Nahu-
For the most part I use pipal, however, I've used PACK in the past as well.
PACK is great if you use hashcat for cracking as it generates valid masks as
input files for you.
http://thesprawl.org/projects/pack/
Daniel
> On Mar 10, 2014, at 11:45 AM, Nahuel Grisolia
> wro
I can see it's starting to
look like a pattern for you.
Daniel
On Feb 8, 2014, at 6:17 AM, Justin Ferguson wrote:
>> That's not what I said when you were trolling offline. You could cite
>> it if you'd like.
>
> its cool, i actually didnt click reply-all
is
being written to the disk.
- Daniel Wood
On Jan 13, 2014, at 10:28 PM, Daniel Wood wrote:
> Title: [CVE-2014-0647] Insecure Data Storage of User Data Elements in
> Starbucks v2.6.1 iOS mobile application
> Published: January 13, 2014
> Reported to Vendor: December 2013 (no
There is a reddit post regarding this.
Please see
http://www.reddit.com/r/Ubuntu/comments/1jek5d/why_am_i_seeing_canonical_when_i_search_using/
Daniel
> On Jan 14, 2014, at 6:41 AM, silence_is_b...@hushmail.com wrote:
>
> Any particular reason when setting duckduckgo as the defau
Title: [CVE-2014-0647] Insecure Data Storage of User Data Elements in Starbucks
v2.6.1 iOS mobile application
Published: January 13, 2014
Reported to Vendor: December 2013 (no direct response)
CVE Reference: CVE-2014-0647
Credit: This issue was discovered by Daniel E. Wood
http://www.linkedin.com
On Jan 6, 2014, at 8:14 AM, Anonymous wrote:
>>> GSM firmware is still not open-source though (as that would make
>>> phone not suitable for legal usage in USA)
>>
>> I'd like to see a law link that says you cannot legally use your own
>> open source GSM compliant stack to communicate over a GS
focusing on the fact that information was disclosed after they had
6+ months to fix the vulnerability, they should be focusing on the positive
aspect that they were able to fix the vulnerability and that it does not affect
their product’s current release version.
- Daniel Wood
On Dec 16
/AC:L/Au:N/C:C/I:N/A:N/E:H/RL:U/RC:C)
Credit: This issue was discovered by Daniel E. Wood
http://www.linkedin.com/in/danielewood
Vendor: ZippyYum, LLC | http://www.zippyyum.com
Application: https://itunes.apple.com/us/app/subwayoc/id510770549?mt=8
Tested Version: 3.4
File: SubwayOCKiosk.app
App
I also forgot to mention that the ciphertext also includes the readable
words "IF", "THEN", "RUN", "you" (next to tip) and "URDAD" besides those I
already mentioned.
On 3 November 2013 22:33, Daniel Llewellyn wrote:
> the quote is from a sav
the quote is from a savant called "Daniel Tammet":
http://en.wikipedia.org/wiki/Daniel_Tammet
the clue is to count primes, not just count. I got as far as spotting that
the ciphertext has the words "clue" and "tip" where clude is at character
locations 11, 12, 13 and
x90c,
Still missing RSBAC :)
http://www.rsbac.org/
http://www.rsbac.org/doc/media/lk2004-tutorial-handout.pdf
Daniel
___
Full-Disclosure - We believe in it.
Charter: http://lists.grok.org.uk/full-disclosure-charter.html
Hosted and sponsored by Secunia
2013/9/28 x90c :
> Hi forks!
>
> I release an article for linux kernel security.
> - http://www.x90c.org/articles/linux_kernel_patches.txt
>
>
> x90c
RSBAC?
http://www.rsbac.org/
Daniel
___
Full-Disclosure - We believe
-Daniel Bacanu
From: Kristian Erik Hermansen
To: "full-disclosure@lists.grok.org.uk"
Sent: Tuesday, September 24, 2013 7:28 PM
Subject: [Full-disclosure] IBM AIX 6.1 / 7.1 - Local root Privilege
Escalation
Moin Moin :)
Does anyone have IBM AIX
Not very subtle, but effective. Because you know the alternative would
be to pick up the phone and call them.
