Legal Line Between Security Research, Cybercrime Murky

LAS VEGAS — In his keynote address at Black Hat Wednesday, Dan Geer, the CISO of In-Q-Tel and a respected security luminary noted that the industry has never been closer to the forefront of corporate and government policy decision making. Despite this, security research remains a dangerous busine...

Security: Invalid EJB caller role check implementation

It was found that the isCallerInRole method of the SimpleSecurityManager did not correctly check caller roles. A remote, authenticated attacker could use this flaw to circumvent the caller check in applications that use black list access control based on caller roles...

Podcast: Threatpost Previews Black Hat 2014

In this special edition of the Digital Underground Podcast, Dennis Fisher interviews fellow Threatpost editor Mike Mimoso and also Threatpost reporter Brian Donohue about the Black Hat security conference, which begins this week in Las Vegas. Topics of discussion include Chris Valasek and Charlie...

WordPress xmlrpc using the test tool multi-threaded version-bug warning-the black bar safety net

The following is the code import futures import requests from Queue import Queue XMLURL = "http://www.myhack58.com/" USERFILE = "username.txt" PASSFILE = "password.txt" THREADNUM = 2 0 data = """wp. getUsersBlogs%s%s""" task = Queuedef attack: while not task. empty: username = the task. get passt...

Tor hidden services attacks deanonymize users

UPDATE: For a little more than six months, attackers were on the Tor network trying to deanonymize users who operate or use Tor hidden services. Tor issued a security advisory this morning warning users who operated or accessed hidden services between Jan. 30 and July 4 that they were likely...

Attackers Compromise TOR Network to De-Anonymize Users of Hidden Services

A critical vulnerability in Tor — an encrypted anonymizing network considered to be one of the most privacy oriented service, which is used by online users in order to hide their activities from law enforcement, government censors and others — was probably being used to de-anonymize the identity ...

Critical Android FakeID Bug Allows Attackers to Impersonate Trusted Apps

There is a critical vulnerability in millions of Android devices that allows a malicious app to impersonate a trusted application in a transparent way, enabling an attacker to take a number of actions, including inserting malicious code into a legitimate app or even take complete control of an...

IP138 suspected the Master Station database leak-vulnerability warning-the black bar safety net

IP138 疑似 主 站 数据库 泄漏 http://www.ip138.com/www.rar ! Vulnerability repair method: this only managers themselves know, I this little hack is impossible to help you fix, huh?...

Third-Party Software Library Risks Scrutinized at Black Hat

Enterprise application developers are under real pressures to push projects out the door quickly and cheaply, and each new version certainly has to be better than the last. This forces them to make decisions that, at a minimum, improve efficiency—and also introduce additional risks. Of particular...

Sum Technologies SQL Injection

Exploit Author:Th3 R0cksT3r Exploit Title: Sum Technologies id SQL Injection Vulnerability Email: [email protected] Vendor Homepage: http://www.sumtechnologies.com/ Google Dork: intext:"Powered by Sum Technologies" Proof Of Concept: 1. https://server/elferecting.php?id=SQL Injection 2...

SSL Black List Aims to Publicize Certificates Associated With Malware

Malware and botnet operators are always adapting their tactics, trying to stay a step or two ahead of defensive technologies and techniques. One of the methods many attackers have adopted is using SSL to communicate with the infected machines they control, and a researcher has started a new...

Million cloud mailbox register logic flaws-vulnerability warning-the black bar safety net

Million network top level domain names sent to cloud mailbox activity, the cloud mailbox can be any resolution, may lead to phishing or fraud, specifically the details look at the following graphic, the language is not too easily described Some time ago promising a domain name, ready for...

Dimensions buy 4. 3 the latest version of the sql analysis-vulnerability warning-the black bar safety net

Haven't been on the forum, today sees the release of the top-dimensional buy 4. 3 the latest versionof sql injectionexploit tool Well, according to this primary information, plus before has been analyzed dimensions, soon locating to the \\app\source\goodslist.php 1. 2. //Buy classification 3...

Oracle Event Processing FileUploadServlet Arbitrary File Upload Exploit-vulnerability warning-the black bar safety net

Current source: https://github.com/rapid7/metasploit-framework require 'msf/core" class Metasploit3 'Oracle Event Processing FileUploadServlet Arbitrary File Upload", 'Description" = %q This module exploits an Arbitrary File Upload vulnerability in Oracle Event Processing 1 1. 1. 1. 7. 0. The...

Web Wiz NewsPad Express Edition 1.03 Database File Disclosure Vulnerability

No description provided by source. ============================================================= NewsPad Database Download Vulnerability ============================================================= Exploit Title: NewsPad Database Download Vulnerability Date: 15/11/2010 Author: keracker Software...

phpg 1.6 (xss/pd/dos) Multiple Vulnerabilities

No description provided by source. PHPg 1.6 has a few XSSes, path disclosures, and a DoS vulnerability. Home: http://black-dwarf.com HS: http://www.hotscripts.com/Detailed/86225.html Found by: Anarchy Angel - http://hha.zapto.org Temp XSS: http://site.com/phpg/index.php?url= XSS Temp XSS:...

IrIran Shoping Script SQL Injection Vulnerability

No description provided by source. ========================================== IrIran Shoping Script SQL Injection Vulnerability ========================================== InformatioN Title : IrIran Shoping Script SQL Injection Vulnerability Author : Net.Edit0r Vendor or Software Link :...

Black Ice Fax Voice SDK 12.6 - Remote Code Execution Exploit

No description provided by source. html !-- Black Ice Fax Voice SDK v12.6 - integer dereference code execution exploit Date: Jun 20, 2011 Link: http://www.blackice.com/Fax%20C++%20ActiveX.htm Version: 12.6 Tested on: WinXP - IE 6 & 7 Class FAX GUID: 2E980303-C865-11CF-BA24-444553540000 Number of...

E-commerce Group (cat.php) SQL Injection Vulnerability

No description provided by source. Exploit Title: E-commerce Group cat.php SQL Injection Vulnerability Date: 2010/05/21 Author:BLack Revenge Software Link: Version: Tested on: CVE : ============================== E-commerce Group cat.php SQL Injection Vulnerability Founder: BLaCk RevenGe Email:-...

Microsoft Office PowerPoint 2007 - Crash PoC

No description provided by source. Title : Microsoft Office PowerPoint 2007 Crash PoC Date: 2013-01-12 Software Link: http://office.microsoft.com/ Author: Asesino04 Tested on: Windows XP SP2 Special Thanks To : Ness Oum El Bouaghi Bug Description: when you insert a sound to Microsoft office...