AirLink101 SkyIPCam1620W OS Command Injection

Advisory ID Internal CORE-2015-0011 1. Advisory Information Title: AirLink101 SkyIPCam1620W OS Command Injection Advisory ID: CORE-2015-0011 Advisory URL:https://www.coresecurity.com/advisories/airlink101-skyipcam1620w-os-command-injection Date published: 2015-07-08 Date of last update: 2015-07-0...

WordPress Vulcan Theme XSS / Disclosure/ DoS

Hello list! Let's back to vulnerabilities, which I disclosed in April 2011, which can be used for DDoS attacks on other sites, e.g. with my DAVOSET http://seclists.org/fulldisclosure/2015/Jun/111. In addition to hundreds of themes, which I wrote about in previous years, here is another theme for...

AirLive Remote Command Injection

Advisory Information Title: AirLive Multiple Products OS Command Injection Advisory ID: CORE-2015-0012 Advisory URL: http://www.coresecurity.com/advisories/airlive-multiple-products-os-command-injection Date published: 2015-07-06 Date of last update: 2015-07-06 Vendors contacted: AirLive Release...

Multiple vulnerabilities in Vulcan theme for WordPress + WAF bypass

Hello 3APA3A! Let's back to vulnerabilities, which I disclosed in April 2011, which can be used for DDoS attacks on other sites, e.g. with my DAVOSET http://seclists.org/fulldisclosure/2015/Jun/111. In addition to hundreds of themes, which I wrote about in previous years, here is another theme fo...

BypassWAF - Burp Plugin to Bypass Some WAF Devices

Add headers to all Burp requests to bypass some WAF products. This extension will automatically add the following headers to all requests. X-Originating-IP: 127.0.0.1 X-Forwarded-For: 127.0.0.1 X-Remote-IP: 127.0.0.1 X-Remote-Addr: 127.0.0.1 Usage Steps include: 1. Add extension to burp 2. Create...

SOPHOS WAF JSON Filter Bypass

SECURITYLABS INTELLIGENT RESEARCH - SECURITY ADVISORY http://www.securitylabs.com.br/ ADVISORY/0115 - SOPHOS WAF WEBSERVER PROTECTION DOES NOT ANALYZE JSON DATA PRIORITY: MEDIUM TYPE: WAF Bypass 1 - About SecurityLabs Intelligent Research ----------------------------------------------- SecurityLa...

一个有意思的通用windows防火墙bypass(云锁为例)

简要描述： 一个有意思的通用bypass 详细说明： 1:之前自己总结了一个帖子,内容上将waf bypass分了几个层面,其中有一个层面是web服务器层面,记得在内容上提到了iis服务器的一些trick 2:IIS在对%u0011形式的内容的时候,是可以解析的,例如我的url为: http://192.168.15.130/letmetest.asp?t=152522098 andselect top 1 eventnameen from eventshelp0 我将url编码为: http://192.168.15.130/letmetest.asp?t=152522098...

Web Application Security Scanner Framework: Arachni

Arachni is a feature-full, modular, high-performance Ruby framework aimed towards helping penetration testers and administrators evaluate the security of modern web applications. It is free, with its source code public and available for review. It is multi-platform, supporting all major operating...

骑士CMS某接口1处SQL盲注#1(官网demo测试)

简要描述： 骑士CMS某接口1处SQL盲注官网demo测试 详细说明： 手机客户端接口存在SQL注入，SELECT注入无关键字过滤,理论上可以获取任意数据。 ： http://demo.74cms.com/android/resume.php 代码： 15 if !empty$aset'displayorder' 16 17 $arr=explode'',$aset'displayorder'; 18 $arr1=pregmatch'/asc|desc/',$arr1?$arr1:"desc"; 19 if $arr0=="rtime" 20 21 $orderbysql=" ORDER...

ALi CTF 2 0 1 5 write up-vulnerability warning-the black bar safety net

0x00 Cake Cake is a title of Android Title, The specific process is an input a string and then initialize a length of 1 by 6 Array, then the string with this array of xor. So we just need to xor it ok. Just look at the code in reverse, the key is there are two Key looking for ok direct codes a= 0...

phpyun人才系(2015-02-03)Sql注入2枚(可删除任意简历)

简要描述： phpyun人才系2015-02-03Sql注入2枚可删除任意简历 无法绕过waf，也就获取不了敏感信息。 详细说明： 代码 /wap/member/model/index.class.php function addresumeaction//复制的较长，可直接略过。 if$this-config'userenforceidentitycert'=="1" $row=$this-obj-DBselectonce"resume","idcardpic'' and uid='".$this-uid."'"; if$row'idcardstatus'!="1"...

