Re: [Full-disclosure] stealing ssh keys

2012-10-24 Thread Jacqui Caren
On 23/10/2012 16:07, Daniel Sichel wrote: Hello everybody: environment is A is hacker client? B is target and C is Manager center and C have all A and B private key. WTF! Why would anyone C or B or even A give out a PRIVATE key. Does no one RTFM - you never ever give out your private

Re: [Full-disclosure] [SE-2012-01] information regarding recently discovered Java 7 attack

2012-08-30 Thread Jacqui Caren
On 29/08/2012 19:53, Jeffrey Walton wrote: I once used DE Cert to report some issues with GnuPG on Windows. Interestingly, I was asked to provide funding for the fix even though I submitted sample code demonstrating the fix. (Crowd sourcing is a myth - don't drink the Kool-aide). When I

Re: [Full-disclosure] Associate professor from Pakistan National University - spammer

2012-08-16 Thread Jacqui Caren
On 16/08/2012 07:04, Tonu Samuel wrote: There is a gaming site meyraj.com http://meyraj.com, registered to this professor name. Not company, not someone else but he personally runs it. Its just another godaddy registration - you can use any old crap to register a domain with GD. There is a

Re: [Full-disclosure] Please remove my e-mail and IP from internet

2012-07-03 Thread Jacqui Caren
On 29/06/2012 06:47, Tonu Samuel wrote: Really funny thread is going on in Postfix-Users list. Scroll down about half of content here: http://comments.gmane.org/gmane.mail.postfix.user/227441 Just good example how NOT to do. I fwd'd details to lester haines of vulture central fame but

Re: [Full-disclosure] Fwd: [Webappsec] Call for Assistance: OWASP Virtual Patching Survey

2012-02-21 Thread Jacqui Caren
On 21/02/2012 02:04, Jeffrey Walton wrote: It is only 10 questions and by taking the survey, you could also win a free spot in the upcoming OWASP AppSecDC Virtual Patching Workshop. AT least they do not insist on an email address. ___ Full-Disclosure

Re: [Full-disclosure] Minimum Syslog Level Needed for Court Trial

2011-12-12 Thread Jacqui Caren
On 09/12/2011 10:27, xD 0x41 wrote: So, whos going to offer REAL DAMN ONLINE SEC HELP HERE , SIMPLE I read this assuming a russian accent until I hit the SIMPLE (with a four dot ellipse - shudder) From that point on everything will be read in meerkat and I just laughed my head off.

Re: [Full-disclosure] Steam defaced

2011-11-11 Thread Jacqui Caren
On 10/11/2011 23:25, Henri Salo wrote: As I usually have good news.. Here is some more: http://forums.steampowered.com/forums/ Steam joins the failboat. Its worse than that Jim, he's dead! from another mailing list... On 11/11/11 00:29, Paul M wrote: Did you get journalism training at

Re: [Full-disclosure] G+ app steals images

2011-10-24 Thread Jacqui Caren
On 24/10/2011 03:45, Tõnu Samuel wrote: FYI, G+ app on Android just steals any images you make using camera. I just made photo using camera and minute later it appeared on https://lh4.googleusercontent.com/-5ep3-OdJSCY/TqTL05oMWzI/As4/luE-w5IE3ZE/s800/DSC_0107.JPG without my

Re: [Full-disclosure] Is this for real.. http://n3td3v.org.uk/

2011-10-03 Thread Jacqui Caren-home
On 02/10/2011 18:38, Stefan Jon Silverman wrote: oy, list newbie meets n3td3v -- this should be fun Just looked at this site. Shudder. FYI: this is PART of one sentence! This site should be linked to within the wikip definition of tag soup :-) font color=#414B56 size=2 is a professional

Re: [Full-disclosure] Is this for real.. http://n3td3v.org.uk/

2011-10-03 Thread Jacqui Caren-home
On 03/10/2011 16:16, Laurelai wrote: that html makes my eyes want to bleed The site is obviously commercial, hence getting the below revoked should be a doddle via a complaint to enom. Registrant: Andrew Wallace Registrant type: UK Individual Registrant's address:

Re: [Full-disclosure] Another minor facebook security flaw

2011-09-21 Thread Jacqui Caren-home
On 20/09/2011 06:04, James Fife wrote: I noticed a recent flaw in Facebooks security resolution process recently. After being asked to confirm my identity simply because I was using a different computer, I apparently took too long to identify my friends in their photos. However, I was able

