Re: [Full-disclosure] iDefense Q-1 2007 Challenge -I WILL BUY FOR MORE

>>> exploits the submitted vulnerability. The arbitrary code >>> >>> >>>> execution >>>> >>>> >>> must be of an uploaded non-malicious payload. Submission of >>> >>> >>>> a >>>> >>>> >>> malicious payload is grounds for disqualification from this phase of >>> the >>> >>> >>>> challenge. >>>> >>>> >>> I) Technologies Covered: >>> - -Microsoft Internet Explorer 7.0 >>> - >>> >>> >>>> -Microsoft Windows Vista >>>> >>>> >>> II) Working Exploit Challenge Ground >>> >>> >>>> Rules: >>>> >>>> >>> Working exploit code must be for the submitted vulnerability only >>> >>> >>>> ­ >>>> >>>> >>> iDefense will not consider exploit code for existing vulnerabilities >>> or new >>> >>> >>>> vulnerabilities submitted by others. iDefense will consider >>>> >>>> >>> one and only one >>> >>> >>>> working exploit for each original vulnerability >>>> >>>> >>> submitted. >>> >>> The minimum award >>> >>> >>>> for a working exploit is $2000. In addition to the >>>> >>>> >>> base award, additional >>> >>> >>>> amounts up to $4000 may be awarded based upon: >>>> >>>> >>> - -Reliability of the >>> >>> >>>> exploit >>>> >>>> >>> - -Quality of the exploit code >>> - -Readability of the exploit >>> >>> >>>> code >>>> >>>> >>> - -Documentation of the exploit code >>> >>> >>> -BEGIN PGP >>> >>> >>>> SIGNATURE- >>>> >>>> >>> Version: GnuPG v1.4.3 (MingW32) >>> Comment: Using GnuPG with >>> >>> >>>> Mozilla - http://enigmail.mozdev.org >>>> >>>> >>> >>> iD8DBQFFpSHsYcX4JiqFDSgRAl+ZAJwMJaZoJ6zwd4m8qZfviOZnNNUVrACgpaTU >>> QkO9IXq+PsC6 >>> >>> >>>> bMKg7j6Dwfw= >>>> >>>> >>> =N0am >>> -END PGP >>> >>> >>>> SIGNATURE- >>>> >>>> >>> ___ >>> Full-Disclosur >>> >>> >>>> e - We believe in it. >>>> >>>> >>> Charter: >>> >>> >>>> http://lists.grok.org.uk/full-disclosure-charter.html >>>> >>>> >>> Hosted and sponsored by >>> >>> >>>> Secunia - http://secunia.com/ >>>> >>>> >>> ___ >>> Full-Disclosure - We believe in it. >>> Charter: http://lists.grok.org.uk/full-disclosure-charter.html >>> Hosted and sponsored by Secunia - http://secunia.com/ >>> >>> >>> > > > > > -- Best Regards, Jim Manico GIAC GSEC Professional, Sun Certified Java Programmer [EMAIL PROTECTED] 808.652.3805

Re: Corsaire Security Advisory: ChainKey Java Code Protection Bypass issue

; any action in reliance upon this information by persons or entities > other than the intended recipient(s) is prohibited. If you have > received this e-mail in error please notify the sender immediately > and destroy the material whether stored on a computer or otherwise. > -- > DISCLAIMER: Any views or opinions presented within this e-mail are > solely those of the author and do not necessarily represent those > of Corsaire Limited, unless otherwise specifically stated. > -- > Corsaire Limited, registered in England No. 3338312. Registered > office: 3 Tannery House, Tannery Lane, Send, Surrey, GU23 7EF. > Telephone: +44 (0)1483-226000 > > > > > -- Best Regards, Jim Manico GIAC GSEC Professional, Sun Certified Java Programmer [EMAIL PROTECTED] 808.652.3805

Circumventing CSFR Form Token Defense

"formtoken" : use something like: : I'll try to come up with sample attack code and do additional research if anyone considers this theory to be plausible. -- Best Regards, Jim Manico GIAC GSEC Professional, Sun Certified Java Programmer [EMAIL PROTECTED] 808.652.3805

Re: [Full-disclosure] [WEB SECURITY] Universal XSS with PDF files: highly dangerous

out CSRF :) M.B.Jr. wrote: > On 1/3/07, Jim Manico <[EMAIL PROTECTED]> wrote: >> I'm most worried about the CSRF vector. > > how come? > > this is client-side stuff. > -- Best Regards, Jim Manico GIAC GSEC Professional, Sun Certified Java Programmer [EMAIL PROTECTED] 808.652.3805

Re: PHP as a secure language? PHP worms? [was: Re: new linux malware]

s, or bulk update data, are removed. > Let us imagine a language where every "dangerous" file path is > removed, and thus, renders the language useless for any operation that > traverses a file path. > Let us imagine a language that only allows for limited looping, so it > cannot suc

Re: [WEB SECURITY] Universal XSS with PDF files: highly dangerous

r.send(null); >> >> >> More on the matter can be found here: >> >> http://www.gnucitizen.org/blog/danger-danger-danger/ >> http://www.disenchant.ch/blog/hacking-with-browser-plugins/34 >> >> -- >> pdp (architect) | petko d. petkov >> http://www.gnucitizen.org >> >> -----

Re: Cracking String Encryption in Java Obfuscated Bytecode

With respect, I disagree from a Java perspective. 1) If you are deploying Java on the server you are protected by so many layers, code obfuscation is not critical 2) If you are deploying Java Applets for enterprise applications, you are nuts. They are inherently insecure and Java applets have a lo