Xornic Contact Us Form CAPTCHA Bypass / XSS

Hi FD, So I got bored/felt nostalgia and decided I would go through the hotscripts website and audit the top 10 most popular PHP scripts PHP being my most proficient language. Y'know, for practice or something. Unfortunately, there were a number of factors that frustrated this effort: Most of the...

Second NSA Crypto Tool Found in RSA BSafe

A team of academics released a study on the maligned Dual EC DRBG algorithm used in RSA Security’s BSafe and other cryptographic libraries that includes new evidence that the National Security Agency used a second cryptographic tool alongside Dual EC DRBG in Bsafe to facilitate spying. Allegation...

Experts Urge Conservatism on Crypto Standards

SAN FRANCISCO–Security people are, by nature, cautious and methodical, and that is even more true of cryptographers. And in the current environment, when new adversaries seem to emerge on a daily basis and cryptographic standards are under intense scrutiny, a panel of some of the biggest names in...

[OWASP iGoat] Security learning tool for iOS developers

The OWASP iGoat project is a security learning tool for iOS developers to learn about security weaknesses in iOS -- by breaking things as well as fixing them. iGoat is available ONLY in source code format, and this is the official repository for that code. On the Downloads tab here, you will find...

98% of SSL enabled websites still using SHA-1 based weak Digital Certificates

The National Institute of Standards and Technology NIST had published a document on Jan 2011 that the SHA-1 algorithm will be risky and should be disallowed after year 2013, but it was recently noticed by Netcraft experts that NIST.gov website itself were using 2014 dated SSL certificate with SHA...

Poor Patching, Passwords Plague Government Computers

A damning report on the security of government computers paints an unflattering picture of lax or non-existent patching efforts, poor password policies, configuration errors and a general lack of confidence that exposes critical services and systems to attack. The report, “The Federal Government’...

Small satellite terminals (VSAT) are vulnerable to Cyber attack

+are+vulnerable+to+Cyber+attack.gif The Military Units that rely on very small aperture terminals VSATs for satellite communications in remote areas are vulnerable to cyber attack. Researchers from cyber intelligence company IntelCrawler recently identified nearly 3 million VSATs, many of them in...

Santander BillPay Security Vulnerabilities Patched

Security weaknesses on the Santander Group BillPay website and mobile banking application have been addressed by the financial services organization’s developer Headland after they were exposed less than a week ago. U.K. consultant Paul Moore of Cresona Corp., reported a number of serious...

Department of Energy Susceptible to Attack

An audit of the Department of Energy has shown that 29 new weaknesses emerged on the agency’s networks this year in addition to 10 existing that the DoE failed to fix after a 2012 audit. The audit, undertaken by the Office of Inspector General and the Office of Audits and Inspections, revealed...

Design/Logic Flaw

Multiple unspecified vulnerabilities in Google Chrome before 30.0.1599.101 allow attackers to cause a denial of service or possibly have other impact via unknown vectors...

NSA Crypto Questions Resemble a 'Hall of Mirrors'

There’s been no shortage of discussion and debate in recent week about the possibility that the NSA has intentionally weakened some cryptographic algorithms and cipher suites in order to give it an advantage in its intelligence-gathering operations. If you subscribe to the worst-case scenario lin...

Cisco Unified MeetingPlace Multiple Session Weaknesses

According to its self-reported version number, the installation of Cisco Unified MeetingPlace hosted on the remote web server may be affected by multiple session weaknesses : - The application fails to invalidate a session upon a logout action, which makes it easier for remote attackers to hijack...

The Sky is Not Falling--It's Fallen

It’s no fun being a cynic, thinking that everything is bad and getting worse. It’s easy–especially in the security community–but it’s not fun. But, in light of the latest in the interminable string of revelations about the NSA’s efforts to eat away at the foundation of the security industry, the...

Windows 8 Picture Gesture Authentication Research

Typing on a smartphone or tablet keyboard lends itself to a lot of fat-fingered mistakes. Recent updates to mobile operating systems and desktop OSes such as Windows 8, however, have tried to better leverage the touch screen for things such as authentication. Users, for example, have the option o...

[Yersinia v0.7.3] The network protocols assessment tool

Yersinia is a network tool designed to take advantage of some weakeness in different network protocols. It pretends to be a solid framework for analyzing and testing the deployed networks and systems. Currently, there are some network protocols implemented, but others are coming tell us which one...

Cracking Cryptography and Encryption Exponentially Easier

It’s been a brutal month for crypto. Starting with the Black Hat conference, researchers, engineers and hackers have been unveiling new weaknesses and attacks in different cryptographic implementations that threaten the security of communication and commerce on the Web. Not only have holes been...

Hackers can steal Windows Phone passwords using Wi-Fi vulnerability

Microsoft has warned that a vulnerability in Windows Phone operating systems could allow hackers to access your login credentials. The vulnerability resides in a Wi-Fi authentication scheme known as PEAP-MS-CHAPv2, which Windows Phones use to access wireless networks protected by version 2 of the...

JavaScript and Timing Attacks Used to Steal Browser Data

LAS VEGAS–Security researchers have been warning about the weaknesses and issues with JavaScript and iframes for years now, but the problem goes far deeper than even many of them thought. A researcher in the U.K. has developed a new technique that uses a combination of JavaScript-based timing...

Massive 167Gbps DDoS attacks against Banking and Financial Institutions

DDoS attackers attempted to bring down an Banking services earlier this week using one of the largest Distributed denial of service attack using DNS reflection technique. Prolexic, the global leader in Distributed Denial of Service DDoS protection services, announced that it has successfully...

CentOS Update for tomcat6 CESA-2013:0869 centos6

The remote host is missing an update for the SPDX-FileCopyrightText: 2013 Greenbone AG Some text descriptions might be excerpted from a referenced sources, and are Copyright C by the respective right holders. SPDX-License-Identifier: GPL-2.0-only ifdescription...