Server side request forgery (ssrf)

The XMLRPC API in WordPress before 3.5.1 allows remote attackers to send HTTP requests to intranet servers, and conduct port-scanning attacks, by specifying a crafted source URL for a pingback, related to a Server-Side Request Forgery SSRF issue...

CVE-2013-0235

The XMLRPC API in WordPress before 3.5.1 allows remote attackers to send HTTP requests to intranet servers, and conduct port-scanning attacks, by specifying a crafted source URL for a pingback, related to a Server-Side Request Forgery SSRF issue...

CVE-2013-0235

CVE-2013-0235 affects WordPress via the XMLRPC API (WordPress prior to 3.5.1). The vulnerability allows a remote attacker to craft a pingback source URL to trigger SRRF-like behavior, enabling the attacker to make the targeted server issue HTTP requests to intranet/internal hosts and perform port...

[Zarp v0.1.2] The Python Network Attack Tool

Zarp is a network attack tool centered around the exploitation of local networks. This does not include system exploitation, but rather abusing networking protocols and stacks to take over, infiltrate, and knock out. Sessions can be managed to quickly poison and sniff multiple systems at once,...

[SECURITY] Fedora 18 Update: fail2ban-0.8.10-1.fc18

Fail2ban scans log files like /var/log/pwdfail or /var/log/apache/errorlog and bans IP that makes too many password failures. It updates firewall rules to reject the IP address. To use the hostsdeny and shorewall actions you must install tcpwrappers and shorewall respectively...

[SECURITY] Fedora 17 Update: fail2ban-0.8.10-1.fc17

Fail2ban scans log files like /var/log/pwdfail or /var/log/apache/errorlog and bans IP that makes too many password failures. It updates firewall rules to reject the IP address. To use the hostsdeny and shorewall actions you must install tcpwrappers and shorewall respectively...

Symantec Mail Security for Exchange / Domino RAR and CAB Multiple Vulnerabilities

The remote host is running a version of the Symantec Mail Security for Exchange / Domino that is affected by multiple vulnerabilities : - A heap overflow vulnerability exists that can be triggered when the scanning engine processes a specially crafted CAB file, possibly leading to arbitrary code...

Symantec Mail Security for SMTP RAR and CAB Parsing Multiple Vulnerabilities

The remote host is running a version of the Symantec Mail Security for Exchange / Domino that is affected by multiple vulnerabilities : - A heap overflow vulnerability exists that can be triggered when the scanning engine processes a specially crafted CAB file, possibly leading to arbitrary code...

Google Chrome < 27.0.1453.116 Flash Click-Jacking

Binary data 6878.pasl...

[SECURITY] Fedora 19 Update: clamav-0.97.8-2.fc19

Clam AntiVirus is an anti-virus toolkit for UNIX. The main purpose of this software is the integration with mail servers attachment scanning. The package provides a flexible and scalable multi-threaded daemon, a command line scanner, and a tool for automatic updating via Internet. The programs ar...

lfi

This plugin will find local file include vulnerabilities. This is done by sending to all injectable parameters file paths like "../../../../../etc/passwd" and searching in the response for strings like "root:x:0:0:". Plugin type Audit Options This plugin doesnt have any user configured options...

file_upload

This plugin will try to expoit insecure file upload forms. One configurable parameter exists: extensions The extensions parameter is a comma separated list of extensions that this plugin will try to upload. Many web applications verify the extension of the file being uploaded, if special extensio...

objects

This plugin greps every page for applets and other types of objects. Plugin type Grep Options This plugin doesnt have any user configured options. Source For more information about this plugin and the associated tests, theres always the source code to understand exactly whats under the hood: Plug...

find_dvcs

This plugin search git, hg, bzr, svn or cvs repositories and checks for files containing. For example, if the input is: http://host.tld/w3af/index.php The plugin will perform requests to: http://host.tld/w3af/.git/index http://host.tld/w3af/.gitignore http://host.tld/w3af/.hg/store/fncache...

credit_cards

This plugins scans every response page to find the strings that are likely to be credit card numbers. It can be tested against the following URL: https://www.paypal.com/enUS/vhelp/paypalmanagerhelp/creditcardnumbers.htm Plugin type Grep Options This plugin doesnt have any user configured options...

Activating mobile malware with Music and Light Sensors

Researchers at the University of Alabama at Birmingham UAB presented the research that it is possible to trigger malware hidden in mobile devices using music, lighting, or vibration. In a research paper titled “Sensing-Enabled Channels for Hard-to-Detect Command and Control of Mobile Devices”, th...

Carna Botnet Analysis Enumerates Vulnerable Network Devices

The Carna botnet, more formally known as the Internet Census 2012, stirred up a hornet’s nest of controversy when it was unveiled in March to a number of popular security mailing lists. An unidentified researcher had found more than 420,000 embedded devices that were accessible online with defaul...

[SECURITY] Fedora 18 Update: clamav-0.97.8-1.fc18

Clam AntiVirus is an anti-virus toolkit for UNIX. The main purpose of this software is the integration with mail servers attachment scanning. The package provides a flexible and scalable multi-threaded daemon, a command line scanner, and a tool for automatic updating via Internet. The programs ar...

CouchDB Login Utility

This module tests CouchDB logins on a range of machines and report successful logins. This module requires Metasploit: https://metasploit.com/download Current source: https://github.com/rapid7/metasploit-framework class MetasploitModule 'CouchDB Login Utility', 'Description' = % This module tests...

[SpiderFoot v2.0] The Open Source Footprinting tool

SpiderFoot is a free, open-source footprinting tool, enabling you to perform various scans against a given domain name in order to obtain information such as sub-domains, e-mail addresses, owned netblocks, web server versions and so on. The main objective of SpiderFoot is to automate the...