A billion reasons to enhance your penetration testing

There are so many questions regarding those leaked Russian passwords. Is this for real? What sites are on that list? How can you tell if your sites users are in the "Russian Billion"? Isnt this just a matter of changing user passwords? Bottom line: As a company with websites that have user...

DSA-2984-2 acpi-support - regression update

Bulletin has no description...

IBM Sametime Meet Server 8.5 Arbitrary File Upload

Exploit Title: IBM Sametime Meet Server 8.5 Arbitrary File Upload Google Dork: intitle:"New Meet - IBM Lotus Sametime" Date: 11/08/2014 CVSS Score: http://nvd.nist.gov/cvss.cfm?calculator&version=2&vector=AV:N/AC:M/Au:N/C:P/I:P/A:P CVE-ID: http://cve.mitre.org/cgi-bin/cvename.cgi?name=2014-3088...

Debian: Security Advisory (DSA-2999-1)

The remote host is missing an update for the Debian SPDX-FileCopyrightText: 2014 Greenbone AG Some text descriptions might be excerpted from a referenced sources, and are Copyright C by the respective right holders. SPDX-License-Identifier: GPL-2.0-only ifdescription...

DSA-2997-1 reportbug - security update

Bulletin has no description...

DSA-2995-1 lzo2 - security update

Bulletin has no description...

Social Connect 0.10.1 - diagnostics/test.php testing Parameter Reflected XSS

The Social Connect WordPress plugin was affected by a diagnostics/test.php testing Parameter Reflected XSS security vulnerability...

利用骑士cms的一次纠结的渗透测试过程(两个潜在而被忽略的漏洞分析)

简要描述： 今天下载了骑士cms的最新版本，由于好久以前一个哥们发了一个后台拿shell的漏洞，还有别人发的一个sql注入的漏洞，一个有意思的渗透测试过程就从这两个地方开始了，成功的拿下了某大型人才网站的服务器，过程算比较艰辛吧，由于附带了对其实cms的漏洞重新分析，并且加入了自己新的利用方法，所以这里提交到了通用漏洞 详细说明： 第一步 我们分析一个老的sql注入问题： 文件job/plus/ajaxcommon.php:lines:88-100 if empty$GET'query' exit; $gbkquery=trim$GET'query'; if...

Kali Linux 1.0.8 — New Release Supports UEFI Boot

Great news for Hackers and Backtrack Linux fans! Offensive Security, the developers of one of the most advance open source operating system for penetration testing known as 'KALI Linux', has finally announced the release of the latest version i.e. Kali Linux 1.0.8. Kali Linux is based upon Debian...

DSA-2989-1 apache2 - security update

Bulletin has no description...

DSA-2984-1 acpi-support - security update

Bulletin has no description...

PwnPi - A Pen Test Drop Box distro for the Raspberry Pi

PwnPi is a Linux-based penetration testing dropbox distribution for the Raspberry Pi. It currently has 200+ network security tools pre-installed to aid the penetration tester. It is built a stripped down version of the Debian Wheezy image from the Raspberry Pi foundation's website and uses Openbo...

Havex, It’s Down With OPC

FireEye recently analyzed the capabilities of a variant of Havex referred to by FireEye as “Fertger” or “PEACEPIPE”, the first publicized malware reported to actively scan OPC servers used for controlling SCADA Supervisory Control and Data Acquisition devices in critical infrastructure e.g., wate...

Egresser - Tool to Enumerate Outbound Firewall Rules

Egresser is a tool to enumerate outbound firewall rules, designed for penetration testers to assess whether egress filtering is adequate from within a corporate network. Probing each TCP port in turn, the Egresser server will respond with the client’s source IP address and port, allowing the clie...

释锐教育区校版电子书包教学平台XSS漏洞

简要描述： 看到http://www.wooyun.org/bugs/wooyun-2010-051965过了，我也来了 存储型xss 详细说明： 利用官方demo测试 http://demo.31390.com:8080/eLearning/user.html 随意点击一个用户 在留言处写入xss语句 点击留言试试 直接就给弹了。。 看看源代码 毫无过滤 测试地址：http://demo.31390.com:8080/eLearning/message/s800.html 其实本身是html文件，给予xss很大空间 测试一下通用性...

DSA-2977-1 libav - security update

Bulletin has no description...

Cross site scripting

Cross-site scripting XSS vulnerability in diagnostics/test.php in the Social Connect plugin 1.0.4 and earlier for WordPress allows remote attackers to inject arbitrary web script or HTML via the testing parameter...

CVE-2014-4551

Cross-site scripting XSS vulnerability in diagnostics/test.php in the Social Connect plugin 1.0.4 and earlier for WordPress allows remote attackers to inject arbitrary web script or HTML via the testing parameter...

skyportal vrc6 Multiple Vulnerabilities

No description provided by source. WwW.BugReport.ir BugReport Security Research & Penetration Testing Group Title: Sky Portal Multiple SQL Injection Vulnerabilities Vendor: http://skyportal.net Exploitation: Remote with browser Fix Available: Patched In Last Version In Vendor Leaders : Shahin...

Poison Ivy 2.3.2 C&C Server Buffer Overflow

No description provided by source. This file is part of the Metasploit Framework and may be subject to redistribution and commercial restrictions. Please see the Metasploit web site for more information on licensing and terms of use. http://metasploit.com/ require 'msf/core' class Metasploit3...