Re: [Full-disclosure] defacements for the installation of malcode

Hi, this is a old known issue many defacers put in mirrors some type of a trojan or some xss trick to stolen hotmail cookie. If someone like a POC just take a look in Iskorpitx defacements (http://www.zone-h.org/component/option,com_attacks/Itemid,43/filter_defacer,iskorpitx/) you will found

Re: [Full-disclosure] Solaris telnet vulnberability - how many on yournetwork?

Hi, you dont want to ask nmap to determine the OS based on port 23 scan only. so, s/p23// in the second nmap call. hence: #!/bin/bash # solaris-telnetd-audit.sh IPSFILE=./ips.lst; # file containing IPs to scan MESSAGE=possible-Solaris-telnet-server-found; EMAIL=[EMAIL PROTECTED]; for IP in

Re: [Full-disclosure] Solaris telnet vulnberability - how many on yournetwork?

Hello Endrazine! That's more complete but more slow at the same time due to service fingerprinting being launched against 1665 ports rather than just one. However, increasing the chance of finding a vulnerable target it's a good idea. Thanks! :-) Here is version 0.03 of solaris-telnetd-audit.sh,

[Full-disclosure] [ GLSA 200702-06 ] BIND: Denial of Service

- - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - Gentoo Linux Security Advisory GLSA 200702-06 - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - http://security.gentoo.org/ - - - - -

[Full-disclosure] [ GLSA 200702-07 ] Sun JDK/JRE: Execution of arbitrary code

- - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - Gentoo Linux Security Advisory GLSA 200702-07 - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - http://security.gentoo.org/ - - - - -

[Full-disclosure] [ GLSA 200702-08 ] AMD64 x86 emulation Sun's J2SE Development Kit: Multiple vulnerabilities

- - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - Gentoo Linux Security Advisory GLSA 200702-08 - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - http://security.gentoo.org/ - - - - -

Re: [Full-disclosure] Firefox: serious cookie stealing / same-domain bypass vulnerability

On 2/15/07, Michal Zalewski [EMAIL PROTECTED] wrote: [...on other potential Firefox flaws...] I did not research them any further, so I can't say if they're exploitable - but you can see a demo here, feel free to poke around: http://lcamtuf.coredump.cx/fftests.html On Thu, 15 Feb 2007,

Re: [Full-disclosure] Drive-by Pharming

I'm sorry, this looks to me like plain CSRF against web interfaces of intranet network devices. If someone knows your router's password (i.e.: default password) and the router's HTTP requests are NOT tokenized (vulnerable to CSRF), then an attacker can most certainly do anything on your behalf by

[Full-disclosure] ALERT! A piece of internet security history is missing

Attention knights of the great Full Disclosure! An important piece of internet security is missing. The missing item is the logo, depicting a turkey, of GOBBLES Security. It was last known to be present on [1] and [2]. Unfortunately the datastreams previously known to have been representing it

Re: [Full-disclosure] Solaris telnet vulnberability - how many on yournetwork?

On Sat, 17 Feb 2007, endrazine wrote: Hi, you dont want to ask nmap to determine the OS based on port 23 scan only. so, s/p23// in the second nmap call. That would run through nmap's list of default ports (2000). OS guess needs one closed, and one open port to be effective. I will supply