Stefan Jon Silverman writes:
> Can I have my mid-90's ping-of-death back??? was incredibly useful for getting
> people (on internal corporate networks) to call the helpdesk when their
+1
Daniel Preussker
[ Research and Engineering
[ dan...@preussker.net
[ http://pgp.mit.edu:11371/pks/lookup?op=get&search=0x87E736968E490AA1
On 16.08.2013, at 23:49, adam wrote:
> Jann, you know what's even worse than someone being a dick for no
> reason? Someone being a _stup
can you paste it somewhere where no login is required please?
Daniel Preussker
[ Security Consultant, Network & Protocol Security and Cryptography
[ LPI & Novell Certified Linux Engineer and Researcher
[ dan...@preussker.net
[ http://pgp.mit.edu:11371/pks/lookup?op=get&search=0x87E7
You mean like using GMail via Webmail (without PGP)? Which security
professional would do this? Do you still use Telnet to manage your
devices instead of SSH?
Yeah, pretty much. Is that a problem? I mean who cares about the privacy or
security of email? As to the telnet, I have a firewall, what c
+1 (including +1 for the 'rant' about cloud)
Daniel Preussker
[ Security Consultant, Network & Protocol Security and Cryptography
[ LPI & Novell Certified Linux Engineer and Researcher
[ +49 178 600 96 30
[ dan...@preussker.net
[ http://pgp.mit.edu:11371/pks/lo
Hi,
it seems to be patched now
Cheers,
Daniel Preussker
[ Security Consultant, Network & Protocol Security and Cryptography
[ LPI & Novell Certified Linux Engineer and Researcher
[ +49 178 600 96 30
[ dan...@preussker.net
[ http://pgp.mit.edu:11371/pks/lookup?op=ge
We are really proud to announce the ninth edition of the ekoparty Security
Conference.
Once again, in this unique event, security specialist from all over Latin
America and the World will have the chance to get acquainted with the most
important researches of the year.
ekoparty has become the mos
bump
On 29.05.2013, at 16:11, Andre Helwig wrote:
> Best solution, don't report the bugs.
> Use the bugs to get your money.. and publish them afterwards :D
>
>
> On 29.05.13 16:04, James Condron wrote:
>> Hrm,
>>
>> I read it that the issue was still the age but that the previous disclosure
>
+1
Am Donnerstag, den 11.04.2013, 00:00 +0200 schrieb Stefan Jon Silverman
:
-BEGIN POPEYE (SPINACH) SIGNED MESSAGE-
Hash: SHAK's-SHORTS
___
Mandriva Linux Security Advisory MDVSA-2013:ALL
__
I agree with the idea of daily digests instead of bursting out dozen of
emails for really old vulns.
Yet having them off the list wouldnt do any harm either... As somebody
said before, many distributions did it already and send this on their
own lists.
- Daniel Preussker
Aspen 0.8 - Directory Traversal
Earlier versions are also possibly vulnerable.
INFORMATION
Product: Aspen 0.8
Remote-exploit: yes
Vendor-URL: http://www.zetadev.com/software/aspen/
Discovered by: Daniel Ricardo dos Santos
CVE Request - 15/03/2013
CVE Assign - 18/03/2013
CVE Number - CVE-2013
Network Weathermap 0.97a - Persistent XSS
Earlier versions are also possibly vulnerable.
INFORMATION
Product: Network Weathermap 0.97a
Remote-exploit: yes
Vendor-URL: http://www.network-weathermap.com/
Discovered by: Daniel Ricardo dos Santos
CVE Request - 15/03/2013
CVE Assign - 18/03/2013
CVE
st regards from Finland,
Daniel Preussker
PS: No offense meant, if you feel offended, delete the mail and ignore me and
the rest of the world. stop crying.
> Bryan Baldwin hat am 30. März 2013 um 09:25
> geschrieben:
>
> On 03/30/13 01:00, Jerry dePriest wrote:
>
> > &
> I could go thru this list and make money turning all you assholes in...
>
> I found a flaw in my front door's lock. It's called a "donkey kick" and is
> quite
> effective on 98% of all door locks.
>
> you guys slay me.
>
>
>
> FOAD
Do you have proof of concept code on the donkey kick thing
Folks,
It's been a day now since the public disclosure of CVE-2013-2266
(https://kb.isc.org/article/AA-00871):
> A flaw in a library used by BIND 9.7, 9.8, and 9.9, when compiled on
> Unix and related operating systems, allows an attacker to
> deliberately cause excessive memory consumption by th
intelligent...
