Bridging the Skills Gap with Trend Micro’s Capture the Flag (CTF) Competition

We all know the IT security industry is suffering from chronic skills gaps and shortages around the world. In the US things are no different, with an estimated talent shortfall of around 40,000 jobs for information security analyst roles alone. While various initiatives have been proposed, few ha...

Credit Card Breach at Kmart Stores. Again.

For the second time in less than three years, Kmart Stores is battling a malware-based security breach of its store credit card processing systems. Last week I began hearing from smaller banks and credit unions who said they strongly suspected another card breach at Kmart. Some of those...

Vulnerability subscriptions in terms of business

The question is: do we really need an employee in organization that deals with vulnerabilities in infrastructure on a full-time basis? Since this is similar to what I do for living, I would naturally say that yes, it is necessary. But as person, who makes security automation, I can say that there...

CVE-2017-3519

CVE-2017-3519 affects Oracle PeopleSoft Enterprise PeopleTools (Security subcomponent) in versions 8.54 and 8.55. The described vulnerability is exploitable by an unauthenticated attacker over HTTP, potentially leading to unauthorized access to critical data and other PeopleSoft data. The NVD ent...

itpro.nikkeibp.co.jp Open Redirect vulnerability

Vulnerable URL: http://itpro.nikkeibp.co.jp/as/ict/images/bnr01.swf?clickTag=http://openbugbounty.org Details: Description| Value ---|--- Patched:| Yes, at 05.07.2017 Latest check for patch:| 05.07.2017 12:49 GMT Vulnerability type:| Open Redirect Vulnerability status:| Publicly disclosed Alexa...

Faveo Helpdesk Community 1.9.3 Cross Site Request Forgery

Exploit Title: CSRF / Privilege Escalation Manipulation of Role Agent to Admin on Faveo version Community 1.9.3 Google Dork: no Date: 05-April-2017 Exploit Author: @runggareksya, @yokoacc, @AdyWikradinata, @dickysofficial, @dvnrcy Vendor Homepage: http://www.faveohelpdesk.com/ Software Link:...

Bonza Digital Cart Script 1 SQL Injection

Title: Bonza Digital Cart Script v1 - SQL injection Credit: Bilal KARDADOU Vendor: http://www.turnkeycentral.com Vendor URL: http://www.turnkeycentral.com/scripts/bonza-digital-cart-script/ Product: Bonza Digital Cart Script v1 Google Dork: N/A Product & Service Introduction: "Bonza Digital Cart"...

Freelancer Script 4.0.1 SQL Injection

Title: FREELANCER SCRIPT v4.0.1 - Authentication Bypass & SQL injection Credit: Bilal KARDADOU Vendor: http://www.2daybiz.com Vendor URL: http://2daybiz.com/content/products/products/job-site-script/119-freelancer-script.php Product: FREELANCER SCRIPT v4.0.1 Google Dork: N/A Product & Service...

Fiyo CMS 2.0.6.1 Privilege Escalation Vulnerability

Fiyo CMS version 2.0.6.1 suffers from a privilege escalation vulnerability due to poor design with trusting the client to tell the server a user's role. Exploit Title: Privilege Escalation Manipulation of User Group Vulnerability on Fiyo CMS 2.0.6.1 Google Dork: no Date: 11-03-2017 Exploit Author...

ICAutosales 1.2 SQL Injection

Title: ICAutosales v1.2 - SQL Injection Credit: Bilal KARDADOU Vendor: http://www.icloudcenter.com Vendor URL: http://www.icloudcenter.com/auto-dealer-car-sales-script.htm Product: AUTO DEALER CAR SALES PHP SCRIPT. Google Dork: N/A Product & Service Introduction: ICAutosales is a powerful, highly...

PHP Entrepreneur 1.2 SQL Injection

Title: PHP Entrepreneur Script v1.2 - SQL Injection Credit: Bilal KARDADOU Vendor: www.jobportalscript.com Vendor URL: http://www.jobportalscript.com/entrepreneur-home-basic- version.html Product: PHP Entrepreneur Script. Entrepreneur Script Feature Document : http://www.jobportalscript...

Job Portal Script 3.0 Cross Site Scripting / SQL Injection

Title: Job portal Script v3.0 - SQL Injection / Cross Site Scripting Credit: Bilal KARDADOU Vendor: www.jobportalscript.com Vendor URL: http://www.jobportalscript.com/index.html Product: Job portal site. Google Dork: categorysearch.php?indus= placementpaper.php?pn= ... Product & Service...

Agora-Project 3.2.2 Cross Site Scripting

Exploit Title: XSS Vulnerability on Agora-Project 3.2.2 Google Dork: no Date: 23-02-2017 Exploit Author: @runggareksya, @AdyWikradinata, @yokoacc Vendor Homepage: https://www.agora-project.net Software Link: https://www.agora-project.net/?ctrl=offline&action=download Software Link Mirror:...

MBLS Flex CMS 0.7.2 SQL Injection / Cross Site Scripting

Title: SQL injection & Cross-site scripting in CMS Flex Credit: Bilal KARDADOU Vulnerability: SQL injection & Cross-Site scripting Vulnerable version: Flex Version 0.7.2 Vendor: MBL Solutions Ltd Vendor URL: http://www.mblsolutions.co.uk/ Product: FLEX CMS "THE INTUITIVE CONTENT MANAGEMENT SYSTEM...

CVE-2016-10216

ITDB 1.23 and earlier permits XSS via insufficient filtering of the value POST parameter sent to itdb-1.23/js/DataTables-1.8.2/examples/examples_support/editable_ajax.php. An attacker could inject and execute arbitrary HTML/JavaScript in a user’s browser within the vulnerable website context. The...

WMD (Weapon of Mass Destruction) - Python framework for IT security tools

This is a python tool with a collection of IT security software. The software is incapsulated in "modules". The modules does consist of pure python code and/or external third programs. Main functions 1 To use a module, run the command "use modulecall", e.g. "use apsniff", to activate the module. ...

Weapon of Mass Destruction: WMD

Weapon of Mass Destruction This is a python tool with a collection of IT security software. The software is incapsulated in “modules”. The modules does consist of pure python code and/or external third programs. Main functions 1 To use a module, run the command “use modulecall”, e.g. “use apsniff...

Exploits and Security Tools Framework: EaST Framework

Exploits and Security Tools Framework Pentest framework environment is the basis of IT security specialist’s toolkit. This software is essential as for learning and improving of knowledge in IT systems attacks and for inspections and proactive protection. The need of native comprehensive open...

NEET - Network Enumeration and Exploitation Tool

Neet is a flexible, multi-threaded tool for network penetration testing. It runs on Linux and co-ordinates the use of numerous other open-source network tools, with the aim of gathering as much network information as possible in clear, easy-to-use formats. The core scanning engine finds and...

Scan Reveals Hydropower Plants, Other Critical Infrastructure Exposed Online

An Internet scan of the IPv4 address space uncovered more than 100 critical facilities exposed to the public Internet, including hydropower plants in Germany and Italy, and a smart building in Israel hosting luxury apartments. The investigation, conducted by researchers at Internet Wache of Berli...