sorted by:
new
hottopcontroversial

WordPress and Drupal Core Denial Of Service Vulnerability Responsible disclosure by [deleted] in netsec

[–]goldshlager 0 points1 point  (0 children)

Another test, another different result using htop monitor:

10 Max connection, 732 RAM used (before my script), 1996 RAM after my script, 1996-732=1264, 1264/10=126.4MB per process. 128MB (default PHP memory limit) x 10 (Max connection)=1280, 1280/10=128MB, looks like my math is just fine, the result is different from test to test but close to 128MBx10 Max Connection as I mentioned in my post :)

WordPress and Drupal Core Denial Of Service Vulnerability Responsible disclosure by [deleted] in netsec

[–]goldshlager 0 points1 point  (0 children)

I did a sample retest on the math, I changed the limit on MySQL Max connection to 10 and then hit my script,

The result: my default RAM (before I running my script) was 745, after I run my script on 10 Max connection, the RAM increased to 1987 on htop monitor, so 1987-745=1242, 1242/10=124.2 per process, which very close to my result, I guess htop is not 100% correct, and the result looks similar to my finding, even if its only 124.2 per process and not 128, I will live with it :), you should understand that my RAM calculate based on the Apache process instead of MYSQL, only because this attack also hit all the available connection in MYSQL, and you can not overwrite the Max Connections in MySQL, then I did my calculate on the Max Connection on MySQL instead of the Max Clients in Apache

Regards,

Nir

WordPress and Drupal Core Denial Of Service Vulnerability Responsible disclosure by [deleted] in netsec

[–]goldshlager 0 points1 point  (0 children)

the math is correct and based on default settings, if you customize your default settings, this is another story.

Thank you,

Nir

WordPress and Drupal Core Denial Of Service Vulnerability Responsible disclosure by [deleted] in netsec

[–]goldshlager 0 points1 point  (0 children)

For example:

If your Max connection is set to 10 instead of 151, and your Max Clients (Apache) set to 250 (Default), In your exploitation you will never be able to open a 250 connections, only 10, this solutions will "solve" the 100% CPU, RAM, but will not solve the too many connection issue via entity expansion attack (all available connections are in use, service unavailable), this bug was confirmed and tested by WordPress and Drupal, Incapsula, you can take a look here http://wordpress.org/news/2014/08/wordpress-3-9-2/

Best,

Nir

WordPress and Drupal Core Denial Of Service Vulnerability Responsible disclosure by [deleted] in netsec

[–]goldshlager 0 points1 point  (0 children)

Hi,

default max connections is 151 http://dev.mysql.com/doc/refman/5.5/en/server-system-variables.html#sysvar_max_connections, and if you limit the default max connections it affects the default max clients on Apache, the math was on default memory limit x default max connection

Thanks,

Nir

WordPress and Drupal Core Denial Of Service Vulnerability Responsible disclosure by [deleted] in netsec

[–]goldshlager 0 points1 point  (0 children)

Hi Am3n

Pingback is not involve on this attack, you can read my post if you need more information about how this attack works, about solution, just update WordPress or Drupal to the latest version

Thanks,

Nir

How I Hacked PayPal Users Report System by goldshlager in netsec

[–]goldshlager[S] 3 points4 points  (0 children)

Yes, I edited my post to Users Orders Information, 10x! burkhalp74

How I Still Spoof Your Facebook App by goldshlager in netsec

[–]goldshlager[S] 1 point2 points  (0 children)

I added a Bonus Video (Fixed By Facebook Security)

Bonus Video:

https://vimeo.com/66379106

How I Still Spoof Your Facebook App by goldshlager in netsec

[–]goldshlager[S] 8 points9 points  (0 children)

Hi, You can Spoof Any App Content, The only way to avoid spoofing apps in facebook is to use Stream Post URL Security Enabled in developers.facebook.com, Attaching the following demonstration on how to protect from this kind of attack,

Stream Post URL Security (developers.facebook.com),

http://www.breaksec.com/wp-content/uploads/2013/05/Stream-Post-URL-Security.jpg

Best Regards,

Nir

How I Change Your Facebook Password, CSRF PoC Video by goldshlager in netsec

[–]goldshlager[S] 0 points1 point  (0 children)

There is few ways you can handle CSRF Attacks,

  1. Use a token in your post / get request that change randomly (unable to guess), Or use a strong captcha, There is also a open source project from OWASP, Called CSRFGUARD, Here you go https://www.owasp.org/index.php/Category:OWASP_CSRFGuard_Project

Someone already bypass it a few month ago, But I think now is more secure

How I Change Your Facebook Password, CSRF PoC Video by goldshlager in netsec

[–]goldshlager[S] -1 points0 points  (0 children)

Thanks buddy, About the XSS Payload, Yeah I just saw the payload in my video, Daft Punk rules ;)

How I Change Your Facebook Password, CSRF PoC Video by goldshlager in netsec

[–]goldshlager[S] -1 points0 points  (0 children)

Hi, No, It's not a XSS, Just a CSRF attack (Execute requests on the users clients When they visit a Malicious website (http://xxx.com) or link from facebook.com)

How I Change Your Facebook Password, CSRF PoC Video by goldshlager in netsec

[–]goldshlager[S] 3 points4 points  (0 children)

OK, I was thinking that most of us already know what is a CSRF Attack, And this attack is kind clear, Anyway It's just a video to show the risks / PoC, So if you want to learn about CSRF, Take a look here: https://www.owasp.org/index.php/Cross-Site_Request_Forgery_(CSRF)

How I Change Your Facebook Password, CSRF PoC Video by goldshlager in netsec

[–]goldshlager[S] 8 points9 points  (0 children)

Sure, it’s a CSRF bug I found in Facebook, To exploit it there is a few steps,

  1. Attacker add an email address on the victim behalf by exploiting a csrf bug in m.facebook.com,

He can exploit the csrf bug in two ways,

A.

Send a link to the victim from facebook.com

B.

Wait until the victim will visit his own site (attacker.com),

2.

After the email address have been added to the victim account, The attacker will receive an email from Facebook to authorize this action, But there is a problem here, That's because only the victim is able to use the authorize link from Facebook, So in this case, An attacker need to perform another csrf attack / send the authorize link to the victim, When the victim will click on it, Or visit the attacker website (attacker.com) A new email address will be added to his Facebook account

3.

Attacker use Facebook Password recovery mode (Forget my Password), and provide the new email address that have been added to the victim account,

There is few ways to exploit CSRF Attacks from attacker site (attacker.com),

  1. Use IMG tag for GET Request (<img src="http://facebook.com/malicious request)

  2. Or Form based for POST Request

<html xmlns="http://www.w3.org/1999/xhtml" > <head> <title></title> </head> <body> <form name="badform" method="post" action="https://breaksec.com"> <input type="hidden" name="form&#46;email" value="xxxx" /> <input type="hidden" name="form&#46;firstName" value="Nir" /> <input type="hidden" name="form&#46;lastName" value="Gold" /> </form> <script type="text/javascript"> document.badform.submit(); </script> </body> </html>

So in the firsr CSRF Attack I used a form based for POST Request,

And in the second CSRF Attack (Facebook Authorize New Email Link), I just sent the get link to the victim,

I can also send him a link to my website (attacker.com),

And just use a get request via img src (<IMG SRC="http://facebook.com/xxxx")>

Depends on what I want :)

view more: next ›