- Hacker Uses XSS and Google Street View Data to Determine Physical Location
- CAnCAn te iubim, CA CA tine nu gasim. Superfete.cancan.ro e de rahat
- Deface (?!?) pe Cotidianul.ro
- Virusi in clipuri video [how to]
- Cyber-Bullying – palma parinteasca a noului mileniu
- Christopher “moot” Poole: The case for anonymity online
- Wtf Avira?
- Some old story about tagged.com
- Pwning cam girls for fun
- Tabloshit
- Yahoo! again - XSS in Uncategorized (357 Visits)
- Yahoo! again - bad settings? in Uncategorized (252 Visits)
- Fanii nostri in Uncategorized (183 Visits)
- Frustrant in Uncategorized (146 Visits)
- La multi ani România, la multi ani românilor in Uncategorized (137 Visits)
- Weblog.ro - Shell via Local File Inclusion in Uncategorized (119 Visits)
- Yahoo! epic fail - permanent xss unleashed in Uncategorized (50 Visits)
- ... in Uncategorized (38 Visits)
- XSS Ownage - hi5 vs. Yahoo! + video in Uncategorized (2 Visits)
- Ce nu se invata la scoala - Tipuri si tehnici spam/Hi5 (4) in Uncategorized (2 Visits)
- Hackersblog.org is now blog.rstcenter.com in (1800 Visits)
- O mica dar importanta precizare in (1402 Visits)
- Twitter in (846 Visits)
- This is the end in (834 Visits)
- Ce servicii de mail folositi? in (826 Visits)
- Un nou membru in (771 Visits)
- La multi ani România, la multi ani românilor in (762 Visits)
- Inca o pierdere de timp in (709 Visits)
- De reţinut in (670 Visits)
- Azi este ziua userilor hackersblog.org in (644 Visits)
- Hi5.com coders read this in (620 Visits)
- SMS scam (1) in (610 Visits)
- Dezinformare sau proasta informare? in (597 Visits)
- Phishing Raiffeisen cu atasament html in (557 Visits)
- Phishing Bancpost in (524 Visits)
- Si tentativele de phishing pot fi amuzante in (456 Visits)
- Ce nu se invata la scoala - Tipuri si tehnici spam/mail (2) in (2867 Visits)
- Ce nu se invata la scoala - Tipuri si tehnici spam/Hi5 (4) in (2833 Visits)
- Despre CSRF, hi5.com, cum sa trisezi la concursuri s.a.m.d. in (1206 Visits)
- [Utilitare] Suna gratis de pe internet sau de pe iPhone in (1187 Visits)
- Ce nu se invata la scoala - (D)DOS (5) in (1006 Visits)
- Virusi in clipuri video [how to] in (967 Visits)
- Ce nu se invata la scoala - Tipuri si tehnici spam (1) in (763 Visits)
- Yahoo! redirects - a big issue (with video) in (609 Visits)
- Internet vs. privacy (1) in (503 Visits)
- Ca musca in... in (461 Visits)
- RedTube.com ... The Free Sex Video Community in (13512 Visits)
- usa.kaspersky.com hacked ... full database acces , sql injection in (5411 Visits)
- libertatea.ro vulnerabil la (blind) sql injection in (3080 Visits)
- Telegraph.co.uk hacked, sql injection in (2700 Visits)
- Pwning cam girls for fun in (2693 Visits)
- Facebook hacked - sql injection in (2577 Visits)
- Simpatie.ro, matrimoniale3x.ro, apetisant.ro, deliciu.ro , etc Sql injection in (2552 Visits)
- F-Secure.com - SQL Injection + Cross Site Scripting in (1857 Visits)
- [Hacked]Bitdefender (Portugal) exposes sensitive customer data in (1852 Visits)
- Wtf Avira? in (1801 Visits)
- Christopher "moot" Poole: The case for anonymity online in (1578 Visits)
- Digital Photocopiers Loaded With Secrets in (1491 Visits)
- Hacker Uses XSS and Google Street View Data to Determine Physical Location in (891 Visits)
- Wannabe Hackers [1] - Cum sa hack-uiesti RapidShare-ul in (648 Visits)
- Wannabe Hackers [2] - cum sa faci un virus by sppy_hacker in (631 Visits)
- Hope 2603 – Kevin Mitnick - Life a Computer Hacker – Revealed in (487 Visits)
- PRIVACY IS DEAD - GET OVER IT, Pt 01-34 (Recommended by Hackersblog ) in (419 Visits)
- Oldies but goodies - Freedom Downtime - The Story of Kevin Mitnick in (415 Visits)
- [Video] The History Of Hacking in (395 Visits)
- Email Security - Why You Should Encrypt Your Email - Part One in (388 Visits)
- Deface - tuttoaffari.lastampa.it si citymusiclab.city.corriere.it in (3545 Visits)
- RNS vs. RAI - citizenreport.rai.it hacked. in (3360 Visits)
- Hi5 email finder si sfarsitul a tot ceea ce inseamna privacy in social networking in (3280 Visits)
- Se poate sparge parola de Yahoo? in (2734 Visits)
- Planete-plus-intelligente.lemonde.fr defaced by R.N.S. in (2560 Visits)
- Free SMS time, TrimiteSMS.ro in (2532 Visits)
- Gmail uber hacking in (2472 Visits)
- Cancan.ro spart pentru a doua oara intr-o zi in (2344 Visits)
- Camera de supraveghere a universitatii Alexandru Ioan Cuza din Iasi in (2322 Visits)
- Stiri cu antena3 in (2241 Visits)
Posted on January 25th, 2009
Acest articol este scris atat in limba romana cat si in engleza.