There are ofc a lot more examples, one individual I used to talk to was close
to jail due to an SQL-Injectection disclosure...
I admit, I might have over exaggerated the situation a bit in rage.
Kind regards,
Daniel Preussker
[ Security Consultant, Network & Protocol Securi
u solve...
And on the other hand, those same companies give away 3-15.000 for a single bug
if the researcher happens to be known :|
Now I don't intent to start a shitstorm or a war here...
Kind regards from the U-Bahn,
Daniel Preussker
[ Security Consultant, Network & Protocol Security
fake clients and
> off goes the AP...
>
> But I would put this "design flaw" in the same cat as the Y2K Problem or the
> Y10K (Y100K, and so on) - just beacuse we currently dont hit it doesnt mean
> we can leave it as it is...
>
>
> Kind Regards without coffe
the latter requiring a reexamination of your
interpersonal relationships.
-Daniel
Daniel Preussker writes:
> Hi,
>
> I was looking into the net/core/dev.c from the current Kernel
> (previous also have this) and found out that ifIndex gets incremented
> by an endless loop.
>
question, is this known?
Daniel Preussker
[ Security Consultant, Network & Protocol Security and Cryptography
[ LPI & Novell Certified Linux Engineer and Researcher
[ +49 178 600 96 30
[ dan...@preussker.net
[ http://pgp.mit.edu:11371/pks/lookup?op=get&search=0x87E736968E490AA
Discovered several UPnP vulnerabilites which allowed me to gain full shell
access and modify the state of the device being controlled. Im in the process
of disclosing to Belkin. PoC soon to come. Link to video below.
http://youtu.be/BcW2q0aHOFo
Belkin WeMo with latest firmware. Able to gain ful
Discovered several UPnP vulnerabilites which allowed me to gain full shell
access and modify the state of the device being controlled. Im in the process
of disclosing to Belkin. PoC soon to come. Link to video below.
http://youtu.be/BcW2q0aHOFo
Belkin WeMo with latest firmware. Able to gain ful
Discovered several UPnP vulnerabilites which allowed me to gain full shell
access and modify the state of the device being controlled. Im in the process
of disclosing to Belkin. PoC soon to come. Link to video below.
http://youtu.be/BcW2q0aHOFo
Belkin WeMo with latest firmware. Able to gain ful
The correct answer you're looking for is: Sell it on the black
vulnerability/exploit market. Profit!
On Tue, Jan 22, 2013 at 3:08 PM, Sanguinarious Rose
wrote:
> And that is the reason why no one wants to report anything they find,
> it's because of people like you and your kind of thinking.
>
>
Christmas and a happy new year!
Daniel Preussker
[ Security Consultant, Network & Protocol Security and Cryptography
[ LPI & Novell Certified Linux Engineer and Researcher
[ +49 178 600 96 30
[ dan...@preussker.net
[ http://pgp.mit.edu:11371/pks/lookup?op=get&search=0x87E736968E490AA1
> Hello everybody:
> environment is A is hacker client? B is target and C is Manager
> center and C have all A and B private key.
> C are open 80,22. And this is http's 403 state on the C.
> I have A's root,how to steal private key On the C. Are there have
> some vuln with openssh.
Dave,
Thank you for reporting this vulnerability. NVIDIA has released an updated
driver, version 304.32, which contains a hotfix to block access to the
registers involved in this attack, as well as some other registers which
we have identified as being susceptible to a similar type of attack. In
a
It depends what the attackers motive is. Is he/she trying to get as many
machines infected as he/she can. Or is he/she trying to get into YOUR
network.
My 2c
On 21/06/2012 20:20, Thor (Hammer of God) wrote:
> I completely agree with Gage. The way I see it, security through obscurity
> is perfec
You can create an XSS with a SQLi
If you can output on the page, you can inject HTML/JS with that variable
On 25/05/2012 09:58, Federico De Meo wrote:
> Hello everybody, I'm new to this maling-list and to security in general.
> I'm here to learn and I'm starting with a question :)
>
> I'm lookin
CALL FOR PAPERS
We are really proud to announce the eight edition of the ekoparty security
conference. Once again, in this unique event, security specialist from all
over the globe (and beyond) will have the chance to get acquainted with the
most important researches of the year.
