<?xml version="1.0" encoding="UTF-8"?>
<?xml-stylesheet href="http://feeds.feedburner.com/~d/styles/rss2full.xsl" type="text/xsl" media="screen"?><?xml-stylesheet href="http://feeds.feedburner.com/~d/styles/itemcontent.css" type="text/css" media="screen"?><!-- generator="wordpress/2.2.3" --><rss xmlns:content="http://purl.org/rss/1.0/modules/content/" xmlns:wfw="http://wellformedweb.org/CommentAPI/" xmlns:dc="http://purl.org/dc/elements/1.1/" xmlns:feedburner="http://rssnamespace.org/feedburner/ext/1.0" version="2.0">

<channel>
	<title>www.notsosecure.com</title>
	<link>http://www.notsosecure.com/folder2</link>
	<description>From Pentesters To Pentesters</description>
	<pubDate>Sat, 21 Jun 2008 09:34:12 +0000</pubDate>
	<generator>http://wordpress.org/?v=2.2.3</generator>
	<language>en</language>
			<atom10:link xmlns:atom10="http://www.w3.org/2005/Atom" rel="self" href="http://feeds.feedburner.com/notsosecure" type="application/rss+xml" /><item>
		<title>Bsqlbf V2, Blind SQL Injection Brute Forcer</title>
		<link>http://feeds.feedburner.com/~r/notsosecure/~3/316794002/</link>
		<comments>http://www.notsosecure.com/folder2/2008/06/21/bsqlbf-v2-blind-sql-injection-brute-forcer/#comments</comments>
		<pubDate>Sat, 21 Jun 2008 09:28:32 +0000</pubDate>
		<dc:creator>sid</dc:creator>
		
		<category><![CDATA[Tools for Wep App Testing]]></category>

		<category><![CDATA[Research]]></category>

		<guid isPermaLink="false">http://www.notsosecure.com/folder2/2008/06/21/bsqlbf-v2-blind-sql-injection-brute-forcer/</guid>
		<description><![CDATA[Bsqlbf was originally written by &#160;A. Ramos from www.514.es and was intended to exploit blind sql injection against mysql backend database. This is a modified version of the same tool. It supports blind sql injection against the following databases:-
MS-SQL
MY-SQL
PostgreSQL
Oracle
It supports injection in string and integer fields. The feature which separates this tool from all other [...]]]></description>
		<wfw:commentRss>http://www.notsosecure.com/folder2/2008/06/21/bsqlbf-v2-blind-sql-injection-brute-forcer/feed/</wfw:commentRss>
		<feedburner:origLink>http://www.notsosecure.com/folder2/2008/06/21/bsqlbf-v2-blind-sql-injection-brute-forcer/</feedburner:origLink></item>
		<item>
		<title>If Query Data Manipulation</title>
		<link>http://feeds.feedburner.com/~r/notsosecure/~3/298573581/</link>
		<comments>http://www.notsosecure.com/folder2/2008/05/26/if-query-data-manipulation/#comments</comments>
		<pubDate>Mon, 26 May 2008 19:28:38 +0000</pubDate>
		<dc:creator>sid</dc:creator>
		
		<category><![CDATA[Research]]></category>

		<guid isPermaLink="false">http://www.notsosecure.com/folder2/2008/05/26/if-query-data-manipulation/</guid>
		<description><![CDATA[Occasionally&#160;when exploiting SQL injections there are conditions when application does not show different pages for true and false result of sql query. If the database server does not resolve host names(thus prohibiting out of band attacks), the attack vector that is used to exploit such conditions is to use functions such as &#39;waitfor delay&#39; which [...]]]></description>
		<wfw:commentRss>http://www.notsosecure.com/folder2/2008/05/26/if-query-data-manipulation/feed/</wfw:commentRss>
		<feedburner:origLink>http://www.notsosecure.com/folder2/2008/05/26/if-query-data-manipulation/</feedburner:origLink></item>
		<item>
		<title>Getting Past the Comma(,) in Oracle SQL Injection</title>
		<link>http://feeds.feedburner.com/~r/notsosecure/~3/297097594/</link>
		<comments>http://www.notsosecure.com/folder2/2008/05/24/getting-past-the-comma-in-oracle-sql-injection/#comments</comments>
		<pubDate>Sat, 24 May 2008 08:38:01 +0000</pubDate>
		<dc:creator>sid</dc:creator>
		
