Loading....
- Hacker Uses XSS and Google Street View Data to Determine Physical Location
- CAnCAn te iubim, CA CA tine nu gasim. Superfete.cancan.ro e de rahat
- Deface (?!?) pe Cotidianul.ro
- Virusi in clipuri video [how to]
- Cyber-Bullying – palma parinteasca a noului mileniu
- Christopher “moot” Poole: The case for anonymity online
- Wtf Avira?
- Some old story about tagged.com
- Pwning cam girls for fun
- Tabloshit
Loading....
- Yahoo! again - XSS in Uncategorized (357 Visits)
- Yahoo! again - bad settings? in Uncategorized (252 Visits)
- Fanii nostri in Uncategorized (183 Visits)
- Frustrant in Uncategorized (146 Visits)
- La multi ani România, la multi ani românilor in Uncategorized (137 Visits)
- Weblog.ro - Shell via Local File Inclusion in Uncategorized (119 Visits)
- Yahoo! epic fail - permanent xss unleashed in Uncategorized (50 Visits)
- ... in Uncategorized (38 Visits)
- XSS Ownage - hi5 vs. Yahoo! + video in Uncategorized (2 Visits)
- Ce nu se invata la scoala - Tipuri si tehnici spam/Hi5 (4) in Uncategorized (2 Visits)
- Hackersblog.org is now blog.rstcenter.com in (1770 Visits)
- O mica dar importanta precizare in (1371 Visits)
- Twitter in (805 Visits)
- This is the end in (776 Visits)
- Ce servicii de mail folositi? in (773 Visits)
- Un nou membru in (730 Visits)
- La multi ani România, la multi ani românilor in (717 Visits)
- Inca o pierdere de timp in (674 Visits)
- De reţinut in (634 Visits)
- Azi este ziua userilor hackersblog.org in (610 Visits)
- SMS scam (1) in (564 Visits)
- Dezinformare sau proasta informare? in (563 Visits)
- Hi5.com coders read this in (553 Visits)
- Phishing Raiffeisen cu atasament html in (516 Visits)
- Phishing Bancpost in (486 Visits)
- Si tentativele de phishing pot fi amuzante in (422 Visits)
- Ce nu se invata la scoala - Tipuri si tehnici spam/mail (2) in (2707 Visits)
- Ce nu se invata la scoala - Tipuri si tehnici spam/Hi5 (4) in (2601 Visits)
- Despre CSRF, hi5.com, cum sa trisezi la concursuri s.a.m.d. in (1143 Visits)
- [Utilitare] Suna gratis de pe internet sau de pe iPhone in (1107 Visits)
- Ce nu se invata la scoala - (D)DOS (5) in (950 Visits)
- Virusi in clipuri video [how to] in (838 Visits)
- Ce nu se invata la scoala - Tipuri si tehnici spam (1) in (725 Visits)
- Yahoo! redirects - a big issue (with video) in (570 Visits)
- Internet vs. privacy (1) in (468 Visits)
- Ca musca in... in (435 Visits)
- RedTube.com ... The Free Sex Video Community in (12972 Visits)
- usa.kaspersky.com hacked ... full database acces , sql injection in (4921 Visits)
- libertatea.ro vulnerabil la (blind) sql injection in (2950 Visits)
- Pwning cam girls for fun in (2586 Visits)
- Telegraph.co.uk hacked, sql injection in (2546 Visits)
- Facebook hacked - sql injection in (2424 Visits)
- Simpatie.ro, matrimoniale3x.ro, apetisant.ro, deliciu.ro , etc Sql injection in (2406 Visits)
- F-Secure.com - SQL Injection + Cross Site Scripting in (1774 Visits)
- [Hacked]Bitdefender (Portugal) exposes sensitive customer data in (1743 Visits)
- Wtf Avira? in (1723 Visits)
- Christopher "moot" Poole: The case for anonymity online in (1495 Visits)
- Digital Photocopiers Loaded With Secrets in (1458 Visits)
- Wannabe Hackers [2] - cum sa faci un virus by sppy_hacker in (592 Visits)
- Wannabe Hackers [1] - Cum sa hack-uiesti RapidShare-ul in (590 Visits)
- Hope 2603 – Kevin Mitnick - Life a Computer Hacker – Revealed in (462 Visits)
