- Apocalipsa dupa Nemessis
- Cand dorinta de afirmare depaseste granitele bunului simt – PaxNwo un leecher ordinar
- Cum sa iti protejezi adresa e-mail si datele confidentiale din aceasta
- Mi s-a furat id-ul de messenger/adresa e-mail. Ce sa fac?
- Experiment social II – andimoisescu.ro
- Pentru posteritate
- In curand…
- “Hot” de id-uri messenger
- Chiar ca sunteti retardati
- Ce nu se invata la scoala – Vendetta (6)
- Apocalipsa dupa Nemessis in (81 Visits)
- Ce servicii de mail folositi? in (27 Visits)
- This is the end in (22 Visits)
- Hackersblog.org is now blog.rstcenter.com in (17 Visits)
- Short news in (16 Visits)
- La multi ani România, la multi ani românilor in (15 Visits)
- Inca o pierdere de timp in (10 Visits)
- Azi este ziua userilor hackersblog.org in (10 Visits)
- Raportare vulnerabilitati in (8 Visits)
- Update in (7 Visits)
- Mi s-a furat id-ul de messenger/adresa e-mail. Ce sa fac? in (228 Visits)
- Hi5.com coders read this in (28 Visits)
- SMS scam (1) in (21 Visits)
- Phishing Bancpost in (7 Visits)
- Dezinformare sau proasta informare? in (7 Visits)
- Si tentativele de phishing pot fi amuzante in (5 Visits)
- Phishing Raiffeisen cu atasament html in (4 Visits)
- Cum sa iti protejezi adresa e-mail si datele confidentiale din aceasta in (75 Visits)
- [Utilitare] Suna gratis de pe internet sau de pe iPhone in (41 Visits)
- Despre CSRF, hi5.com, cum sa trisezi la concursuri s.a.m.d. in (30 Visits)
- Ce nu se invata la scoala - Tipuri si tehnici spam/Hi5 (4) in (29 Visits)
- Ce nu se invata la scoala - (D)DOS (5) in (24 Visits)
- Virusi in clipuri video [how to] in (22 Visits)
- Ce nu se invata la scoala - Tipuri si tehnici spam/mail (2) in (20 Visits)
- Ce nu se invata la scoala - Tipuri si tehnici spam (1) in (17 Visits)
- Yahoo! redirects - a big issue (with video) in (10 Visits)
- Ca musca in... in (9 Visits)
- usa.kaspersky.com hacked ... full database acces , sql injection in (123 Visits)
- Simpatie.ro, matrimoniale3x.ro, apetisant.ro, deliciu.ro , etc Sql injection in (72 Visits)
- Yahoo! epic fail - permanent xss unleashed in (69 Visits)
- Telegraph.co.uk hacked, sql injection in (52 Visits)
- RedTube.com ... The Free Sex Video Community in (41 Visits)
- Kaspersky Thailand hacked by TinKode in (37 Visits)
- Conquiztador Hacked Again in (32 Visits)
- Telegraph.co.uk hacked - when will they learn? in (29 Visits)
- F-Secure.com - SQL Injection + Cross Site Scripting in (27 Visits)
- Ziua userilor - sinu.utcluj.ro in (26 Visits)
- Wannabe Hackers [2] - cum sa faci un virus by sppy_hacker in (24 Visits)
- Wannabe Hackers [1] - Cum sa hack-uiesti RapidShare-ul in (20 Visits)
- Digital Photocopiers Loaded With Secrets in (15 Visits)
- Hacker Uses XSS and Google Street View Data to Determine Physical Location in (12 Visits)
- OWASP Phishing demo in (7 Visits)
- Oldies but goodies - Freedom Downtime - The Story of Kevin Mitnick in (7 Visits)
- Hope 2603 – Kevin Mitnick - Life a Computer Hacker – Revealed in (6 Visits)
- Christopher "moot" Poole: The case for anonymity online in (6 Visits)
- Owasp5005 Part1 - New zero-day browser exploits - ClickJacking in (5 Visits)
- [Video] The History Of Hacking in (5 Visits)
- Se poate sparge parola de Yahoo? in (255 Visits)
- phpBB.ro hacked in (81 Visits)
- Cand dorinta de afirmare depaseste granitele bunului simt - PaxNwo un leecher ordinar in (47 Visits)
- Experiment social in (46 Visits)
- Oare cum e pana la urma? in (39 Visits)
- "Hot" de id-uri messenger in (38 Visits)
- Experiment social II - andimoisescu.ro in (37 Visits)
- Ce nu se invata la scoala – Vendetta (6) in (37 Visits)
- Concurs fara premii in (36 Visits)
- Forumul Andreei Balan spart in (32 Visits)
Posted on January 25th, 2009
Acest articol este scris atat in limba romana cat si in engleza.
