Coinbase: Bypassing 2FA for BTC transfers

Under advanced settings, users have the ability to protect their wallet by requiring two-factor confirmation when sending bitcoins. Personally, I have configured my account with the most secure option, which requires two factor confirmation when sending any amount of bitcoins. However, a flaw...

Burp Suite Professional v1.6 - The leading toolkit for web application security testing

Burp Suite is an integrated platform for performing security testing of web applications. Its various tools work seamlessly together to support the entire testing process, from initial mapping and analysis of an application’s attack surface, through to finding and exploiting security...

HackerOne: creating titleless and non-closable bugs

Hi, I just found that it's possible to create titleless and non-closable bugs by prepending values for the 'reporttitle' and 'reportvulnerabilityinformation' parameters with '%00' characters respectively. To reproduce: - Create a baseline request via https://hackerone.com/program/reports/new -...

Slack: Reflected Xss

go to https://auth.slack.com/generate/ 2. input username and password, and submit the request. 3. In the next step application asks for the password you just created like the application says "We're almost done. Just need to test that you remember your password. Enter it again for me". Enter the...

[Burp Co2] A collection of enhancements for Portswigger's popuplar Burp Suite web penetration testing tool

Co2 includes several useful enhancements bundled into a single Java-based Burp Extension. The extension has it's own configuration tab with multiple sub-tabs for each Co2 module. Modules that interact with other Burp tools can be disabled from within the Co2 configuration tab, so there is no need...

程氏舞曲CMS最新php版本高危SQL注入漏洞

简要描述： 注入毫无限制！ 详细说明： 昨天刚下载的源码（应该最新的吧...） bug文件位置：https://images.seebug.org/upload/app/models/csdjskins.php第3466行 function GetIP //定义了一个获取ip地址的函数 if getenv"HTTPCLIENTIP" && strcasecmpgetenv"HTTPCLIENTIP", "unknown" //换取ip地址，如果存在，则使用clientip。 $ip = getenv"HTTPCLIENTIP"; else if...

Magento vulnerability allows an attacker to create administrative user

It seems you cannot go a day without hearing about someone or some group hacking a website or stealing credit card and other sensitive data from e-commerce sites. The Market of E-commerce is at its boom, and that provides even more opportunities to hackers. There are many readymade e-commerce...

EasyTalk存储型xss（官网为例已进后台）

简要描述： EasyTalk存储型xss，可盗取cookie可csrf 详细说明： 先注册一个会员 然后文件上传 （需要管理员开启文件上传插件） 来到广场，点文件上传，然后用burp抓包 最后说下不知道什么时候打到官网的cookie，官网后台以沦陷 修改cookie后直接登录后台截图 漏洞证明： img src="https://images.seebug.org/upload/201402/102113563579d07173f7f8c3d...

i-doit Pro 1.2.4 Cross Site Scripting

COMPASS SECURITY ADVISORY http://www.csnc.ch/ CVE ID : CVE-2014-1237 CSNC ID: CSNC-2014-002 Product: i-doit Vendor: synetics Gesellschaft für Systemintegration mbH Subject: Cross-site Scripting - XSS Risk: High Effect: Remotely exploitable Author: Stephan Rickauer [email protected] Date:...

SiteCore XML Control Script Insertion

Hey All, Sitecores “special way” of displaying XML Controls directly allows for a Cross Site Scripting Attack – more can be achieved with these XML Controls and will be documented in another vulnerability report http://target/?xmlcontrol=body20onload=alert123...

Sitecore XML Cross Site Scripting

Hey All, Sitecores “special way” of displaying XML Controls directly allows for a Cross Site Scripting Attack – more can be achieved with these XML Controls and will be documented in another vulnerability report http://target/?xmlcontrol=body%20onload=alert123...

Easy POS System SQL注入漏洞

No description provided by source. 1 Sql Injection POST Time Based Blind Note: Time based Injection on POST requests using burp, as output indicated. You might use ‘sqlmap -l’ to load it though. PoC: POST /login.php HTTP/1.1 Host: localhost User-Agent: Mozilla/5.0 X11; Linux i686; rv:22.0...

Simple e-document 1.31登录绕过漏洞

No description provided by source. 1 Sql Injection on username field PoC: username=-4731' OR 2708=2708 Burp output POST /simpleedocumentv131/login.php HTTP/1.1 Host: localhost User-Agent: Mozilla/5.0 X11; Linux i686; rv:22.0 Gecko/20100101 Firefox/22.0 Iceweasel/22.0 Accept:...

Easy POS System SQL Injection

Exploit: Easy POS System - SQL Injection + Author: vinicius777 + Contact: vinicius777 AT gmail @vinicius777 + Vendor Homepage: http://sourceforge.net/projects/easypossystem/ 1 Sql Injection POST Time Based Blind Note: Time based Injection on POST requests using burp, as output indicated. You...

Easy POS System - SQL Injection Vulnerability

Exploit for php platform in category web applications + Exploit: Easy POS System - SQL Injection + Author: vinicius777 + Contact: vinicius777 AT gmail @vinicius777 + Vendor Homepage: http://sourceforge.net/projects/easypossystem/ 1 Sql Injection POST Time Based Blind Note: Time based Injection on...

Easy POS System - 'login.php' SQL Injection

Exploit: Easy POS System - SQL Injection + Author: vinicius777 + Contact: vinicius777 AT gmail @vinicius777 + Vendor Homepage: http://sourceforge.net/projects/easypossystem/ 1 Sql Injection POST Time Based Blind Note: Time based Injection on POST requests using burp, as output indicated. You...

Easy POS System - login.php SQL Injection

Easy POS System - login.php SQL Injection + Exploit: Easy POS System - SQL Injection + Author: vinicius777 + Contact: vinicius777 AT gmail @vinicius777 + Vendor Homepage: http://sourceforge.net/projects/easypossystem/ 1 Sql Injection POST Time Based Blind Note: Time based Injection on POST reques...

Simple E-document 1.31 - Authentication Bypass

Exploit: Simple e-document v1.31 Login Bypass + Author: vinicius777 + Contact: vinicius777 AT gmail @vinicius777sec + version: Simple e-document v1.31 + Vendor Homepage: http://sourceforge.net/projects/simplee-doc/files/ 1 Sql Injection on username field PoC: username=-4731' OR 2708=2708 Burp...

信游科技页游平台后台管理验证码设计错误可致暴力破解

简要描述： 信游科技页游平台后台管理验证码设计错误可致暴力破解，验证码形同虚设啊。看厂商会发礼物。^^ 嘻嘻 详细说明： 信游科技页游平台后台管理验证码设计错误可致暴力破解，验证码形同虚设啊。 http://ht.52xinyou.cn/xykj/login.aspx burp下，验证码怎么写在cookie里了啊。反正只要登录不成功，验证码是不会变的。 然后就可以burp设置payload开始暴力破解了。只是演示，字典随便设的。 可以看到成功的payload，长度是不同的，而且response是200OK 漏洞证明： 信游科技页游平台后台管理验证码设计错误可致暴力破解，验证码形同虚设啊。...

yxcms任意文件删除 导致的重新安装漏洞

简要描述： yxcms任意文件删除 导致的重新安装漏洞 详细说明： yxcms任意文件删除 导致的重新安装漏洞 protected/apps/members/contoller/newscontroller.php if empty$FILES'picture''name' === false $tfile=date"Ymd"; $imgupload= $this-upload$this-uploadpath.$tfile.'/',config'imgupSize','jpg,bmp,gif,png'; $imgupload-saveRule='thumb'.time;...