Reddit Publishes its First Transparency Report

Reddit on Thursday published its first transparency report, joining the litany of technology and online service providers who have already shed light on their privacy practices, and the extent to which governments makes requests for user information. Reddit thrives on user-submitted content...

某政府信息公开系统存在SQL注入

简要描述： RT 详细说明： 吉大正元信息技术股份有限公司:http://www.jit.com.cn/ 众多政府网站都在使用该系统 我就用5个案例来测试。 注入链接是： zwdtSjgl/ysq/depInfoiframe.jsp?depid= 案例： http://www.jlfm.gov.cn:8081/zwdtSjgl/ysq/depInfoiframe.jsp?depid=013520945&depname=吉林市国土资源局丰满分局...

某政府系统通用SQL盲注#4（影响政府众多网站）

简要描述： RT 详细说明： 官网:http://www.jit.com.cn/ 案例如下： http://139.209.60.6//zwdtSjgl/ysq/depListDir.jsp?departmentid=013521374&departmentname=%EF%BF%BD%EF%BF%BD%EF%BF%BD%EF%BF%BD%EF%BF%BD%EF%BF%BD%EF%BF%BD%EF%BF%BD%EF%BF%BD%EF%BF%BD%EF%BF%BD%EF%BF%BD%EF%BF%BD%EF%BF%BD...

House Takes First Steps on Federal Data Breach Law

The House Subcommittee on Commerce, Manufacturing and Trade today held its first hearing of the 114th Congress in order to begin work on developing federal data breach legislation. Pre-hearing memos suggested that any data breach notification law would be primarily concerned with protecting...

Police Using High-Tech Device to See Through Walls Warrantlessly

We are all aware of the mass surveillance conducted by the government agencies on us. From our phone calls, emails to web activities, chats and social network activities, everything has been interrupted by the law enforcements. And now they have crossed every limits by using a new way to spy on...

华天动力储存XSS（11处打包，非self-xss）

简要描述： 缺个移动硬盘存片子 详细说明： 上次提交说是self-xss，为了证明不是self-xss，这次打一下管理cookie吧 demo演示，涉及大量政府，医院，房产，电视台等网站：http://www.oa8000.com/solution.htm 首先还是来到官网，看到demo演示地址：http://demo.oa8000.com 然后先用官方提供的普通用户登录 存在XSS的地方在：客户管理--我的客户--新建...

Regin Cyberespionage Malware Platform Modules Disclosed

The Regin malware platform used to steal secrets from government agencies, banks and GSM network operators caught the attention of security experts who called it one of the most advanced attack platforms that has been studied, surpassing Flame, Duqu, even Stuxnet. Researchers at Kaspersky Lab sai...

eYou邮件系统邮件正文存储型XSS（HTML5特性并需点击）

简要描述： eyou邮件系统邮箱多为政府和学校使用，经测试存在xss。 详细说明： 由于eyou版本号不同，下面测试代码的效果也有细微区别，但是存在漏洞原因相同。 测试代码： 发送后打开，效果如图： 某党政机关邮箱： 某院校邮箱： 漏洞证明： 由于eyou版本号不同，下面测试代码的效果也有细微区别，但是存在漏洞原因相同。 测试代码： 发送后打开，效果如图： 某党政机关邮箱：...

Spammers Take A Liking to WhatsApp Mobile App

Spammers have settled in on the WhatsApp messaging platform with greater regularity, aided in one locale, by of all things, government regulations. Researchers at AdaptiveMobile yesterday published a report that exposed a number of spam campaigns peddling phony handbags and sunglasses, investment...

Government Demands for Verizon Customer Data Drop

The number of subpoenas, total orders and warrants that the United States government delivered to Verizon all dropped in the second half of 2014, according to the company’s latest transparency report. The giant telecom provider released data on Thursday that showed a decrease in subpoenas of abou...

