This file contains bidirectional Unicode text that may be interpreted or compiled differently than what appears below. To review, open the file in an editor that reveals hidden Unicode characters.
Learn more about bidirectional Unicode characters
The following request is vulnerable to a SQL injection attack from authenticated users. | |
GET /ossim/report/BusinessAndComplianceISOPCI/ISO27001Bar1.php?date_from=2014-02-28&date_to=2014-03-30 HTTP/1.1 | |
Host: 172.31.16.150 | |
User-Agent: Mozilla/5.0 (X11; Ubuntu; Linux x86_64; rv:26.0) Gecko/20100101 Firefox/26.0 | |
Accept-Language: en-US,en;q=0.5 | |
Accept-Encoding: gzip, deflate | |
Referer: https://172.31.16.150/ossim/report/wizard_run.php?run=ZmRzYWZkc2EjIyNhZG1pbg== | |
Cookie: PHPSESSID=jllhuhmphk6ma5q8q2i0hm0mr1; | |
Connection: keep-alive |
This file contains bidirectional Unicode text that may be interpreted or compiled differently than what appears below. To review, open the file in an editor that reveals hidden Unicode characters.
Learn more about bidirectional Unicode characters
Request: | |
GET /nlw/2014.04.09.1969/json-proxy?refresh=30&url=https://google.com&httpMethod=GET&headers=&postData=&authz=&st=&contentType=JSON&numEntries=3&getSummaries=false&signOwner=true&signViewer=true&gadget=undefined&container=default&bypassSpecCache= HTTP/1.1 | |
Host: developers.socialtext.net | |
User-Agent: Mozilla/5.0 (Macintosh; Intel Mac OS X 10.9; rv:26.0) Gecko/20100101 Firefox/26.0 | |
Accept: text/html,application/xhtml+xml,application/xml;q=0.9,*/*;q=0.8 | |
Accept-Language: en-US,en;q=0.5 | |
Accept-Encoding: gzip, deflate | |
Referer: https://developers.socialtext.net/st/profile/whoaaa@binkmail.com | |
Cookie: NLW-session=503aac177589fc69b99e505fefde5d4e; NLW-user=T1RLAQLCPVucDWQKiCCbOOWnNwCEHoE5ahAWSGkzQ4h0RJIR8GgjUw6UEPUqFzYNxZooLlCrXpuVE14AcI1wxp-G_Oe6vIiCt-PHOojudJWbXIGNuOqBGzLZMLXKCtakvrqTIF6KoDvU6dKd1D456b4v_FzxwBBs2uz09tUFD6dQn36oDsml2UfoEGcEHD3nGMAYd5li-WhihAtYusVePzsY81W62K-3st4v730%2A |
This file contains bidirectional Unicode text that may be interpreted or compiled differently than what appears below. To review, open the file in an editor that reveals hidden Unicode characters.
Learn more about bidirectional Unicode characters
The following request is vulnerable to a SQL injection in the last URI segment: | |
GET /docushare/dsweb/ResultBackgroundJobMultiple/1 HTTP/1.1 | |
Host: 172.31.16.194:8080 | |
User-Agent: Mozilla/5.0 (X11; Ubuntu; Linux x86_64; rv:26.0) Gecko/20100101 Firefox/26.0 | |
Accept: text/html,application/xhtml+xml,application/xml;q=0.9,*/*;q=0.8 | |
Accept-Language: en-US,en;q=0.5 | |
Accept-Encoding: gzip, deflate | |
Referer: http://172.31.16.194:8080/docushare/dsweb/DeleteConfirmation/1/Collection-14/Services | |
Cookie: JSESSIONID=AB82A86859D9C65475DDE5E47216F1A0.tomcat1; AmberUser=64.980A91BBF9D661CB800C2CE5FCCE924AEF4D51CF0280B319873BC31AF0705F0F21.1svt4r2doj13hhu1dc7kf |
This file contains bidirectional Unicode text that may be interpreted or compiled differently than what appears below. To review, open the file in an editor that reveals hidden Unicode characters.
Learn more about bidirectional Unicode characters
Unitrends Enterprise Backup 7.3.0 | |
Multiple vulnerabilities exist within this piece of software. The largest one is likely the fact that the ‘auth’ string used for authorization isn’t random at all. After authentication, any requests made by the browser send no cookies and only check this ‘auth’ param, which is completely insufficient. Because of this, unauthenticated users can know what the ‘auth’ parameter should be and make requests as the ‘root’ user. | |
Unauthenticated root RCE | |
Because the ‘auth’ variable is not random, an unauthenticated user can post a specially crafted request to the /recoveryconsole/bpl/snmpd.php PHP script. This script does not sanitize the SNMP community string properly which allows the user to execute remote commands as the root user. A metasploit module that exploits this has been given alongside this report. Below is the actual request. To recreate, after authentication, click on Settings -> Clients, Networking, and Notifications -> SNMP and Modify the ‘notpublic’ entry to contain |
This file contains bidirectional Unicode text that may be interpreted or compiled differently than what appears below. To review, open the file in an editor that reveals hidden Unicode characters.
