Microsoft Internet Explorer 5.0.1 Mouse Event URI Status Bar Obfuscation Weakness

No description provided by source. source: http://www.securityfocus.com/bid/12541/info Microsoft Internet Explorer is reported prone to a URI obfuscation weakness. The issue presents itself when a HREF tag contains certain mouse events. This issue may be leveraged by an attacker to display false...

MS FrontPage 98 Server Extensions for IIS,MS InterDev 1.0 Filename Obfuscation

No description provided by source. source: http://www.securityfocus.com/bid/1108/info Two dlls dvwssr.dll and mtd2lv.dll included with the FrontPage 98 extensions for IIS and shipped as part of the NT Option Pack include an obfuscation string that manipulates the name of requested files. Knowing...

Mozilla Browser 1.6/1.7 URI Obfuscation Weakness

No description provided by source. source: http://www.securityfocus.com/bid/10532/info A weakness is reported in Mozilla that may allow an attacker to obfuscate the URI of a link. This could facilitate the impersonation of legitimate web sites in order to steal sensitive information from...

AskMen Purportedly Compromised by Nuclear Pack Kit

Users who visit AskMen.com, a men’s entertainment and lifestyle portal, are being hit with malicious code, potentially stemming from the Nuclear Pack exploit kit, researchers announced today. When a user stumbles across the site – or a localized version aus.askmen.com, etc. of it – malicious code...

Xornic Contact Us Form CAPTCHA Bypass / XSS

Hi FD, So I got bored/felt nostalgia and decided I would go through the hotscripts website and audit the top 10 most popular PHP scripts PHP being my most proficient language. Y'know, for practice or something. Unfortunately, there were a number of factors that frustrated this effort: Most of the...

JavaScript Malicious Obfuscation Techniques - Ver2

Known exploits could potentially bypass security products by using JavaScript obfuscation techniques. Since the exploits are obfuscated they may not be detected by IDS and IPS systems, thus allowing attackers to successfully attack target machines...

Symantec Endpoint Protection Manager 12.1.x - Overflow (SEH) (PoC)

Exploit-DB Mirror: https://gitlab.com/exploit-database/exploitdb-bin-sploits/-/raw/main/bin-sploits/33056-sepm-secars-poc-v0.3.tar.gz !/usr/bin/perl -w Exploit Title: Symantec Endpoint Protection Manager 12.1.x - SEH Overflow POC Date: 31 January 2013 Exploit Author: [email protected] a.k.a...

HULK - Web Server DoS Tool

HULK is a web server denial of service tool DDoS Tool written for research purposes. It is designed to generate volumes of unique and obfuscated traffic at a webserver, bypassing caching engines and therefore hitting the server's direct resource pool. The Hulk Web server is a brainchild of Barry...

plexusCMS 0.5 - Cross-Site Scripting / Remote Shell / Credentials Leak

Exploit Title: plexusCMS 0.5 XSS Remote Shell Exploit Google Dork: allinurl: plx-storage Date: 22.02.2013 Exploit Author: neglomaniac Vendor Homepage: http://plexus-cms.org/ Version: 0.5 --- FILES backdoor.php simple commend execute backdoor commands.txt list of useful commands for owning remote...

Hacking Team Hosting in U.S.

Milan-based Hacking Team relies on servers in the United States and hosted by American companies to support its clients’ state-sponsored surveillance operations in some of the world’s most repressive regimes. Hacking Team is an Italian security firm that develops surveillance equipment and sells ...

Suspicious Non-Alphanumeric JavaScript Encoding

Certain evasion tools can obfuscate JavaScript code in order to circumvent security software. Successful exploitation could allow attackers to execute arbitrary code on the target...

[Weevely v1.1] Stealth tiny PHP web shell

Weevely is a stealth PHP web shell that provides a telnet-like console. It is an essential tool for web application post exploitation , and can be used as stealth backdoor or as a web shell to manage legit web accounts, even free hosted ones. Weevely is currently included in Backtrack and Backbox...

Suspicious JavaScript Encoding

Certain evasion tools can obfuscate JavaScript code in order to circumvent security software. Successful exploitation could allow attackers to execute arbitrary code on the target...

JavaScript Payload Encoding

Certain JavaScript obfuscation schemes can be used to circumvent security software. These methods could allow attackers to execute arbitrary code on a target machine...

JavaScript Malicious Obfuscation Techniques

Known exploits could potentially bypass security products by using JavaScript obfuscation techniques. Since the exploits are obfuscated they may not be detected by IDS and IPS systems, thus allowing attackers to successfully attack target machines...

CVE-2013-5208

HR Systems Strategies info:HR HRIS 7.9 does not properly protect the database password, which allows local users to bypass intended database restrictions by accessing the USERPW registry key and bypassing an unspecified obfuscation technique...

Design/Logic Flaw

HR Systems Strategies info:HR HRIS 7.9 does not properly protect the database password, which allows local users to bypass intended database restrictions by accessing the USERPW registry key and bypassing an unspecified obfuscation technique...

CVE-2013-5208

HR Systems Strategies info:HR HRIS 7.9 does not properly protect the database password, which allows local users to bypass intended database restrictions by accessing the USERPW registry key and bypassing an unspecified obfuscation technique...

Microsoft Windows Authenticated Powershell Command Execution

This module uses a valid administrator username and password to execute a powershell payload using a similar technique to the "psexec" utility provided by SysInternals. The payload is encoded in base64 and executed from the commandline using the -encodedcommand flag. Using this method, the payloa...

[Binrev] Automate Reversing Windows Binaries for Pentesters

What you can do with this? Static analysis: you can do a basic manual code review for decompiled sources to discover hidden communication channels, search for hard-coded passwords, or SQL injection vulnerabilities. Import decompiled projects to an IDE to reconstruct and modify the original source...