Bleeding Life 2 Exploit Pack Released

Bleeding Life 2 Exploit Pack Released Black Hat Academy releases Bleeding Life 2 exploit pack. This is an exploit pack that affects Windows-based web browsers via Adobe and Java. You can read all about it, and download it for yourself. Statistics are kept based on exploit, browser, and OS version...

Mac OS X XProtect Detection

The remote Mac OS X host includes XProtect, an antivirus / anti- malware application from Apple included with recent releases of Snow Leopard 10.6 and later. It is used to scan files that have been downloaded from the Internet by browsers and other tools. Note that this plugin only gathers...

HTTPS: block-wise chosen-plaintext attack against SSL/TLS (BEAST)

The SSL protocol, as used in certain configurations in Microsoft Windows and Microsoft Internet Explorer, Mozilla Firefox, Google Chrome, Opera, and other products, encrypts data by using CBC mode with chained initialization vectors, which allows man-in-the-middle attackers to obtain plaintext HT...

Federal Trojan's Got A "Big Brother"

About two weeks ago, the German Chaos Computer Club CCC has published an analysis report of a backdoor trojan that they claim had been used by German police during investigations in order to capture VoIP and IM communication on a suspect’s PC. Our friends over at F-Secure published a blog post la...

GateOne Beta - Terminal emulator for HTML5 web browsers

GateOne Beta - Terminal emulator for HTML5 web browsers The software makes use of WebSockets to connect a server backend written in Python and a frontend written for modern browsers in JavaScript, HTML5 and CSS. The frontend doesn't require any browser plug-ins to be installed.Gate One also...

DarkComet-RAT v4.2 fwb (Firewall bypass)

DarkComet-RAT v4.2 fwb Firewall bypass This version is firewall bypass it will inject to web browsers and bypass firewall rules. Targets are in this order : Firefox, Opera, Chrome, Safari, Internet Explorer and Explorer if all fails normally never then it runs normally. Notice now you can use...

Fraudulent Digital Certificates Spoofing Vulnerability (2607712)

Microsoft Windows operating system is prone to a spoofing vulnerability. This VT has been superseded by KB2641690 which is addressed in the VT SPDX-FileCopyrightText: 2011 Greenbone AG Some text descriptions might be excerpted from a referenced sources, and are Copyright C by the respective right...

GlobalSign Investigation Continues, Some CA Services to Return Monday

UPDATE: A day after suspending the issuance of SSL certificates while it investigates claims that its certificate authority infrastructure was compromised, GlobalSign said that the investigation is still ongoing but that it planned to begin bringing some of its services back online on Monday...

Session fixation

The SSL protocol, as used in certain configurations in Microsoft Windows and Microsoft Internet Explorer, Mozilla Firefox, Google Chrome, Opera, and other products, encrypts data by using CBC mode with chained initialization vectors, which allows man-in-the-middle attackers to obtain plaintext HT...

Inline attachment downloads vulnerable to XSS by setting tweaked HTML content type

Please see CONFDEV-9069 https://jira.atlassian.com/browse/CONFDEV-9069 for the current issue addressed at fixing attachment XSS vulnerabilities. --- TLDR: white-list mime-types which can be served "inline" and don't let the user set arbitrary mime-types. I have been having a good laugh sorry...

Inline attachment downloads vulnerable to XSS by setting tweaked HTML content type

Please see CONFDEV-9069 https://jira.atlassian.com/browse/CONFDEV-9069 for the current issue addressed at fixing attachment XSS vulnerabilities. --- TLDR: white-list mime-types which can be served "inline" and don't let the user set arbitrary mime-types. I have been having a good laugh sorry...

Flash 0day Exploit Analysis-exploit warning-the black bar safety net

The number of days before the network broke to take advantage of the latest“Flash Media loophole”hanging horse attack page, this vulnerability affects Adobe Flash Player 10.3.183.5 the following version, you want to know on this Wednesday before 1 0. 3. 1 8 3. 5 is flash highest version, even if...

ICQ Website Cross Site Scripting

+-----------------------------------------------------------------------------+ | noptrix.net - Public Security Advisory | +-----------------------------------------------------------------------------+ Date: ----- 07/26/2011 Vendor: ------- ICQ website - http://www.icq.com/ Affected Software:...

Researchers Find Browser History-Sniffing Still Ongoing

The practice of history sniffing, which has been seen as out-of-bounds and a serious privacy violation for the better part of a decade now, is still ongoing by some ad networks, researchers have found. A study completed recently by researchers at Stanford University’s Center for Internet and...

Impassioned Framework Download - Another Crimeware Available for Free !

Impassioned Framework Download - Another Crimeware Available for Free ! Russo is the creator of Impassioned Framework - Browser Exploitation Kit, a subscription-based software vulnerability exploit service. He is 23 year old the young hacker, This toolkits designed to be stitched into a Web site...

Phony SSL Certificates issued for Google, Yahoo, Skype, Others

UPDATED: A major issuer of secure socket layer SSL certificates acknowledged on Wednesday that it had issued 9 fraudulent SSL certificates to seven Web domains, including those for Google.com, Yahoo.com and Skype.com following a security compromise at an affiliate firm. The attack originated from...

XSS in Oracle default fcgi-bin/echo

Long ago, I wrote about an XSS vulnerability in Oracle fcgi-bin/echo : http://lists.grok.org.uk/pipermail/full-disclosure/2010-October/076794.html http://www.securityfocus.com/archive/1/514181 The issue may now be fixed in the latest versions of Oracle web servers:...

Step 6: Update and Patch

With your machine disinfected, take a few moments to update your operating system software and any third party applications to their latest and most secure version. Rogue antivirus and scareware programs are usually delivered as drive by downloads spawned by malicious Web sites. These leverage...

Microsoft Releases Zero IE8 Security Updates Before "Pwn2Own" !

Microsoft has opted not to release any patches to its Internet Explorer 8 browser prior to this year's Pwn2Own browser exploit challenge, which is set to run from March 9 to March 11 at the CanSecWest security conference. There's been no indication as to why Microsoft's not making one last effort...

Password Management Site LastPass Sports Security Hole

Web surfers frustrated with the task of managing a forest of user names and passwords have been flocking to LastPass in an effort to simplify. But now a a security researcher says that a security flaw in that company’s Web site could reveal sensitive account details. Mike Cardwell, an independent...