Cloudflare Server Detection via HTTP/HTTPS

Binary data 7256.pasl...

HTTP/HTTPS Client Connection to Cloudflare Server

Binary data 9975.prm...

Cloudbleed Triggered 1.2M Times, Damage Kept to Minimum

Having had more than a week to digest Cloudbleed’s causes and impact, Cloudflare CEO Matthew Prince assessed the damage yesterday in a lengthy post-mortem as relatively low. Prince said there is no evidence the vulnerability, which leaked customer data from memory, was exploited by attackers. The...

Authoritative Cloudflare DNS Server Detection

Binary data 9976.prm...

Cloudflare Client Detection via DNS

Binary data 7255.pasl...

Cloudflare Client Detection via HTTP/HTTPS

Binary data 7252.pasl...

Buffer Overflow Vulnerability in CloudFlare Server

CloudFlare is a U.S. content delivery network CDN and network security provider, mainly providing technical support to customer websites related to website security management, performance optimization and other related technical support. CloudFlare serves more than 5.5 million websites worldwide...

Threatpost News Wrap, February 24, 2017

Mike Mimoso and Chris Brook recap RSA and discuss the news of the week including the impact of Cloudflare’s “Cloudbleed” bug, Google breaking SHA-1, and more. Download: ThreatpostNewsWrapFebruary242017.mp3 Music by Chris Gonsalves...

Cloudbleed Bug Leaks Sensitive Cloudflare Customer Data

The Cloudflare content delivery network for months has been leaking customer data, everything from private messages to encryption keys and credentials belonging to users of some of the Internet’s biggest properties. The vulnerability has been addressed, Cloudflare CTO John Graham-Cumming said, bu...

Serious Bug Exposes Sensitive Data From Millions Sites Sitting Behind CloudFlare

A severe security vulnerability has been discovered in the CloudFlare content delivery network that has caused big-name websites to expose private session keys and other sensitive data. CloudFlare, a content delivery network CDN and web security provider that helps optimize safety and performance...

Finding Ticketbleed

Ticketbleed CVE-2016-9244 is a software vulnerability in the TLS stack of certain F5 products that allows a remote attacker to extract up to 31 bytes of uninitialized memory at a time, which can contain any kind of random sensitive information, like in Heartbleed. If you suspect you might be...

Go Time #32 - Hellogopher, whosthere?

I joined Erik St. Martin, Carlisia Pinto and Brian Ketelsen for episode 32 of the Go Time podcast to chat about Hellogopher, whosthere whoami.filippo.io, $GOPATH, TLS 1.3, Cloudflare's secret reverse proxy, and more. Go Time 32 — Hellogopher, whosthere? with Filippo Valsorda hellogopher — "just...

WordPress 4.7.0 / 4.7.1 REST API Privilege Escalation Exploit

WordPress versions 4.7.0 and 4.7.1 REST API post privilege escalation and defacement exploit. !/usr/bin/env python ''' WordPress 4.7.0-4.7.1 REST API Post privilege escalation / defacement exploit @dustyfresh Date: 02-01-2017 Original vuln disclosed by Sucuri's research team Reference:...

WordPress 4.7.0 / 4.7.1 REST API Privilege Escalation

!/usr/bin/env python ''' WordPress 4.7.0-4.7.1 REST API Post privilege escalation / defacement exploit @dustyfresh Date: 02-01-2017 Original vuln disclosed by Sucuri's research team Reference: https://blog.sucuri.net/2017/02/content-injection-vulnerability-wordpress-rest-api.html...

Cisco Patches Critical Flaw in WebEx Chrome Plugin

A vulnerability in the Cisco WebEx Chrome Plugin, used by tens of millions for web conferencing in business environments, exposed computers to remote code execution. Cisco has begun releasing updates that patch the flaw, details of which were disclosed Monday by Google Project Zero researcher Tav...

Cloudflare Shares National Security Letter It Received in 2013

Thanks to the lifting of a gag order, on Tuesday security firm Cloudflare was finally able to post a National Security Letter it received from the Federal Bureau of Investigation back in 2013. Cloudflare’s counsel Kenneth R. Carter acknowledged the lifting of the order and said the letter is part...

So you want to expose Go on the Internet

I was asked to contribute a post to the excellent Gopher Academy advent series. I took the occasion to write down what I learned deploying a Go service on the Cloudflare edge. The result is a catalogue of what you need to know before you drop NGINX from in front of your Go server. The net/http pa...

Cloudflare: [http2.cloudflare.com] Open Redirect

PoC https://http2.cloudflare.com/%5cblackfan.ru HTTP Response http HTTP/1.1 301 Moved Permanently ... location: /\blackfan.ru/...

Half of Chrome Pageloads are HTTPS

First it was Mozilla, and now Google is the latest to confirm that encryption is inching closer toward becoming a standard building block for websites and web applications. Google reported yesterday that more than half of pages loaded on desktop versions of the Chrome browser are being done so ov...

Mozilla Turning TLS 1.3 On By Default With Firefox 52

When Mozilla ships Firefox 52, on or around March 7, 2017, the browser will come with the cryptographic protocol TLS 1.3 on by default. Martin Thomson, a principle engineer at Mozilla broke the news Wednesday in an email to Mozilla Development Platform members. “TLS 1.3 removes old and unsafe...