In this ye
Right. I think you're entirely correct to call this out as a distinct
feature from checking the user's raw credentials. The point of this
function is, as Mike said, to try to protect against bulk use of stolen
credentials--the starting assumption is thus that the attacker already has
valid credenti
The code is broken,
All pages have a require_once() that references a static path.
require_once('/scanner/functions/databaseFunctions.php');
This needs to be
require_once('./scanner/functions/databaseFunctions.php');
Dan
On Thu, May 17, 2012 at 12:48 AM, Dermot Blair wrote:
> Hi All,
>
>
>
-BEGIN PGP SIGNED MESSAGE-
Hash: SHA1
On 12/12/2011 07:37 PM, Ramon de C Valle wrote:
>>> But how can I state that ftp has access to the users homedir
>>> and not allow access to user_home_t?
>> This is a good question. Actually, we shouldn't allow ftpd_t read
>> the locale files from with
-BEGIN PGP SIGNED MESSAGE-
Hash: SHA1
On 12/12/2011 11:58 AM, Ramon de C Valle wrote:
>
>
>> Ramon, not sure I understand, what are you trying to prevent
>> here?
> Hello Dan, vsftpd processes open locale files from the
> "/usr/share/zoneinfo" directory, which are expected to have the
>
-BEGIN PGP SIGNED MESSAGE-
Hash: SHA1
On 12/12/2011 11:22 AM, Ramon de C Valle wrote:
>> I havent looked into it yet, just saw the 0x41414141 in the
>> registers and assumed it is exploitable.I will have a look into
>> it when I find time and post the results here.
> Just some additional i
Note that it's an option (That seems to be on by default?) that you
can disable in the G+ app settings.
(This however would be handing for when taking photos out and public
and idiot cops/security guards "ask" you to delete photos you've just
taken!)
On Mon, Oct 24, 2011 at 3:45 PM, Tõnu Samuel
>Well there is no push to make snail-mail encrypted and lets face it
most
>peoples mailboxes don't have any sort of locking mechanisms and is
>available to anyone with two hands and the malicious intent to steal
>someones mail however the US Gov needs a warrant to intercept your
>physical mail
>In fact, law enforcement officials don?t even need a search warrant to
>access private emails.
In point of fact, nobody does, although acquiring this access is clearly
easier for law enforcement.
One of the burdens that the freedom the Internet brings, is the freedom.
Your email is out there, typ
Somebody posted the following;
> I'm just curious to these questions. It's strange to hear someone
> saying "we basically have no idea what's going on".
>
Doesn't sound funny to me, happens to me all the time. That's how I
learn.
Dan S.
___
Full-
is not such a hard thing to do. If you really want to catch all the steps try
implement a honeypot on one of your test servers.
I wish you good luck,
-----
Adrian-Daniel Bãcanu
-
From: BH
Anyone else seen this going around?
I've got a couple of links coming through for this via hacked email
accounts. Looks like its installing FakeAV.
Links include:
www [dot] epo4 [dot] com [slash] find11.html
I can't seem to find anything on google about it yet though.
Dan
__
/27/2010
Author: Daniel Clemens [daniel.clemens[at]packetninjas.net]
Application: Zeacom Chat Application <= 5.0 SP4
Severity:
Usage of weak Weak Session management exists within the Zeacom web-chat
application
enabling the bruteforce of the sessionid which
, Javier Bassi wrote:
>> On Tue, May 3, 2011 at 7:51 PM, Daniel Clemens
>> wrote:
>>> Prove it!
>>> You clearly know nothing about our legal system.
>>
>> You might find this links interesting
>> http://www.youtube.com/watch?v=t0aQojDGSD4
>>
that they have developed for US intelligence to use.
Prove it!