Rude.com is an online adult community with a large number of members. Its pretty heavy and stuffed with alot of features in their desire to unite several adult services into one large site. Such features as porn videos, amateur videos, amateur live cams, private cams, social network, xxx games etc., seem to manage to attract some attention to it.
Yet, visiting rude.com can be a hazard for you. Why?
You can insert javascript in any comments box of each profile. I dont mean inserting the script in your own profile but the possibility to do this with ALL the profiles on the website.
The method is extremely simple. With your comment, add <img src=”" onerror=”evil javascript code”>, which gets executed everytime someone sees that profile. Example: <img src=”" onerror=”alert(1)”>.
This vulnerability is extremely dangerous for rude.com users especailly when we know there are payed services on the website. Wouldn’t want to be one of their paying members.
Suppose you are a paying client and want to see a live xxx show. You buy some chips (credit) and while you do that, your session cookie gets stolen. Next thing you know, your credit is being used by someone else. And here you are faced with two options:
1. You dont notice that and you dont take any counter measure.
2. You notice and make a chargeback and the model and the website loses their money. Your credit score is affected, the website gets a bad reputation and the model is left with no money.
Of course this kind of vulnerability can be used for phishing, generate traffic on other websites or to hide some XSS attacks targeting other websites (yahoo, gmail, ebay, paypal etc.).
The possiblity to insert an XSS worm is extremely simple and the owners of this website know about this isue for over a year and still, nobody seems to bother.
Rude.com este o comunitate adult cu un numar mare de membri. Este un site stufos ce si-a dorit sa uneasca mai multe servicii gen porn videos, amateur videos, amateur live cams, private cams, social network, xxx games etc., complexitatea acestuia facandu-l destul de cunoscut in US.
Si totusi este un adevarat pericol sa vizitezi acest site. De ce?
In rubrica comments a fiecarui profil se poate insera javascript. Nu, nu ma refer doar la inserarea scripturilor in propriul profil, ci la posibilitatea de a face acest lucru in TOATE profilele existente pe acest site.
Metoda este extrem de simpla. In spatiul de comentarii se adauga <img src=”" onerror=”evil javascript code”>, iar la vizualizarea profilului acest cod se executa. Exemplu: <img src=”" onerror=”alert(1)”>.
Aceasta vulnerabilitate este extrem de periculoasa pentru userii rude.com mai ales ca exista servicii platite ce pot provoca gauri in bugetul utilizatorilor.
Sa luam ca exemplu un client al showurilor private. Omul isi cumpara chips-uri (credit), i se fura cookies si i se foloseste contul. Aici exista doua posibilitati:
1. Clientul nu ia nicio masura sau poate nu observa disparitia creditului din cont.
2. Clientul observa, face chargeback, iar modelul care a beneficiat de show-ul privat cu “atacatorul” nu isi primeste banii. Credit score-ul clientului are de suferit, imaginea site-ului are de suferit, modelul nu isi primeste banii.
Desigur ca acest tip de vulnerabilitate poate fi folosit la phishing, generarea traficului pe alte site-uri sau pentru ascunderea unor atacuri xss asupra unor alte servicii web (yahoo, gmail, ebay, paypal etc.).
Posibilitatea de a implementa un xss worm este extrem de facila.
Proprietarii rude.com stiu de peste un an de zile de aceasta problema dar dupa cum se poate observa nimeni nu a facut nimic.
NOTA: accesarea site-ului din Romania se poate face doar cu ajutorul unui ip extern. Toate ip-urile romanesti sunt banate si vizitatorii din aceasta tara sunt redirectionati automat catre alt site.
Leave a Reply