SecuriTeam Blogs
 
Showing 1-10 of 64 records
 
Expand article

How not to handle a responsible XSS disclosure!

2010-01-08 10:35:10 by xyberpix in SecuriTeam Blogs
 
...security contact e-mail address on their sites However there was one, whose name Im not going to mention here, that came back to me with the worst possible answer ever This is an online retailer, and my e-mail went to their help desk, but still Heres the full e-mail trail (Ive removed certain bits of info though so that the site or the attack...
 
Tags: xxx support user2, xxx, sites, profile web sites, e-mail, xyberpix mailto, xyberpix, e-mail trail, customer services representative
 
 
 
 
Expand article

Vendor response to vulnerability disclosure

2009-12-31 10:36:06 by Aviram in SecuriTeam Blogs
 
My wish for 2010: I want this guide to be taught in CS classes to developers everywhere http://vrt-sourcefire.blogspot.com/2009/12/matts-guide-to-vendor-response.html Happy new year everybody Is your site safe from SQL Injection attacks? Use an SQL Injection Scanner on a daily basis to protect your network
 
Tags: sql injection attacks, sql injection scanner, daily basis, site safe, vrt-sourcefire, classes, network, blogspot, guide
 
 
 
 
Expand article

Signs of the (end) times

2009-12-29 21:39:59 by p1 in SecuriTeam Blogs
 
...security holes in your products during development. Black Box Testing makes it safer
 
Tags: snack foods, proper snack foods, seventies tv detective, shoppers drug mart, canadian deviant translation, black box, ancient manuscripts, land newly, word
 
 
 
 
Expand article

Adobe 0-Day (CVE-2009-4324) Fix To Be Pushed 12th January 2010

2009-12-17 02:39:32 by xyberpix in SecuriTeam Blogs
 
...Security Advisory APSA09-07 that reflects the target ship date of January 12, 2010 for the update to remediate vulnerability CVE-2009-4324. I thought folks might be interested in some of the analysis that went into developing the schedule for the fix, so let me share some of the details in this post We evaluated two different options for...
 
Tags: javascript apis, individual javascript apis, adobe, javascript, fix, january, javascript blacklist, javascript blacklist mitigation, adobe reader
 
 
 
 
Expand article

Adobe 0-day vulnerability (CVE-2009-4324) - what this means?

2009-12-16 18:37:09 by Juha-Matti in SecuriTeam Blogs
 
...security advisory APSA09-07 , but as mentioned DEP method doesnt fully prevent the exploitation 3 Do not open PDF documents from unknown sources AND received unexpectedly What this means If you dont know the sender who is sending you file attachments there is always a risk that you are a victim of targeted attack. Remember that the sender...
 
Tags: malicious pdf document, pdf document, pdf, exploit-pdf, pdf reader, adobe, adobe 0-day, pdf documents, alternative pdf reader
 
 
 
 
Expand article

Latest Adobe 0-Day Exploit Now In Metasploit

2009-12-15 21:35:48 by xyberpix in SecuriTeam Blogs
 
Just reading through Twitter and I saw this from HDM, and thought Id share Adobe PDF 0.9-day added to Metasploit: [msf> use exploit/windows/fileformat/adobe media newplayer.rb] (via jduck/pusscat/myself) SVN r7881 Night All Is your site safe from SQL Injection? Website Security Audit is the way to protect your network
 
Tags: website security audit, media newplayer, sql injection, metasploit, site safe, svn r7881, adobe pdf, network, night
 
 
 
 
Expand article

Exploiting WebView through Internet Explorer to remotely discover windows directory

2009-12-11 05:38:07 by Rafel Ivgi in SecuriTeam Blogs
 
...security holes in your products during development. Black Box Testing makes it safer
 
Tags: windows, webview, windows explorer, lpbyte pszexpansion, pszexpansion, lpbyte, microsoft windows, define reg webview, htt
 
 
 
 
Expand article

Bypassing Windows Unknown Publisher Verification For Web Downloaded Executables

The Article has images
2009-12-11 05:38:06 by Rafel Ivgi in SecuriTeam Blogs
...Information System Instructor, she is no developer or hacker Me: Honey, go to http://www.teamviewer.com, can you download it Her: yes, but when I run the setup.exe it says something weired like windows has blocked this software because it cant verify the publisher and it wont let me install Me: O.K, Open Start-Run, type notepad and space,...
 
Tags: minute phone call, call, honey, sql injection attacks, bye bye bye, information system instructor, sql injection scanner, windows, type notepad
 
 
 
 
Expand article

Using Nmap Remotely Through F5 FirePass VPN

2009-12-11 05:38:05 by Rafel Ivgi in SecuriTeam Blogs
 
Well, we all use the common hacking tools of the trade like Nmap. Some of us use it on Windows and some on Linux. This post is for the people using it on Windows I was connected to a network remotely through the companys F5 VPN appliance and I wanted to scan the internal network It looked like Microsoft Windows XP [Version 5.1.2600 C) Copyright...
 
Tags: nmap, device, dlpi device, ppp device, windows, microsoft windows, ethernet device, device type interfaces, error
 
 
 
 
Expand article

Protected: KISS shellcoding and exploitation

2009-12-08 06:41:00 by Weis in SecuriTeam Blogs
 
This post is password protected. To view it please enter your password below Password Expose the security holes in your products during development. Black Box Testing makes it safer
 
Tags: password, security holes, black box, post, enter, expose, view, safer, development
 
 
 
 
 
Showing 1-10 of 64 records