en

XSSer Penetration Testing Tool 1.8-1

XSSer is an open source penetration testing tool that automates the process of detecting and exploiting XSS injections against different applications. It contains several options to try to bypass certain filters, and various special techniques of code injection.




en

XSSer Penetration Testing Tool 1.8-2

XSSer is an open source penetration testing tool that automates the process of detecting and exploiting XSS injections against different applications. It contains several options to try to bypass certain filters, and various special techniques of code injection.




en

Bing.com Hostname / IP Enumerator 1.0

This tool enumerates hostnames from Bing.com for an IP address. Bing.com is Microsoft's search engine which has an IP: search parameter. Written in Bash for Linux. Requires wget.




en

EnumJavaLibs Java Classpath Enumerator

EnumJavaLibs is a tool that can be used to discover which libraries are loaded (i.e. available on the classpath) by a remote Java application when it supports deserialization.




en

RSA BSAFE Crypto Attacks / Denial Of Service

RSA BSAFE Micro Edition Suite, Crypto-C Micro Edition, Crypto-J, SSL-J and SSL-C all suffer from various crypto, denial of service, and underflow vulnerabilities.




en

FreeBSD Security Advisory - ntp Authentication Bypass

FreeBSD Security Advisory - Crypto-NAK packets can be used to cause ntpd(8) to accept time from an unauthenticated ephemeral symmetric peer by bypassing the authentication required to mobilize peer associations. FreeBSD 9.3 and 10.1 are not affected. Various other issues have also been addressed.




en

RSA BSAFE Lenstra's Attack

RSA BSAFE Micro Edition Suite, Crypto-C Micro Edition, Crypto-J, and SSL-J contain a fix to address Lenstra's attack. RSA BSAFE Micro Edition Suite (MES) 4.1.5, RSA BSAFE Crypto-C Micro Edition (CCME) 4.1.3, RSA BSAFE Crypto-J 6.2.1, and RSA BSAFE SSL-J 6.2.1 are affected.




en

Apache2 Web Server Hardening Article

This is an article discussing Apache2 Web Server hardening. Written in Turkish.





en

Linux/x86 (NOT|ROT+8 Encoded) execve(/bin/sh) Null Free Shellcode

47 bytes small Linux/x86 (NOT|ROT+8 Encoded) execve(/bin/sh) null free shellcode.




en

Linux/x86 Encoder / Decoder Shellcode

117 bytes small Linux/x86 encoding of random bytes + XOR/SUB/NOT/ROR and also decodes ROL/NOT/ADD/XOR execve(/bin/sh) shellcode.




en

Linux/x86 Random Bytes Encoder + XOR/SUB/NOT/ROR execve(/bin/sh) Shellcode

114 bytes small Linux/x86 random bytes encoder and XOR/SUB/NOT/ROR execve(/bin/sh) shellcode.




en

Linux/x64_86 ROL Encoded Execve Shellcode

57 bytes small Linux/x64_86 /bin/bash shellcode. The stub decodes the ROL Encoded shellcode. When the stub has finished decoding the payload, execution control is passed to the payload.










en

Scam Call Center Owner In Custody After BBC Investigation






en

SuiteCRM 7.11.11 Broken Access Control / Local File Inclusion

SuiteCRM versions 7.11.11 and below suffer from an add_to_prospect_list broken access control that allows for local file inclusion attacks.




en

PHPKB Multi-Language 9 Authenticated Directory Traversal

PHPKB Multi-Language 9 suffers from an authenticated directory traversal vulnerability.




en

FIBARO System Home Center 5.021 Remote File Inclusion / XSS

FIBARO System Home Center version 5.021 suffers from cross site scripting and remote file inclusion vulnerabilities.




en

Zen Load Balancer 3.10.1 Directory Traversal

Zen Load Balancer version 3.10.1 suffers from a directory traversal vulnerability. This finding was originally discovered by Cody Sixteen.











en

Kentico CMS 12.0.14 Remote Command Execution

This Metasploit module exploits a vulnerability in the Kentico CMS platform versions 12.0.14 and earlier. Remote command execution is possible via unauthenticated XML requests to the Staging Service SyncServer.asmx interface ProcessSynchronizationTaskData method stagingTaskData parameter. XML input is passed to an insecure .NET deserialize call which allows for remote command execution.