752 matches found
U.S. Govt. Makes it Harder to Get .Gov Domains
The federal agency in charge of issuing .gov domain names is enacting new requirements for validating the identity of people requesting them. The additional measures come less than four months after KrebsOnSecurity published research suggesting it was relatively easy for just about anyone to get...
Explained: the strengths and weaknesses of the Zero Trust model
In a US court of law, the accused are deemed to be innocent until proven guilty. In a Zero Trust security model, the opposite is true. Everything and everyone must be considered suspect—questioned, investigated, and cross-checked—until we can be absolutely sure it is safe to be allowed. Zero Trus...
GHSA-2R3V-Q9X3-7G46 Link injection in SimpleSAMLphp
Background Several scripts part of SimpleSAMLphp display a web page with links obtained from the request parameters. This allows us to enhance usability, as the users are presented with links they can follow after completing a certain action, like logging out. Description The following scripts we...
Link injection in SimpleSAMLphp
Background Several scripts part of SimpleSAMLphp display a web page with links obtained from the request parameters. This allows us to enhance usability, as the users are presented with links they can follow after completing a certain action, like logging out. Description The following scripts we...
john-anthony.com Improper Access Control vulnerability
Open Bug Bounty ID: OBB-1037897 Following coordinated and responsible vulnerability disclosure guidelines of the ISO 29147 standard, Open Bug Bounty has:       a. verified the vulnerability and confirmed its existence;       b. notified the website...
john-west.ie Cross Site Scripting vulnerability
Security Researcher g0bl1nsec Helped patch 3712 vulnerabilities Received 4 Coordinated Disclosure badges Received 3 recommendations , a holder of 4 badges for responsible and coordinated disclosure, found a security vulnerability affecting john-west.ie website and its users. Following coordinated...
Exploit for OS Command Injection in Webmin
Make-and-Break Create and exploit a vulnerable Virtual Mac...
National Security Is in Trump's Hands
With the departure of John Bolton from the White House this week, even the former national security advisor’s biggest critics are worried...
John Ratcliffe Is a Dangerous Pick for Director of National Intelligence
The director of national intelligence's main job is to speak truth to power. Trump's nominee, John Ratcliffe, seems destined to do the opposite...
John Paul Stevens Was a Cryptographer
I didn't know that Supreme Court Justice John Paul Stevens "was also a cryptographer for the Navy during World War II." He was a proponent of individual privacy...
Password Cracker: Windows
This module uses John the Ripper or Hashcat to identify weak passwords that have been acquired from Windows systems. LANMAN is format 3000 in hashcat. NTLM is format 1000 in hashcat. MSCASH is format 1100 in hashcat. MSCASH2 is format 2100 in hashcat. NetNTLM is format 5500 in hashcat. NetNTLMv2 ...
Password Cracker: Databases
This module uses John the Ripper or Hashcat to identify weak passwords that have been acquired from the mssqlhashdump, mysqlhashdump, postgreshashdump, or oraclehashdump modules. Passwords that have been successfully cracked are then saved as proper credentials. Due to the complexity of some of t...
Password Cracker: AIX
This module uses John the Ripper or Hashcat to identify weak passwords that have been acquired from passwd files on AIX systems. These utilize DES hashing. DES is format 1500 in Hashcat. This module requires Metasploit: https://metasploit.com/download Current source:...
Password Cracker: Linux
This module uses John the Ripper or Hashcat to identify weak passwords that have been acquired from unshadowed passwd files from Unix/Linux systems. The module will only crack MD5, BSDi and DES implementations by default. However, it can also crack Blowfish and SHA256/512, but it is much slower...
Password Cracker: Webapps
This module uses John the Ripper or Hashcat to identify weak passwords that have been acquired from various web applications. Atlassian uses PBKDF2-HMAC-SHA1 which is 12001 in hashcat. PHPass uses phpass which is 400 in hashcat. Mediawiki is MD5 based and is 3711 in hashcat. Apache Superset, some...
WordPress WP Live Chat Support plugin <= 8.0.26 - Unauthenticated Stored Cross-Site Scripting (XSS) vulnerability
Unauthenticated Stored Cross-Site Scripting XSS vulnerability found by John Castro Sucuri in WordPress WP Live Chat Support plugin versions = 8.0.26. Solution 21 May 2019 - This plugin has been closed for new installations...
U.S. Charges Chinese Hacker For 2015 Anthem Data Breach
The United States Justice Department today announced charges against a Chinese hacker and his hacking team member for their alleged role in the 2015 massive data breach at health insurance giant Anthem and three other unnamed American companies. Fujie Wang 王 福 杰 and another hacker named John Doe...
Canadian Police Raid ‘Orcus RAT’ Author
Canadian police last week raided the residence of a Toronto software developer behind “Orcus RAT,” a product that’s been marketed on underground forums and used in countless malware attacks since its creation in 2015. Its author maintains Orcus is a legitimate Remote Administration Tool that is...
Ruby On Rails File Content Disclosure ('doubletap')
This module uses a path traversal vulnerability in Ruby on Rails versions = "Ruby On Rails File Content Disclosure 'doubletap'", 'Description' = %q This module uses a path traversal vulnerability in Ruby on Rails versions = 'Carter Brainerd ', Metasploit module 'John Hawthorn ' PoC/discovery ,...