Bashark - Bash Post Exploitation Toolkit

Bashark aids pentesters and security researchers during the post-exploitation phase of security audits. Usage To launch Bashark on compromised host, simply source the bashark.sh script from terminal: $ source bashark.sh Then type help to see Bashark's help menu Features Single Bash script...

Cisco IOS Access Points Software Denial of Service Vulnerability

Cisco IOS Access Points APs Software is a suite of software for management control of access point devices from Cisco USA. A security vulnerability exists in the 802.11r Fast Transition feature set in Cisco IOS APs Software. An attacker in close physical proximity could exploit this vulnerability...

Design/Logic Flaw

A vulnerability in the 802.11r Fast Transition feature set of Cisco IOS Access Points APs Software could allow an unauthenticated, adjacent attacker to cause a denial of service DoS condition on an affected device. The vulnerability is due to a corruption of certain timer mechanisms triggered by...

CVE-2018-0441

Cisco IOS Access Points Software vulnerable to CVE-2018-0441 due to a timer mechanism corruption in the 802.11r Fast Transition feature. An unauthenticated, adjacent attacker can trigger a DoS by sending malicious reassociation events in quick succession, leading to timer crashes. Root cause: tim...

Cisco IOS Access Points Software 802.11r Fast Transition Denial of Service Vulnerability

A vulnerability in the 802.11r Fast Transition feature set of Cisco IOS Access Points APs Software could allow an unauthenticated, adjacent attacker to cause a denial of service DoS condition on an affected device. The vulnerability is due to a corruption of certain timer mechanisms triggered by...

CVE-2018-0441: Uncontrolled Resource Consumption

A vulnerability in the 802.11r Fast Transition feature set of Cisco IOS Access Points APs Software could allow an unauthenticated, adjacent attacker to cause a denial of service DoS condition on an affected device. The vulnerability is due to a corruption of certain timer mechanisms triggered by...

PT-2018-1744

Name of the Vulnerable Software and Affected Versions Cisco IOS Access Points APs Software affected versions not specified Description A vulnerability in the 802.11r Fast Transition feature set could allow an unauthenticated, adjacent attacker to cause a denial of service DoS condition on an...

bouncycastle: Information leak in AESFastEngine class

In the Bouncy Castle JCE Provider version 1.55 and earlier the primary engine class used for AES was AESFastEngine. Due to the highly table driven approach used in the algorithm it turns out that if the data channel on the CPU can be monitored the lookup table accesses are sufficient to leak...

Pentest-Machine - Automates Some Pentest Jobs Via Nmap Xml File

Automates some pentesting work via an nmap XML file. As soon as each command finishes it writes its output to the terminal and the files in output-by-service/ and output-by-host/. Runs fast-returning commands first. Please send me protocols/commands/options that you would like to see included. HT...

Debian DSA-4311-1 : git - security update

joernchen of Phenoelit discovered that git, a fast, scalable, distributed revision control system, is prone to an arbitrary code execution vulnerability via a specially crafted .gitmodules file in a project cloned with --recurse-submodules. C Tenable Network Security, Inc. The descriptive text an...

Tcpreplay Buffer Overflow Vulnerability

Tcpreplay is a set of open source utilities for editing and replaying network traffic for UNIX based operating systems. A buffer overflow vulnerability exists in the 'fasteditpacket' function of the sendpackets.c file in Tcpreplay version 4.3. An attacker can exploit this vulnerability with a...

[SECURITY] Fedora 28 Update: rust-1.29.1-2.fc28

Rust is a systems programming language that runs blazingly fast, prevents segfaults, and guarantees thread safety. This package includes the Rust compiler and documentation generator...

[SECURITY] Fedora 27 Update: rust-1.29.1-2.fc27

Rust is a systems programming language that runs blazingly fast, prevents segfaults, and guarantees thread safety. This package includes the Rust compiler and documentation generator...

PT-2018-14067

Name of the Vulnerable Software and Affected Versions Tcpreplay version 4.3.0 beta1 Description A heap-based buffer over-read exists in the fast edit packet function, located in the send packets.c file. This issue can lead to Denial of Service DoS and potentially Information Exposure when the...

bouncycastle: Information leak in AESFastEngine class

In the Bouncy Castle JCE Provider version 1.55 and earlier the primary engine class used for AES was AESFastEngine. Due to the highly table driven approach used in the algorithm it turns out that if the data channel on the CPU can be monitored the lookup table accesses are sufficient to leak...

Getting the most out of your branch local connection

In our global world of business, organizations often have multiple branch offices spanning every country. Some of these branches are quite large with their own IT infrastructure and personnel, while some are very small with just a few employees. In the past, these branch offices were connected to...

Updated cgit packages fix security vulnerability

Jann Horn discovered a directory traversal vulnerability in cgit, a fast web frontend for git repositories written in C. A remote attacker can take advantage of this flaw to retrieve arbitrary files via a specially crafted request, when 'enable-http-clone=1' default is not turned off...

Compromising Online Accounts by Cracking Voicemail Systems: VoiceMailAutomator

voicemailautomator is a tool that serves as a Proof of Concept for the research I presented at DEF CON 26, “Compromising online accounts by cracking voicemail systems”. voicemailautomator supports two actions: “message” – retrieves and records the newest message in the voicemail system. It return...

Debian DSA-4263-1 : cgit - security update

Jann Horn discovered a directory traversal vulnerability in cgit, a fast web frontend for git repositories written in C. A remote attacker can take advantage of this flaw to retrieve arbitrary files via a specially crafted request, when 'enable-http-clone=1' default is not turned off. C Tenable...

Friday Squid Blogging: Calamari Squid Catching Prey

The calamari squid grabs prey three feet away with its fast tentacles. As usual, you can also use this squid post to talk about the security stories in the news that I haven't covered. Read my blog posting guidelines here...