Airachnid Burp Extension - A Burp Extension to test applications for vulnerability to the Web Cache Deception attack

A Burp extension to test applications for vulnerability to the Web Cache Deception attack. Once the extension has been loaded, it can be accessed in the Target - Sitemap tab and right click on the resource that should be tested. A context sensitive menu item called "Airachnid Web Cache Test" will...

U.S. Dept Of Defense: Insecure Direct Object Reference on in-scope .mil website

Summary: A web form in a .mil website doesn't implement restriction against multiple failed attempts to place an ID in order to obtain users information or cancel an ongoing process. Description: Websites https://█████████/appointment/lookup.aspx?a=f and...

Dashlane: Extract Billing admin email address using random team id

Any user can extract and enumerate email address of dashlane members. Steps to reproduce 1 Login to console.dashlane.com Register using https://www.dashlane.com/business/try 2 Click on Manage Users while intercepting request in Burp 3 Look for a request to...

Weblate: Account Takeover using Third party Auth CSRF

Login to your account at demo.weblate.org 2. Goto Profile Authentication - https://demo.weblate.org/accounts/profile/auth 3. In Add new association section , select Ubuntu 4. Login with Ubuntu One account , before clicking on Yes log me in on ubuntu authentication site , start a proxy tool like...

U.S. Dept Of Defense: Exposed ███████ Administrative Interface (ColdFusion 11)

Summary: The "/██████████/administrator/" directory is accessible to the public and allows an attacker to further enumerate the system and/or perform brute force attacks. Description: The ████████ website has an exposed "Administrative Interface" for ColdFusion 11, which could be useful to an...

Serv-U FTP/MFT Server Unauthenticated Privilege Escalation

Details source: https://www.trustwave.com/Resources/SpiderLabs-Blog/Exploiting-Privilege-Escalation-in-Serv-U-by-SolarWinds/?page=1&year=0&month=0 I was recently working on an external network penetration test where I identified a new vulnerability in a file sharing web application called Serv-U ...

Mail.ru: Stored XSS in e.mail.ru (payload affect multiple users)

Hi, We have found a high risk level STORED XSS in e.mail.ru chat, the status change function allow to inject malicious payload in javascript & HTML, The attack affect multiple users and run in auto mode, no need a user interaction. Vulnerability affect any user that have been invited to your chat...

Urban Dictionary: Session replay vulnerability in www.urbandictionary.com

Session replay vulnerability in www.urbandictionary.com I considered titling this bug "Session tokens not expiring", which is what you need to tell your development team. But I titled it as I did to emphasize at least one attack made possible by the bug. There may be others. Description Privilege...

Trello: Rate limiting of incorrect Two Factor Authentication codes not enforced

Trello has a feature which allows the user to enable Two factor authentication to enhance the security. But no Rate Limiting is present on second authentication, i.e. code sent to Registered Mobile Number. Attacker can try as many attempts as he wants to bypass the 2 factor authentication. So usi...

EPSON TMNet WebConfig 1.00 - Cross-Site Scripting Vulnerability

Exploit for hardware platform in category web applications Exploit Title: Persistent XSS in EPSON TMNet WebConfig Ver. 1.00 Google Dork: intitle:"EPSON TMNet WebConfig Ver.1.00" Date: 3/3/2017 Exploit Author: Michael Benich Vendor Homepage: https://www.epson-biz.com/ Software Link:...

EPSON TMNet WebConfig 1.00 - Cross-Site Scripting

Exploit Title: Persistent XSS in EPSON TMNet WebConfig Ver. 1.00 Google Dork: intitle:"EPSON TMNet WebConfig Ver.1.00" Date: 3/3/2017 Exploit Author: Michael Benich Vendor Homepage: https://www.epson-biz.com/ Software Link: https://c4b.epson-biz.com/modules/community/index.php?contentid=50 Versio...

LocalTapiola: Brute force unsubscription on /webApp/unsub_sb (viestinta.lahitapiola.fi)

Basic report information Summary: CSRF is an attack that tricks the victim into submitting a malicious request. It inherits the identity and privileges of the victim to perform an undesired function on the victim's behalf Description: Any user subscribed to Active Campaign, or admin too, attacker...

For the Node. js in the node-serialize module deserialization vulnerability the subsequent analysis-vulnerability warning-the black bar safety net

Of the Node. js serialization remote command execution vulnerabilities of a number of follow-up found and how to develop the attack load. A few days ago I was in opsecx blog found an article How to use a named node-serialize nodejs module in the RCE remote code execution error blog. The article...

Collaborative Penetration Test & Vulnerability Management Platform: Faraday

Collaborative Penetration Test & Vulnerability Management Platform Faraday introduces a new concept – IPE Integrated Penetration-Test Environment a multiuser Penetration test IDE. Designed for distribution, indexation and analysis of the data generated during a security audit. The main purpose of...

Faraday v2.3 - Collaborative Penetration Test and Vulnerability Management Platform

Faraday is the Integrated Multiuser Risk Environment you were looking for! It maps and leverages all the knowledge you generate in real time, letting you track and understand your audits. Our dashboard for CISOs and managers uncovers the impact and risk being assessed by the audit in real-time...

New Relic: SSRF in alerts.newrelic.com exposes entire internal network

By sending a malformed HTTP request to alerts.newrelic.com, it's possible to trick that server into routing the request to an arbitrary location. This can be exploited by an internet based attacker to access internal services - doing a quick scan of █████████ I was able to access █████ etc. The...

Exploit for OS Command Injection in Gnu Bash

ActiveScan++ ================== ActiveScan++ extends Burp Suite...

Burp Suite Professional 1.7.14 - The Leading Toolkit for Web Application Security Testing

Burp Suite is an integrated platform for performing security testing of web applications. Its various tools work seamlessly together to support the entire testing process, from initial mapping and analysis of an application's attack surface, through to finding and exploiting security...

WordPress: [Buddypress] Arbitrary File Deletion through bp_avatar_set

Hi, The bpavatarset action in BuddyPress when cropping avatars allows an attacker to arbitrarily delete a file the webserver can delete through the 'originalfile' parameter. For example: Create a user on a Buddypress-powered Wordpress instance any user is OK, doesn't need to be admin, just needs ...

The use of Python code implementing the Web application of the injection-vulnerability warning-the black bar safety net

Vulnerability overview If your Web application exists in the Python code injection vulnerability, the attacker can use your Web applications to your back-end server of the Python parser to send malicious Python code. This also means that if you can on the target server execute Python code, you ca...