FBI Warns Public Officials of Doxing Threat

The FBI has put law enforcement and high-profile public officials on notice that they could be targeted by hacktivists following the recent doxing of CIA director John Brennan by the hacktivism collective called Crackas With Attitude. Brennan’s AOL email account was taken over by a teen associate...

Volatile Memory Extraction: The Volatility Framework

The Volatility Framework is a completely open collection of tools, implemented in Python under the GNU General Public License, for the extraction of digital artifacts from volatile memory RAM samples. The extraction techniques are performed completely independent of the system being investigated...

Chinese Mobile Ad Library Backdoored to Spy on iOS Devices

Versions of a popular Chinese mobile ad library have been backdoored with capabilities that can be used to surreptitiously record audio and steal data stored on thousands of iOS devices. Researchers at FireEye said today they have found 17 backdoored versions of the mobiSage SDK versions 5.3.3 to...

Snapchat: Password Reset - query param overrides postdata

Suppose a user were to reset their password at the following url with the given query parameters: https://accounts.snapchat.com/accounts/changepassword? newpassword=someNewPass&newpassword2=someNewPass Then regardless of the new password entered into the form, someNewPass becomes the user's new...

X (Formerly Twitter): Following a User Actually Follows Another User

I can display a web intent page to a victim that appears to prompt them to follow one user, but actually ends up following a completely different user when they click "follow". The following is a proof of concept:...

ROOT tools to exploit open“doors”-the vulnerability warning-the black bar safety net

Even when all information is disclosed, the Android Root Application Developer or the presence of the unknown side. ROOT for exploit the open door The latest study found that by promoting strong Root to use the program, one of the few application distributors are millions of Android user is place...

Social Engineering — Free Online Training for Hackers

For most of us Hacking is Technological in Nature. But, we usually forget the most important element of hacking that makes a successful hack from 10% to over 90%... ...The Human Element. And here the Social Engineering comes in. Social Engineering deals with non-technical kind of intrusion and...

High school Student Hacked Into CIA Director's Personal Email Account

A self-described teenage hacker has claimed to have hacked into personal AOL email account of Central Intelligence Agency CIA Director John Brennan and swiped sensitive top-secret data. It's Really a major embarrassment for Brennan as well as the CIA. The hacker, who describes himself as an...

Important: Red Hat Security Advisory: Red Hat JBoss Enterprise Application Platform 6.4.4 update

Updated packages that provide Red Hat JBoss Enterprise Application Platform 6.4.4 and fix three security issues, several bugs, and add various enhancements are now available for Red Hat Enterprise Linux 5. Red Hat Product Security has rated this update as having Important security impact. Common...

Announcing BlueHat v15 Conference

We are happy to announce the 15th version of the Microsoft BlueHat Security Conference set for January 12-13, 2016. The annual security conference brings internal and external speakers to educate and engage Microsoft’s engineering community and their executives. Work is under way currently to set...

EMC SourceOne Email Supervisor Hard-Coded Password Vulnerability

EMC SourceOne Email Supervisor is an email and IM content monitoring and management solution. EMC SourceOne Email Supervisor suffers from a reverse engineering vulnerability in its implementation. An attacker could exploit this vulnerability to take control of an affected system via a hard-coded...

SpeedPhishing Framework: SPF

This presentation will start by quickly exploring some of the common phishing attack tools and techniques. During the presentation, audience participation will be encouraged in the form of providing examples and personal experience in what phishing techniques people have used and what would be...

Palo Alto Networks Panorama PAN-OS < 6.0.1 Firmware Signature Verification Bypass Arbitrary Code Execution

The remote Panorama appliance is running a version of Palo Alto Networks PAN-OS prior to 6.0.1. It is, therefore, affected by a firmware signature bypass vulnerability due to a flaw in signature verification process that allows an attacker to execute arbitrary Python code within an image file...

Aw, Snap! This 16-Character String Can Crash Your Google Chrome

Remember when it took only 13 characters to crash Chrome browser instantly? This time, it takes 16-character simple URL string of text to crash Google Chrome instantly. Yes, you can crash the latest version of Chrome browser with just a simple tiny URL. To do this, all you need to do is follow on...

src.ac.uk XSS vulnerability

Vulnerable URL: http://www.src.ac.uk/student-life/134-courses/part-time-courses/engineering-skills/641-recreational-welding? Details: Description| Value ---|--- Patched:| Yes, at 30.01.2016 Latest check for patch:| 30.01.2016 22:42 GMT Vulnerability type:| XSS Vulnerability status:| Publicly...

DARPA Protecting Software From Reverse Engineering Through Obfuscation

Researchers with a DARPA-led team are looking into new ways to combat reverse engineering by using obfuscation to tidy up shoddy commercial and government security. Researchers with the unit, dubbed the SafeWare program, are hoping to develop new methods, bolstered by encryption, to obscure...

PageAdmin v3.0 /e/database/v3.mdb 数据库泄漏

PageAdmin CMS V3.0版，默认数据库地址“/e/database/v3.mdb“，默认后台地址：“/e/master/login.aspx”，由于数据库地址未做限制，导致可以下载。通过逆向管理员MD5加密算法获得md5密文，并通过md5密文可以破解管理员密码。发现非常规MD5加密，于是使用ILSPY逆向源代码，查看加密方式public string GetMd5string s MD5 mD = new MD5CryptoServiceProvider; Encoding encoding = Encoding.GetEncoding"UTF-8"; string s2 =...

Open Automation Software OPC Systems NET DLL Hijacking Vulnerability

OVERVIEW Ivan Sanchez from Nullcode Team has identified a DLL Hijacking vulnerability in Open Automation Software’s OPC Systems.NET application. Open Automation Software has reviewed the vulnerability and determined not to patch the issue at this time. This vulnerability could be exploited remote...

DLA-304-1 openslp-dfsg - security update

Bulletin has no description...

FBI Warns Businesses of Email Scams, Wire Fraud

U.S. businesses are losing millions in fraudulent wire transfers that have their root in email compromises of accounts belonging to top executives. An FBI advisory issued Thursday warns businesses that regularly conduct wire transfer payments to be vigilant about potential email account...