Microsoft Yammer - Bypass & Persistent Vulnerabilities

Document Title: =============== Microsoft Yammer - Bypass & Persistent Vulnerabilities References: =========== http://www.vulnerability-lab.com/getcontent.php?id=1330 View: https://www.youtube.com/watch?v=0w8S3uryeII Advisory: http://www.vulnerability-lab.com/getcontent.php?id=976 Release Date:...

Yahoo! Messenger v11 - Bypass & Persistent Vulnerability

Document Title: =============== Yahoo! Messenger v11 - Bypass & Persistent Vulnerability References: =========== http://www.vulnerability-lab.com/getcontent.php?id=1279 Video: https://www.youtube.com/watch?v=kDdg6O5vGCY Advisory: http://www.vulnerability-lab.com/getcontent.php?id=1136 Release Dat...

Yahoo! Messenger v11 - Bypass & Persistent Vulnerability

Document Title: =============== Yahoo! Messenger v11 - Bypass & Persistent Vulnerability References: =========== http://www.vulnerability-lab.com/getcontent.php?id=1279 Video: https://www.youtube.com/watch?v=kDdg6O5vGCY Advisory: http://www.vulnerability-lab.com/getcontent.php?id=1136 Release Dat...

Quack Chat 1.0 - Multiple Vulnerabilities

No description provided by source. Exploit Title: Quack Chat 1.0 - XSS / SQL Injection / Path Diclosure Date: 15 de Agosto del 2013 Exploit Author: Dylan Irzi Credit goes for: websecuritydev.com Vendor Homepage: http://www.quack-chat.com/ Tested on: Win8 & Linux Mint Affected Version : 1.0...

Hostscan - PHP tool for scanning specific range of hosts

Hostscan is a php tool which allows you to scan specific range of hosts, mostly for information gathering and testing for weak passwords. I guess it's a pentest tool, i'd created it to automate some tests that i often do. Since it's PHP, it works quite slowly compared to client-side soft. How it...

C2FO: c2fo.com is releasing sensitive Information about Database Configuration.

Hello C2FO Securiity Team, Vulnerability Details : Disclosure of Database Username and Password of c2fo.com Description: Your configuration file of your website is available to download from your website c2fo.com.When i thought to pentest your site,i landed on https://c2fo.com .But instead of...

RFP - External Network Vulnerability Assessment & PenTest

Document Title: =============== RFP - External Network Vulnerability Assessment & PenTest References: =========== https://www.vulnerability-lab.com/getcontent.php?id=1225 Download: https://www.vulnerability-lab.com/resources/documents/RFP-BoMPLC-2014.pdf Release Date: ============= 2014-03-13...

RFP - External Network Vulnerability Assessment & PenTest

Document Title: =============== RFP - External Network Vulnerability Assessment & PenTest References: =========== http://www.vulnerability-lab.com/getcontent.php?id=1225 Download: http://www.vulnerability-lab.com/resources/documents/RFP-BoMPLC-2014.pdf Release Date: ============= 2014-03-13...

[FS-NyarL] A network takeover & forensic analysis tool

NyarL it's Nyarlathotep, a mitological chaotic deity of the writer HP. Lovecraft's cosmogony. It's represent Crawling Chaos and FS-NyarL it's The Crawling Chaos of Cyber Security :- A network takeover & forensic analysis tool - useful to advanced PenTest tasks & for fun and profit - but use it at...

Penetration Testing Browser Bundle: PenQ

PenQ is an open source, Linux-based penetration testing browser bundle we built over Mozilla Firefox. It comes pre-configured with security tools for spidering, advanced web searching, fingerprinting, anonymous browsing, web server scanning, fuzzing, report generating and more. Penetration Testin...

CBHotel Hotel Software and Booking system 1.8 - Multiple Vulnerabilities

CBHotel Hotel Software and Booking system 1.8 - Multiple Vulnerabilities Exploit Title: Hotel Software and Booking system 1.8 - SQL Injection / Cross Site Scripting Date: 21 de Agosto del 2013 Exploit Author: Dylan Irzi Credit goes for: websecuritydev.com Vendor Homepage: http://www.cbhotel.eu/...

Quack Chat 1.0 - Multiple Vulnerabilities

Exploit Title: Quack Chat 1.0 - XSS / SQL Injection / Path Diclosure Date: 15 de Agosto del 2013 Exploit Author: Dylan Irzi Credit goes for: websecuritydev.com Vendor Homepage: http://www.quack-chat.com/ Tested on: Win8 & Linux Mint Affected Version : 1.0 Contacts: https://twitter.com/Dylanirzi11...

Quark Chat 1.0 XSS / SQL Injection / Path Disclosure

Exploit Title: Quark Chat 1.0 - XSS / SQL Injection / Path Diclosure Date: 15 de Agosto del 2013 Exploit Author: Dylan Irzi Credit goes for: websecuritydev.com Vendor Homepage: http://www.quack-chat.com/ Tested on: Win8 & Linux Mint Affected Version : 1.0 Contacts: https://twitter.com/Dylanirzi11...

Powershell Payload Web Delivery

This file is part of the Metasploit Framework and may be subject to redistribution and commercial restrictions. Please see the Metasploit web site for more information on licensing and terms of use. http://metasploit.com/ require 'msf/core' class Metasploit3 'Powershell Payload Web Delivery',...

[Full-disclosure] Magnolia CMS multiple access control vulnerabilities

Subject: ====== Multiple access control vulnerabilities in Magnolia CMS, Community and Enterprise editions CVE ID: ====== CVE-2013-4621 Summary: ======== A non-admin user such as default users eric / peter can access and execute multiple administrative functionalities of the CMS by accessing...

XSS vulnerability in JW Player and JW Player Pro

Hello 3APA3A! I want to warn you about new XSS vulnerability in JW Player and JW Player Pro. Last year I've written about multiple Content Spoofing and Cross-Site Scripting vulnerabilities in JW Player and JW Player Pro, and this is new Cross-Site Scripting vulnerability about which I've not wrot...

[MSF-Installer] Script to Automate Metasploit Framework Installation

Script to help with installing and configuring Metasploit Framework, Armitage and the Plugins I have written on OSX and Linux To use the script on OSX Java, Xcode and Command Development Tools from Xcode must be installed before running the script. In the case of OSX I also added the option of...

[SPF v0.1.7] Smartphone Pentest Framework - Support of the SMS shell pivot

The smartphone penetration testing framework, the result of a DARPA Cyber Fast Track project, aims to provide an open source toolkit that addresses the many facets of assessing the security posture of these devices. We will look at the functionality of the framework including information gatherin...

[zANTI] The Power of Backtrack on your Android

Android Network Toolkit also known as zANTI is the most comprehensive and refined pentest tool for android by Zimperium. Zimperium is founded by white hat hacker Itzhack ‘Zuk’ Avraham and also have Kevin Mitnick on there team! They also had recently held the Pentester’s WorldCup. zAnti still come...

[Knock] Subdomain Scanner

Knock is a python script, written by Gianni 'guelfoweb' Amato , designed to enumerate subdomains on a target domain through a wordlist. For more information I have posted a documentation page. If you want to see how it works, you can see this sample output: Simple Scan Zone Transfer Scan Wildcard...