c4an-dl.blogspot.com
c4an dll: August 2010
http://c4an-dl.blogspot.com/2010_08_01_archive.html
Sunday, August 22, 2010. Cold Fusion article.cfm SQL injection. Just look in google using the following query:. I will sugest that you also try not to touch .com sites and start with sites that are in other remote countries. Also try to test this on sites that use ssl so in case the site is monitored by an IDS or IPS it won't detect you. The next thing that you have to do is identify all sites that are using something like this:. Id=1 UNION select 1,1,1,1,1,1,name from systables;-. Have fun ;).
c4an-dl.blogspot.com
c4an dll: November 2010
http://c4an-dl.blogspot.com/2010_11_01_archive.html
Monday, November 15, 2010. VXworks - Open can of worms. However, I would like to add, people if you have not tested or use these modules on your pentests I will just say: DO IT! Well, I just wanted to throw this out there and since all the info is already posted out I will not waste your time anymore. SAP application server default passwords. This is something that I want to share here just because sometimes I forget the links that I see out there. So just for the sake of it this a link. Pages I like .
c4an-dl.blogspot.com
c4an dll: Raven Airlink default password scanner
http://c4an-dl.blogspot.com/2012/11/raven-airlink-default-password-scanner.html
Tuesday, November 27, 2012. Raven Airlink default password scanner. This is a short post that I have been wanting to do for a long time but I haven't have time. I know, excuses. I hope this helps someone. This file is part of the Metasploit Framework and may be subject to. Redistribution and commercial restrictions. Please see the Metasploit. Web site for more information on licensing and terms of use. Class Metasploit3 Msf: Auxiliary. Include Msf: Exploit: Remote: HttpClient. License' = MSF LICENSE.
c4an-dl.blogspot.com
c4an dll: March 2011
http://c4an-dl.blogspot.com/2011_03_01_archive.html
Friday, March 25, 2011. Nessus reports to csv. Even though it seems a stupid thing there have been times when I have to upload Nessus reports to an excel spreadsheet to play with the data and report a executive summary of all the vulns. I putting this post as a personal reference with the hope that sometimes it will help someone. 1 Export the Nessus report to a .nesssus (v1) file. 2 Convert the nessus report to a nbe file with the following command. Opt/nessus/bin/nessus - dot-nessus NESSUS REPORT.
c4an-dl.blogspot.com
c4an dll: Nessus reports to csv
http://c4an-dl.blogspot.com/2011/03/nessus-reports-to-csv.html
Friday, March 25, 2011. Nessus reports to csv. Even though it seems a stupid thing there have been times when I have to upload Nessus reports to an excel spreadsheet to play with the data and report a executive summary of all the vulns. I putting this post as a personal reference with the hope that sometimes it will help someone. 1 Export the Nessus report to a .nesssus (v1) file. 2 Convert the nessus report to a nbe file with the following command. Opt/nessus/bin/nessus - dot-nessus NESSUS REPORT.
c4an-dl.blogspot.com
c4an dll: December 2010
http://c4an-dl.blogspot.com/2010_12_01_archive.html
Monday, December 13, 2010. Metasploit HTTP fuzzer v0.2 - Tutorial. The main idea of this post is give an overview of the fuzzer that I developed. I don't think it is an state of the art fuzzer. Actually, I think it is pretty dumb fuzzer but I feel it can help a lot if you know how to configure it and use metasploit at the same time. To start using the fuzzer download the file from here. And save it in the metasploit msf3 folder under "/modules/auxiliary/fuzzers/http/". Example 1 - NUMERIC Fuzzing (TYPE 1).
c4an-dl.blogspot.com
c4an dll: September 2010
http://c4an-dl.blogspot.com/2010_09_01_archive.html
Sunday, September 5, 2010. The types of of iterations that you can use are:. 3 CUSTOM Fuzzing. Define POSITIONS and advanced option CHARS. 4 File (Provide a File to use). 5 RANDOM Characters e.g. �! 6 SQL injection (will use Msf: Config.install root/data/wordlists/sql injections.txt). 7 Long strings eg. A x 10000. Things that you might want to try while using this tool:. Use methods GET or POST. Configure a COOKIE and fuzz. Add custom HEADERS and fuzz. Transversal, passwords, etc. RHOST = TARGET IP.
c4an-dl.blogspot.com
c4an dll: August 2011
http://c4an-dl.blogspot.com/2011_08_01_archive.html
Thursday, August 4, 2011. HP Data Protector vuln. This is a quick post on a vuln we (ch0ks and I)identified and exploit in a HP-UX during a pentest. The vuln had been already reported on the ZDI site and had a working PoC on security focus. The metasploit module that I developed using this analysis has been already submitted to the team and hopefully they will included in it. Just to show you guys that I am not full of it I included some screenshots of the execution of the module. Gr33tz to ch0ks, etlow.
c4an-dl.blogspot.com
c4an dll: May 2010
http://c4an-dl.blogspot.com/2010_05_01_archive.html
Wednesday, May 26, 2010. FCKeditor not rocket science/fckeditor. Just the other day I was doing a test and I identified a website that used FCKeditor to modify the content of the web pages that they had. Basically this tool is an easy way to allow dum users to update whatever they want on their sites without the lazy and/or busy administrator to give support to the users. Pretty straight forward right? The module can be founded here: fckeditor-scan. Look for the folder:. Subscribe to: Posts (Atom).
SOCIAL ENGAGEMENT