Re: [Full-disclosure] Possibility to exploit bash * processing

2011-09-21 Thread Jacqui Caren
On 21/09/2011 10:39, Cédric Jeanneret wrote: Consider using: rm ./* I dont see why someone would know how to use '--' for touch and not for rm... [jacqui@dieter test]$ touch -- -f -r [jacqui@dieter test]$ rm * [jacqui@dieter test]$ ls -l total 0 -rw-rw-r-- 1 jacqui jacqui 0 Sep 21 12:53 -f

[Full-disclosure] http://www.bestcareersopportunities.com/

2011-08-31 Thread Jacqui Caren-home
is running wordpress 3.2.1 This lahore based spammer is running a PPC link blog and is pushing his crap all over the social networks right now and has just appeared in my work spamtraps from botnett'd systems. Anyone know if the above site has any known exploits? Note the hosting company has

Re: [Full-disclosure] INSECT Pro - Free tool for pentest - New version release 2.7

2011-08-28 Thread Jacqui Caren-home
On 27/08/2011 23:12, Dan Dart wrote: Looks like it's freeWARE but not free per se. With the added disadvantage that it runs on none of the platforms I use. How sad. 0/5 review from me then. http://www.insecurityresearch.com/files/download/ From the readme's its an old version of metasploit

Re: [Full-disclosure] Phone Scam

2011-07-20 Thread Jacqui Caren-home
On 20/07/2011 14:19, Dave wrote: -BEGIN PGP SIGNED MESSAGE- Hash: SHA1 OK This is not new, but it happened to me just an hour ago. A stranger on the end of a phone call tells you your PC is infected, and you should download and install a RC server so it can be fixed. SOP. I just

[Full-disclosure] Spooks really call em Whizz and do cyber

2011-07-13 Thread Jacqui Caren-home
I need some real internet whizzes in order to do cyber ... I probably have to do better than I am doing at the moment, or else my internet whizzes are not going to stay… and we do have a steady drip, I am afraid.

Re: [Full-disclosure] Vodafone Phone Hacking Scandal - Femto hacked

2011-07-13 Thread Jacqui Caren-home
On 13/07/2011 19:47, r...@segfault.net wrote: The technical details are available at http://wiki.thc.org/vodafone. Much more importantly it allows you to avoid the insane VF roaming charges... Hacking one of these to use via openvpn when abroad means you could take your UK mobile whereever you

Re: [Full-disclosure] Is there a system or program which presents HTTP response count

2011-07-07 Thread Jacqui Caren-home
On 07/07/2011 08:03, 김무성 wrote: Is there a system or program which presents HTTP response count? Yes. ___ Full-Disclosure - We believe in it. Charter: http://lists.grok.org.uk/full-disclosure-charter.html Hosted and sponsored by Secunia -

Re: [Full-disclosure] Is there a system or program which presents HTTP response count

2011-07-07 Thread Jacqui Caren-home
On 07/07/2011 11:00, William Reyor wrote: Webalizer? Sent from my ATmega128 On Jul 7, 2011, at 5:44 AM, Jacqui Caren-homejacqui.ca...@ntlworld.com wrote: On 07/07/2011 08:03, 김무성 wrote: Is there a system or program which presents HTTP response count? Yes. Sorry folks but wrong list

Re: [Full-disclosure] Is there a system or program which presents HTTP response count

2011-07-07 Thread Jacqui Caren-home
On 07/07/2011 11:34, Ed Carp wrote: Smart ass... :p My hubs says I have a nice ass :-) ___ Full-Disclosure - We believe in it. Charter: http://lists.grok.org.uk/full-disclosure-charter.html Hosted and sponsored by Secunia - http://secunia.com/

Re: [Full-disclosure] Joomla! 1.6.3 and lower | Multiple Cross Site Scripting (XSS) Vulnerabilities

2011-06-29 Thread Jacqui Caren-home
On 29/06/2011 02:40, Nick FitzGerald wrote: Christian Sciberras wrote: Rather than that, I'd say the dev team is out of sync with the security team.. Assuming that that may be a reasonable one-sentence encapsulation of how Joomla development is organized... The fact such a sentence can be

Re: [Full-disclosure] Joomla! 1.6.3 and lower | Multiple Cross Site Scripting (XSS) Vulnerabilities

2011-06-29 Thread Jacqui Caren-home
On 29/06/2011 02:40, Nick FitzGerald wrote: The kind of problems that scream Why would anyone in their right mind use it? The official line. http://forum.joomla.org/viewtopic.php?f=432t=335090 and a good example of how CVE's are handled http://forum.joomla.org/viewtopic.php?f=432t=631398

Re: [Full-disclosure] Joomla! 1.6.3 and lower | Multiple Cross Site Scripting (XSS) Vulnerabilities

