[SECURITY] [DSA 3380-1] php5 security update

------------------------------------------------------------------------- Debian Security Advisory DSA-3380-1 [email protected] https://www.debian.org/security/ Florian Weimer October 27, 2015 https://www.debian.org/security/faq -...

MobSF (Mobile Security Framework) - Mobile (Android/iOS) Automated Pen-Testing Framework

Mobile Security Framework MobSF is an intelligent, all-in-one open source mobile application Android/iOS automated pen-testing framework capable of performing static and dynamic analysis. We've been depending on multiple tools to carry out reversing, decoding, debugging, code review, and pen-test...

[SECURITY] [DSA 3373-1] owncloud security update

------------------------------------------------------------------------- Debian Security Advisory DSA-3373-1 [email protected] https://www.debian.org/security/ Salvatore Bonaccorso October 18, 2015 https://www.debian.org/security/faq -...

BackBox Linux 4.4 - Ubuntu-based Linux Distribution Penetration Test and Security Assessment

BackBox is a Linux distribution based on Ubuntu. It has been developed to perform penetration tests and security assessments. Designed to be fast, easy to use and provide a minimal yet complete desktop environment, thanks to its own software repositories, always being updated to the latest stable...

[SECURITY] [DSA 3370-1] freetype security update

------------------------------------------------------------------------- Debian Security Advisory DSA-3370-1 [email protected] https://www.debian.org/security/ Alessandro Ghedini October 06, 2015 https://www.debian.org/security/faq -...

The vulnerability of the Flash Player and Adobe Integrated Runtime software platforms allows attackers to trigger service failures.

The vulnerabilities of the Flash Player and Adobe Integrated Runtime programs exist due to insufficient testing of input data. Exploiting these vulnerabilities can allow a malicious actor to cause service failures remotely...

SpeedPhishing Framework: SPF

This presentation will start by quickly exploring some of the common phishing attack tools and techniques. During the presentation, audience participation will be encouraged in the form of providing examples and personal experience in what phishing techniques people have used and what would be...

Evil FOCA - MITM, DoS, DNS Hijacking in IPv4 and IPv6 Penetration Testing Tool

Evil Foca is a tool for security pentesters and auditors whose purpose it is to test security in IPv4 and IPv6 data networks. The tool is capable of carrying out various attacks such as: MITM over IPv4 networks with ARP Spoofing and DHCP ACK Injection. MITM on IPv6 networks with Neighbor...

Here's What Facebook 'Dislike or Empathy Button' Would Look Like

A Facebook Dislike button is one of the most frequently requested features from users for years. Earlier in the last week, Facebook finally confirmed its plans to add a Dislike or Empathy to your Facebook Profile and News Feed. If you are thinking that Facebook Dislike is going to be a thumbs-dow...

Reverse Shell with Windows Media Center remote execution vulnerability, CVE-2 0 1 5-2 5 0 9 use-vulnerability warning-the black bar safety net

In this article, we will briefly introduce the reverse shell and the Windows Media Center vulnerabilities CVE-2 0 1 5-2 5 0 9）vulnerabilities, and finally a detailed description of the vulnerability of the method. 0×0 1 reverse shell The so-called shell, everybody is not strange, is nothing more...

Weevely3 - Weaponized Web Shell

Weevely is a command line web shell dynamically extended over the network at runtime designed for remote administration and pen testing. It provides a weaponized telnet-like console through a PHP script running on the target, even in restricted environments. The low footprint agent and over 30...

The reverse shell and the CVE-2 0 1 5-2 5 0 9 exploit-vulnerability warning-the black bar safety net

0×0 0 introduction to In this article, we will briefly introduce the reverse shell and the CVE-2 0 1 5-2 5 0 9 vulnerabilities, and finally a detailed description of the vulnerability of the method. 0×0 1 reverse shell The so-called shell, everybody is not strange, is nothing more than a command...

Total Commander 8.52 - Buffer Overflow Exploit

Exploit for windows platform in category local exploits !/usr/bin/python EXPLOIT TITLE: Total Commander 8.52 Buffer Overflow AUTHOR: VIKRAMADITYA "-OPTIMUS" Credits: UnN0n Date of Testing: 19th September 2015 Download Link : http://tcmd852.s3-us-west-1.amazonaws.com/tc852x32b1.exe Tested On :...

Total Commander 8.52 - Local Buffer Overflow

!/usr/bin/python EXPLOIT TITLE: Total Commander 8.52 Buffer Overflow AUTHOR: VIKRAMADITYA "-OPTIMUS" Credits: UnN0n Date of Testing: 19th September 2015 Download Link : http://tcmd852.s3-us-west-1.amazonaws.com/tc852x32b1.exe Tested On : Windows XP Service Pack 2 Steps to Exploit Step 1: Execute...

DSA-3360-1 icu - security update

Bulletin has no description...

Pentoo 2015 - Security-Focused Livecd based on Gentoo

Pentoo is a Live CD and Live USB designed for penetration testing and security assessment. Based on Gentoo Linux, Pentoo is provided both as 32 and 64 bit installable livecd. Pentoo is also available as an overlay for an existing Gentoo installation. It features packet injection patched wifi...

Cross site scripting

Cross-site scripting XSS vulnerability in the DataTables plugin 1.10.8 and earlier for jQuery allows remote attackers to inject arbitrary web script or HTML via the scripts parameter to media/unittesting/templates/6776.php...

CVE-2015-6584

Cross-site scripting XSS vulnerability in the DataTables plugin 1.10.8 and earlier for jQuery allows remote attackers to inject arbitrary web script or HTML via the scripts parameter to media/unittesting/templates/6776.php...

ZAP 2.4.2 - Penetration Testing Tool for Testing Web Applications

The Zed Attack Proxy ZAP is an easy to use integrated penetration testing tool for finding vulnerabilities in web applications. It is designed to be used by people with a wide range of security experience and as such is ideal for developers and functional testers who are new to penetration testin...

Arris Password of The Day Generator (list.txt)

Arris TM502G、TM602G 路由器进入高级模式时需要密码，这个密码会根据系统日期来自动生成，每天都有不同的密码。 具体算法已经在PoC中给出。 1.直接访问 Arris 路由器会显示路由器的一些信息，不需要任何认证。 2.但是当点击高级菜单的时候，会提示输入密码。 3.如果密码输入错误 4.如果密码输入的是在码表中的正确密码，但是时间不正确，会提示需要相应时间的密码： 5.当提交正确的密码后进入到高级设置： ---- PoC 默认使用调用者当前系统时间，如果时间与路由器时间不符合，会自动处理 如果调用者要手动指定时间，可以使用 --extra-params...