Learn more about bidirectional Unicode characters
WebTitan 4.01 (build 148) multiple vulnerabilities | |
http://www.webtitan.com/free-trial | |
WebTitan suffers from many command injection attacks, which is exacerbated by the fact that the “role-based” access is superficial only. An attacker with any credentials to the system can execute remote commands as a variety of local users. An authorized attacker can also take advantage of a directory traversal attack as the ‘www’ user and read arbitrary files. The application seems to only change what it displays to the users based on their roles, but these limited users can still successfully perform any request an “admin” can perform. | |
Because of these vulnerabilities, in the worst case scenario, a limited-access authorized user can eventually run commands remotely as the root user. | |
This file contains bidirectional Unicode text that may be interpreted or compiled differently than what appears below. To review, open the file in an editor that reveals hidden Unicode characters.
Learn more about bidirectional Unicode characters
at Mono.CSharp.CSharpCodeCompiler.CompileFromFileBatch (System.CodeDom.Compiler.CompilerParameters options, System.String[] fileNames) [0x00135] in /private/tmp/source/bockbuild-mono-3.2.6/profiles/mono-mac-xamarin/build-root/mono-3.2.6/mcs/class/System/Microsoft.CSharp/CSharpCodeCompiler.cs:236 | |
at Mono.CSharp.CSharpCodeCompiler.CompileAssemblyFromFileBatch (System.CodeDom.Compiler.CompilerParameters options, System.String[] fileNames) [0x00011] in /private/tmp/source/bockbuild-mono-3.2.6/profiles/mono-mac-xamarin/build-root/mono-3.2.6/mcs/class/System/Microsoft.CSharp/CSharpCodeCompiler.cs:135 | |
at System.CodeDom.Compiler.CodeDomProvider.CompileAssemblyFromFile (System.CodeDom.Compiler.CompilerParameters options, System.String[] fileNames) [0x00014] in /private/tmp/source/bockbuild-mono-3.2.6/profiles/mono-mac-xamarin/build-root/mono-3.2.6/mcs/class/System/System.CodeDom.Compiler/CodeDomProvider.cs:111 | |
at System.Web.Compilation.AssemblyBuilder.BuildAssembly (System.Web.VirtualPath virtualPath, System |
This file contains bidirectional Unicode text that may be interpreted or compiled differently than what appears below. To review, open the file in an editor that reveals hidden Unicode characters.
Learn more about bidirectional Unicode characters
## | |
# This module requires Metasploit: http//metasploit.com/download | |
# Current source: https://github.com/rapid7/metasploit-framework | |
## | |
require 'msf/core' | |
require 'json' | |
class Metasploit3 < Msf::Exploit::Remote | |
Rank = ExcellentRanking |
This file contains bidirectional Unicode text that may be interpreted or compiled differently than what appears below. To review, open the file in an editor that reveals hidden Unicode characters.
Learn more about bidirectional Unicode characters
## | |
# This module requires Metasploit: http//metasploit.com/download | |
# Current source: https://github.com/rapid7/metasploit-framework | |
## | |
require 'msf/core' | |
class Metasploit3 < Msf::Exploit::Remote | |
Rank = ExcellentRanking |
This file contains bidirectional Unicode text that may be interpreted or compiled differently than what appears below. To review, open the file in an editor that reveals hidden Unicode characters.
Learn more about bidirectional Unicode characters
bperry@w00den-pickle:~/tmp/discourse$ brakeman | |
WARNING: -------------------------------------------------------------------------- | |
You are running an old version of bundler, please update by running: gem install bundler | |
Loading scanner... | |
[Notice] Detected Rails 3 application | |
Processing application in /home/bperry/tmp/discourse | |
Processing gems... | |
Processing configuration... |
This file contains bidirectional Unicode text that may be interpreted or compiled differently than what appears below. To review, open the file in an editor that reveals hidden Unicode characters.
Learn more about bidirectional Unicode characters
<?php | |
$m = new MongoClient("mongodb://127.0.0.1:27017"); | |
$m->selectDB('foo'); | |
$collection = $m->selectCollection('test', 'phpmanual'); | |
if ($_GET["age"] != "") { | |
$js = 'function(){if(this.name == "Joe"||this.age=='.$_GET["age"].')return true;}'; | |
$cursor = $collection->find(array('$where' => $js)); | |
foreach($cursor as $doc) { |