Rude.com is an online adult community with a large number of members. Its pretty heavy and stuffed with alot of features in their desire to unite several adult services into one large site. Such features as porn videos, amateur videos, amateur live cams, private cams, social network, xxx games etc., seem to manage to attract some attention to it.
Yet, visiting rude.com can be a hazard for you. Why?
You can insert javascript in any comments box of each profile. I dont mean inserting the script in your own profile but the possibility to do this with ALL the profiles on the website.
The method is extremely simple. With your comment, add <img src=”" onerror=”evil javascript code”>, which gets executed everytime someone sees that profile. Example: <img src=”" onerror=”alert(1)”>.
This vulnerability is extremely dangerous for rude.com users especailly when we know there are payed services on the website. Wouldn’t want to be one of their paying members.
Suppose you are a paying client and want to see a live xxx show. You buy some chips (credit) and while you do that, your session cookie gets stolen. Next thing you know, your credit is being used by someone else. And here you are faced with two options:
1. You dont notice that and you dont take any counter measure.
2. You notice and make a chargeback and the model and the website loses their money. Your credit score is affected, the website gets a bad reputation and the model is left with no money.
Of course this kind of vulnerability can be used for phishing, generate traffic on other websites or to hide some XSS attacks targeting other websites (yahoo, gmail, ebay, paypal etc.).
The possiblity to insert an XSS worm is extremely simple and the owners of this website know about this isue for over a year and still, nobody seems to bother.
Rude.com este o comunitate adult cu un numar mare de membri. Este un site stufos ce si-a dorit sa uneasca mai multe servicii gen porn videos, amateur videos, amateur live cams, private cams, social network, xxx games etc., complexitatea acestuia facandu-l destul de cunoscut in US.
Si totusi este un adevarat pericol sa vizitezi acest site. De ce?
In rubrica comments a fiecarui profil se poate insera javascript. Nu, nu ma refer doar la inserarea scripturilor in propriul profil, ci la posibilitatea de a face acest lucru in TOATE profilele existente pe acest site.
Metoda este extrem de simpla. In spatiul de comentarii se adauga <img src=”" onerror=”evil javascript code”>, iar la vizualizarea profilului acest cod se executa. Exemplu: <img src=”" onerror=”alert(1)”>.
Aceasta vulnerabilitate este extrem de periculoasa pentru userii rude.com mai ales ca exista servicii platite ce pot provoca gauri in bugetul utilizatorilor.
Sa luam ca exemplu un client al showurilor private. Omul isi cumpara chips-uri (credit), i se fura cookies si i se foloseste contul. Aici exista doua posibilitati:
1. Clientul nu ia nicio masura sau poate nu observa disparitia creditului din cont.
2. Clientul observa, face chargeback, iar modelul care a beneficiat de show-ul privat cu “atacatorul” nu isi primeste banii. Credit score-ul clientului are de suferit, imaginea site-ului are de suferit, modelul nu isi primeste banii.
Desigur ca acest tip de vulnerabilitate poate fi folosit la phishing, generarea traficului pe alte site-uri sau pentru ascunderea unor atacuri xss asupra unor alte servicii web (yahoo, gmail, ebay, paypal etc.).
Posibilitatea de a implementa un xss worm este extrem de facila.
Proprietarii rude.com stiu de peste un an de zile de aceasta problema dar dupa cum se poate observa nimeni nu a facut nimic.
NOTA: accesarea site-ului din Romania se poate face doar cu ajutorul unui ip extern. Toate ip-urile romanesti sunt banate si vizitatorii din aceasta tara sunt redirectionati automat catre alt site.
Leave a Reply