Re: [Full-disclosure] My ISP is routing traffic to private addresses...
Maybe when we cut over to IPv6 the ISPs will revert to the golden age of putting all their gear on publicly addressable space :) Conversely, an enjoyable network design is where you route public IPs from a private network to a private network, and the public IP has different services on the internet to the internally routed version, but clients need access to both. NATing heaven. ___ Full-Disclosure - We believe in it. Charter: http://lists.grok.org.uk/full-disclosure-charter.html Hosted and sponsored by Secunia - http://secunia.com/
Re: [Full-disclosure] Forticlient VPN client credential interception vulnerability
Reminded me of a bug I found in an EAL4 certified military encryption product. The source code actually says FIXME - need to add parameter validation. So instead of spending a few minutes adding input sanitisation, the developers just added a reminder that none exists and shipped the product as-is. One of those face slap moments. -Patrick On Wed, May 1, 2013 at 8:36 PM, Thierry Zoller thie...@zoller.lu wrote: You got to be kidding me... FORTICLIENT VPN CLIENT CREDENTIAL INTERCEPTION VULNERABILITY When the FortiClient VPN client is tricked into connecting to a proxy server rather than to the original firewall (e.g. through ARP or DNS spoofing,) it detects the wrong SSL certificate but it only warns the user _AFTER_ it has already sent the password to the proxy. ___ Full-Disclosure - We believe in it. Charter: http://lists.grok.org.uk/full-disclosure-charter.html Hosted and sponsored by Secunia - http://secunia.com/ ___ Full-Disclosure - We believe in it. Charter: http://lists.grok.org.uk/full-disclosure-charter.html Hosted and sponsored by Secunia - http://secunia.com/
Re: [Full-disclosure] Google's robots.txt handling
I wouldn't consider this an issue. If Google didn't do this, someone else would have (e.g. my rather old http://www.aushack.com/robanukah/ does it but I never bothered to index the web at large). I believe it was suggested to Shodan and others, so it was only a matter of time. If anything, Google is raising awareness by including it in their results (which I noticed cropped up about 6 months (?) ago). It is also worth noting that some organisations (and some security appliances) use it for bait. E.g. robots.txt = Disallow: /database.bak and as soon as a request is seen the IP is blacklisted permanently, because their behaviour either means that a spider is disobeying robots, or more than likely it is a human poking around where they shouldn't be. Should Google index it? Probably not - but then you're back to point #1, if they didn't someone else would have - and Google does a better job at it, so by all means... Interestingly, Google indexes their own sites https://www.google.com/search?q=inurl:robots.txt+filetype%3Atxt+site%3Agoogle.com. At least they're not playing double standards. My only questions is *why* did they suddenly decide to include this? I'd hazard a guess that they released new improved indexing code, and this was a by-product of their improvement (perhaps related to the TXT file-type?). -Patrick ___ Full-Disclosure - We believe in it. Charter: http://lists.grok.org.uk/full-disclosure-charter.html Hosted and sponsored by Secunia - http://secunia.com/
Re: [Full-disclosure] PenTest Magazine - try us for free! (FIRST FIX YOUR XSS and other bUGS in PAGE..)
Yes - and stop *spamming* info@ ... domain after domain, and if you're going to send spam use CC'ed instead of BCC'ed FFS! -Patrick 2011/11/25 Tomy supp...@vs-db.info hello, first, fix your BUGS in page (few...) than you can release PenTestMag. sample: http://pentestmag.com:80/wp-login.php?action=register (XSS) e-mail: john@somewhere.com/sCrIpTsCrIpTalert(87118)/sCrIpT http://www.vs-db.info/?p=1230 Tomy Wiadomość napisana przez Maciej Kozuszek w dniu 22 lis 2011, o godz. 14:39: Hi everyone, PenTest Magazine - the only publication devoted to penetration testing. Each week around 20 pages to be downloaded for free, and lot of free stuff on a website. Visit us at: www.pentestmag.comhttp://pentestmag.com/?a_aid=maciejkozuszeka_bid=163efff7 See for yourself that PenTest is worth subscribing to. Best regards, -- Maciej Kozuszek PenTest Magazine Managing Editor Software Media Sp z o.o.www.pentestmag.com ___ Full-Disclosure - We believe in it. Charter: http://lists.grok.org.uk/full-disclosure-charter.html Hosted and sponsored by Secunia - http://secunia.com/ Ariko-Security Rynek Glowny 12 32-600 Oswiecim tel:. +48 33 4741511 mobile: +48 784086818 (Mo-Fr 10.00-20.00 CET) Ariko-Security Sp. z o.o. z siedzibą w Oświęcimiu , zarejestrowana przez Sąd Rejonowy dla m. Krakowa-Śródmieścia, XII Wydział Gospodarczy Krajowego Rejestru Sądowego, KRS: 0358273, NIP: 549-239-90-67, REGON 121262172 Tomy supp...@vs-db.info ___ Full-Disclosure - We believe in it. Charter: http://lists.grok.org.uk/full-disclosure-charter.html Hosted and sponsored by Secunia - http://secunia.com/ ___ Full-Disclosure - We believe in it. Charter: http://lists.grok.org.uk/full-disclosure-charter.html Hosted and sponsored by Secunia - http://secunia.com/
Re: [Full-disclosure] INSECT Pro - Free tool for pentest - New version release 2.7
Ahem, http://mail.metasploit.com/pipermail/framework/2010-September/006889.html A bit of msf licensing history is mentioned here (and abuses): http://blog.metasploit.com/2008/10/metasploit-32-bsd-licensing.html The new license will lead to commercial abuse, but I believe that the project is now strong enough to succeed even with competition from commercial entities that are using our source code. The key to our success is the Metasploit community and our dedication to sharing security information (and code) in a timely fashion. Metasploit is great at destroying FUD, whether the source is an incompetent product vendor or a media-happy security company. -Patrick On Thu, Sep 1, 2011 at 3:51 AM, valdis.kletni...@vt.edu wrote: On Wed, 31 Aug 2011 14:34:58 -0300, root said: That file is under the msf3 tree, if Insect pro is violating GPL, Metasploit is also doing it (and everything including it, like 80% of security frameworks out there), remember MSF is BSD licensed. And even the top-level Metasploit HACKING says: By submitting code contributions to the Metasploit Project it is assumed that you are offering your code under a BSD or similar license. MIT and Ruby Licenses are also fine. We specifically cannot include GPL code. LGPL code is accepted on a case by case basis for libraries only and is never accepted for modules. ___ Full-Disclosure - We believe in it. Charter: http://lists.grok.org.uk/full-disclosure-charter.html Hosted and sponsored by Secunia - http://secunia.com/
