55,000 Hacked Sites Serving Malware Cocktail

Security researchers are raising an alarm for a potent malware cocktail — backdoor Trojans and password stealers — being pushed to Windows users from about 55,000 hacked Web sites. According to Mary Landesman, a researcher in ScanSafe’s security threat alert team, the cybercriminals have embedded...

Unfixed XSS vulnerability at www.adalarweb.com

Security researcher Dark.Man, has submitted on 15/08/2009 a cross-site-scripting XSS vulnerability affecting www.adalarweb.com, which at the time of submission ranked 23185032 on the web according to Alexa. We manually validated and published a mirror of this vulnerability on 07/09/2009. It is...

URL Shortening Service Hacked

From Computerworld Gregg Keizer A URL-shortening service that condenses long Web addresses for use on micro-blogging sites like Twitter was hacked over the weekend, sending millions of users to an unintended destination, a security researcher said today. Read the full story cio.com Also see...

Most attacks come from legit but hijacked sites

From TechWorld John E. Dunn The number of legitimate Websites being hacked to host malware has hit startling highs in recent days, new figures from MessageLabs have revealed. Data taken from the days between May 4 and 8 showed that 84.6 percent of Websites blocked by the company for hosting...

Exploiting Skype: Building a telephone botnet

From the Industry Standard Robert McMillan Flaws in popular Internet-based telephony systems could be exploited to create a network of hacked phone accounts, somewhat like the botnets that have been wreaking havoc with PCs for the past few years. Researchers at Secure Science recently discovered...

iTunes gift card hack could be work of carders

Research by Joe Stewart, SecureWorks In response to published reports outdustry.com about a hacking attack appletell.com against the iTunes gift card system, security researcher Joe Stewart has gone digging for answers and comes up with an eyebrow-raising theory. Stewart believes this is the work...

76% of phishing sites hosted on hacked servers

ZDNet’s Dancho Danchev is pointing to a new research paper .pdf that shows that 75.8% of the phishing sites analyzed 2486 sites were hosted on compromised web servers to which the phishers obtained access through Google hacking techniques search engine reconnaissance. Dancho writes: The research...

Unfixed XSS vulnerability at www.navioo.com

Security researcher 599eme Team, has submitted on 22/02/2009 a cross-site-scripting XSS vulnerability affecting www.navioo.com, which at the time of submission ranked 113414 on the web according to Alexa. We manually validated and published a mirror of this vulnerability on 12/07/2009. It is...

Unfixed XSS vulnerability at www.modelucak.com

Security researcher Hacked By Alpagut, has submitted on 02/01/2009 a cross-site-scripting XSS vulnerability affecting www.modelucak.com, which at the time of submission ranked 9206227 on the web according to Alexa. We manually validated and published a mirror of this vulnerability on 16/12/2011. ...

Linux/x86 - mkdir(hacked) + exit() Shellcode (36 bytes)

Linux/x86 - mkdirhacked + exit Shellcode 36 bytes. Shellcode exploit for Linuxx86 platform The comment in that file is not correct.. I cut and pasted the shell code in an existing c source and forgot to adjust it.. / This shellcode will do a mkdir of 'hacked' and then an exit Written by...

phpg 1.6 - Cross-Site Scripting Full Path Disclosure Denial of Service

phpg 1.6 - Cross-Site Scripting Full Path Disclosure Denial of Service PHPg 1.6 has a few XSSes, path disclosures, and a DoS vulnerability. Home: http://black-dwarf.com HS: http://www.hotscripts.com/Detailed/86225.html Found by: Anarchy Angel - http://hha.zapto.org Temp XSS:...

Security Best Practice: Protect Yourself from VoIP Denial of Service Vulnerabilities

VoIP opens voice communications to the same kinds of security threats that imperil data communications. Attacks on data communications can come through the IP voice infrastructure and vice versa. Denial of service attacks targeting weak VoIP elements could flood the network with voice traffic,...

AuraCMS <= 2.2.2 (pages_data.php) Arbitrary Edit/Add/Delete Exploit

No description provided by source. !/usr/bin/perl k1tk4t Public Security Advisory //////////////////////////////////////////////////////////// AuraCMS = 2.2.2 pagesdata.php Arbitrary Edit/Add/Delete data halaman exploit Vendor : http://www.auracms.org/ Kutu : ./js/pages/pagesdata.php Keterangan :...

AuraCMS 2.2.2 - '/pages_data.php' Arbitrary Edit/Add/Delete

!/usr/bin/perl k1tk4t Public Security Advisory //////////////////////////////////////////////////////////// AuraCMS = 2.2.2 pagesdata.php Arbitrary Edit/Add/Delete data halaman exploit Vendor : http://www.auracms.org/ Kutu : ./js/pages/pagesdata.php Keterangan : pada berkas pagesdata.php dari awa...

Unfixed XSS vulnerability at www.tbv.org.tr

Security researcher lejoner, has submitted on 15/06/2008 a cross-site-scripting XSS vulnerability affecting www.tbv.org.tr, which at the time of submission ranked 1703377 on the web according to Alexa. We manually validated and published a mirror of this vulnerability on 15/06/2008. It is current...

Dropbear SSH <= 0.34 Remote Root Exploit

No description provided by source. / Linux x86 Dropbear SSH = 0.34 remote root exploit coded by live You'll need a hacked ssh client to try this out. I included a patch to openssh-3.6.p1 somewhere below this comment. The point is: the buffer being exploited is too small25 bytes to hold our...

Unfixed XSS vulnerability at www.roac.nl

Security researcher HACKED BYJAPAN, has submitted on 26/05/2008 a cross-site-scripting XSS vulnerability affecting www.roac.nl, which at the time of submission ranked 565438 on the web according to Alexa. We manually validated and published a mirror of this vulnerability on 06/06/2008. It is...

Unfixed XSS vulnerability at www.hala-wersonst.de

Security researcher TurKPoweR, has submitted on 22/05/2008 a cross-site-scripting XSS vulnerability affecting www.hala-wersonst.de, which at the time of submission ranked 0 on the web according to Alexa. We manually validated and published a mirror of this vulnerability on 08/06/2008. It is...

Unfixed XSS vulnerability at www.bad-hersfeld.de

Security researcher TurKPoweR, has submitted on 17/05/2008 a cross-site-scripting XSS vulnerability affecting www.bad-hersfeld.de, which at the time of submission ranked 1548240 on the web according to Alexa. We manually validated and published a mirror of this vulnerability on 10/11/2008. It is...

Unfixed XSS vulnerability at www.karadenizgundem.com

Security researcher TurKPoweR, has submitted on 17/05/2008 a cross-site-scripting XSS vulnerability affecting www.karadenizgundem.com, which at the time of submission ranked 900103 on the web according to Alexa. We manually validated and published a mirror of this vulnerability on 07/06/2008. It ...