SirGod
-
Posts
784 -
Joined
-
Last visited
-
Days Won
27
Posts posted by SirGod
-
-
La multi ani, ba!
-
la fel ca orice linux, de nepatruns
.Mai documenteaza-te inainte sa aberezi. O fi mai sigur, dar nu de nepatruns.
-
Mai baga o conditie in IF. Vezi daca utilizatorul curent e cel pe care il "vrei".
how to get current username in .net using c#? - Stack Overflow
Sau:
How do you kill a process for a particular user in .NET (C#)? - Stack Overflow
-
scrie clar XSS, adika poti introduce coduri java script care ar putea compromite siguranta siteului sau a vizitatorilor. uite aici un exemplu : <iframe src="javascript:alert('Hacked<marquee><h1>HACKED</h1></marquee>, pentru mai multe informati intreabal pe google sunt sute de tutoriale disponibile pe tema asta.
Si cu ce compromite siguranta site-ului sau a vizitatorilor exemplul oferit de tine? Puteai sa ii dai un exemplu mai putin penibil decat un marquee cu hacked.
-
Security researchers estimate that 50% of worldwide spam has been killed off by the Grum strike.
NEW YORK (CNNMoney) -- Good news for your email inbox: You'll be seeing less spam in it now, thanks to a global takedown effort that knocked one of the world's biggest spammers offline this week."About 50% of the worldwide spam is gone," says FireEye senior scientist Atif Mushtaq, who participated in the demolition.
The dramatic decrease is the result of a coordinated attack by security firms and Internet service providers around the globe that took down a network of infected computers known as "the Grum botnet." Grum, one of the world's most prolific spammers, generated around 18 billion emails a day, by FireEye's estimates.A botnet is a collective of computers infected with malware -- typically without the computer owner's knowledge -- and taken over by an outside attacker. Criminals who gain control of botnets use them for malicious activities like pumping out massive volumes of spam or launching denial-of-service attacks on targeted websites. The bigger the botnet, the more firepower the cybercrimal has at their fingertips.Grum was an especially vast and nasty spammer. First detected in early 2008, its malware infected several hundred thousand computers around the world and churned out huge amounts of pharmaceutical spam advertising cheap drugs.At its peak, Grum was the world's most prolific spam machine, though researchers recently dropped it to the number three spot on their ever-changing list of the world's largest botnets.The tale of its demise reads like a high-tech thriller.The brain of a botnet is what's known as a "command and control" server. Grum had several of those servers scattered around the globe in countries including Russia, Panama, and the Netherlands. But it also had a fatal weakness: The network had no recovery mechanism if all of its command servers were simultaneously knocked offline.A Dutch Internet service provider yanked the plug Tuesday on two of Grum's primary command servers. A Panamanian server went down next, leaving just one main server -- in Russia -- coordinating the entire Grum swarm.But when the botnet's operators realized their network was under attack, they launched their evasive actions, shifting their traffic to a fresh set of backup servers in Ukraine."Right in front of my eyes, the bot herders started pointing their botnet to new destinations," Mushtaq wrote in a blog post about the takedown. "For a moment, I was stunned."Mushtaq alerted collaborators around the global, including a cybersecurity team in Russia that quickly went after the new servers' Internet providers. Within a few hours, they persuaded key providers to cut the connection. By 2 p.m. ET on Wednesday, the entire system was dead."We are confident that it can't recover," Mushtaq told CNNMoney on Thursday morning. "I've been monitoring Grum for four years. Right from the start we knew that it doesn't have any fallback mechanism."Grum was responsible for 35% of the Internet's spam volume last week, according to monitoring statistics from security firm Trustwave.Tracking botnet spam is tricky, and other firms have different estimates. Spam tracker Spamhaus estimates that 15% to 17% of the world's spam was coming from Grum as of early this week.Its demise is having ripple effects. The spam volume from another major botnet, Lethic, plunged overnight, Mushtaq said. He thinks the operators of that botnet have "gone underground."Cumulatively, killing Grum and wounding Lethic has instantly cut the worldwide spam volume in half, FireEye estimates.Grum recently averaged 120,000 infected computers a day generating spam, but immediately after the takedown, that number dropped to 21,505, Spamhaus reported.On Thursday, Spamhaus's latest data showed zero infected machines sending messages.Spam had already declined dramatically in recent years thanks to coordinated global efforts. Mushtaq thinks the goal of a junk-free inbox is in reach."One last final blow and I think we can make a rapid and permanent decline in worldwide spam," he said.