You clearly know nothing about our legal system.
| Daniel Uriah Clemens
| Packetninjas L.L.C | | http://www.packetninjas.net
| c. 205.567.6850 | | o. 866.267.8851
"Moments of sorrow are moments of sobriety"
On 02/05/2011 20:08, t0hitsugu wrote:
> Not much of a find, but the firefox4 app for android transmits your
> google accounts email/password in plain text
> posted a picture here, as I didnt know where else to:
> http://img861.imageshack.us/img861/6466/ff4e.png
Note the s in https://tohitsugu:@ma
: Daniel Clemens [daniel.clemens[at]packetninjas.net]
Application: MediaCast <= 8 (By Inventive, Inc) - http://www.InventiveTec.com
Description:
Vulnerabilities exist within the MediaCast application have been discovered
that allow
an unauthenticated user to force the application to ret
On 9/12/2010 4:43 PM, paul.sz...@sydney.edu.au wrote:
> Firefox's interpretation of the same-origin policy is more strict than
> most other browsers, and it affects how fonts are loaded with the
> @font-face CSS directive. ...
> There is a solution to this, however, if you manage the se
OK, I am in the Golden state (California) where things are not so golden
at the moment.
I deal with a state agency and use their "secure" ftp site.
Their certificate has expired and won't be renewed for a few weeks, but
they want me to continue to ftp stuff
Using their expired cert.
So, as a rela
>Message: 4
>Date: Fri, 09 Jul 2010 09:38:49 -0400
>From: Iadnah
>Subject: [Full-disclosure] Nostalgia and days gone by
>To: full-disclosure@lists.grok.org.uk
>Message-ID: <4c372669.4000...@uplinklounge.com>
>Content-Type: text/plain; charset=ISO-8859-1; format=flowed
>
>I know this is offtopic bu
rsity, USA
Jeff Williams, Microsoft, USA
Yang Xiang, Deakin University, Australia
------
Publicity chair: Daniel Reynaud, Nancy University - Loria, France
Local chair: Matthieu Kaczmarek, INRIA Nancy Grand-Est, France
__
University, USA
Jeff Williams, Microsoft, USA
Yang Xiang, Deakin University, Australia
------
Publicity chair: Daniel Reynaud, Nancy University - Loria, France
Local chair: Matthieu Kaczmarek, INRIA Nancy Grand-Est, France
___
We have a boneheaded group of software developers who even in this day
and age eschew the client server model of software for the easier dumber
run it from the console school of design. So I have this idiotic Windows
accounting application that MUST run on an application server, cannot be
rance
Andrew Walenstein, Lafayette University, USA
Jeff Williams, Microsoft, USA
Yang Xiang, Deakin University, Australia
------
Publicity chair: Daniel Reynaud, Nancy University - Loria, France
Local chair: Matt
installing
xchat-gnome when you look through the software centre, but personally I
prefer the original xchat. Do I complain that I'm being forced by the Ubuntu
people to use an "evil" minimalist HIG-compliant xchat? no, instead I fire
up synaptic and install the xchat package instead of the xchat-gnome
package.
--
Regards,
Daniel Llewellyn
___
Full-Disclosure - We believe in it.
Charter: http://lists.grok.org.uk/full-disclosure-charter.html
Hosted and sponsored by Secunia - http://secunia.com/
bugsban...@hushmail.com wrote:
> ...Unpatched bug since Mozilla firefox 3.0...
>
> Mozilla "INsecurity team" remember, security through obscurity just
> DOESN'T WORK...
> Locking down bugzilla advisories even the 2 years old ones is
> unnecessary and lame.
Care to expand on "locking down" and "
mrx wrote:
> ps I wish Thunderbird would default to the list when replying.
Thunderbird 3.0 supports Reply to List (ctrl-shift-L) when there's a
List-Post: header (which full-disclosure has). Maybe not what you meant by
"default" but sure beats doing Reply to All and then deleting addresses
other
Hello,
Please excuse the corny subject line, but it is my farewell speech, and I
couldn't help it...
My apologies also if you received two copies of this note, as I wanted to
ensure that everyone did in fact get a copy.
The purpose of this email is to notify you of my moving on from the comput
While resolving a tech support issue with McAfee Smart Filter I found
the clear text password and user name of the SmartFilter user ID that
authenticates to the proxy server in at least one place, the config.txt
file in the config subdirectory under c:\Program Files\Secure
Computing\Smartfilter Adm
)
- Blind SQL injection: 1 request -> 1/7 char
- Union / error-based SQL injection: 1 request -> 1 field
- SFX-SQL injection: 1 request -> 1 table
So yes, this technique will extract the same data, but thousands of times
faster than other methods.
