DAVScan - Fingerprints servers, finds exploits, scans WebDAV

DAVScan is a quick and lightweight webdav scanner designed to discover hidden files and folders on DAV enabled webservers. The scanner works by taking advantage of overly privileged/misconfigured WebDAV servers or servers vulnerable to various disclosure or authentication bypass vulnerabilities...

GitLab: SSRF via git Repo by URL Abuse

Hi team , First things first, awesome work with As a poc i simply port forwarded port 4444 on my router and started simple HTTP server and listened on 4444 to check for incoming connections, by doing the steps mentioned above i got a GET request from 40.84.0.225 , images for the same are attached...

Alpha Version of Sandboxed Tor Browser Released

A sandboxed version of the Tor Browser was released over the weekend, and while there are still some rough edges and bugs – potentially major, according to the developer– it could be the first step toward protecting Tor users from recent de-anonymization exploits. Yawning Angel, a longtime Tor...

LocalTapiola: Suspicious browser fingerprinting(?) scripts on http://www.lahitapiola.fi/ redirector

I was doing some routine scanning of my Internet traffic at work I work as a Security Researcher for Forcepoint and noticed that my IDS popped up alarms of a ton of suspicious behaviour when I was trying to access http://www.lahitapiola.fi/ front page. It turned out that there seems to be a lot o...

TRS Infogate Plugin SSRF Vulnerability

TRS Infogate is a general-purpose plug-in developed by TORS for application on WCM and IDS platforms of national governments, enterprises and institutions. TRS Infogate plug-in page infogate/customer/system/wcmurltest.jsp SSRF vulnerability. The page in the infogate/customer/system directory can...

High Precision WiFi Indoor Positioning Framework: FIND

High Precision WiFi Indoor Positioning Framework The Framework for Internal Navigation and Discovery FIND allows you to use your Android smartphone or WiFi-enabled computer laptop or Raspberry Pi or etc. to determine your position within your home or office. You can easily use this system in plac...

KNX Home Automation Security Auditing: KNXmap

KNX Home Automation Security Auditing A tool for scanning and auditing KNXnet/IP gateways on IP driven networks. KNXnet/IP defines Ethernet as physical communication media for KNX EN 50090, ISO/IEC 14543. KNXmap also allows to scan for devices on the KNX bus via KNXnet/IP gateways. In addition to...

Identify Web Application Firewall: WAFW00F

WAFW00F Fingerprints and Identify Web Application Firewall WAF products WAFW00F is a Python tool to help you fingerprint and identify Web Application Firewall WAF products. It is an active reconnaissance tool as it actually connects to the web server, but it starts out with a normal HTTP response...

CVE-2016-2832

Mozilla Firefox before 47.0 allows remote attackers to discover the list of disabled plugins via a fingerprinting attack involving Cascading Style Sheets CSS pseudo-classes...

Code injection

Mozilla Firefox before 47.0 allows remote attackers to discover the list of disabled plugins via a fingerprinting attack involving Cascading Style Sheets CSS pseudo-classes...

UBUNTU-CVE-2016-2832

Mozilla Firefox before 47.0 allows remote attackers to discover the list of disabled plugins via a fingerprinting attack involving Cascading Style Sheets CSS pseudo-classes...

CVE-2016-2832

Mozilla Firefox before 47.0 allows remote attackers to discover the list of disabled plugins via a fingerprinting attack involving Cascading Style Sheets CSS pseudo-classes...

Information disclosure of disabled plugins through CSS pseudo-classes — Mozilla

Mozilla developer John Schoenick reported that CSS pseudo-classes can be used by web content to leak information on plugins that are installed but disabled. This can be used for information disclosure through a fingerprinting attack that lists all of the plugins installed by a user on a system,...

KLA10822 Multiple vulnerabilities in Mozilla Firefox and Firefox ESR

Multiple serious vulnerabilities have been found in Mozilla Firefox. Malicious users can exploit these vulnerabilities to bypass security restrictions, execute arbitrary code, elevate privileges, cause denial of service, conduct XSS or obtain sensitive information. Below is a complete list of...

WAFW00F - Identifies and Fingerprints Web Application Firewall (WAF) Products

WAFW00F allows one to identify and fingerprint Web Application Firewall WAF products protecting a website. How does it work? To do its magic, WAFW00F does the following: Sends a normal HTTP request and analyses the response; this identifies a number of WAF solutions If that is not successful, it...

Top Websites Using Audio Fingerprinting to Secretly Track Web Users

Despite browsing incognito, blocking advertisements, or hiding your tracks, some websites monitor and track your every move online using a new web-tracking technique called Audio Fingerprinting. This new fingerprinting technique can be utilized by technology and marketing companies to deliver...

nmap 7.10 issued(an increase of 1 to 2 new scripts&bug fixes&increased os identification)-vulnerability warning-the black bar safety net

! This offering Namp 7.10 in the previous version on the basis of a lot improved! Add 1 2 A of the NSE scripts, hundreds of OS system and version fingerprint recognition, of course, there are also some small detail improvements and Bug fixes. The source code and for Linux, Windows, Mac system...

chromium-browser: various fixes from internal audits

The CSPSource::schemeMatches function in WebKit/Source/core/frame/csp/CSPSource.cpp in the Content Security Policy CSP implementation in Blink, as used in Google Chrome before 48.0.2564.82, does not apply http policies to https URLs and does not apply ws policies to wss URLs, which makes it easie...

Here's How Websites Are Tracking You Online

Webmasters can track all your activities on the Internet – even if you have already cleared your browsing history and deleted all saved cookies. A researcher demonstrated two unpatched flaws that can be exploited to track Millions of Internet users, allowing malicious website owners: 1. List...

WPHardening 1.5 - Fortify the security of any WordPress installation

Fortify the security of any WordPress installation. Installation Installing WPHardening requires you to execute one console command: $ pip install -r requirements.txt Usage $ python wphardening.py -h \ \ / / | | | | | | \ \ /\ / /| | | || | | | \ / / / | /| |/ | '/ |/ \ ' | | ' \ / | \ /\ / | |...