2011-06-28 Thread Jacqui Caren-home
On 28/06/2011 07:25, YGN Ethical Hacker Group wrote: Joomla! 1.6.3 and lower | Multiple Cross Site Scripting (XSS) Vulnerabilities FYI 1.5.21 seems to be AOK. IMHO The Joomla team do not seem to grok the concept of regression testing and keep re-introducing the same XSS problems over and over

Re: [Full-disclosure] Mambo CMS 4.6.x (4.6.5) | Multiple Cross Site Scripting Vulnerabilities

2011-06-27 Thread Jacqui Caren-home
On 27/06/2011 09:15, YGN Ethical Hacker Group wrote: Mambo CMS 4.6.x (4.6.5) | Multiple Cross Site Scripting Vulnerabilities I thought these were found in Joomla ages ago? Did you really test a code base that is a version of an old Joomla base or did you look at the code, and test old Joomla

Re: [Full-disclosure] Fwd: Reminder about your invitation from Rain Liu

2011-05-03 Thread Jacqui Caren-home
On 03/05/2011 12:11, Cal Leeming wrote: Eww, what a horrible acronym. I thought it was common usage! The reason for the acronym? I keep getting stupid rejections from members on this list from a certain clueless US ISP who sends backscatter to whoever is in the envelope from address. Yes

Re: [Full-disclosure] Unbelivable, Pangolin 3.2.3 free edition released

2011-04-30 Thread Jacqui Caren-home
On 25/04/2011 16:31, Steven Pinkham wrote: It's entirely possible that is all there is to it. Let me be perfectly clear: For people in the real world to trust your tool, This stupid f-wit is now sending linkedin invites to full-disclosure posting addresses - following his abusive adverts for

Re: [Full-disclosure] Unbelivable, Pangolin 3.2.3 free edition released

2011-04-25 Thread Jacqui Caren-home
On 25/04/2011 06:51, Beatyou Man wrote: I tried Pangolin 2.5.2 and the latest one. No data will be transfered to the server you mentioned in http://laramies.blogspot.com/2009/05/pangolin-and-your-data.html; Why don't you trust your eyes and try this one? OK let have a bash - literally.

Re: [Full-disclosure] Unbelivable, Pangolin 3.2.3 free edition released

2011-04-25 Thread Jacqui Caren-home
On 25/04/2011 11:29, Jacqui Caren-home wrote: On 25/04/2011 06:51, Beatyou Man wrote: I tried Pangolin 2.5.2 and the latest one. No data will be transfered to the server you mentioned in http://laramies.blogspot.com/2009/05/pangolin-and-your-data.html; Why don't you trust your eyes and try

Re: [Full-disclosure] Vulnerabilities in *McAfee.com

2011-03-31 Thread Jacqui Caren-home
On 31/03/2011 13:13, BlackHawk wrote: to close with a semi-serious joke: put all this together and you will know why black market selling of exploit is increasing his size: at least someone will appreciate your work and eventually recompensate you for it.. Everyone makes mistakes. Being

Re: [Full-disclosure] [AntiSnatchOr] Drupal = 6.20 insecure Captcha defaults PoC

2011-02-18 Thread Jacqui Caren-home
On 15/02/2011 16:55, Michele Orru wrote: 2011/2/14 MustLivemustl...@websecurity.com.ua: Hello Michele! Few days ago I saw your advisory about Drupal's captcha. It's interesting advisory, but I have one note concerning it - your research is very close to mine ;-) (it concerns similar holes

Re: [Full-disclosure] Fwd: Re getting off the patch

2011-01-16 Thread Jacqui Caren-home
On 15/01/2011 01:53, Glenn Everhart wrote: If you have a system that is built well secured in the first place (existence proof: VMS) then patches are comparatively rare. This is a joke right? When I first used VMS there was a bug that when a directory was deleted all files within the

Re: [Full-disclosure] TEHTRI-Security: Many 0days soon released at SyScan Singapore 2010

2010-06-02 Thread Jacqui Caren-home
Fionnbharr wrote: Thanks for the marketing spam On 2 June 2010 20:11, Laurent OUDOT at TEHTRI-Security laurent.ou...@tehtri-security.com wrote: There, we will release more than 13 remote pre-auth zero-days against many different products (yes: 13 0days...). Hmm a company that can predict

Re: [Full-disclosure] go public to avoid jail

2010-05-04 Thread Jacqui Caren-home
PsychoBilly wrote: The_UT went to jail because his Gonzales m8 kindly supplied irc logs A *long* time ago I found a buffer overflow issue with a MAC web server reported to devs but no takeup. With only a few hundred web requests I could take down a web server. Noddy stuff today but in those