Jump to content

kw3rln

Active Members
  • Posts

    1019
  • Joined

  • Last visited

Posts posted by kw3rln

  1. ce forum preferati? phpbb2 sau 3?

    ma tot gandesc de ceva vreme sa pun 3-u ... care aveti experienta cu el spuneti aici parerile....

    si va astept sa votati in poll

    ma astept la ceva detasament pt phpbb3 daca ii sa-l schimb....ca trebuie schimbat TOT CMS-ul sa fie compatibil cu 3-u

    UPDATE: si puneti si ceva theme pt 3 care va plac :P

  2. hmmm 35useri / zi...din toate partile lumii

    Antigua and Barbuda

    Greece

    United States

    Nicaragua

    Slovakia

    Turkey

    ïîðíî ðîëèêè

    Austria

    .....

    .

    .

    .

    si lista continua......adica .. pt ce se inregistreaza pe forumul acesta?

    si inca o remarca : numarul de useri romani inregistrati / zi e mult mai mic decat cel al userilor de alta nationalitate/zi...

    si inca una : astia nu posteaza nimic. or fi boti? (srry for the stupid q.)

    zi si mie de unde ai luat statisticile alea?

  3. Cred ca FOARTE multe site-uri sunt vulnerabile...

    o aparut in New York Times: http://www.nytimes.com/2008/08/09/technology/09flaw.html?_r=1&oref=slogin

    Successfully poisoned the latest BIND with fully randomized ports!

    Exploit required to send more than 130 thousand of requests for the fake records like

    131737-4795-15081.blah.com to be able to match port and ID and insert poisoned entry

    for the poisoned_dns.blah.com.

    # dig @localhost www.blah.com +norecurse

    ; <<>> DiG 9.5.0-P2 <<>> @localhost www.blah.com +norecurse

    ; (1 server found)

    ;; global options: printcmd

    ;; Got answer:

    ;; ->>HEADER<<- opcode: QUERY, status: NOERROR, id: 6950

    ;; flags: qr ra; QUERY: 1, ANSWER: 0, AUTHORITY: 1, ADDITIONAL: 1

    ;; QUESTION SECTION:

    ;www.blah.com. IN A

    ;; AUTHORITY SECTION:

    www.blah.com. 73557 IN NS poisoned_dns.blah.com.

    ;; ADDITIONAL SECTION:

    poisoned_dns.blah.com. 73557 IN A 1.2.3.4

    # named -v

    BIND 9.5.0-P2

    BIND used fully randomized source port range, i.e. around 64000 ports.

    Two attacking servers, connected to the attacked one via GigE link, were used,

    each one attacked 1-2 ports with full ID range. Usually attacking server is able

    to send about 40-50 thousands fake replies before remote server returns the

    correct one, so if port was matched probability of the successful poisoning is more than 60%.

    Attack took about half of the day, i.e. a bit less than 10 hours.

    So, if you have a GigE lan, any trojaned machine can poison your DNS during one night...

    original source: http://tservice.net.ru/~s0mbre/blog/2008/08/08/

    http://milw0rm.com/sploits/2008-dns-bind.tgz

×
×
  • Create New...