U.S. Dept Of Defense: Time Based SQL Injection vulnerability on a DoD website

A Department of Defense webserver was vulnerable to a SQL injection attack that could have revealed sensitive financial information. @psychomantis was able to demonstrate this vulnerability by crafting specially formatted URLs. Thank you! The service being used didn't properly sanitize id...

Turkish Hackers Are Giving Away Prizes For Participating In DDoS Attacks

DDoS has become a game now that could knock any service offline. A Turkish hacking group is encouraging individuals to join its DDoS-for-Points platform that features points and prizes for carrying out distributed denial-of-service DDoS attacks against a list of predetermined targets. The points...

U.S. Dept Of Defense: SQL injection vulnerability on a DoD website

A Department of Defense website was vulnerable to a SQL injection attack which may allow an attacker to execute arbitrary SQL commands and expose sensitive data. @mthirup was able to demonstrate this vulnerability by crafting a specially formatted URL. Thanks to @mthirup for discovering this...

U.S. Dept Of Defense: Reflected XSS on a DoD website

A cross-site scripting vulnerability was found on a Department of Defense website which may trick a web user into executing a malicious script, potentially revealing a user's web session information or modify web content. @juliocesar was able to demonstrate this vulnerability by crafting a...

U.S. Dept Of Defense: QuickTime Promotion on a DoD website

A Department of Defense website was configured to require users to view video files using an insecure software application. Thanks for notifying us of this, @spam404!...

U.S. Dept Of Defense: SQL injection vulnerability on a DoD website

A Department of Defense website was vulnerable to a SQL injection attack which may allow an attacker to execute arbitrary SQL commands and expose sensitive data. @korprit was able to demonstrate this vulnerability by crafting a specially formatted URL...

Hacking Millions with Just an Image — Recipe: Pixels, Ads & Exploit Kit

If you have visited any popular mainstream website over the past two months, your computer may have been infected — Thanks to a new exploit kit discovered by security researchers. Researchers from antivirus provider ESET released a report on Tuesday stating that they have discovered an exploit ki...

U.S. Dept Of Defense: Reflected XSS in a Navy website

A cross-site scripting vulnerability was found on a Navy website which may trick a web user into executing a malicious script, potentially revealing a user's web session information or modify web content. juliocesar was able to demonstrate this vulnerability by crafting a specially formatted URL...

U.S. Dept Of Defense: Remote code execution on an Army website

A webserver hosted by the U.S. Army allowed the execution of local shell commands. meals was able to demonstrate this vulnerability by crafting a specially formatted URL. Thanks meals!...

U.S. Dept Of Defense: Personal information disclosure on a DoD website

A Department of Defense website was mis-configured in a manner that could have exposed personal information. Thanks for notifying us of this, @spam404! IDOR exposing PII...

U.S. Dept Of Defense: Violation of secure design principles on a DoD website

A DoD website was misconfigured in a manner that could have allowed an attacker to collect sensitive information about a user. @spam404 was able to demonstrate this vulnerability by crafting a specially formatted URL. Thank you for notifying us of this vulnerability! Passwords stored in cleartext...

U.S. Dept Of Defense: Open redirect vulnerability in a DoD website

An open redirect vulnerability was found on a Department of Defense website which may trick a web user into being redirected to fake websites which may steal data or credentials usernames and passwords, or trick users into installing malware. @niwasaki was able to demonstrate this vulnerability b...

U.S. Dept Of Defense: XSS vulnerability on an Army website

A U.S. Army website was vulnerable to a cross-site scripting attack which may be used to trick a web user into executing a malicious script, potentially revealing a user's browser cookies or modify web content. spam404 was able to demonstrate this vulnerability by crafting a specially formatted...

U.S. Dept Of Defense: Reflected XSS vulnerability on a DoD website

A cross-site scripting vulnerability was found on a Department of Defense website which may trick a web user into executing a malicious script, potentially revealing a user's web session information or modify web content. @korprit was able to demonstrate this vulnerability by crafting a specially...

U.S. Dept Of Defense: Persistent XSS vulnerability on a DoD website

A cross-site scripting vulnerability was found on a Department of Defense website which may trick a web user into executing a malicious script, potentially revealing a user's web session information or modify web content. korprit was able to demonstrate this vulnerability by crafting a specially...

U.S. Dept Of Defense: Arbitrary Script Injection (Mail) in a DoD Website

A DoD website was misconfigured in a manner that could have allowed an attacker to inject malicious code into automated emails sent by the server. @ahsantahir was able to demonstrate this vulnerability by posting a specially formatted webform. Thanks @ahsantahir!...

U.S. Dept Of Defense: Open Redirect in a DoD website

An open redirect vulnerability was found on a Department of Defense website which may trick a web user into being redirected to fake websites which may steal data or credentials usernames and passwords, or trick users into installing malware. adrianomarcmont was able to demonstrate this...

U.S. Dept Of Defense: Cross-Site Scripting (XSS) on a DoD website

A cross-site scripting vulnerability was found on a Department of Defense website which may trick a web user into executing a malicious script, potentially revealing a user's web session information or modify web content. @clizsec was able to demonstrate this vulnerability by crafting a specially...

U.S. Dept Of Defense: Arbitary file download vulnerability on a DoD website

A DoD website was misconfigured in a manner that could have allowed an attacker to collect sensitive information about the web application or system. @psychomantis was able to demonstrate this vulnerability by crafting a specially formatted URL. Thank you for notifying us of this vulnerability!...

U.S. Dept Of Defense: Information disclosure on a DoD website

A Department of Defense website was misconfigured to disclose potentially sensitive system and user information. @r0p3 was able to demonstrate this vulnerability by crafting a specially formatted URL. Thanks @r0p3!...