Scalable Fuzzing Infrastructure: ClusterFuzz

ClusterFuzz is a scalable fuzzing infrastructure which finds security and stability issues in software. It is used by Google for fuzzing the Chrome Browser, and serves as the fuzzing backend for OSS-Fuzz . ClusterFuzz provides many features which help seamlessly integrate fuzzing into a software...

Comparison of Application Security Testing Approaches

Overview The following table lists a side-by-side comparison of different application security testing approaches. Additional rating details are available when hovering over each column. In the following, each approach is introduced. Category Automated Security Testing Manual Security Testing...

Zomato: Length extension attack leading to HTML injection

At the profile setting page where I can set my personal website I found this url: https://www.zomato.com/redirect?u=xxx&t=yyy Where xxx is the url that we can control and yyy is the hash. Through out blackbox testing I find out that if md5somescret + url == t then the redirect is allowed. This is...

blackbox.com XSS vulnerability

Vulnerable URL: https://www.blackbox.com/en-us/store/selector.aspx?s=";alert'OPENBUGBOUNTY';// Details: Description| Value ---|--- Patched:| Yes, at Vulnerability type:| XSS Vulnerability status:| Publicly disclosed Alexa Rank| 144418 VIP website status:| No Check blackbox.com SSL connection:|...

BLACKBOx - A Penetration Testing Framework

Password Attacks: MD5 CRACKER SHA1 CRACKER SHA224 CRACKER SHA256 CRACKER SHA384 CRACKER SHA512 CRACKER MSSQL2000 CRACKER MSSQL2005 CRACKER MYSQL323 CRACKER MYSQL41 CRACKER ORACLE11 CRACKER Web Hacking : Wordpress Bruteforce – Bruteforce wordpress panel FTP Bruteforce – Bruteforcing FTP LOGIN SSH...

AutoGuard Dash Cam - Blackbox - Customized SSL, Dangerous filesystem permissions, Redefined SSL Common Names verifier vulnerabilities

HackApp vulnerability scanner discovered that application AutoGuard Dash Cam - Blackbox published at the 'play' market has multiple vulnerabilities...

AutoBoy Dash Cam - BlackBox - Customized SSL, Redefined SSL Common Names verifier, WebView code execution vulnerabilities

HackApp vulnerability scanner discovered that application AutoBoy Dash Cam - BlackBox published at the 'play' market has multiple vulnerabilities...

CaroO Free (Blackbox & OBD) - Base64 encoded String, Runtime privilege escalation vulnerabilities

HackApp vulnerability scanner discovered that application CaroO Free Blackbox & OBD published at the 'play' market has multiple vulnerabilities...

netool.sh - MitM Pentesting Opensource T00lkit

netool.sh toolkit provides a fast and easy way For new arrivals to IT security pentesting and also to experience users to use allmost all features that the Man-In-The-Middle can provide under local lan, since scanning, sniffing and social engeneering attacks "spear phishing attacks"... DESCRIPTIO...

[Introspy] Security profiling for blackbox iOS

Blackbox tool to help understand what an iOS application is doing at runtime and assist in the identification of potential security issues. The tracer can be installed on a jailbroken device to hook and log security-sensitive iOS APIs called by applications running on the device. The tool records...

phpMyRecipes 1.x.x XSS / CSRF / SQL Injection

Product: phpMyRecipes version 1.x.x Vulnerability: Multiple SQL Injection, XSS and CSRF Vulnerabilities Impact: High Authors: Rafay Baloch And Sikandar Ali Company: RHAinfoSEC Website: http://rhainfosec.com Introduction ============ "PhpMyRecipes is a simple application for storing and retrieving...

CVE-2010-0217 - Zeacom Chat Server JSESSIONID weak SessionID Vulnerability

-----BEGIN PGP SIGNED MESSAGE----- Hash: SHA1 Packetninjas L.L.C www.packetninjas.net -= Security Advisory =- Advisory: Zeacom Chat Server JSESSIONID weak SessionID Vulnerability Release Date: unknown Last Modified: 09/27/2010 Author: Daniel Clemens daniel.clemensatpacketninjas.net Application:...

CVE-2010-0223

Kingston DataTraveler BlackBox DTBB, DataTraveler Secure Privacy Edition DTSP, and DataTraveler Elite Privacy Edition DTEP USB flash drives do not prevent password replay attacks, which allows physically proximate attackers to access the cleartext drive contents by providing a key that was captur...

Design/Logic Flaw

Kingston DataTraveler BlackBox DTBB, DataTraveler Secure Privacy Edition DTSP, and DataTraveler Elite Privacy Edition DTEP USB flash drives do not prevent password replay attacks, which allows physically proximate attackers to access the cleartext drive contents by providing a key that was captur...

CVE-2010-0223

Kingston DataTraveler BlackBox DTBB, DataTraveler Secure Privacy Edition DTSP, and DataTraveler Elite Privacy Edition DTEP USB flash drives do not prevent password replay attacks, which allows physically proximate attackers to access the cleartext drive contents by providing a key that was captur...

SazCart 1.5.1 Multiple Remote File Inclusion Vulnerabilities

No description provided by source. -========================================== ViVa Islam + YeMeN ====================================- Name : SazCart 1.5.1 Multiple Remote File Include Vulnerability Download From : http://www.sazcart.com/site/download.php?id=16 Found By : RoMaNcYxHaCkEr...

cmsfaethon-rfixss.txt

-========================================== ViVa Islam + YeMeN ====================================- Name : CMS Faethon 2.2 Ultimate Multiple Remote Vulnerabilies Download From : http://cmsfaethon.org Found By : RoMaNcYxHaCkEr RoMaNTiC-TeaM BlackxHat , BlackBox , aLwHEeD Home Page : WwW.4RxH.CoM...

cyberfolio-rfi.txt

-========================================== ViVa Islam + YeMeN ====================================- Name : cyberfolio 7.2 Remote File Include Vulnerabiliy Download From : http://cyberfolio.org/sources/version7.10/cyberfolio712.zip Found By : RoMaNcYxHaCkEr RoMaNTiC-TeaM BlackxHat , BlackBox ,...

CMS Faethon 2.2 Ultimate (RFI/XSS) Multiple Remote Vulnerabilies

No description provided by source. -========================================== ViVa Islam + YeMeN ====================================- Name : CMS Faethon 2.2 Ultimate Multiple Remote Vulnerabilies Download From : http://cmsfaethon.org Found By : RoMaNcYxHaCkEr RoMaNTiC-TeaM BlackxHat , BlackBox ...

interact 2.4.1 Multiple Remote File Inclusion Vulnerabilities

No description provided by source. -========================================== ViVa Islam + YeMeN ====================================- Name : interact 2.4.1 Multiple Remote RFI Vulnerabiliy Download From : http://puzzle.dl.sourceforge.net/sourceforge/cce-interact/interact-2-4-1.tar.gz Found By :...