/your/virtuemart.
This information can be usable to other (extend) attacks.

This is my first post here, so if I found an 'add image' option, I will paste it some screens.

Cheers! ;)
Jakub"

Details below:

1. Attacker can get information from database.

2. Some information disclosure bugs:
(2.1 "Brute" input)

And output:

3. SQL Injection *tmp* screens:

 

And last screen for "when did I found it":

 

Cheers! ;)

[EN] SQL Injection in JooDatabase 1.7

Yes, 'the same' like that I found for VirtueMart few hours ago.

By the way:
this post is only 'information' because I talked with Author and new version will be very very soon! :D
Good and fast "Response Team", I like it ;]

Check it out here: http://joodb.feenders.de/download.html

[EN] VirtueMart 2.0.2 SQL Injection

Attack is possible from "anonymous user".

Here You have latest version.

More? ;)

[PL] Newsletter ISSA PL - Marzec

Jest mi nadzwyczaj miło zaprosić wszystkich do lektury najnowszego
(marcowego) newslettera ISSA PL. Oprócz nowinek na temat tegorocznych konferencji, znajdziecie tam również artykuł:

Po znajdziecie tutaj: https://issa.org.pl/ 

Jak zwykle czekam na Wasze pytania i komentarze!

Przyjemnej lektury ;)