Affordable Care Act Phishing Campaign

US-CERT is aware of a phishing campaign purporting to come from a U.S. Federal Government Agency. The phishing emails reference the Affordable Care Act in the subject and claim to direct users to health coverage information, but instead direct them to sites which attempt to elicit private...

某政府在用系统#通用SQL注入

简要描述： 影响案例很大,转应急中心把 详细说明： 案例如下： http://117.40.186.185:8008/outportal/transactlist/searchtransactlist.jsp?applysubject= http://wssp.jdz.gov.cn/outportal/transactlist/searchtransactlist.jsp?applysubject= http://xzsp.jxgc.gov.cn/outportal/transactlist/searchtransactlist.jsp?applysubject=...

DHS Not Addressing Cyber Threats to Building Access Systems

Civil watchdogs at the Government Accountability Office are warning the Department of Homeland Security and the Government Services Agency about unaddressed risks posed to building access control systems at federal facilities. The systems in question are those that prevent unauthorized access to...

Encryption is Not the Enemy

There are few things scarier these days than a politician stepping in front of a microphone, taking a deep breath and opening his mouth to pontificate on security. A long list of American elected officials have reinforced this, and on Monday, UK Prime Minister David Cameron jumped to the head of...

某大型政府服务系统Oracle注入(使用量大)

简要描述： 某大型政府服务系统Oracle注入使用量大 详细说明： 问题厂商:深圳太极软件有限公司 一套专门的政务服务系统 用户量：大 影响：广 注入点 /researchinfo.do?method=queryinfo&id=1（id存注入） /researchinfo.do?method=querysx&deptid=1（deptid存注入） 证明： google关键字：inurl:bmtd.do? 漏洞证明： http://www.yjxzfw.com.cn/researchinfo.do?method=queryinfo&id=1 sqlmap.py -u...

某大型政府服务系统Oracle注入(使用量大)

简要描述： rt，霍霍。为了生活费也是蛮拼的。。。。 详细说明： 问题厂商:深圳太极软件有限公司 一套专门的政务服务系统 用户量：大 影响：广 注入点 browsebgxz.do?method=dept&deptid=（deptid存注入） google关键字：inurl:browsebgxz.do?method= 案例: http://www.gygxzw.gov.cn:8066/browsebgxz.do?method=dept&deptid=556631684 http://61.189.156.73/browsebgxz.do?method=dept&deptid=0094204...

Indian Government blocks 32 Sites, including GitHub, Pastebin, Imgur and Vimeo

China is known as the nation of 'global internet censorship', and the country proved it many times, in fact when recently it blocked the access to Gmail from the country. Now, it seems that its northern neighbouring country, India doesn't want to get left behind. On Wednesday, the Indian Computer...

某政府信息公开系统存在SQL注入

简要描述： RT 详细说明： 吉大正元信息技术股份有限公司:http://www.jit.com.cn/ 众多政府网站都在使用该系统。 我就用5个案例来测试 注入链接： /zwdtSjgl/info/gonggaoiframe.jsp?cid= 案例： http://222.34.78.21/zwdtSjgl/info/gonggaoiframe.jsp?cid=3 http://218.27.207.22/zwdtSjgl/info/gonggaoiframe.jsp?cid=3...

某大型政府系统任意文件读取及Oracle注入

简要描述： 某大型政府系统任意文件读取及Oracle注入 详细说明： 这系统有人提交过，详情： WooYun: 某大型政府服务系统Oracle注入使用量大 文件读取（获取数据库用户、密码等）： /download?url=../../WEB-INF/classes/wssp/util/dbconfig.properties http://hxasc.cn/download?url=../../WEB-INF/classes/wssp/util/dbconfig.properties...

Lizard Squad vs Anonymous — 'PlayStation, Xbox and Tor Network' Attacks

It was the sad Christmas day for gamers all around the world!! A lot of people get new PlayStations and Xboxes on Christmas, but this Christmas they bought the game, popped it into the console for online gaming, and what they found? Oh Crap! I can't log on. It was the notorious hacker group "Liza...