		<category><![CDATA[Research]]></category>

		<guid isPermaLink="false">http://www.notsosecure.com/folder2/2008/05/24/getting-past-the-comma-in-oracle-sql-injection/</guid>
		<description><![CDATA[Recently i came across a SQL Injection against oracle database, where the vulnerable parameter was taking comma separated input.
 Thus Valid input will look like:- index.do?id=1,200
 And it was easier to confirm that its vulnerable to sql injection by making true and false responses:-
 True response:- index.do?id=1,200 and 1=1
 False Response:- index.do?id=1,200 and 1=2
 This [...]]]></description>
		<wfw:commentRss>http://www.notsosecure.com/folder2/2008/05/24/getting-past-the-comma-in-oracle-sql-injection/feed/</wfw:commentRss>
		<feedburner:origLink>http://www.notsosecure.com/folder2/2008/05/24/getting-past-the-comma-in-oracle-sql-injection/</feedburner:origLink></item>
		<item>
		<title>Exploiting Internal Networks with Oracle UTL_HTTP package</title>
		<link>http://feeds.feedburner.com/~r/notsosecure/~3/275685702/</link>
		<comments>http://www.notsosecure.com/folder2/2008/04/22/exploiting-internal-networks-with-oracle-utl_http-package/#comments</comments>
		<pubDate>Tue, 22 Apr 2008 21:36:19 +0000</pubDate>
		<dc:creator>sid</dc:creator>
		
		<category><![CDATA[Research]]></category>

		<guid isPermaLink="false">http://www.notsosecure.com/folder2/2008/04/22/exploiting-internal-networks-with-oracle-utl_http-package/</guid>
		<description><![CDATA[
Oracle&#39;s utl_http.request() function has been referred a number of times to carry out sql injection. It is generally used for the purpose of resolving names, so that an attacker could receive the output of his SQL query over DNS channel.
However, this function can also be used to make a legitimate http connection to internal network. [...]]]></description>
		<wfw:commentRss>http://www.notsosecure.com/folder2/2008/04/22/exploiting-internal-networks-with-oracle-utl_http-package/feed/</wfw:commentRss>
		<feedburner:origLink>http://www.notsosecure.com/folder2/2008/04/22/exploiting-internal-networks-with-oracle-utl_http-package/</feedburner:origLink></item>
		<item>
		<title>Oracle 10g Express Edition Cookie’s issue</title>
		<link>http://feeds.feedburner.com/~r/notsosecure/~3/274001168/</link>
		<comments>http://www.notsosecure.com/folder2/2008/04/20/oracle-10g-express-edition-cookies-issue/#comments</comments>
		<pubDate>Sun, 20 Apr 2008 10:08:35 +0000</pubDate>
		<dc:creator>sid</dc:creator>
		
		<category><![CDATA[Advisories]]></category>

		<category><![CDATA[Research]]></category>

		<guid isPermaLink="false">http://www.notsosecure.com/folder2/2008/04/20/oracle-10g-express-edition-cookies-issue/</guid>
		<description><![CDATA[Oracle 10g Express Edition does not invalidate the cookie www_flow_user2 on server when the user logs off.
Tested in version:- Oracle 10g Express edition 10.2.0.1.0, other versions may also be vulnerable.
Patch:- Oracle CPU April 2008 
]]></description>
		<wfw:commentRss>http://www.notsosecure.com/folder2/2008/04/20/oracle-10g-express-edition-cookies-issue/feed/</wfw:commentRss>
		<feedburner:origLink>http://www.notsosecure.com/folder2/2008/04/20/oracle-10g-express-edition-cookies-issue/</feedburner:origLink></item>
		<item>
		<title>Database Password Hashes Cracking</title>
		<link>http://feeds.feedburner.com/~r/notsosecure/~3/270567750/</link>
		<comments>http://www.notsosecure.com/folder2/2008/04/15/database-password-hashes-cracking/#comments</comments>
		<pubDate>Tue, 15 Apr 2008 08:42:34 +0000</pubDate>
		<dc:creator>sid</dc:creator>
		
		<category><![CDATA[Research]]></category>

		<guid isPermaLink="false">http://www.notsosecure.com/folder2/2008/04/15/database-password-hashes-cracking/</guid>
		<description><![CDATA[
SQL Server 2000:-
SELECT password from master.dbo.sysxlogins where name=&#39;sa&#39;&#160;
0&#215;010034767D5C0CFA5FDCA28C4A56085E65E882E71CB0ED250341
2FD54D6119FFF04129A1D72E7C3194F7284A7F3A
 
0&#215;0100- constant header
34767D5C- salt
0CFA5FDCA28C4A56085E65E882E71CB0ED250341- case senstive hash
2FD54D6119FFF04129A1D72E7C3194F7284A7F3A- upper case hash
crack the upper case hash in &#39;cain and abel&#39; and then work the case sentive hash
&#160;
 
SQL server 2005:-
SELECT password_hash FROM sys.sql_logins where name=&#39;sa&#39;
0&#215;0100993BF2315F36CC441485B35C4D84687DC02C78B0E680411F
0&#215;0100- constant header
993BF231-salt
5F36CC441485B35C4D84687DC02C78B0E680411F- case sensitive hash
crack case sensitive hash in cain, try brute force and [...]]]></description>
		<wfw:commentRss>http://www.notsosecure.com/folder2/2008/04/15/database-password-hashes-cracking/feed/</wfw:commentRss>
		<feedburner:origLink>http://www.notsosecure.com/folder2/2008/04/15/database-password-hashes-cracking/</feedburner:origLink></item>
		<item>
		<title>Xgrid Controller, Mac Unleashed</title>
		<link>http://feeds.feedburner.com/~r/notsosecure/~3/244498915/</link>
		<comments>http://www.notsosecure.com/folder2/2008/03/02/xgrid-controller-mac-unleashed/#comments</comments>
		<pubDate>Sun, 02 Mar 2008 21:58:54 +0000</pubDate>
		<dc:creator>sid</dc:creator>
		
