PHPYUN最新版SQL注入二处（绕过防御）

简要描述： PHPYUN最新版（phpyunv3.1.0604gbk）SQL注入二处，无视GPC（绕过防御） 详细说明： PHPYUN最新版（phpyunv3.1.0604gbk）SQL注入二处 第一处SQL注入： 文件/member/model/com.class.php function job if$GET'puid' $data'puid'=int$GET'puid'; $data'inputtime'=mktime; $data'cuid'=$this-uid; $data'usertype'=$COOKIE'usertype';...

DARPA Cyber Grand Challenge Finale Set For DEF CON 2016

DARPA’s announcement last October that it would sponsor a $2 million contest, challenging academics and security industry stalwarts to come up with an automated network defense system, has already attracted 35 entrants and a high-profile venue to stage the tournament finale. The final stage of th...

Destoon B2B 2014-05-21最新版绕过全局防御暴力注入（官方Demo可重现）

简要描述： destoon某加密函数缺陷可破解导致注入 由于字符串加密，所以自带的全局stripsql gpc等直接无视了 使用不安全的“随机数”的实例 搬个小凳子吧，这个一时半会儿说不完。。。 详细说明： 出问题的是用于cookie加解密的encrypt和decrypt函数 首先看一下函数内容include/global.func.php 122行 function encrypt$txt, $key = '' $key or $key = DTKEY; //DTKEY是在安装时生成的一个15位随机字符串 $rnd = md5microtime;//缺陷 下面说 $len =...

Upload the file of trap-vulnerability warning-the black bar safety net

0x00 background Now many sites allow users to upload files, but they didn't realize that allow the user or attacker to upload files or even the legitimate files of the trap. What is a legitimate file? Generally, to determine whether the file is legitimate through two parameters: the file suffix,...

Iranian Ajax Security Team targets US Defense Industry

The Iranian hacking group, which calls itself the “Ajax Security Team”, was quite famous from last few years for websites defacement attacks, and then suddenly they went into dark since past few months. But that doesn't mean that the group was inactive, rather defacing the websites, the group was...

Iranian Hackers Target US Defense Contractors

An Iranian hacking group has moved from politically motivated website defacements to a new specialty – cyberespionage. The group known as the Ajax Security Team has been outed as the perpetrators of a number of espionage operations against U.S.-based defense contractors in addition to targeting...

Apache vulnerabilities-after suffix name parsing vulnerability-vulnerability warning-the black bar safety net

We all know that windows2003 + IIS6. 0, if the directory structure has xxx. asp such a directory, then all the directory of the file regardless of the extension of what are as asp to parse. We generally call this the loophole for windows2003+iis6. 0 directory to resolve the vulnerability. Blog...

While bypassing Baidu heuristic engine and active Defense-vulnerability warning-the black bar safety net

While bypassing Baidu heuristic engine and the Proactive Defense heuristic Avira and active defense in the two different logic levels for system protection, but rely on the malware's malicious behavior to be killing, if malicious behavior is scattered in different logic levels, will make these tw...

Draft Bill to Protect Threat Information Sharing

The fear of lawsuits has – for a very long time – been among the primary reasons that public-private cyber-threat information sharing practices have never really materialized. This failure is reality in spite of repeated calls for such partnerships year after year from government and industry...

Exploit for Out-of-bounds Read in Openssl

It is an offensive tool for Tor Network vulnerability exploitati...

Easily around the various WAF POST injection, cross-site Defense(such as security Dog)-vulnerability warning-the black bar safety net

XXX before there was mention of a multipart request to bypass the various WAF way: 3 6 0 website po/security po/accelerating music and other similar product protection to bypass the defective one, and seemingly didn't cause much concern. Found out today that a security Dog gets smart before that ...

The Next Leap Forward in Cyber Defense: Taking Action to Help Defeat Adversaries

It is often said that attackers have an advantage, because the defenders have to protect every part of their systems all the time, while the attacker only has to find one way in. This argument oversimplifies the security landscape and the real strength that defenders can achieve if they work...

Agent.btz Malware May Have Served as Starting Point for Red October, Turla

Researchers looking into the recently uncovered Turla, or Snake, cyber espionage campaign have discovered some similarities connecting it to older pieces of malware such as Agent.btz, the worm that several years ago infected U.S. military networks and eventually caused the Department of Defense t...

When ASLR makes the difference

We wrote several times in this blog about the importance of enabling Address Space Layout Randomization mitigation ASLR in modern software because it’s a very important defense mechanism that can increase the cost of writing exploits for attackers and in some cases prevent reliable exploitation. ...

The NSA, Snowden and the Internet's Offensive Future

Despite everything that has transpired in the last year, Edward Snowden sounded calm, reflective and in some ways wistful yesterday discussing the fallout and consequences of the multitude of NSA programs and methods he’s revealed. Snowden bemoaned the fact that the NSA specifically and the...

Edward Snowden at SXSW Conference: Would I do this again?, I Would!

The Whistleblower and Former National Security Agency NSA contractor Edward Snowden raised his voice and talked about citizen’s privacy once again. Yes, Snowden, whose leaks last year triggered debate on the massive surveillance conducted by the Government worldwide. In an interview, speaking via...

Boeing launches Ultra-Secure 'Black' Smartphone that has Self-Destruct Feature

Looking for a Secure Smartphone? World's biggest Aerospace company - Boeing is finally close to the launch of its high-security Android Smartphone, called "Boeing Black H8V-BLK1", primarily designed for secure communication between Governmental agencies and their contractors. Encrypted email,...

Snowden used web crawler tool to access and download 1.7 million Secret NSA Files

National Security Agency NSA – the one that had ruled over the privacy of the entire world from countries to individuals, the one with master access to read anyone’s data, intruded into large fiber networks, and can target anyone, at any time, at any place; but lapsed somewhere in protecting its...

IBM developing Self-Destructing Microchips for US Defense

Science Fiction Movies always show the possible direction of the development of technology and gives us the opportunity to think about it. The U.S. Government is also trying to develop such technology that was introduced in movies like Star Trek and TERMINATOR i.e. Self destructing Network of...

Israeli Defense computer hacked in Spear Phishing Attack

Hackers broke into an Israeli defense ministry computer via an email attachment tainted with malicious software. Reuters reported Israeli Defense is the latest illustrious victim of the Spear Phishing Attack, and hackers penetrated into an Israeli defense ministry computer using a malicious email...