New Relic: Server Side Browsing - localhost open port enumeration

Hi again to all, I've found that is possible to scan all the open ports and network information of internal instances of your amazon DC that are related with synthetics monitors. NOTE: I do not have a pro account so I can use the more advanced synthetics functions or the Insights db query to get...

Monkey race ray! RSA conference badge scanning application broke vulnerability-vulnerability warning-the black bar safety net

Recently, the BLUE BOX company's security researchers found: RSA 2 0 1 6 The General Assembly on the use of badge scanning APP there is a hard-coded default passwords. This year, RSA 2 0 1 6 The participants will get a unique surprise: the General Assembly, as many manufacturers offer a Samsung...

How To Keep Your Android Phone Secure

As the number of threats is on the rise, Android platform is no longer safe, which isn't a surprise to anyone. Most of us are usually worried more about the security of our desktops or laptops and forget to think about the consequences our smartphones can make if compromised or stolen. Unlike...

How Often Should You Scan Websites and Web Applications for Vulnerabilities?

Web Applications and Websites Exist in a Dynamic Environment There is no questioning the fact that the web application security landscape is in a constant state of flux. The pace of change is not only rapid but resembles a constant game of cat and mouse between hackers and security professionals...

Nikto Web Server Scanning Detection

Binary data 9085.prm...

Nikto Port Scanning Detection

Binary data 9086.prm...

Umbraco SSRF / Cross Site Request Forgery / Cross Site Scripting

image: Vulnerable Umbraco Recently I got an assignment where I had to work on the Umbraco application - a free Open Source Content Management System built on the ASP.NET platform and is used by more than 2,25,000 websites. While performing the security testing of this application, I discovered...

WinREST Remote Privilege Escalation

So a year back I was massively scanning internet. This case ISPs IPs blocks where you can find easily at RIPE for example. Then I found some interesting hosts where SMB were open and the ACL is totally open to root file system with the same netbios name. All file system is writable. I was able to...

Damn Vulnerable Web Services: DVWS

Damn Vulnerable Web Services is a vulnerable testing environment that can be used to learn real world web service vulnerabilities. The aim of this project is to aid security professionals in testing their skills and tools in a legal environment. This application is designed to understand the...

Samsung Galaxy S6 - libQjpeg je_free Crash

Samsung Galaxy S6 - libQjpeg jefree Crash Source: https://code.google.com/p/google-security-research/issues/detail?id=617 The attached jpg causes an invalid pointer to be freed when media scanning occurs. F/libc 11192: Fatal signal 11 SIGSEGV, code 1, fault addr 0xffffffffffffb0 in tid 14368 HEAV...

Samsung Galaxy S6 - libQjpeg je_free Crash

Exploit for Android platform in category dos / poc Source: https://code.google.com/p/google-security-research/issues/detail?id=617 The attached jpg causes an invalid pointer to be freed when media scanning occurs. F/libc 11192: Fatal signal 11 SIGSEGV, code 1, fault addr 0xffffffffffffb0 in tid...

Samsung Galaxy S6 - libQjpeg je_free Crash

Source: https://code.google.com/p/google-security-research/issues/detail?id=617 The attached jpg causes an invalid pointer to be freed when media scanning occurs. F/libc 11192: Fatal signal 11 SIGSEGV, code 1, fault addr 0xffffffffffffb0 in tid 14368 HEAVY7 I/DEBUG 3021: I/DEBUG 3021: Build...

Fast and Full Featured SSL Scanner: SSLyze

SSLyze is a Python tool that can analyze the SSL configuration of a server by connecting to it. It is designed to be fast and comprehensive, and should help organizations and testers identify mis-configurations affecting their SSL servers. SSLyze is all Python code but it uses an OpenSSL wrapper...

VirusTotal Firmware Malware Implant Scanning

Successful attacks against firmware are rare but provide hackers with one thing they covet most: persistence. Advanced attack groups have already accelerated their capabilities in finding ways to burrow into the BIOS and EFI as noted by the Snowden leaks’ description of the NSA’s attempts to...

V3n0M-Scanner - Popular SQLi and Pentesting Scanner

V3n0M runs on Python3 Live Project - Readding old features back in and improved for Python3 v3n0m is a free and open source scanner. Evolved from baltazar's scanner, it has adapted several new features that improve fuctionality and usability. It is mostly experimental software. This program is fo...

ParanoicScan - Vulnerability Scanner

Old Options Google & Bing Scanner that also scan : XSS SQL GET / POST SQL GET SQL GET + Admin Directory listing MSSQL Jet Database Oracle LFI RFI Full Source Discloure HTTP Information SQLi Scanner Bypass Admin Exploit FSD Manager Paths Finder IP Locate Crack MD5 Panel Finder Console Fixes +...

SQL Injection Scanning Attempt (CVE-2022-27412)

Remote attackers use SQL injection scanning in order to locate potential SQL injection vulnerabilities on a target server, which could be later used for attacks...

PentestPackage - A Package of Multiple Pentest Scripts

Contents: Wordlists - Comprises of password lists, username lists and subdomains Web Service finder - Finds web services of a list of IPs and also returns any URL rewrites Gpprefdecrypt. - Decrypt the password of local users added via Windows 2008 Group Policy Preferences. rdns.sh - Runs...

ComfortableMexicanSofa CMS Engine Detection

The script sends a HTTP request to the server and attempts to extract the version from the reply. SPDX-FileCopyrightText: 2015 SCHUTZWERK GmbH Some text descriptions might be excerpted from a referenced sources, and are Copyright C by the respective right holders. SPDX-License-Identifier:...

Flashlight - Automated Information Gathering Tool for Penetration Testers

Pentesters spend too much time during information gathering phase. Flashlight Fener provides services to scan network/ports and gather information rapidly on target networks. So Flashlight should be the choice to automate discovery step during a penetration test. In this article, usage of Flashli...