Sursa: Grum takedown: '50% of worldwide spam is gone' - Jul. 19, 2012
-
Ce fisiere ai incercat sa citesti? Poti citi doar ce poate apache/www citi. De obicei toate fisierele din directorul htdocs/www + cateodata si altele (depinde de permisiunile setate de catre sysadmin si din moment ce citesti etc/passwd probabil poti citi si alte fisiere de sistem).
-
E doar un PoC. Modifica-l si citeste ce fisier vrei si ai permisiuni sa citesti (e.g. config.php). E un Local File Disclosure.
-
Nu sunt sigur dar cred ca o companie de telefonie poate localiza un telefon dupa IMEI. Daca codul IMEI a fost schimbat nu cred ca mai sunt sanse de recuperare atata timp cand nu ai nimic instalat pentru asemenea situatii. Suna la operator si vezi ce poti face.
Poate o sa fie si o invatare de minte ca sa nu oferi unui copil de 12 ani un telefon de 20 de milioane fiindca nu este responsabil si nu stie sa aiba grija de el pentru ca sunt aproape sigur ca nu si l-a cumparat din banii castigati de el.
-
Eu l-am mai jucat (si altele) cu VirtualNES.
-
Missile tank.
Missile Tank - Play the Nintendo game Missile Tank online (rulat/emulat cu Java)
-
Dupa cate vad la demo poti uploada fisiere PHTML. Din cate stiu eu serverul trebuie configurat ca sa le poata "rula". Majoritatea nu sunt (probabil nu iti va merge in niciunul dintre cazuri - le vei putea uploada, dar nu vor fi 'rulate', probabil o sa iti tranteasca un dialog de download sau sa iti afiseze continutul direct in browser).
-
Bitdefender Report :
Nume virus: Gen:Trojan.Heur.pm0@dTFCVpki
SirGod report:
Nume utilizator: LoseControL@Failed.To.Check.Date
Acum serios, e postat de mai bine de 3 ani, la ce te asteptai?
-
Pai ce faci prietene, imi trantesti o eroare SQL si imi zici ca e SQL Injection? Mai si furi un XSS, de parca o vulnerabilitate in Ministerul Transporturilor e ceva demn de lauda.
-
Redaxscript iti recomand si eu. E foarte rapid.
-
Il pot face sa mearga si pe Chrome folosind alti vectori, dar nu vad rostul...
Da, sunt cateva chestii. Aici nu ii vezi rostul, pentru ca chiar nu are niciunul. Dar cand vrei ceva sa faci ceva "in masa", o sa vrei sa mearga pe toate browserele.
-
In chrome nu merge.
Multe nu merg pe Chrome, nu doar asta.
-
-
Acum am vazut ca mai are si SQLI
@ak4d3a ia vezi daca gasesti vreun XSS intr-o pagina .HTML
Paginile alea "HTML" sunt defapt PHP-uri (URL Rewrite). In pagini HTML poti gasi doar DOM XSS, in cazul in care contin cod JavaScript vulnerabil.
-
-
S-au mai f?cut topicuri de genul acesta. S-au mai f?cut propuneri de genul acesta. Ciudat este c? nu îmi aduc aminte ca vreun user cu o oarecare reputa?ie sau vechime s? fi propus asta, numai oameni care ?i-au f?cut cont de 2-3 luni au venit cu ideea splendid? de a pune teste nefolositoare la înregistrare.
-
Nu am ceva cu tine, nu vreau s? te descurajez, dar odat? ?i odat? trebuie s? aflu. Ce e a?a de special la XSS-ul ?sta? E a?a de important Dan Bursuc încat un XSS în site-ul lui ne aduce bucurie în cas?? E cumva vreun specialist în securitate care î?i stric? reputa?ia? De ce s-ar fi sinchisit programatorii s? îl securizeze sau m?car s? îi testeze securitatea? E vreo informa?ie vital? stocat? pe undeva? Înteleg c? aici e categoria "XSS" dar sincer, nu ?tiu câ?i ar fi interesa?i de un XSS în www.danbursuc.ro.
-
Înregistrat în 2008, acum suntem în 2012. Exit. Go figure.
-
Se pare ca full-time study este un termen foarte folosit (siteuri facultati straine, corpus). Cred ca e OK daca il folosesti.
-
Bine ai venit, amigo!
Sugestii Defcamp 2012
in Off-topic
Posted
Da, e maricica sala dar o sa stea lumea cu laptopu in brate... Nu mai tin minte daca erau prize, probabil ca nu... Ca asa ca sala ar fi OK.