Apache Tomcat Manager - Application Upload (Authenticated) Code Execution (Metasploit)

This module requires Metasploit: http//metasploit.com/download Current source: https://github.com/rapid7/metasploit-framework require 'msf/core' class Metasploit3 /Apache.Coyote|Tomcat/ CSRFVAR = 'CSRFNONCE=' include Msf::Exploit::Remote::HttpClient include Msf::Exploit::EXE def initializeinfo =...

Apache Tomcat Manager Code Execution Exploit

This Metasploit module can be used to execute a payload on Apache Tomcat servers that have an exposed "manager" application. The payload is uploaded as a WAR archive containing a jsp application using a POST request against the /manager/html/upload component. NOTE: The compatible payload sets var...

Chainfire's Pry-Fi Android App released to defend against NSA Spying under Public Wi-Fi

Turn your face in any direction, someone is always trying to spy on you; doesn’t matter who and what you are? Just yesterday we reported that Communications Security Establishment Canada CSEC in Canada and NSA are together, running a spying program called 'game-changer'. It was revealed that the...

Apache Tomcat Manager Code Execution

This module requires Metasploit: http//metasploit.com/download Current source: https://github.com/rapid7/metasploit-framework require 'msf/core' class Metasploit3 /Apache.Coyote|Tomcat/ CSRFVAR = 'CSRFNONCE=' include Msf::Exploit::Remote::HttpClient include Msf::Exploit::EXE def initializeinfo =...

NASA website Hacked; Protest by Hackers against US action on Syria and Brazil Spying

Earlier reports based on Snowden's documents revealed the existence of the NSA's PRISM program, and indicate that the National Security Agency spied on Brazilians. On other End, President Obama said that the Syrian government used chemical weapons on its citizens and The United States may have to...

Email Spam Claims US Attacks Syria and Leads to Malware

A new phishing campaign is disseminating malicious links with emails purporting to come from CNN saying that the United States has initiated military strikes against the embattled regime of Syrian President Bashar al Assad. One such email, obtained by Kaspersky Lab and posted on Securelist, comes...

NASA website Hacked; Protest by Hackers against US action on Syria and Brazil Spying

Earlier reports based on Snowden's documents revealed the existence of the NSA's PRISM program, and indicate that the National Security Agency spied on Brazilians. On other End, President Obama said that the Syrian government used chemical weapons on its citizens and The United States may have to...

Passwords, Email, Usernames Accessed in Ubisoft Hack

The video game publishing company Ubisoft is urging its users to create new passwords after announcing late last week on a support forum that attackers exploited a vulnerability in one of the company’s websites to gain unauthorized access to some of their online systems. The attackers compromised...

Upgrade bundled Tomcat to the latest minor release

panel:bgColor=e7f4fa NOTE: This suggestion is for JIRA Server. Using JIRA Cloud? See the corresponding suggestion|http://jira.atlassian.com/browse/JRACLOUD-33563. panel Customer did a Security Scan on the instance and founded the version 5.1.8 that he is using subjected to security vulnerabilitie...

Internet Blocked Briefly in Syria

Sometime around 2:45 PM EDT yesterday, Syria’s BGP routes were severed and the country disappeared from the Internet. Just as quickly as it had fallen, Syria came back online this morning. In March, the Middle Eastern nation entered the third year of a violent conflict in which the country’s ruli...

Anonymous Hackers Launch #OpUSA against US Banking and Government Agencies

OpUSA campaign is officially started, the day has come, today May 7 as announced by Anonymous, a coordinated online attack will hit Banking and government websites. The announcement made by popular group of hacktivists is creating great concerns between US security experts in charge of defense th...

JBoss 4.2.0 BSHDeployer 代码执行漏洞

JBoss是基于J2EE的开放源代码的应用服务器，其4.2.0版本默认会开启BSHDeployer服务， 当攻击者绕过JMX-console拦截里， 可以利用BSHDeployer服务方便地（将war信息直接写在bsh文件里）部署一个war，从而成功地远程部署了恶意代码。 JBoss 4.2.0...

Hackers Compromise The War Z Forum, Game Databases

Hackers compromised the forum and game database of the massively multiplayer online game, The War Z, forcing the game’s producer OP Productions to temporarily take the game and its forum offline. In a security alert issued yesterday, OP Productions informed The War Z players of the breach and...

Cyber 9/11, cyber doomsday...between fear and need for action

It’s not a mystery, every nation is worried of the level of security of its infrastructure, the United States are among the most concerned governments due the high number of cyber-attack against its networks. US Government representative such us former States Secretary of Defense Leon Panetta and...

Philippines President's website defaced by Anonymous Hackers

Philippines-Malaysia Cyber war over Sabah land dispute take another turn, when Philippines hackers deface their own President Benigno Aquino III website early Thursday, and criticized how the President has been handling the conflict in Sabah.The hacker group left a message to the president on the...

Philippines President's website defaced by Anonymous Hackers

Philippines-Malaysia Cyber war over Sabah land dispute take another turn, when Philippines hackers deface their own President Benigno Aquino III website early Thursday, and criticized how the President has been handling the conflict in Sabah.The hacker group left a message to the president on the...

War FTP Daemon 1.82 Denial of Service

According to its banner, the version of War FTP Daemon installed on the remote host is 1.82. As such, it is potentially affected by a flaw in how log messages are logged to the Windows Event log. A remote, unauthenticated attacker could leverage this issue to cause a denial of service. Note that...

VulnCheck KEV: CVE-2017-16959

The locale feature in cgi-bin/luci on TP-Link TL-WVR, TL-WAR, TL-ER, and TL-R devices allows remote authenticated users to test for the existence of arbitrary files by making an operation=write;locale=%0d request, and then making an operation=read request with a crafted Accept-Language HTTP...

Philippines-Malaysia Cyber war over Sabah land dispute

A series of websites defacement has been conducted between Philippines and Malaysia over the dispute in the land of Sabah. Hackers claiming to be part of Anonymous group from Malaysian and Filipino and attacking websites of each other. It was believed that the first online attacks were made by...

Philippines-Malaysia Cyber war over Sabah land dispute

A series of websites defacement has been conducted between Philippines and Malaysia over the dispute in the land of Sabah. Hackers claiming to be part of Anonymous group from Malaysian and Filipino and attacking websites of each other. It was believed that the first online attacks were made by...