roxysploit - Penetration Testing Suite

roxysploit is a community-supported, open-source and penetration testing suite that supports attacks for numerous scenarios. conducting attacks in the field. Some containing Plugins in roxysploit Scan is a automated Information gathering plugin it gives the user the ability to have a rest while t...

httpd: Use-after-free by limiting unregistered HTTP method (Optionsbleed)

A use-after-free flaw was found in the way httpd handled invalid and previously unregistered HTTP methods specified in the Limit directive used in an .htaccess file. A remote attacker could possibly use this flaw to disclose portions of the server memory, or cause httpd child process to crash...

Razer US: Heart-bleed Vulnerability that leads to disclose sensitive information from the memory

Summary: Upon doing penetration testing on the Rezar domains, I have found that on of the domains is vulnerable to the heartbleed vulnerability, but I am not sure that careers.razerzone.com is in scope. Because of the dangerous of the vulnerability, I took further step to report. The Heartbleed B...

Apache Optionsbleed Scanner

This module scans for the Apache optionsbleed vulnerability where the Allow response header returned from an OPTIONS request may bleed memory if the server has a .htaccess file with an invalid Limit method defined. This module requires Metasploit: https://metasploit.com/download Current source:...

18-Byte ImageMagick Hack Could Have Leaked Images From Yahoo Mail Server

After the discovery of a critical vulnerability that could have allowed hackers to view private Yahoo Mail images, Yahoo retired the image-processing library ImageMagick. ImageMagick is an open-source image processing library that lets users resize, scale, crop, watermarking and tweak images. The...

DEBIAN-CVE-2016-0702

The MODEXPCTIMECOPYFROMPREBUF function in crypto/bn/bnexp.c in OpenSSL 1.0.1 before 1.0.1s and 1.0.2 before 1.0.2g does not properly consider cache-bank access times during modular exponentiation, which makes it easier for local users to discover RSA keys by running a crafted application on the...

UBUNTU-CVE-2016-0702

The MODEXPCTIMECOPYFROMPREBUF function in crypto/bn/bnexp.c in OpenSSL 1.0.1 before 1.0.1s and 1.0.2 before 1.0.2g does not properly consider cache-bank access times during modular exponentiation, which makes it easier for local users to discover RSA keys by running a crafted application on the...

Vimeo: Poodle bleed vulnerability in cloud sub domain

Hello Vimeo team This is Shahmeer and i found out that the Vimeo web application is highly vulnerable to Poodle bleed vulnerability located on this IP 54.235.139.25 In order to scan this properly Go here https://www.poodlescan.com Enter the domain captions.cloud.vimeo.com And it will prompt as...

OpenSSL issued a warning: memory 1 0 years of vulnerability may be hackers for“man in the middle”attack-vulnerability warning-the black bar safety net

On Thursday, the OpenSSL Foundation issued a warning that one already exists 1 0 years of the vulnerabilities could lead to hackers through the use of OpenSSL to encrypt the traffic to launch“man in the middle”attack. Information security experts are still trying to solve the OpenSSL encryption...

Mass Bleed 20140423

!/bin/bash massbleed.sh 20140423 by 1N3 http://treadstonesecurity.blogspot.ca Usage: sh massbleed.sh port proxy This script has four main functions with the ability to proxy all connections: 1. To mass scan any CIDR range for HeartBleed via port 443/tcp https example: sh massbleed.sh 192.168.0.0/...