Citrix Netscaler NS10.5 - WAF Bypass Via HTTP Header Pollution Vulnerability

Exploit for linux platform in category web applications Exploit Title: Citrix Netscaler NS10.5 WAF Bypass via HTTP Header Pollution Date: Mar 13, 2015 Exploit Author: BGA Security Vendor Homepage: http://www.citrix.com/ Version: NS10.5 Tested on: NetScaler NS10.5: Build 50.9.nc, Document Title:...

Citrix Netscaler NS10.5 WAF Bypass

Document Title: ============ Citrix Netscaler NS10.5 WAF Bypass via HTTP Header Pollution Release Date: =========== 12 Mar 2015 Product & Service Introduction: ======================== Citrix NetScaler AppFirewall is a comprehensive application security solution that blocks known and unknown...

Citrix Netscaler NS10.5 - WAF Bypass (Via HTTP Header Pollution)

Citrix Netscaler NS10.5 - WAF Bypass Via HTTP Header Pollution Exploit Title: Citrix Netscaler NS10.5 WAF Bypass via HTTP Header Pollution Date: Mar 13, 2015 Exploit Author: BGA Security Vendor Homepage: http://www.citrix.com/ Version: NS10.5 Tested on: NetScaler NS10.5: Build 50.9.nc, Document...

Citrix Netscaler NS10.5 - WAF Bypass (Via HTTP Header Pollution)

Exploit Title: Citrix Netscaler NS10.5 WAF Bypass via HTTP Header Pollution Date: Mar 13, 2015 Exploit Author: BGA Security Vendor Homepage: http://www.citrix.com/ Version: NS10.5 Tested on: NetScaler NS10.5: Build 50.9.nc, Document Title: ============ Citrix Netscaler NS10.5 WAF Bypass via HTTP...

XSSYA v2.0 - Cross Site Scripting Scanner & Vulnerability Confirmation

XSSYA Cross Site Scripting Scanner & Vulnerability Confirmation written in python scripting language confirm the XSS Vulnerability in two method first work by execute the payload encoded to bypass Web Application Firewall which is the first method request and responseif it respond 200 it turn...

TIPASK Q & A system at bypass the WAF SQL injection-vulnerability warning-the black bar safety net

Case ! 0.jpg Since the system allows the registration contains a backslash""username can be caused by manySQL injectionvulnerabilities, because the system exists 360WAF Defense, at the same time using a plurality of parameters of the perfect combination to bypass the WAF protection function...

53KF客服系统存在sql注入(官方测试)

简要描述： rt 详细说明： 53KF的客服系统存在sql注入 晚上你们服务器有waf 好不容易绕过了 早上发现却没有了 奇怪 www5.53kf.com/fenci/robotfenci.php?cmd=CR&comid=72000079&robotid=971b5d68cdd2d141e86978b8afa02f21&qid=1e278e4878dc8de61694c69482d20b6d&val=4 comid存在注入 Place: GET Parameter: comid Type: AND/OR time-based blind Title: MySQL 5.0.11 AND...

WordPress4. 0 and the following version of the Dos attack Vulnerability CVE-2 0 1 4-9 0 3 4 the detection and use-vulnerability and early warning-the black bar safety net

In this article, I will detail how to use vulnerability POC（proof-of-concept tool Searchspoit on your Wordpress website, 4.0 and following versions of Dos attack Vulnerability CVE-2 0 1 4-9 0 3 4 the detection and utilization. Vulnerability description CVE-2 0 1 4-9 0 3 4 is due to the hash numbe...

Vulnerability alert: well-known WordPress theme Pagelines and Platform the presence of high-risk vulnerabilities-vulnerability warning-the black bar safety net

Use the Pagelines and Platform themes for WordPress users, please update the theme version. We at once on WAF routine audit, accidentally discovered two serious vulnerabilities: a privilege elevation vulnerability affecting the Pagelines and Platform, as well as a remote code execution...