Rega
://www.kachakil.com/papers/SFX-SQLi-en.htm
Regards,
Daniel Kachakil
___
Full-Disclosure - We believe in it.
Charter: http://lists.grok.org.uk/full-disclosure-charter.html
Hosted and sponsored by Secunia - http://secunia.com/
I finally made it to the penultimate level of "Important enough to be
spoofed"
Woo-hoo!!
Note to spoofer:
Please learn how to send email first...I need to claim my notoriety!
--
Sincerely,
Daniel H. Renner
President
Los Angeles Computerhelp
A division of Co
On Mon, Nov 10, 2008 at 12:29 AM, n3td3v <[EMAIL PROTECTED]> wrote:
> This isn't n3tcr4p, this is a wide issue shared by many people
> including a british telecom engineer.
>
> http://lists.grok.org.uk/pipermail/full-disclosure/2008-October/065252.html
>
> n3td3v will not be 'getting the fuck out
You do care
That is why you replied
On 10/21/08, n3td3v <[EMAIL PROTECTED]> wrote:
> On Mon, Oct 20, 2008 at 2:45 PM, <[EMAIL PROTECTED]> wrote:
>> Either I'm on your list, or I'm not. Make up your mind.
>>
>
> I don't care anymore, I really don't care.
>
> __
This should play nicer with some auto-linking code: http://isis.poly.edu/csaw/
Sorry about that!
--
Dan Guido
___
Full-Disclosure - We believe in it.
Charter: http://lists.grok.org.uk/full-disclosure-charter.html
Hosted and sponsored by Secunia - http:
om/estadisticas.html
-------
Daniel Guido
Polytechnic University
Cyber Security Awareness Week 2007 Essay Contest
It's Not About Security Products
The United States, much like the rest of the world, creates laws and
regulations to protect its citizens from dangers ranging from tainted
food to hazardo
Daniel Veditz wrote:
> carl hardwick wrote:
>> I set network.protocol-handler.warn-external.mailto to 'true', clicked
>> on an e-mail link and Windows Mail is launched without any warnings
>
> That state is now saved elsewhere and managed through the "App
carl hardwick wrote:
> For example,
> I set network.protocol-handler.warn-external.mailto to 'true', clicked
> on an e-mail link and Windows Mail is launched without any warnings
> (tested on Firefox 3.0 on Windows Vista SP1)
That state is now saved elsewhere and managed through the "Applications"
all again.
Daniel Sichel, CCNP, MCSE,MCSA,MCTS (Windows 2008)
Network Engineer
Pwnderosa Telephone (559) 868-6367
___
Full-Disclosure - We believe in it.
Charter: http://lists.grok.org.uk/full-disclosure-charter.html
Hosted and sponsored by
when you are in the United States, it's a
bad idea to drive on the left hand side of the road. It's just so basic
it's not documented anywhere. So, please help me explain why netbios and
file shares on machines not within your network are bad ideas.
Thanks,
Daniel Sichel,
On Tue, May 20, 2008 at 10:06 AM, Paul Schmehl <[EMAIL PROTECTED]> wrote:
> --On May 19, 2008 3:50:37 PM -0400 Elazar Broad <[EMAIL PROTECTED]>
> wrote:
>
> > Yea, and there are plenty that can't even set up their own home
> > network...
> >
>
> If that's true, I'm sure you can name a few.
>
> Or
Hey,
Ureleet wrote:
> i declare may 1 "dont post anything to full-disclosure day". just in
> spite of n3td3v thinking that hes going to claim all the glory for his
> own website that day, i say that no one post _a thing_.
Well I expect to start the indulgence of the bank holiday early; no
"re
o difficult to disable it by
default unless and SBP device is in use. Even in that case it is
apparently possible to limit the access granted to a particular device
(eg only allow it for the places you expect the device to write to).
--
Daniel O'Connor software and network engineer
for Gen
: High
# Author: Daniel Roethlisberger
# Date: 2008-02-25
# CVE Name: CVE-2008-0385
#
#
Introduction
An AJAX based Blind SQL Injection vulnerability exists in
the Web 2.0 CMS framework Urulu [1]. A
Randal, Phil wrote:
> And the mozilla bugzilla numer is?
https://bugzilla.mozilla.org/show_bug.cgi?id=403746
___
Full-Disclosure - We believe in it.
