CGISecurity Logo

Topics

Tags

  • WASC Announcement: 2007 Web Application Security Statistics Published

    Posted by Robert A on

    in
    , , , , ,
    | |

    The Web Application Security Consortium (WASC) is pleased to announce the WASC Web Application Security Statistics Project 2007. This initiative is a collaborative industry wide effort to pool together sanitized website vulnerability data and to gain a better understanding about the web application vulnerability landscape. We ascertain which classes of attacks are the most prevalent…

  • Affiliate Programs Vulnerable to Cross-site Request Forgery Fraud

    Posted by Robert A on

    in
    , , , , ,
    | |

    Intro The following describes a long-standing and common implementation flaw in online affiliate programs allowing for fraud. For those unfamiliar with affiliate programs, they provide a way for companies to allow 3rd parties/website owners to direct traffic to their site in exchange for a share of the profits of user purchases. Most view affiliate programs…

  • DNS Vulnerability Leaked By Matasano Security After Being Asked Not To By Vulnerability Discoverer

    Posted by Robert A on

    in
    , , , , ,
    | |

    "Two weeks ago, when security researcher Dan Kaminsky announced a devastating flaw in the internet's address lookup system, he took the unusual step of admonishing his peers not to publicly speculate on the specifics. The concern, he said, was that online discussions about how the vulnerability worked could teach black hat hackers how to exploit…

  • Fallout From the Fall of CAPTCHAs

    Posted by Robert A on

    in
    ,
    | |

    "CAPTCHA went from relatively obscure security measure perfected in 2000 by researchers at Carnegie Mellon University to deployment by most of the major Web e-mail sites and many other Web sites by 2007. Sites such as Yahoo Mail, Google's Gmail and Microsoft's Hotmail all used — and, for that matter, continue to use — CAPTCHA…

  • Widescale DNS flaw discovered

    Posted by Robert A on

    in
    , ,
    | |

    A pretty nasty DNS vulnerability has been discovered in 81 products by Dan Kaminsky. This vulnerability type seems to be the same described by Amit Klein and involves abusing the PRNG involved in transactions on DNS queries. Long story short if you run a vulnerable caching DNS server you can have your cache poisoned. From…

  • Microsoft outlines extensive IE8 security improvements

    Posted by Robert A on

    in
    , ,
    | |

    Microsoft has posted a very extensive article outling the security improvements to IE8. Improvements have been made to the following area's. – Cross-Site-Scripting Defenses – Safer Mashups (HTML and JSON Sanitization) – MIME-Handling Changes (Restrict Upsniff and Sniffing Opt-Out) – Add-on Security – Protected Mode – Application Protocol Prompt – File Upload Control – Social…

  • My current stance on Web Application Firewalls

    Posted by Robert A on

    in
    , , , ,
    | |

    Andre Gironda has posted an interesting take on ‘what web application security really is’. I agree with some of his points however one in particular I’m going to have to disagree with and that related to using Web application firewalls. For many years I’ve been anti Web application firewall and as a general rule I…

  • JavaScript Code Flow Manipulation, and a real world example advisory – Adobe Flex 3 Dom-Based XSS

    Posted by Robert A on

    in
    , ,
    | |

    "We recently researched an interesting DOM-based XSS vulnerability in Adobe Flex 3 applications that exploits a scenario in which two frames (parent & son) interact with each other, without properly validating their execution environment. In our research, we have seen that in some cases, it is possible to manipulate JavaScript code flow, by controlling the…

  • Paper: The Extended HTML Form attack revisited

    Posted by Robert A on

    in
    ,
    | |

    "HTML forms (i.e. <form>) are one of the features in HTTP that allows users to send data to HTTP servers. An often overlooked feature is that due to the nature of HTTP, the web browser has no way of identifying between an HTTP server and one that is not an HTTP server. Therefore web browsers…

  • Paper: Bypassing URL Authentication and Authorization with HTTP Verb Tampering

    Posted by Robert A on

    in
    | |

    Arshan Dabirsiaghi has announced a new paper discussion switching HTTP VERBS to bypass authorization checking in certain web frameworks. In the paper he also outlines how some web frameworks default to allowing HTTP methods not explicitly defined as 'protected' resources. I highly recommend reading this paper as well as the mailing thread. While the concept…

  • Whitepaper: DoS Attacks Using SQl Wildcards

    Posted by Robert A on

    in
    , ,
    | |

    Ferruh Mavituna has just published a whitepaper titled "DoS Attacks Using SQL Wildcards" where he discusses CPU utilization based dos against SQL Server where user data is thrown into sql statements. That is all. Whitepaper Link: http://www.portcullis-security.com/uplds/wildcard_attacks.pdf

  • Tools: The Browserrecon Project

    Posted by Robert A on

    in
    , ,
    | |

    "Most of todays tools for fingerprinting are focusing on server-side services. Well-known and widely-accepted implementations of such utilities are available for http web services, smtp mail server, ftp servers and even telnet daemons. Of course, many attack scenarios are focusing on server-side attacks. Client-based attacks, especially targeting web clients, are becoming more and more popular.…

  • Whitepaper: Access through access by Brett Moore, attacking Microsoft Access

    Posted by Robert A on

    in
    ,
    | |

    Brett Moore has published a great document on how to SQL Inject applications utilizing Microsoft Access. He discusses default tablenames, sandboxing, reading local files and more. There aren't many good papers on attacking MS Access and this is WELL worth the read. From the paper ""MS Access is commonly thought of as the little brother…

