Nosql Exploitation Framework

The Tool focuses on scanning and exploiting NoSQL Databases which makes the pentesters life easy. The tool currently has support for Mongo,Couch-db and Redis,with further additions to be made soon.It supports Enumerating NoSQL Db’s,Dumping Nosql db’s,Dictionary attacks and Shodan Search...

Automate Security Audit: netool.sh

Netool is a toolkit written in bash, python and ruby and provides easy automation for frameworks like Nmap, Driftnet, Sslstrip, Metasploit and Ettercap – mostly MitM attacks. This toolkit makes tasks as SNIFFING tcp/udp traffic, Man-In-The-Middle attacks, SSL-sniff, DNS-spoofing, D0S attacks in...

Object Scanning System: Laika BOSS

Laika is an object scanner and intrusion detection system that strives to achieve the following goals: Scalable Work across multiple systems High volume of input from many sources Flexible Modular architecture Highly configurable dispatching and dispositioning logic Tactical code insertion withou...

PortDog - Simple Python Script to Detect Port Scanning Techniques

PortDog is a network anomaly detector aimed to detect port scanning techniques. It is entirely written in python and has easy-to-use interface. It was tested on Ubuntu 15. Please note that, it is not working on Windows OS due to suffering from capturing RAW packets.I am working on to write this...

Lynis 2.1.1 - Security Auditing Tool for Unix/Linux Systems

Lynis is an open source security auditing tool. Commonly used by system administrators, security professionals and auditors, to evaluate the security defenses of their Linux/Unix based systems. It runs on the host itself, so it can perform very extensive security scans. Supported operating system...

Malicious Gaming App Infects More than 1 Million Android Users

It's not at all surprising that the Google Play Store is surrounded by a number of malicious applications that may gain users' attention to fall victim for one, but this time it might be even worse than you thought. Threat researchers from security firm ESET have discovered a malicious...

OPM Hack Expands to Include Data of 21.5M People

UPDATE–The ever-expanding data breach at the Office of Personnel Management has now spread to include the Social Security numbers and other personal data of a total of 21.5 million people, and the toll also now includes the agency’s director, Katherine Archuleta, who resigned Friday morning...

Unspecified Vulnerability in the 802.11n Wireless Network Standard Frame Aggregation Mechanism

802.11 protocol group is the International Electrotechnical and Electronics Engineering Society IEEE for wireless local area network standard. 802.11n is in 802.11g and 802.11a above the development of a technology, the most important feature is the rate of enhancement, the theoretical rate of up...

A year later, Yahoo finally fixes the SSRF vulnerability-vulnerability warning-the black bar safety net

! After a lapse of a year later, Yahoo finally fixes the image processing system of the SSRF service end request forgery）vulnerabilities. SSRF service end request forgery）vulnerability, also known as XSPA（cross-site port attacks, the problem exists in the application program loading the user...

[SECURITY] Fedora 21 Update: openvas-manager-6.0.3-3.fc21

The OpenVAS Manager is the central service that consolidates plain vulnerab ility scanning into a full vulnerability management solution. The Manager control s the Scanner via OTP and itself offers the XML-based, stateless OpenVAS Manageme nt Protocol OMP. All intelligence is implemented in the...

Antivirus Exclusions for Veeam ONE

Purpose This article documents antivirus exclusions that may be created to reduce the impact that antivirus software has on the functionality of Veeam ONE. These antivirus exclusions may be applied to the Windows built-in antivirus or third-party antivirus software. Note: Antivirus will not alway...

The Internet Scanner: ZMap

The Internet Scanner: ZMap ZMap is an open-source network scanner that enables researchers to easily perform Internet-wide network studies. With a single machine and a well provisioned network uplink, ZMap is capable of performing a complete scan of the IPv4 address space in under 45 minutes,...

OPM Breach Dates Back to December

The attack on the Office of Personnel Management that was disclosed earlier this month began as early as December 2014 and likely was the end result of a social engineering attack that enabled the hackers to gain valid user credentials and move around OPM’s network. During a hearing on Capitol Hi...

Shopify: SSRF via 'Insert Image' feature of Products/Collections/Frontpage

Hi Security team, I would like to report an another SSRF issue like my previous bug 67377 https://hackerone.com/reports/67377. The description, threats, risks, exploatations are the same. The base request is the following POST /admin/settings/files.json HTTP/1.1 Host: test-4925.myshopify.com...

HP WebInspect 10.4 - XML External Entity Injection

HP WebInspect 10.4 - XML External Entity Injection Exploit Title: HP WebInspect - XML External Entity Date: 23\04\2015 Exploit Author: Jakub Palaczynski Vendor Homepage: http://www.hp.com/ Version: 10.4, 10.3, 10.2, 10.1, 10.0, 9.x, 8.x, 7.x CVE : CVE-2015-2125 1. Create website that exploits...

WP Mobile Edition Wordpress Plugin - LFI Vulnerability

Exploit for php platform in category web applications Exploit Title: Wordpress Plugin 'WP Mobile Edition' LFI Vulnerability Date: june 6, 2015 Exploit Author: ViRuS OS Google Dork: inurl:?fdxswitcher=mobile Vendor Homepage: https://wordpress.org/plugins/wp-mobile-edition/ Software Link:...

OPM Warned About Vulnerabilities, Governance Weaknesses

It’s hardly a surprise that the U.S. Office of Personnel Management OPM was targeted by nation-state hackers, given the sensitivity of the personal information the office stored. It’s also no shocker that OPM has been successfully infiltrated more than once given the state of its information...

WordPress Plugin WP Mobile Edition - Local File Inclusion

Exploit Title: Wordpress Plugin 'WP Mobile Edition' LFI Vulnerability Date: june 6, 2015 Exploit Author: ViRuS OS Google Dork: inurl:?fdxswitcher=mobile Vendor Homepage: https://wordpress.org/plugins/wp-mobile-edition/ Software Link:...

IBM Security AppScan 9.0.2 remote code execution vulnerability-vulnerability warning-the black bar safety net

IBM Security AppScan Standard is the United States, IBM company a Web application security testing tool. The tool is available in the application development life cycle for automated static and dynamic security vulnerability scanning. The vulnerability is based on the Windows OLE Automation array...

Ruby Web Applications Vulnerability Scanner: Yasuo

Ruby Web Applications Vulnerability Scanner Yasuo is a ruby script that scans for vulnerable 3rd-party web applications While working on a network security assessment internal, external, redteam gigs etc., we often come across vulnerable 3rd-party web applications or web front-ends that allow us ...