._/:: 8#00p$ ::\_.: August 2010

Monday, August 23, 2010

PT with Browser

PT with Browser

yes, penetration testing became so easy nowadays. You don't need heavy, bulky, expensive vulnerability assessment tools. Now you just need now is, a browser (Firefox) and its Add-ons (plug-ins), which are available freely. Here I'm going to tell you something about free Mozilla Add-ons, which can help you to effectively perform vulnerability assessment and penetration testing.

These tools are listed below:

1. SQL Inject Me: SQL Injection vulnerabilities can cause a lot of damage to a web application.

2. HackBar: Simple security audit / Penetration test tool.

3. Backend Software Information: Detect the backend software of the current website (Drupal 5.x, 6.x, Wordpress 2.x, Django, phpBB, MediaWiki, MoinMoin, Joomla, Reddit, ...).

4. Firebug: It integrates with Firefox to put a wealth of development tools at your fingertips while you browse. You can edit, debug, and monitor CSS, HTML, and JavaScript live in any web page.

5. FxIF: View EXIF data in image properties.

6. Fireforce: Launches brute-force attacks on GET or POST forms.

7. Widerbug: web developing with CSS and JavaScript.

8. Lazarus: Lazarus securely auto-saves all forms as you type.

9. ShowIP: Show the IP address(es) of the current page in the status bar.

10. Multiproxy Switch: This tool lets you switch proxy between multiple configurations, and it's easy to manage, easy to configure.

11. FoxyProxy Standard: FoxyProxy is an advanced proxy management tool that completely replaces Firefox's limited proxying capabilities.

12. PassiveRecon: PassiveRecon provides information security professionals with the ability to perform "packetless" discovery of target resources utilizing publicly available information.

13. Live HTTP Headers: View HTTP headers of a page and while browsing.

14. Add N Edit Cookies: Cookie Editor that allows you add and edit session and saved cookies.

15. Greasemonkey: Allows you to customize the way a webpage displays using small bits of JavaScript.

16. XSS Me: Cross-Site Scripting (XSS) is a common flaw found in todays web applications.

17. Whiteacid's XSS assistant: Very powerful.

18. SQL Injection: SQL Injection is an Upgrade from the old form free, it is a component to transform checkboxes, radio buttons, select elements to a input text and enable disabled elements from all forms in a page.

It makes easier to test and identify SQL injection vulnerabilities in web pages.

19. FireCAT 1.5 "Plus" Edition: Security databse tools.

20. iMacros for Firefox: Automate Firefox. Record and replay repetitious work. If you love the Firefox web browser, but are tired of repetitive tasks like visiting the same sites every days, filling out forms, and remembering passwords, then iMacros for Firefox is the solution you’ve been dreaming of! ***Whatever you do with Firefox, iMacros can automate it.***

21. Xmarks Sync: Xmarks is the #1 bookmarking add-on. Keep your bookmarks, passwords and open tabs backed up and synchronized across computers and browsers. Search smarter with website ratings and reviews displayed with your search results.

22. Read It Later: Save pages to read later with just one click. When you have time, access your reading list from any computer or phone, even without an internet connection!

To read more, follow:

http://www.securityaegis.com/hacking-with-your-browser/

Have safe browsing, safe hacking and successful penetration testing.

nj0y !!!

Abode Patches

Adobe Patches

This month, adobe released patches for lots of severe vulnerabilities in their products. Most of these vulnerable applications are generally used by us. Hence it is requested, to update all adobe products and avoid system compromise & severe problems caused, and if possible use adobe update manager.

Affected Adobe Products

Adobe Flash Player 10.1.53.64 and earlier

Adobe AIR 2.0.2.12610 and earlier

Adobe ColdFusion 9.0.1 and previous versions

Flash Media Server 3.5.3 and earlier versions

Flash Media Server 3.0.5 and earlier versions

Detail are give below:

Adobe

http://www.adobe.com/support/security/bulletins/apsb10-19.html

http://www.adobe.com/support/security/bulletins/apsb10-16.html

http://www.adobe.com/support/security/bulletins/apsb10-18.html

CERT-In

http://www.cert-in.org.in/advisory/ciad-2010-58.htm

http://www.cert-in.org.in/vulnerability/civn-2010-188.htm

http://www.cert-in.org.in/vulnerability/civn-2010-189.htm

#@V3 $@F3 8R0W$!N9 !!!

nj0y !!!

Wednesday, August 11, 2010

Hello Friends,

Today is Microsoft patch day, Microsoft has released 15 security bulletins which are covering 34 vulnerabilities.

These vulnerabilities are affecting Windows Kernel, Windows Movie Maker, SChannel, Microsoft XML Core Services, Microsoft MPEG Layer-3 Codecs, Cinepak Codec, SMB Server, Internet Explorer, Microsoft Office Word, Microsoft Office Excel, TCP/IP, Microsoft .NET and Silverlight. Install the patches as mentioned in Microsoft Security Bulletin. Most of them are critical and needs to be patched as early as possible.

MS10-046

Critical

Vulnerability in Windows Shell Could Allow Remote Code Execution (2286198)

MS10-049

Critical

Vulnerabilities in SChannel Could Allow Remote Code Execution (980436)

MS10-051

Critical

Vulnerability in Microsoft XML Core Services Could Allow Remote Code Execution (2079403)

MS10-052

Critical

Vulnerability in Microsoft MPEG Layer-3 Codecs Could Allow Remote Code Execution (2115168)