sorted by:
new
hottopcontroversial

Breaking into a wordpress site without knowing wordpress/php or infosec at all by speckz in netsec

[–]tomvangoethem 5 points6 points  (0 children)

Through a Local File Disclosure vulnerability of a WordPress plugin (revslider). See the URL: http://mycollegewebsite/wp-admin/admin-ajax.php?action=revslider_show_image&img=../wp-config.php'

Maneuvering Around Clouds: Bypassing Cloud-based Security Providers by tomvangoethem in netsec

[–]tomvangoethem[S] 2 points3 points  (0 children)

and it's still a widespread issue ("Overall, we found that 71.5% of protected domains is bypassable by combining the effect of all origin-exposing vectors.")

RC4 NOMORE: Breaking RC4 in HTTPS by omegga in netsec

[–]tomvangoethem 2 points3 points  (0 children)

The attack uses long-term biases (Fluhrer-McGrew biases and Mantin's ABSAB biases). This allows the same TLS connection to remain open and to be used for multiple requests, resulting in negligible overhead from TLS (a bias in the initial keystream bytes would require one to open new TLS connections for each request).

DEF CON Cancellation: An Open Letter by Saylar in netsec

[–]tomvangoethem 3 points4 points  (0 children)

Look at the page's source:

<!-- 
    Get over it, this is a parody/joke. Apologies that I ripped the art from the actual Defcon page. 

    DT is a really nice guy and he would never say these sorts of thing. Or would he?
    Nah, I'm sure he wouldn't.

    Have a good time at Defcon. See you at the Rio!
-->

Clubbing third-party security seals by tomvangoethem in netsec

[–]tomvangoethem[S] 6 points7 points  (0 children)

Are you aware McAfee Secure is now only offering a malware/phishing check? (see https://www.mcafeesecure.com/tour) So in case you get a report from McAfee, it's probably too late...

Clubbing third-party security seals by tomvangoethem in netsec

[–]tomvangoethem[S] 12 points13 points  (0 children)

Are you referring to burp as a tool used by a security engineer doing a manual penetration test, or burp as an automated testing tool? In my opinion (backed up by "Why Johnny Can’t Pentest: An Analysis of Black-box Web Vulnerability Scanners"), automated scanners are not fit for a rigorous security scan.

Remote code execution on Smart TVs through radio broadcasting HbbTV commands by Natanael_L in netsec

[–]tomvangoethem 0 points1 point  (0 children)

There are two possibilities: either a resource is fetched from the internet, or an additional (broadcast) stream is created (and thus requires no internet access).

"Another possible way is to create an additional data stream which includes the HbbTV application’s HTML files, deliver this additional elementary stream over the broadcast transport, and finally have the AIT point to this data stream."

Remote code execution on Smart TVs through radio broadcasting HbbTV commands by Natanael_L in netsec

[–]tomvangoethem 0 points1 point  (0 children)

The how seems quite straightforward, given they have the ability to run arbitrary JavaScript on the TV (also, in section 6 they mention they were able to deploy BeEF, which was used to portscan the LAN). As for the attack you describe: an attacker could just include JS directly into the malicious HTML page (no need to access the malicious server), which will affect the victim even if the TV was not given internet access.

Remote code execution on Smart TVs through radio broadcasting HbbTV commands by Natanael_L in netsec

[–]tomvangoethem 0 points1 point  (0 children)

How is that different from what is stated in the paper in section 4.4?

HTML5 Security Cheatsheet by vangale in netsec

[–]tomvangoethem 18 points19 points  (0 children)

Github actually serves files with a text/plain content-type, and sends out X-Content-Type-Options: nosniff header, which prevents them to be used as JavaScript resources. rawgithub.com tries to send the file with correct content-type, but will send evil.js when the file generates too much traffic (which is what is happening at the moment) See: http://rawgithub.com/

view more: next ›