		<category><![CDATA[Research]]></category>

		<guid isPermaLink="false">http://www.notsosecure.com/folder2/2008/03/02/xgrid-controller-mac-unleashed/</guid>
		<description><![CDATA[&#160;I have been using Mac OSX since last few months, and its fun to explore things which apple do. Apple in 2004 introduced XGrid, which allows you to utilize the resources of different Mac OS in your network and gain a considerable performance boost. Here is a great article, talking about How to Turn Your [...]]]></description>
		<wfw:commentRss>http://www.notsosecure.com/folder2/2008/03/02/xgrid-controller-mac-unleashed/feed/</wfw:commentRss>
		<feedburner:origLink>http://www.notsosecure.com/folder2/2008/03/02/xgrid-controller-mac-unleashed/</feedburner:origLink></item>
		<item>
		<title>Security Of Flash Games</title>
		<link>http://feeds.feedburner.com/~r/notsosecure/~3/238079401/</link>
		<comments>http://www.notsosecure.com/folder2/2008/02/20/security-of-flash-games/#comments</comments>
		<pubDate>Wed, 20 Feb 2008 09:44:16 +0000</pubDate>
		<dc:creator>sid</dc:creator>
		
		<category><![CDATA[Research]]></category>

		<guid isPermaLink="false">http://www.notsosecure.com/folder2/2008/02/20/security-of-flash-games/</guid>
		<description><![CDATA[A number of websites allow users to play flash games online and then submit their score. After the competition end, the user with highest score wins a prize. A major problem which such websites face, is, how do they ensure user submits the correct score?
The scores submitted by user is mostly a HTTP POST request, [...]]]></description>
		<wfw:commentRss>http://www.notsosecure.com/folder2/2008/02/20/security-of-flash-games/feed/</wfw:commentRss>
		<feedburner:origLink>http://www.notsosecure.com/folder2/2008/02/20/security-of-flash-games/</feedburner:origLink></item>
		<item>
		<title>Mail Fraud: Case Study</title>
		<link>http://feeds.feedburner.com/~r/notsosecure/~3/234860025/</link>
		<comments>http://www.notsosecure.com/folder2/2008/02/14/mail-fraud-case-study/#comments</comments>
		<pubDate>Thu, 14 Feb 2008 09:31:16 +0000</pubDate>
		<dc:creator>sid</dc:creator>
		
		<category><![CDATA[Research]]></category>

		<guid isPermaLink="false">http://www.notsosecure.com/folder2/2008/02/14/mail-fraud-case-study/</guid>
		<description><![CDATA[A few days ago, i came across this mail fraud. I was looking for some merchandise and came across this forum, in which someone has advertised an iphone for just 100 quid. This sounded very phishy and too good to be true. I decided to contact the person and enquire about the product. The person [...]]]></description>
		<wfw:commentRss>http://www.notsosecure.com/folder2/2008/02/14/mail-fraud-case-study/feed/</wfw:commentRss>
		<feedburner:origLink>http://www.notsosecure.com/folder2/2008/02/14/mail-fraud-case-study/</feedburner:origLink></item>
		<item>
		<title>Flawed XSRF Protection In Wordpress</title>
		<link>http://feeds.feedburner.com/~r/notsosecure/~3/234400455/</link>
		<comments>http://www.notsosecure.com/folder2/2008/02/13/flawed-xsrf-protection-in-wordpress/#comments</comments>
		<pubDate>Wed, 13 Feb 2008 15:16:18 +0000</pubDate>
		<dc:creator>sid</dc:creator>
		
		<category><![CDATA[Research]]></category>

		<guid isPermaLink="false">http://www.notsosecure.com/folder2/2008/02/13/flawed-xsrf-protection-in-wordpress/</guid>
		<description><![CDATA[
As demonstrated by ferruh &#39;http://ferruh.mavituna.com/flawed-csrf-protections-oku/&#39;, this is a serious flaw which surprisingly went un-noticed. An admin could be easily tricked into clicking a &#39;Yes&#39; button resulting in a password update. An attacker could also update the admin&#39;s email and use the &#39;forgot password&#39; functionality to reset his password. Wordpress, do not ask user&#39;s to provide [...]]]></description>
		<wfw:commentRss>http://www.notsosecure.com/folder2/2008/02/13/flawed-xsrf-protection-in-wordpress/feed/</wfw:commentRss>
		<feedburner:origLink>http://www.notsosecure.com/folder2/2008/02/13/flawed-xsrf-protection-in-wordpress/</feedburner:origLink></item>
	</channel>
</rss>