- PRIVACY IS DEAD - GET OVER IT, Pt 01-34 (Recommended by Hackersblog ) in (396 Visits)
- Oldies but goodies - Freedom Downtime - The Story of Kevin Mitnick in (379 Visits)
- [Video] The History Of Hacking in (373 Visits)
- Email Security - Why You Should Encrypt Your Email - Part One in (368 Visits)
- The Story of DEFCON in (343 Visits)
- Deface - tuttoaffari.lastampa.it si citymusiclab.city.corriere.it in (3493 Visits)
- RNS vs. RAI - citizenreport.rai.it hacked. in (3300 Visits)
- Hi5 email finder si sfarsitul a tot ceea ce inseamna privacy in social networking in (2995 Visits)
- Se poate sparge parola de Yahoo? in (2572 Visits)
- Free SMS time, TrimiteSMS.ro in (2492 Visits)
- Planete-plus-intelligente.lemonde.fr defaced by R.N.S. in (2464 Visits)
- Gmail uber hacking in (2256 Visits)
- Camera de supraveghere a universitatii Alexandru Ioan Cuza din Iasi in (2255 Visits)
- Cancan.ro spart pentru a doua oara intr-o zi in (2251 Visits)
- Stiri cu antena3 in (2208 Visits)
Posted on December 15th, 2008
“Evenimentul zilei online: Net superior.Publicatia online a cotidianului Evenimentul Zilei”
Mda, net superior. Cui si/sau din ce puncte de vedere? Pentru ca la capitolul vulnerabilitati sta mai prost ca un site mic, bine securizat. Cu peste 600.000 de vizitatori si aproape 4 milioane de afisari in ultimele 7 zile (sursa: trafic.ro) evenimentul zilei ofera acces nelimitat la baza sa de date. Ce contine o baza de date? Multe. Printre care datele de logare a utilizatorilor, a editorilor, a adminilor (cont mysql), mii de adrese de email a celor inscrisi pentru newsletter ,etc (chiar si un tabel denumit “cucu”).
Schema name:
Username si parola pt mysql user (admin)
Conturile utilizatorilor, cu parola in text clar !!!!!!!!!
Cat si o cantitate impresionanta de adrese email a celor inscrisi pentru newsletter
December 15th, 2008 at 11:09 am
Acelasi lucru l-am facut si eu aici -> http://hackpedia.info/viewtopic.php?p=60790#p60790
Ma rog … pentru un site asa mare … nici n-ar trebui sa se puna problema … dar :-j Romania
December 15th, 2008 at 11:27 am
am vazut, doar ca din acel parametru nu puteai scoate nimic, la http://www.evz.ro/dmain/americani.ro/?id_domain=2+and+ascii(substring((SELECT+concat(username,0×3a,password)+from+users+limit+0,1),1,1))%3E10
iti dadea eroare …sa anunti adminii pt vuln in id_domain , daca vrei
December 15th, 2008 at 11:39 am
stiu ca nu puteam scoate nimic … de aia nici n-am continuat … oricum , e vulnerabil
… o sa-i anunt … 
Salutari , si felicitari pentru treaba buna pe care o faceti toti 
December 15th, 2008 at 3:27 pm
Interesant .Sigur ei sunt ” Mda, net superior.” . Good job btw.
December 15th, 2008 at 4:52 pm
Chiar nu ii inteleg pe cei care dezvolta astfel de website-uri – legat de partea de autentificare. De ce se chinuie oare sa tina datele de autentificare in mysql in loc sa foloseasca ceva gen ldap …
December 15th, 2008 at 5:04 pm
Unu , da-mi un mail te rog frumos. vreau sa te intreb ceva. Am trecut mailu …
December 17th, 2008 at 9:39 pm
[...] vom avea in continuare baza de date de newsletter de la evenimentul zilei publica pentru ca unii sunt [...]
December 17th, 2008 at 10:09 pm
Pai bine oameni buni de ce nu mi-ati acoperit mai mult din parola?
February 21st, 2009 at 5:34 pm
da ma retardatii astia acuma scriu despre unu cica ATACA americanii
)))))
February 21st, 2009 at 8:53 pm
O da 8-|