Faraday v3.5 - Collaborative Penetration Test and Vulnerability Management Platform

Here’s the main new features and improvements in Faraday v3.5: New vulnerability form We are happy to introduce our new vulnerability form which makes the creation and editing of vulnerabilities easier. The new form brings you tabs to make it smaller and group different fields. Custom fields Add...

Yet Another Bypass: Is 2FA Broken? Authentication Experts Weigh In

A penetration testing tool published by Polish security researcher Piotr Duszyński can bypass login protections for accounts protected by two-factor authentication 2FA. In his write-up on the tool, which is dubbed Modlishka, meaning “mantis” in English, he asked, “is 2FA broken?” It’s a question...

WordPress Two Factor Authentication plugin <= 1.3.12 - Cross-Site Request Forgery (CSRF) vulnerability

Cross-Site Request Forgery CSRF vulnerability found by Martijn Korse in WordPress Two Factor Authentication plugin versions = 1.3.12. Solution Update the WordPress Two Factor Authentication plugin to the latest available version at least 1.3.13...

"Cannot complete request" when logging on via NetScaler using dual factor authentication and SSON to StoreFront Server 3.14

After configuring a remote portal with StoreFront servers load balanced with NetScaler, a user authenticates and they get the error "Cannot complete your request". From the event Viewer logs of the StoreFront SF server: "An error occurred while using SSL configuration for endpoint 0.0.0.443. The...

CFP Time: Missing Two Factor Authentication in /admin/login

Hello Team, First of all this report is just mainly concern for Suggested security improvements based on your policy page. If and only if not mean possible, please do let me know. Thanks! INTRODUCTION Administrative panel is one of the main entry point for the website owner to manage their web ap...

3 Infosec Reflections to Kick off 2019 & Finally Shift the Balance of Power Back to Defenders

Wow. It's already 2019. Talk about a year in 2018 that flew by! I won’t spend this entire blog talking about 2018 but, needless to say, a lot happened in 2018 and it doesn’t look to slow down anytime soon. This time of year, I like to stop and reflect on the previous year and think about moving...

Hijacking Online Accounts Via Hacked Voicemail Systems

LEIPZIG, GERMANY – Voicemail systems are vulnerable to compromise via brute-force attacks against the four-digit personal identification numbers PINs that protect them. Researchers say a malicious user can thus access the voicemail system to then take over online accounts for services like...

X (Formerly Twitter): Ability to perform actions (Tweet, Retweet, DM) and other actions, unauthenticated, on any account with SMS enabled.

Summary: By knowing the mobile phone number associated with a Twitter account, or by using random mobile phone numbers! It is possible to perform the following actions against a target without their knowledge or interaction. With no account takeover scenario. It's a case of, if I know the mobile...

Phishing Campaign Toolkit: King Phisher

King Phisher is a tool for testing and promoting user awareness by simulating real world phishing attacks. It features an easy to use, yet very flexible architecture allowing full control over both emails and server content. King Phisher can be used to run campaigns ranging from simple awareness...

CVE-2018-20231

Cross Site Request Forgery CSRF in the two-factor-authentication plugin before 1.3.13 for WordPress allows remote attackers to disable 2FA via the tfaenabletfa parameter due to missing nonce validation...

CVE-2018-20231

CVE-2018-20231 affects the WordPress Two Factor Authentication plugin (pre-1.3.13). The vulnerability is a CSRF flaw that allows remote attackers to disable 2FA by triggering tfa_enable_tfa due to missing nonce validation. Impact is partial to high: it can disable two-factor protection, leaving a...

libpng: Integer overflow and resultant divide-by-zero in pngrutil.c:png_check_chunk_length() allows for denial of service

In libpng 1.6.34, a wrong calculation of rowfactor in the pngcheckchunklength function pngrutil.c may trigger an integer overflow and resultant divide-by-zero while processing a crafted PNG file, leading to a denial of service...

Two Factor Authentication <= 1.3.12 - Disable Two Factor Authentication CSRF

According to the changelog: "Fix a logged-in CSRF vulnerability reported by Martijn Korse www.bitnesswise.com. Due to a missing nonce check, if an attacker was able to persuade a personally-targetted victim who was currently logged in to their WordPress account to visit a personally-crafted for t...

Step 2. Manage authentication and safeguard access: top 10 actions to secure your environment

This series outlines the most fundamental steps you can take with your investment in Microsoft 365 security solutions. We will provide advice on activities such as setting up identity management through active directory, malware protection, and more. In this post, we explain how to enable single...

Real-Time Attacks Against Two-Factor Authentication

Attackers are targeting two-factor authentication systems: Attackers working on behalf of the Iranian government collected detailed information on targets and used that knowledge to write spear-phishing emails that were tailored to the targets' level of operational security, researchers with...

FreeBSD : phpMyAdmin -- multiple vulnerabilities (ed10ed3f-fddc-11e8-94cf-6805ca0b3d42)

The phpMyAdmin development team reports : Summary Local file inclusion through transformation feature Description A flaw has been found where an attacker can exploit phpMyAdmin to leak the contents of a local file. The attacker must have access to the phpMyAdmin Configuration Storage tables,...

Certificate Based Authentication on Gateway Insight

With Client Authentication enabled on an SSL virtual server, the NetScaler appliance asks for the Client Certificate during the SSL handshake. The appliance checks the certificate presented by the client for normal constraints, such as the issuer signature and expiration date. Here are some use...

Linux.org Redirected to NSFW Page Spewing Racial Epithets

The Linux organization said late Friday that its main domain, Linux.org, was hacked and defaced in a DNS hijacking incident. The group said that someone was able to compromise the registrar account for the domain and point its DNS to another server — as well as lock administrators out from changi...

phpMyAdmin -- multiple vulnerabilities

The phpMyAdmin development team reports: Summary Local file inclusion through transformation feature Description A flaw has been found where an attacker can exploit phpMyAdmin to leak the contents of a local file. The attacker must have access to the phpMyAdmin Configuration Storage tables,...

Defending Credentials From Automated Attack Tools

By Danny Wasserman The folks on the Akamai Professional Services team are the people who help implement, configure, and tune the cloud security products that protect our customers' web applications from the daily onslaught of bots blasting login attempts against their websites, mobile apps, and...