HBGary's Greg Hoglund: The Art Of RAT Hunting In the Enterprise

Threatpost spent much of the last year chasing after Greg Hoglund, the founder and CEO of HB Gary. First, it was to get his reaction to the bruising encounter his firm had with the hacking group Anonymous. Then it was an endless series of requests on the aftermath of that hack, including the...

SA-CONTRIB-2012-038 - Views Language Switcher Cross Site Scripting (XSS)

CVE: CVE-2012-2064 The Views Language Switcher module enables you to provide natively-formatted links that act as Views exposed filters for i18n content being displayed by Views. The module doesn't sufficiently filter the path output when a user manually modifies the path and makes a new request...

Greg Hoglund

In his presentation on Friday, “Lateral Movement and Other APT Interaction Patterns within the Enterprise,” HBGary CEO Greg Hoglund reviewed a multitude of modern day Advanced Persistent Threats APTs while breaking down the four stages of an attack...

SA-CONTRIB-2012-011 - Panels - Cross Site Scripting (XSS)

CVE: CVE-2012-0914 The Panels module allows a site administrator to create customized layouts for multiple uses. The module doesn't sufficiently sanitize administrator supplied data. This vulnerability is mitigated by the fact that an attacker must have a role with the permission "administer pane...

SA-CONTRIB-2012-010 - stickynote - Multiple vulnerabilities

CVE: CVE-2012-1636 This module enables you to add textual notes in a block to perform quality assurance of your site. Previously it did not sufficiently protect against Cross Site Scripting XSS or Cross Site Request Forgery CSRF. This vulnerability is mitigated by the fact that an attacker must...

SA-CONTRIB-2011-058 - Support Timer - Cross Site Scripting (XSS)

The Support Timer module adds a javascript-based timer to the Support Ticketing System for tracking how long users are working on support tickets, as well as administrative reports. The module does not properly sanitize user-supplied content, resulting in multiple Cross-Site Scripting XSS...

DHS Names Weatherford as Deputy Under Secretary for Cybersecurity

Department of Homeland Security DHS Secretary Janet Napolitano appointed Mark Weatherford today as the National Protection and Programs Directorate’s NPPD new Deputy Under Secretary for Cybersecurity, according to a press release on the DHS’ site. The role was created by the Directorate in...

BlazeVideo HDTV Player 6.6 Professional - Universal ASLR + DEP Bypass

Exploit Title: BlazeVideo HDTV Player 6.6 Professional Universal DEP+ASLR Bypass Author: modpr0be Software Download: http://www.blazevideo.com/download.php?product=blazevideo-hdtv-pro Date: 07/10/2011 Tested on: Windows XP SP3, Windows Vista SP2, Windows 7 SP1 Thanks: corelanc0d3r, cyb3r.anbu,...

SA-CONTRIB-2011-047 - OG Features access bypass

OG Features provides a mechanism for groups to enable or disable certain bundles of functionality, of features, within the groups they administer. The module is able to turn components on and off within given groups by overriding the access callbacks of every menu item, and checking conditions...

SA-CONTRIB-2011-039 - Bot Alarm - Multiple vulnerabilities

This module enables you to set alarms for your IRC bot. The module does not properly escape the message and channels of alarms in pages listing the alarms, leading to a Cross Site Scripting XSS vulnerability. This vulnerability is mitigated by the fact that an attacker must have a role with the...

Linux kernel 2.6.38.6 ( stable) has been released !

Linux kernel 2.6.38.6 stable has been released ! The latest -Stable kernel has been raised again after Greg released a new version : 2.6.38.6. This is a maintenance update, so no new feature are included, only bug fixes and minor changes. Even though Greg urges users to upgrade to this version,...

Anonleaks - HBGary Email Viewer Portal ,71,800 Emails Exposed !

Anonleaks - HBGary Email Viewer Portal,71,800 Emails Exposed ! Inboxes new [email protected] - Greg Hoglund - 27,606 emails torrent [email protected] - Aaron Barr - 16,906 emails torrent [email protected] - Ted Vera - 12,134 emails torrent [email protected] - Phil Wallisch - 15,156 emails torrent...

Exposed : HBGary wanted to suppress Stuxnet research !

It is no secret that in recent days, Anonymous Operatives have released a cache of HBGary Federal internal emails to the public. Crowdleaks has discovered that within these communications, Aaron Barr received a copy of Stuxnet a computer worm that targets the types of industrial control systems I...

Anonymous launches Anonleaks.ru to expose HBGary 27,000 Emails, Data available soon !

Anonymous launches Anonleaks.ru to expose HBGary 50000 Emails, data available soon ! Anonymous plans to release 27,000 emails from the server of Greg Hoglund, chief executive of the software security firm HBGary. It has posted 50,000 emails of Aaron Barr from the CEO of its sister organization, H...

SA-CONTRIB-2010-081 - FileField Sources - Arbitrary Code Execution

The FileField Sources module expands on the abilities of FileField, allowing users to select new or existing files through additional means, including: Reuse of existing files through an autocomplete textfield or IMCE, or transfering files directly from remote servers. The module does not sanitiz...

SA-CONTRIB-2010-047: Services - Access Bypass

The Services module allows users to expose Drupal functionality to remote users. Services provides the ability for developers to define access callbacks in code for exposed services. When using session ID authentication without API key authentication, the module does not properly check access whe...

SA-CONTRIB-2009-092 - S5 Presentation Player Cross Site Scripting

The S5 Presentation Player module enables the creation of an S5 slideshow using content from the site. The module does not properly sanitize user supplied text it includes in the HTML HEAD section, leading to a cross-site scripting XSS vulnerability. Such an attack may lead to a malicious user...

CORE-2009-0922: Jetty Persistent XSS in Sample Cookies Application

-----BEGIN PGP SIGNED MESSAGE----- Hash: SHA1 Core Security Technologies - CoreLabs Advisory http://www.coresecurity.com/corelabs/ Jetty Persistent XSS in Sample Cookies Application 1. Advisory Information Title: Jetty Persistent XSS in Sample Cookies Application Advisory Id: CORE-2009-0922...

pmaPWN phpMyAdmin Code Injection Scanner

?php $list = array '/phpmyadmin/', '/phpMyAdmin/', '/PMA/', '/pma/', '/admin/', '/dbadmin/', '/mysql/', '/myadmin/', '/phpmyadmin2/', '/phpMyAdmin2/', '/phpMyAdmin-2/', '/php-my-admin/', '/phpMyAdmin-2.2.3/', '/phpMyAdmin-2.2.6/', '/phpMyAdmin-2.5.1/', '/phpMyAdmin-2.5.4/',...

SA-CONTRIB-2009-010 Plus 1 - Cross-site request forgery

The Plus 1 module provides a voting widget for content that records votes using Ajax. The URL for voting is vulnerable to cross-site request forgeries CSRF making it possible for users to unknowingly vote for content. Versions affected Versions of Plus 1 prior to 6.x-2.6 Drupal core is not...