smf-blind.txt

SMF is a very hardened php application. If anyone wants an example of some interesting PHP security SMF is a good place to look. Even after being able to injection SQL I had to take another step and bypass some difficult filters found in the dbquery function. Ultimately i was able to do so. This...

Simple Machines Forum (SMF) 1.1.3 - Blind SQL Injection

!/usr/bin/perl Written By Michael Brooks contact: th3dotr00katgmaildotcom SMF 1.1.3 Extremely fast Blind SQL Injection Exploit! -Binary Search -Multi-Threaded -NO benchmark's Two SQL Injection flaws. Works with magicquotesgpc=On or Off. Total Bypass of SMF's SQL Injection filter. I submitted a...

mdpro1076-sql.txt

!/usr/bin/perl use strict; use IO::Socket; my $app = "MDPro 1.0.76"; my $type = "SQL Injection"; my $author = "undefined1"; my $settings = "magicquotesruntime = off, mysql = 4.1.0"; $| = 1; print ":: $app $type - by $author ::\n\n\n"; my $url = shift || usage; if$url = m/^?:http://./ $url = $1;...

Boa 0.93.15 - Administrator Password Overwrite Authentication Bypass

Boa 0.93.15 - Administrator Password Overwrite Authentication Bypass source: https://www.securityfocus.com/bid/25676/info Boa is prone to an authentication-bypass vulnerability because the application fails to ensure that passwords are not overwritten by specially crafted HTTP Requests. An attack...

Cross site request forgery (csrf)

Cross-site request forgery CSRF vulnerability in the device management interface in Buffalo AirStation WHR-G54S 1.20 allows remote attackers to make configuration changes as an administrator via HTTP requests to certain HTML pages in the res parameter with an inp req parameter to cgi-bin/cgi, as...

CVE-2007-4822

Cross-site request forgery CSRF vulnerability in the device management interface in Buffalo AirStation WHR-G54S 1.20 allows remote attackers to make configuration changes as an administrator via HTTP requests to certain HTML pages in the res parameter with an inp req parameter to cgi-bin/cgi, as...

OWASP Stinger - Filter Bypass

OWASP Stinger - Filter Bypass source: https://www.securityfocus.com/bid/25294/info OWASP Stinger is prone to a filter-bypass weakness because the application fails to properly handle certain input. Since the OWASP Stinger project is a software module designed to be incorporated into other...

SOCKS Proxy UNC Path Redirection

This module provides a Socks proxy service that redirects all HTTP requests to a web page that loads a UNC path. This module requires Metasploit: https://metasploit.com/download Current source: https://github.com/rapid7/metasploit-framework class MetasploitModule 'SOCKS Proxy UNC Path Redirection...

Heap overflow

Multiple heap-based buffer overflows in 1 clsscheduler.exe aka scheduler client and 2 srvscheduler.exe aka scheduler server in BakBone NetVault Reporter 3.5 before Update4 allow remote attackers to execute arbitrary code via long filename arguments in HTTP requests...

CVE-2007-3911

Multiple heap-based buffer overflows in 1 clsscheduler.exe aka scheduler client and 2 srvscheduler.exe aka scheduler server in BakBone NetVault Reporter 3.5 before Update4 allow remote attackers to execute arbitrary code via long filename arguments in HTTP requests...

CVE-2007-3911

Multiple heap-based buffer overflows in 1 clsscheduler.exe aka scheduler client and 2 srvscheduler.exe aka scheduler server in BakBone NetVault Reporter 3.5 before Update4 allow remote attackers to execute arbitrary code via long filename arguments in HTTP requests...

CVE-2007-3911: Improper Restriction of Operations within the Bounds of a Memory Buffer

Multiple heap-based buffer overflows in 1 clsscheduler.exe aka scheduler client and 2 srvscheduler.exe aka scheduler server in BakBone NetVault Reporter 3.5 before Update4 allow remote attackers to execute arbitrary code via long filename arguments in HTTP requests...

ips-evasion.txt

Summarized from https://strikecenter.bpointsys.com/ Many commercial IPS products fail to decode HTTP requests which use 0x0c, 0x0b, and 0x0d instead of the normal 0x20/0x09 separators. A request in the following format will evade most IPS protocol decoders: $ echo -ne...

Code injection

Unspecified vulnerability in Interchange before 5.4.2 allows remote attackers to cause an unspecified denial of service possibly server hang via crafted HTTP requests...

CVE-2007-2635

Unspecified vulnerability in Interchange before 5.4.2 allows remote attackers to cause an unspecified denial of service possibly server hang via crafted HTTP requests...

CVE-2007-2635

Unspecified vulnerability in Interchange before 5.4.2 allows remote attackers to cause an unspecified denial of service possibly server hang via crafted HTTP requests...

CVE-2007-2635

CVE-2007-2635 affects Interchange prior to 5.4.2 (and related lines) with an unspecified vulnerability that allows remote attackers to cause a denial of service (potential server hang) via crafted HTTP requests. Multiple sources confirm the issue and the fix is to upgrade to Interchange 5.4.2 or ...

CVE-2007-2635: Undefined Security Weakness

Unspecified vulnerability in Interchange before 5.4.2 allows remote attackers to cause an unspecified denial of service possibly server hang via crafted HTTP requests...

TPTI-07-05: IBM Tivoli Provisioning Manager for OS Deployment Multiple Stack Overflow Vulnerabilities

TPTI-07-05: IBM Tivoli Provisioning Manager for OS Deployment Multiple Stack Overflow Vulnerabilities http://dvlabs.tippingpoint.com/advisory/TPTI-07-05 May 2, 2007 -- CVE ID: CVE-2007-1868 -- Affected Vendor: IBM -- Affected Products: Tivoli Provisioning Manager for OS Deployment -- Vulnerabilit...

CVE-2007-2336

Unspecified vulnerability in InterVations NaviCOPA Web Server 2.01 20070323 allows remote attackers to cause a denial of service daemon crash via crafted HTTP requests, as demonstrated by long requests containing '\A' characters, probably a different issue than CVE-2006-5112 and CVE-2007-1733...