Kerio MailServer 5.6.3 - Remote Buffer Overflow

/ Remote Buffer Overflow Exploit for Kerio MailServer 5.6.3 / / ========================================= / / By B-r00t / / / / In response to the Kerio Mailserver vulnerabilities / / discovered by David F.Madrid. / / / / Although this exploit requires valid authentication / / details, it is...

Kerio MailServer 5.6.3 - Remote Buffer Overflow

Kerio MailServer 5.6.3 - Remote Buffer Overflow / Remote Buffer Overflow Exploit for Kerio MailServer 5.6.3 / / ========================================= / / By B-r00t / / / / In response to the Kerio Mailserver vulnerabilities / / discovered by David F.Madrid. / / / / Although this exploit...

kerio563.txt

/ Remote Buffer Overflow Exploit for Kerio MailServer 5.6.3 / / ========================================================= / / By B-r00t ok rcpt to: [email protected] 550 5.1.1 Mailbox does not exist rcpt to:[email protected] 250 2.1.5 Recipient ok local ok local user fred seems to...

KunaniFTP-Server v.1.0.10 allows dictionary traversal

KunaniFTP-Server v.1.0.10 allows dictionary traversal: Some ftp-commands in KunaniFTP-Server allows dictionary traversal. Example: Verbindung mit server. 220 Kunani FTP Server Ready www.kunani.com Benutzer server:none: anonymous 331 Password required for anonymous. Kennwort: billsucks 230 User...

Remote Desktop Protocol Service Detection

The Remote Desktop Protocol allows a user to remotely obtain a graphical login and therefore act as a local user on the remote host. If an attacker gains a valid login and password, this service could be used to gain further access on the remote host. An attacker may also use this service to moun...

X Display Manager Control Protocol (XDMCP) Detection

The X Display Manager Control Protocol XDMCP service allows a Unix user to remotely obtain a graphical X11 login and therefore act as a local user on the remote host. If an attacker can gain a valid login and password, this service could be used to gain further access on the remote host. An...

Syskey reuses keystream

Overview Versions of SYSKEY in use prior to December, 1999 leave the SAM database vulnerable to cryptanalytic attacks. Description SYSKEY is a utility introduced in Microsoft Windows NT 4.0 service pack 3 to provide strong cryptographic protection to the SAM password database. The protection SYSK...

CVE-1999-1073

Excite for Web Servers EWS 1.1 records the first two characters of a plaintext password in the beginning of the encrypted password, which makes it easier for an attacker to guess passwords via a brute force or dictionary attack...

CVE-2001-0461

template.cgi in Free On-Line Dictionary of Computing FOLDOC allows remote attackers to read files and execute commands via shell metacharacters in the argument to template.cgi...

Dallas Semiconductor iButton DS1991 vulnerable to dictionary attack

Overview The Dallas Semiconductor iButton DS1991 is vulnerable to a dictionary attack, allowing an intruder to recover passwords. Description The Dallas Semiconductor iButton DS1911 stores 1 kilobyte of data in 3 separate password-protected areas. It includes functionality intended to prevent...

ssh-brute.sh

!/usr/bin/expect -f simple expect exploit to brute force root's password via ssh without detection.. see CLABS200101 for info on this exploit. this is beerware, just buy me a beer at defcon if you like this. build your own dictionary, use at your own risk, no warranty, etc. [email protected]...

CVE-2001-1436

Dallas Semiconductor iButton DS1991 returns predictable values when given an incorrect password, which makes it easier for users with physical access to conduct dictionary attacks against the device password...

Check Point Software Firewall-1 3.0/1 4.0/1 4.1 - Session Agent Dictionary Attack (2)

source: https://www.securityfocus.com/bid/1662/info A vulnerability exists in all versions of the Check Point Session Agent, part of Firewall-1. Session Agent works in such a way that the firewall will establish a connection back to the client machine. Upon doing so, it will prompt for a username...

Firewall-1 session agent 3.0 -> 4.1, dictionnary and brute force attack

hi, every session agents from 3.0 to 4.1 4.1 included, all plateforms are vulnerables to a brute force and dictionnary style password attack. while authenticating a user through his port 261, firewall modules send a "331 User:" string to the agent, wait for an answer, and then reply with a "220...

Check Point Software Firewall-1 3.01 4.01 4.1 - Session Agent Dictionary Attack (1)

Check Point Software Firewall-1 3.01 4.01 4.1 - Session Agent Dictionary Attack 1 source: https://www.securityfocus.com/bid/1662/info A vulnerability exists in all versions of the Check Point Session Agent, part of Firewall-1. Session Agent works in such a way that the firewall will establish a...

Уязвимость в Lotus Notes

Алгоритм хэширования паролей пользователя очень слабый - один и тот же пароль всегда дает одинаковый результат, при этом хэши паролей хранятся в файле открытом на чтение, что позволяет атаки по словарю или грубой силы...

pptp.revisited.txt

Date: Sat, 13 Feb 1999 11:28:40 -0800 From: [email protected] To: [email protected] Subject: PPTP Revisited The following text is in the "iso-8859-1" character set. Your display is set for the "US-ASCII" character set. Some characters may be displayed incorrectly. Lots of people have aske...

Microsoft IIS 5.0 - User Existence Disclosure (1)

Microsoft IIS 5.0 - User Existence Disclosure 1 source: https://www.securityfocus.com/bid/7492/info Microsoft IIS is prone to an issue where the existence of users may be revealed to remote attackers. The vulnerability exists when users attempt to authenticate against a vulnerable system. IIS wil...

Microsoft IIS 5.0 - User Existence Disclosure (2)

Microsoft IIS 5.0 - User Existence Disclosure 2 source: https://www.securityfocus.com/bid/7492/info Microsoft IIS is prone to an issue where the existence of users may be revealed to remote attackers. The vulnerability exists when users attempt to authenticate against a vulnerable system. IIS wil...

CVE-1999-1073

Excite for Web Servers EWS 1.1 records the first two characters of a plaintext password in the beginning of the encrypted password, which makes it easier for an attacker to guess passwords via a brute force or dictionary attack...