[Full-disclosure] Universal XSS vulnerability in Ad Muncher

2010-12-29 Thread MustLive
Hello Full-Disclosure! I want to warn you about Cross-Site Scripting vulnerability in Ad Muncher. In May I already wrote about universal XSS in Ad Muncher (http://websecurity.com.ua/4202/), which allowed to conduct XSS attacks on any sites in any browsers. Which existed in versions before Ad Munc

Re: [Full-disclosure] Fwd: some considerations on Ettercap code repository breach

2010-12-29 Thread exploit dev
just publish new details. Regards. I hope that this could be useful for understand my point of view. Regards On Wed, Dec 29, 2010 at 10:22 PM, wrote: > On Wed, 29 Dec 2010 20:04:56 GMT, "Cal Leeming [Simplicity Media Ltd]" > said: > > Just playing devils advocate, but that "mind map" image rea

Re: [Full-disclosure] Fwd: some considerations on Ettercap code repository breach

2010-12-29 Thread Valdis . Kletnieks
On Wed, 29 Dec 2010 20:04:56 GMT, "Cal Leeming [Simplicity Media Ltd]" said: > Just playing devils advocate, but that "mind map" image really does not have > any usefulness... Just playing an even more evil devil's advocate, but just because you didn't *see* the image as containing anything useful

[Full-disclosure] Fwd: some considerations on Ettercap code repository breach

2010-12-29 Thread Cal Leeming [Simplicity Media Ltd]
Just playing devils advocate, but that "mind map" image really does not have any usefulness... I really just don't understand why you have made it and shared it with us. Unless I've missed something here? On Wed, Dec 29, 2010 at 7:53 PM, exploit dev wrote: > Hi Wendel, > > My post is not about

Re: [Full-disclosure] some considerations on Ettercap code repository breach

2010-12-29 Thread exploit dev
Hi Wendel, My post is not about the possibility that the Ettercap code was been backdoored or not. I have only try to explain (with very few details) how is possible find breaches in well known web sites (like sourceforge) starting from the analaysis of source ode of a p(php/perl/python)bot. Nothi

Re: [Full-disclosure] some considerations on Ettercap code repository breach

2010-12-29 Thread Wendel Guglielmetti Henrique
Hi, One of the claims made in the zine was that they compromised the popular ARP-Spoofing toolkit – Ettercap, and implied that the code had been altered several years ago. The implication was that a backdoor was placed in the code. However, there is no evidence... We wrote a post about that @ Spi

[Full-disclosure] [ MDVSA-2010:260 ] libxml2

2010-12-29 Thread security
-BEGIN PGP SIGNED MESSAGE- Hash: SHA1 ___ Mandriva Linux Security Advisory MDVSA-2010:260 http://www.mandriva.com/security/ _

Re: [Full-disclosure] some considerations on Ettercap code repository breach

2010-12-29 Thread Cal Leeming [Simplicity Media Ltd]
Lol at the ettercap sheep, quite accurate tbh. But, can you explain what the point of the mindmap picture is supposed to be? On Wed, Dec 29, 2010 at 6:32 PM, exploit dev wrote: > If you are interested > > http://extraexploit.blogspot.com/2010/12/some-considerations-on-ettercap-source.html > >

[Full-disclosure] some considerations on Ettercap code repository breach

2010-12-29 Thread exploit dev
If you are interested http://extraexploit.blogspot.com/2010/12/some-considerations-on-ettercap-source.html Regards -- http://extraexploit.blogspot.com ___ Full-Disclosure - We believe in it. Charter: http://lists.grok.org.uk/full-disclosure-charter.htm

[Full-disclosure] Awakenedlands.com Hacked/Username-Password Dump & Source Code

2010-12-29 Thread AwakenedLands.com Account Activation
Dumb admin over at Awakenedlands.com Here's all their code and a decrypted users table 35k of emails and 16k of md5 decrypted hashes. I also include most of the tables name and data, and column names. users list: http://bit.ly/hFW7Ak code: http://bit.ly/gN5KFk Site currently reads: AwakenedLa

[Full-disclosure] Fusion of Exploits - Multiplexing exploitation

2010-12-29 Thread Prashant Uniyal
Hello! A white paper on exploitation. Topic:- Fusion Of Exploits: Multiplexing exploitation Thanks and Regards -- Prashant Uniyal www.hackingethics.wordpress.com ___ Full-Disclosure - We believe in it. Charter: http://lists.grok.org.uk/full-disclosure

[Full-disclosure] [SECURITY] [DSA 2138-1] Security update for wordpress

2010-12-29 Thread Giuseppe Iuculano
-BEGIN PGP SIGNED MESSAGE- Hash: SHA1 - Debian Security Advisory DSA-2138-1 secur...@debian.org http://www.debian.org/security/Giuseppe Iuculano December 29, 2010

Re: [Full-disclosure] [0day?] sql-injection in people.joomla.org

2010-12-29 Thread Zerial.
-BEGIN PGP SIGNED MESSAGE- Hash: SHA1 has been fixed On 12/28/10 14:31, Zerial. wrote: > Hi folks, > > Exists an SQL-Injection on http://people.joomla.org > > http://people.joomla.org/events.html?groupid=1%20or%201=0%20union%20select%20all%201,2,3,4,5,6,7,8,9,10,11,12,13,14,15,16,16,17