Phearless Serbian/Croatian Security Magazine Issue #01 - In this issue: The Art of Sniffing, The Art of Footprinting, SQL Injection Techniques, Wireless - Under the hood, Cross Site Scripting with examples, VX Coding - New ideas, Win Hack and Tweak, Samba Lin and Win Dance, Exploiting ShopAdmin, CGI Exploiting, and Mirc Scripting Basics. Note: All articles are in Serbian/Croatian.
667c8c8ad2e789a3b6b7c451991dfb87400bbd7db568da9276d836ec71ab233ePhearless Group Logo
687e4d09dcf869779d098b6768593aa39fa80f365840e6d1a92c87f8709c29d2Scapy is a powerful interactive packet manipulation tool, packet generator, network scanner, network discovery tool, and packet sniffer. It provides classes to interactively create packets or sets of packets, manipulate them, send them over the wire, sniff other packets from the wire, match answers and replies, and more. Interaction is provided by the Python interpreter, so Python programming structures can be used (such as variables, loops, and functions). Report modules are possible and easy to make. It is intended to do the same things as ttlscan, nmap, hping, queso, p0f, xprobe, arping, arp-sk, arpspoof, firewalk, irpas, tethereal, tcpdump, etc.
e71c6917f00ed0269144680029ea3270650ee1a6200f32e1ffe1c8b958da0293iptables is the new packet alteration framework (firewall utility) for Linux 2.4. It is an enhancement on ipchains, and is used to control packet filtering, Network Address Translation (masquerading, port forwarding, transparent proxying), and special effects.
2067ed2134adde5f50716dd1d3752dfb023a634ff274af88eb635e5a1bba1bdaTechnical Cyber Security Alert TA05-312A - Microsoft has released updates that address critical vulnerabilities in Windows graphics rendering services. A remote, unauthenticated attacker exploiting these vulnerabilities could execute arbitrary code or cause a denial of service on an affected system.
e7447a542eaf53d621a44d2a16c5be621d1fde25bf9e9ac9ca0b932d7548fd5aeEye Security Advisory - eEye Digital Security has discovered a heap overflow vulnerability in the way the Windows Graphical Device Interface (GDI) processes Windows enhanced metafile images (file extensions EMF and WMF). An attacker could send a malicious metafile to a victim of his choice over any of a variety of media -- such as HTML e-mail, a link to a web page, a metafile-bearing Microsoft Office document, or a chat message -- in order to execute code on that user's system at the user's privilege level.
fbe0e7b4b08c26cdcbea6f41f6a2f4a4b4680d5b2050eb53b95436d4a2a12232eEye Security Advisory - eEye Digital Security has discovered a vulnerability in the way the Windows Graphical Device Interface (GDI) processes Windows Metafile (WMF) format image files that would allow arbitrary code execution as a user who attempts to view a malicious image. An attacker could send such a metafile to a victim of his choice over any of a variety of attack vectors, including an HTML e-mail, a link to a web page, a metafile-bearing Microsoft Office document, or a chat message.
fb070c689f7c1eb6298f3b908b6d3263adc6334948806fad6400732d941dbe93SCO Security Advisory - Ulf Harnhammar has reported a vulnerability in Lynx, which can be exploited by malicious people to compromise a user's system. The vulnerability is caused due to a boundary error in the HTrjis() function in the handling of article headers sent from NNTP (Network News Transfer Protocol) servers. This can be exploited to cause a stack-based buffer overflow by e.g. tricking a user into visiting a malicious web site which redirects to a malicious NNTP server via the nntp: URI handler. Successful exploitation allows execution of arbitrary code.
3a4f408a9e7a6a4943c8178a7eda2a2ee13c50995972d5fa0fc6e533172fbd78Examining the Oracle October 2005 Critical Patch Update in depth, NGSResearchers discovered a number of problems which have all since been reported to Oracle. As well as new vulnerabilities and problems with the patches for old vulnerabilities, the October 2005 CPU fails to install the patched Oracle Text (CTXSYS) components on Oracle 8.1.7.4 on all operating systems.
dcb5911d8865a35e374c4408fe8e0d9825eb68d9a0f3aad29905098199a62c7c18th Annual FIRST Conference - Call For Papers - The Forum of Incident Response and Security Teams (FIRST) is a global organization dedicated to bringing together computer security incident response teams (CSIRTs). The annual FIRST conference not only provides a setting for participants to attend tutorials and hear presentations by leading experts in the CSIRT community, it also creates opportunities for networking, collaboration, and sharing of technical information. Equally important, this conference enables the attendees to meet with their peers and build trusted relationships.
3af538673af42b25c9ec43c7b3d208c2167c4b2a88ec2bb36eeaa45cdecbe8d1PHPKIT versions 1.6.1 R2 and below suffer from cross site scripting, SQL injection, information disclosure, password hash disclosure, local file disclosure, and arbitrary code execution flaws. Various sample exploitation details provided.
a91e4d42b773ee597b5ea0162d7a64232a6a053f5d7b8e1af72709197633e2f8Debian Security Advisory DSA 889-1 - A bug has been discovered in enigmail, GPG support for Mozilla MailNews and Mozilla Thunderbird, that can lead to the encryption of mail with the wrong public key, hence, potential disclosure of confidential data to others.
4be675ece4a4d67f879b5d40f664546958c95aef39d098d00d59abee0a458ae7Secunia Security Advisory - Two vulnerabilities have been reported in Microsoft Windows, which can be exploited by malicious people to compromise a vulnerable system.
cf26ef2d1adb33dda06e1c49fa3c03feabdbc78f0182b78e588cf09286a66e7bLayerOne 2006 - Call for Papers - LayerOne is now officially accepting papers and presentations for consideration at our 2006 show. We are looking for people to speak on a broad range of topics, so all submissions will be considered. At the moment we're interested in hearing from potential speakers with the following interests: Data Forensics, Reverse Engineering, VoIP (security and development), Emerging Security Trends, Regulatory Issues (SOX, PCI, ISO 17799, etc), Firmware/Embedded Systems Hacking.
38046b10e761b0737f9adaecc125068acd262730c34c2288dde55dce30615e6b
© 2022 Packet Storm. All rights reserved.
%7Cutmcsr%3D(direct)%7Cutmcmd%3D(none)){kind=small}
Follow us on Twitter
Follow us on Facebook
Subscribe to an RSS Feed
