2747 matches found
WAFW00F - Identifies and Fingerprints Web Application Firewall (WAF) Products
WAFW00F allows one to identify and fingerprint Web Application Firewall WAF products protecting a website. How does it work? To do its magic, WAFW00F does the following: Sends a normal HTTP request and analyses the response; this identifies a number of WAF solutions If that is not successful, it...
Coinbase: Cookie not secure
The cloudflare cookie does not have the Secure flag set. When a cookie is set with the Secure flag, it instructs the browser that the cookie can only be accessed over secure SSL channels. This is an important security protection for session cookies...
Cloudflare: Reflected XSS on partners.cloudflare.com
partners.cloudflare.com is vulnerable to reflected XSS because its 404 page reflects the path inside a block without encoding it. This vulnerability could be used to hijack partner accounts. The following URL demonstrates this vulnerability - if you load it in Edge you'll see an alert screenshot...
HackerOne: Web Authentication Endpoint Credentials Brute-Force Vulnerability
Dear, Your web authentication endpoint, https://hackerone.com/sessions POST, currently protects against credentials brute-force attacks only by requests rate-limiting based on IP. It was found that if an attacker sends login requests faster than every 4 seconds from the same IP address, it would...
WordPress CloudFlare 1.3.20 Cross Site Scripting
Product: CloudFlare Exploit Author: Sachin Wagh Version: 1.3.20 Home page Link: https://wordpress.org/plugins/cloudflare/ ============================================================================ Details: The CloudFlare plugin for WordPress is prone to a multiple cross-site scripting...
CloudFlare <= 1.3.20 - Authenticated Cross-Site Scripting (XSS)
The Cloudflare WordPress plugin was affected by an Authenticated Cross-Site Scripting XSS security vulnerability...
WordPress CloudFlare Plugin <= 1.3.20 - Cross Site Scripting
Because of this vulnerability, the attackers can inject arbitrary JavaScript or HTML code. Solution Update the plugin...
HackerOne: Hogging up all the resources on hackerone.com
Please note. I believe that some of the issues described below can also be used on their own and/or combined in other configurations to achieve different results, e.g. "paying" a bounty of zero or team avoiding to resolve and unpleasant issue. I am however describing the very likely doomsday...
HackerOne: Putting link inside link in markdown
Hello. I was playing around in markdown editor and find 1 interesting feature. You can put a link inside link. ololol l l:http://dwq If you do it ololol will be parsed first, then result of parsing will be send outside. Maximum depth of such link inserting is 16. So the slowest thing we can do is...
Cloudflare: Clickjacking : https://partners.cloudflare.com/
Hey, The title of submission defines the issue very clearly which is clickjacking at https://partners.cloudflare.com/ this subdomain missing x frame headers. As this subdomain contain a partner login then it is dangerous to have this type of issue. You understand better what i mean ; Attached a...
HackerOne: CSRF possible when SOP Bypass/UXSS is available
Description If an attacker could extract content from https://hackerone.com, they could perform CSRF attacks due to the fact that: 1. Some pages prints the token in the HTML response edit user form at https://hackerone.com/settings/profile/edit 2. Tokens aren't bound per action 3. PATCH/DELETE ca...
Algolia: Stored XSS on https://www.algolia.com/realtime-search-demo/*
Description When you generate a UI demo, the values of the Attributes are not escaped when printed in the page of the demo. There is a protection by CloudFlare, but because the values of the Attributes are printed in Javascript code, I found a way to abuse this to execute Javascript code. Seems...
The “Unhackable” WordPress Blog – Finding Security In the Static
Using the word “unhackable” is generally considered a bad ideaTM due to this being a largely unobtainable feat with software. In this post I attempt to get as close to “unhackable” as possible with my own personal blog the one you’re reading right now. I have designed the process in such a way th...
BitTorrent Fixes Reflective DDoS Attack Security Flaw
Two weeks ago, we reported how a serious flaw in the popular peer-to-peer BitTorrent file sharing protocols could be exploited to carry out a devastating distributed denial of service DDoS attack, allowing lone hackers with limited resources to take down large websites. Good news is that the...
CloudFlare Transparency Report Shows Spike in Court Orders
In its latest transparency report, CloudFlare says that the number of subpoenas it has received has remained steady since last year, but the volume of court orders has more than doubled since the second half of last year. While much of the data from CloudFlare’s report for the first half of 2015...
IIS the latest high-risk Vulnerability, CVE-2 0 1 5-1 6 3 5, AND MS15-0 3 4. THE POC and online detection of source-vulnerability warning-the black bar safety net
! HTTP. sys remote code execution vulnerability, CVE-2 0 1 5-1 6 3 5, AND MS15-0 3 4. the A remote code execution vulnerability exists in the HTTP Protocol stack HTTP.sys, when the HTTP.sys not correct parsing specially crafted HTTP request to cause this vulnerability. Successful exploitation of...
CloudFlare Deploys ChaCha20-Poly1305 Encryption Across Sites
After rolling out free SSL for its users last fall, CloudFlare has deployed a new level of encryption on its service that hardens and speeds up the user experience, especially when accessing domains via mobile browsers. The form of encryption, a relatively new transport layer cipher suite known a...
The Pirate Bay relaunch is FBI's Honeypot? Pirate Bay Team Responds,'NO WAY'
After almost two months of untimely and unexpected outage, The Pirate Bay TPB finally came back this weekend. But the re-launch of the infamous torrent-indexing website raised a question among those suspicious about this new setup — Is it really The Pirate Bay? A few days back we reported that Th...
CloudFlare Rolls Out Free SSL
In a move that will essentially double the number of SSL-protected sites on the Web in the space of 24 hours, CloudFlare on Monday said that it was enabling SSL for all of its more than two million customers for free. The new service is called Universal SSL, and the company is making it available...
Cloudflare: Apache mod_negotiation filename bruteforcing
Vulnerability description modnegotiation is an Apache module responsible for selecting the document that best matches the clients capabilities, from one of several available documents. If the client provides an invalid Accept header, the server will respond with a 406 Not Acceptable error...