Charter: http://lists.grok.org.uk/full-disclosure-charter.html
Hosted and sponsored by Secunia - http://
# Risk: Medium
# Author: Daniel Roethlisberger
# Date: 2008-01-29
# CVE Name: CVE-2007-6340
#
#
Introduction
LSrunasE [1] and Supercrypt [2] are utilities used to run
commands under a different user
Dude VanWinkle wrote:
> On Nov 29, 2007 12:11 PM, <[EMAIL PROTECTED]> wrote:
>> On Wed, 28 Nov 2007 21:44:40 PST, "Daniel H. Renner" said:
>>> From what I've noticed, users of MS' FTP client aren't the usual
>>> Windows GUI user.
From what I've noticed, users of MS' FTP client aren't the usual
Windows GUI user. So that would be one good social engineering trick...
Original Message:
> Date: Wed, 28 Nov 2007 18:34:47 -0500
> From: "Peter Dawson" <[EMAIL PROTECTED]>
> Su
goal, then we have become their
enemy, not their ally. It's the same old story, computer security is
something you have, end user trust; and something you know, I must (and
can) allow my end users to get their jobs done timely and securely.
Daniel Sichel, CCNP, MCSE
On 10/15/07, Kelly Robinson <[EMAIL PROTECTED]> wrote:
>
> In the Control Field of a TCP segment I noticed the following values:
>
> URG 0
> ACK 0
> PSH 0
> RST 0
> SYN 1
> FIN 1
>
> I assume the checksum is OK, is this an attack packet? If not, why not? If
> so, what is the attacker probably tryin
carl hardwick wrote:
> PoC concept here:
> javascript:5.2-0.1
> (copy this code into address bar)
>
> Firefox 2.0.0.7 result: 5.1005 (WRONG!)
> Internet Explorer 7 result: 5.1 (OK)
In IE7 and Opera I get the same thing you do for Firefox. This is not
surprising because the ECMAScript
On 9/28/07, Jimby Sharp <[EMAIL PROTECTED]> wrote:
>
> I am a system administrator and I find this list full of noise due to
> people like you.
>
> On 9/28/07, Knud Erik Højgaard <[EMAIL PROTECTED]> wrote:
> > I am a system administrator and I find this list full of noise due to
> > people like you
carl hardwick wrote:
> Found a lof of sites exploiting Firefox URI vulnerability!!!
Maybe I'm getting to these sites after they've been cleaned up, or maybe
I'm just missing it, but what exactly are they exploiting and how? I don't
see anything that looks like the recent announced Firefox URI prob
Daniel Veditz wrote:
> carl hardwick wrote:
>> @Daniel Veditz
>> IE6 SP2 and IE7 are not affected!
>
> IE is affected if you use the Sun JRE. Not the default, I know, but then
> unless you've installed Sun's JRE Firefox doesn't come with Java either.
>
carl hardwick wrote:
> @Daniel Veditz
> IE6 SP2 and IE7 are not affected!
IE is affected if you use the Sun JRE. Not the default, I know, but then
unless you've installed Sun's JRE Firefox doesn't come with Java either.
http://evil.hackademix.net/f
a plagiarist wrote:
> PoC here:
> http://carl-hardwick.googlegroups.com/web/Firefox2.0.0.6JavaPopUpDoS.htm
In your haste to get this important warning out to full-disclosure you
forgot to credit Ronald van den Heetkamp as your source:
http://www.0x00.com/index.php?i=408
Re-written an an appl
Give it until six months before the next presidential election...
Daniel H. Renner
President
Los Angeles Computerhelp
A division of Computerhelp, Inc.
818-352-8700
http://losangelescomputerhelp.com
[EMAIL PROTECTED] wrote:
Date: Mon, 30 Jul
Billy Rios wrote:
> I've posted a PoC for remote command execution in Firefox (2.0.0.5),
> Netscape Navigator 9, and mozilla at:
> http://xs-sniper.com/blog/2007/07/24/remote-command-execution-in-firefox-2005/
>
> These specific examples are built for WinXP SP2 WITH NO OTHER EXTERNAL
> EMAIL progr
1 - 100 of 164 matches
Mail list logo