  • DNS lords expose netizens to ‘poisoning’

    Posted by Robert A on

    in
    ,
    | |

    "More than a decade after serious holes were discovered in the internet's address lookup system, end users remain vulnerable to so-called domain name system cache poisoning, a security researcher has warned. Developers of the software that handles DNS lookups have scrambled to patch buggy code that could allow the attacks, but not to the satisfaction…

  • Thread: Attacking Upload forms

    Posted by Robert A on

    in
    ,
    | |

    Someone posed the question in a pen-test thread titled 'Malicious file upload in .JPG or GIF format' of how to pen test logins forms. While this isn't a new subject people are still asking the question and this is a decent thread to learn about the subject. Thread Link: http://archives.neohapsis.com/archives/sf/pentest/2008-02/thread.html#102

  • Same Site Scripting Paper Released

    Posted by Robert A on

    in
    ,
    | |

    An email sent to bugtraq by Travis Ormandy outlines a new attack dubbed same site scripting. "It's a common and sensible practice to install records of the form "localhost. IN A 127.0.0.1" into nameserver configurations, bizarrely however, administrators often mistakenly drop the trailing dot, introducing an interesting variation of Cross-Site Scripting (XSS) I call Same-Site…

  • Coined Buzzword of the week: Cross Site Printing

    Posted by Robert A on

    in
    ,
    | |

    Aaron Weaver has published a whitepaper describing how you can utilize 'intranet hacking' tricks to send spam to printers. Pretty amusing. "Many network printers listen on port 9100 for a print job (RAW Printing or Direct IP printing). You can telnet directly to the printer port and enter text. Once you disconnect from the printer…

  • Malware honeypots wait for ’08

    Posted by Robert A on

    in
    , ,
    | |

    "An innovative malware honeypot project backed by a leading consortium of IT security experts is preparing to re-launch its global sensor network after Jan. 1 in an effort to dupe more cyber-criminals into handing over information about their latest attack methods. Project link: The Web Application Security Consortium's Distributed Open Proxy Honeypot Project, which was…

  • Performing Distributed Brute Forcing of CSRF vulnerable login pages

    Posted by Robert A on

    in
    , ,
    | |

    Update: Apparently this is described in a paper by sensepost that I wasn’t aware of. Check out there paper at http://www.sensepost.com/research/squeeza/dc-15-meer_and_slaviero-WP.pdf. We know that CSRF is bad, and that if your application is performing an important action to utilize a random token associated with the users session. I started thinking a bit about CSRF and…

  • Cross-build injection attacks

    Posted by Robert A on

    in
    , ,
    | |

    " Injection-based attacks have proven effective, yielding access to private data or possible control over a compromised machine. Software vendors are in a continual race to fix the holes that allow these attacks to succeed. But what if a hacker could inject malicious code when a program is actually compiled and created? Unfortunately, with the…

  • Browser Security: I Want A Website Active Content Policy File Standard!

    Posted by Robert A on

    in
    , , , ,
    | |

    UPDATE Before reading on any further I want to prefix that the purpose of this post is to begin a discussion on the ways a website can communicate to a browser to instruct it of what its behavior should be on that site. The example below is a "sample implementation" and isn’t meant to be…

  • IIS7 short Security Guide by Chris Weber

    Posted by Robert A on

    in
    ,
    | |

    Chris Weber has a great writup of the new security changes in IIS7. Here are a few article section highlights * Integrated request processing pipeline and WCF * ASP.NET Integration * Request filtering (replaces URLScan) * IIS7 URL Authorization He even has a nice checklist at the bottom. Guide Link: http://chrisweber.wordpress.com/2007/09/19/iis7-security-guide-for-application-reviews/

  • Website CAPTCHA only as good as the porn offered to break it

    Posted by Robert A on

    in
    ,
    | |

    "The Captcha Trojan disguises itself as a stripper game that offers voyeurs the chance to see images of a model getting undressed. In order to get "Melissa" to lose an item of clothing, the user must identify the letters or numbers found within a scrambled text image that forms the basis of a captcha (Completely…

  • How to Turn Your Browser Into a Weapon

    Posted by Robert A on

    in
    , ,
    | |

    "I wrote about three of my favorite Firefox extensions that help me stay safe when I'm browsing the darker areas of the Web and incoming email. Today, let's look at three other extensions: Those that can turn Firefox into a feature-filled, Web-hacking weapon. These extensions aren't required to use Firefox for hacking Web applications, but…

  • Uninformed Journal Release Announcement: Volume 8

    Posted by Robert A on

    in
    , , ,
    | |

    "Uninformed is pleased to announce the release of its eighth volume. This volume includes 6 articles on a variety of topics:" Real-time Steganography with RTP PatchGuard Reloaded: A Brief Analysis of PatchGuard Version 3 Getting out of Jail: Escaping Internet Explorer Protected Mode OS X Kernel-mode Exploitation in a Weekend A Catalog of Windows Local…

Favorite Links

Twitter

Twitter

Popular Pages

WASC Threat Classification

Copyright 2000-2026 CGISecurity.com – The oldest application security site online, predating OWASP.