1001 matches found
WiFi-Pumpkin v0.8.5 - Framework for Rogue Wi-Fi Access Point Attack
WiFi-Pumpkin is a very complete framework for auditing Wi-Fi security. The main feature is the ability to create a fake AP and make Man In The Middle attack, but the list of features is quite broad. Installation Python 2.7 git clone https://github.com/P0cL4bs/WiFi-Pumpkin.git cd WiFi-Pumpkin...
Weblate: Incorrect HTTPS Certificate
Weblate appears to have a public facing git repository located at git.weblate.org that utilises HTTPS when viewed in the browser. As a side note, netcat to port 80 results in the default debian landing page. 77.78.107.252 - git.weblate.org The site has an incorrectly configured certificate, and...
EAPHammer - Targeted Evil Twin Attacks Against WPA2-Enterprise Networks [Indirect Wireless Pivots Using Hostile Portal Attacks]
EAPHammer is a toolkit for performing targeted evil twin attacks against WPA2-Enterprise networks. It is designed to be used in full scope wireless assessments and red team engagements. As such, focus is placed on providing an easy-to-use interface that can be leveraged to execute powerful wirele...
Uber: duplicate hsts headers lead to firefox ignoring hsts on business.uber.com
It was possible for an attacker to temporarily downgrade a chosen victim from a secure HTTPS connection to HTTP in Firefox. The impact of this issue was low due to the very small window that it provided to actually take advantage of the downgrade, and the fact that it required getting a user to...
SSLsplit - transparent SSL/TLS interception
SSLsplit is a tool for man-in-the-middle attacks against SSL/TLS encrypted network connections. It is intended to be useful for network forensics, application security analysis and penetration testing. SSLsplit is designed to transparently terminate connections that are redirected to it using a...
Universal MITM Web Server: CopyCat
Universal MITM Web Server CopyCat is a Node.js based universal MITM web server. Used with DNS spoofing or another redirect attack, this server will act as a MITM for web traffic between the victim and a real server. Most often we see DNS spoofing used to redirect victims to an attackers server...
Facebook, Researcher at Odds Over Messenger Issue
Facebook is dismissing claims by a researcher who says multimedia content such as audio-based messages sent via its Facebook Messenger service can be intercepted by a third-party under certain conditions. On Tuesday, Mohamed Baset, a security analyst at ecommerce firm Linio México, published a...
http-hsts-verify NSE Script
Verify that HTTP Strict Transport Security is enabled. HTTP Strict-Transport-Security HSTS RFC 6797 forces a web browser to communicate with a web server over HTTPS. This script examines HTTP Response Headers to determine whether HSTS is configured. References:...
IBM BigFix Remote Control Information Disclosure Vulnerability (CNVD-2016-11864)
IBM BigFix Remote Control is a set of remote control systems from IBM in the United States. An information disclosure vulnerability exists in IBM BigFix Remote Control 9.1.2 and earlier versions, which stems from the program failing to enable the HSTS protection mechanism. A remote attacker can...
CVE-2016-2952
IBM BigFix Remote Control before 9.1.3 does not enable the HSTS protection mechanism, which makes it easier for remote attackers to obtain sensitive information by leveraging use of HTTP...
CVE-2016-2952
IBM BigFix Remote Control before 9.1.3 does not enable the HSTS protection mechanism, which makes it easier for remote attackers to obtain sensitive information by leveraging use of HTTP...
CVE-2016-2952
IBM BigFix Remote Control before 9.1.3 does not enable the HSTS protection mechanism, which makes it easier for remote attackers to obtain sensitive information by leveraging use of HTTP...
Design/Logic Flaw
IBM BigFix Remote Control before 9.1.3 does not enable the HSTS protection mechanism, which makes it easier for remote attackers to obtain sensitive information by leveraging use of HTTP...
CVE-2016-2952
IBM BigFix Remote Control is affected by CVE-2016-2952. Versions before 9.1.3 do not enable HSTS, enabling information disclosure via HTTP and allowing remote attackers to obtain sensitive data. The CNVD/NVD entries corroborate an information‑disclosure impact due to missing HSTS. Root cause: HST...
CVE-2016-2952
IBM BigFix Remote Control before 9.1.3 does not enable the HSTS protection mechanism, which makes it easier for remote attackers to obtain sensitive information by leveraging use of HTTP...
PoisonTap Steals Cookies, Drops Backdoors From Password Protected Computers
Even locked, password-protected computers are no rival for Samy Kamkar and his seemingly endless parade of gadgets. His latest, PoisonTap, is a $5 Raspberry Pi Zero device running Node.js that’s retrofitted to emulate an Ethernet device over USB. Assuming a victim has left their web browser open,...
Mozilla Firefox Security Advisories (MFSA2016-89, MFSA2016-90) - Mac OS X
Mozilla Firefox is prone to multiple vulnerabilities. SPDX-FileCopyrightText: 2016 Greenbone AG Some text descriptions might be excerpted from a referenced sources, and are Copyright C by the respective right holders. SPDX-License-Identifier: GPL-2.0-only CPE = "cpe:/a:mozilla:firefox";...
tomcat security, bug fix, and enhancement update
0:7.0.69-10 - Related: rhbz1368122 0:7.0.69-9 - Resolves: rhbz1362213 Tomcat: CGI sets environmental variable based on user supplied Proxy request header - Resolves: rhbz1368122 0:7.0.69-7 - Resolves: rhbz1362545 0:7.0.69-6 - Related: rhbz1201409 Added /etc/sysconfig/tomcat to the systemd unit fo...