ecshop某处通杀存储型xss直达后台漏洞

简要描述： 测试了2.7.3-2.7.4 都存在这个漏洞 应该是通杀吧：） 详细说明： 随便找一个商品购买 数量填999999999999 然后会让你填写缺货登记 数据随便填 然后利用burp抓包 修改掉email中的数据提交 然后坐等管理员审核缺货登记。。。 漏洞证明： 过滤...

Seagate GoFlex Remote Shell

I have been scanning some ranges in my free time and came across a Seagate GoFlex Home Network Storage System which my scanner flagged as being vulnerable to shellshock but getting a remote shell was no easy task "for me anyway". I ended up having to build a payload with msfvenom and doing the...

用友企业空间APP权限绕过泄露大量内部资料

简要描述： 也来玩玩移动安全 详细说明： 网址为 http://upesn.com。在web版里只找到几个xss，于是下载了app看看。 然而app用了360的加密，菜鸟表示不知道怎么逆向了。。 smali └── com └── qihoo └── util └── StubApplication.smali 虚拟机运行app抓包，终于找到个有问题的地方： 这里会有个请求： 其中的id就是该企业的公告id，可以通过修改id越权查看其他企业的公告。 用 burp suite 跑了下： 一大堆内部资料。。 漏洞证明： img...

withinsecurity: DDOS using xmlrpc.php

Wordpress blogs that have xmlrpc.php enabled for pingbacks, trackbacks, etc. can be made as a part of a huge botnet causing a major DDOS. The blog at withinsecurity.com has the xmlrpc.php file enabled and could thus be potentially used for such an attack against other victim hosts. In order to...

Revive Adserver: Login page password-guessing attack

Vulnerability description not provided...

Cross-Site Scripting in subscribetocalendar.action

panel:bgColor=e7f4fa NOTE: This bug report is for Confluence Server. Using Confluence Cloud? See the corresponding bug report|http://jira.atlassian.com/browse/CONFCLOUD-48910. panel The contents of the 'subCalendarId' parameter is not validated in POST requests to 'subscribetocalendar.action' and...

Cross-Site Scripting in subscribetocalendar.action

The contents of the 'subCalendarId' parameter is not validated in POST requests to 'subscribetocalendar.action' and is susceptible to cross-site scripting. Steps to Reproduce: Start a proxy tool such as Burp Suite. Log into a Confluence instance with Team Calendars installed. Use the proxy tool t...

Cross-Site Scripting in subscribetocalendar.action

panel:bgColor=e7f4fa NOTE: This bug report is for Confluence Server. Using Confluence Cloud? See the corresponding bug report|http://jira.atlassian.com/browse/CONFCLOUD-48910. panel The contents of the 'subCalendarId' parameter is not validated in POST requests to 'subscribetocalendar.action' and...

Cross-Site Scripting in subscribetocalendar.action

panel:bgColor=e7f4fa NOTE: This bug report is for Confluence Cloud. Using Confluence Server? See the corresponding bug report|http://jira.atlassian.com/browse/CONFSERVER-48910. panel The contents of the 'subCalendarId' parameter is not validated in POST requests to 'subscribetocalendar.action' an...

Automattic: WooCommerce: Support Ticket indirect object reference

Hi there's no protection against Idor, so i can comment on anyone's Ticket. Reproduce Issue: 1.Go Here: https://www.woothemes.com/my-account/tickets/ 2.Create a new Ticket suppose ticked id is : 340529 Comment something on 340529 Ticket, and capture that request In Burp suite. here's the request:...

Burp Suite Professional 1.6.26 - The Leading Toolkit for Web Application Security Testing

Burp Suite is an integrated platform for performing security testing of web applications. Its various tools work seamlessly together to support the entire testing process, from initial mapping and analysis of an application's attack surface, through to finding and exploiting security...

InVision: Deleting a Project for which the user is not owner but a normal member

A Project member who is not the owner of the project does not have delete option. But using proxy tool like Burp Suite, a low privilege Project member user can delete the Project, Where only the project owner has the privilege to delete the project. Pre-Requisite: A project where current user is...

Local file inclusion vulnerability detection tools – Burp the domestic plug-in LFI scanner checks-vulnerability warning-the black bar safety net

LFI scanner checks to myself to burp the lightweight scanner to do a detect a LFI vulnerability plug-ins, because burp is not an effective detection of the LFI feature, only to write yourself a plugin. Look at the following screenshot: ! To compare the following J2EESCAN inside the included LFI...

XSS Payload Management Framework: Sleepy Puppy

Sleepy Puppy is a cross-site scripting XSS payload management framework which simplifies the ability to capture, manage, and track XSS propagation over long periods of time. Why Should I use Sleepy Puppy? Often when testing for client side injections HTML/JS/etc. security engineers are looking fo...

Burp Suite Tutorial

Ребята из bugcrowd начали записывать видео-руководство по использованию программы Burp Suite Видео ENG: Hacking with Burp Suite - Tutorial 1 Вопросы по курсу...

Web Security Dojo

Web Security Dojo is a preconfigured, stand-alone training environment for Web Application Security. Virtualbox and VMware versions are available for download. Dojo is an open source project intended to be used as a training environment, and shouldn’t be used as a pen-testing platform due to the...

Slack: Link vulnerability leads to phishing attacks

Hello Guys, Hope you are doing great. I'm sending this email to let you know about a vulnerability i stumbled upon while using slack it's a great app!. While copy-pasting a link from a pdf to slack desktop/web, i noticed that the resulting links looked a bit messed up 1.png Firing up burp and...

BypassWAF - Burp Plugin to Bypass Some WAF Devices

Add headers to all Burp requests to bypass some WAF products. This extension will automatically add the following headers to all requests. X-Originating-IP: 127.0.0.1 X-Forwarded-For: 127.0.0.1 X-Remote-IP: 127.0.0.1 X-Remote-Addr: 127.0.0.1 Usage Steps include: 1. Add extension to burp 2. Create...

Hishop商城分销系统某处信息泄露

简要描述： RT 详细说明： 前人案例： http://wooyun.org/bugs/wooyun-2010-019206 泄露地址： /SubmmitOrderHandler.aspx?Action=GetUserShippingAddress&ShippingId=2 其中ID值为可控的，用BURP不断遍历可以找出非常多的用户信息 案例： http://demo.kuaidiantong.cn/SubmmitOrderHandler.aspx?Action=GetUserShippingAddress&ShippingId=2...

Autorize - Automatic Authorization Enforcement Detection (Extension for Burp Suite)

Autorize is an automatic authorization enforcement detection extension for Burp Suite. It was written in Python by Barak Tawily, an application security expert at AppSec Labs. Autorize was designed to help security testers by performing automatic authorization tests. Installation 1. Download Burp...