::1 Page

While performing a pentest for a client, I discovered that the virtual host HTTP header of a web server was vulnerable to SQL injection (!). This is probably because the default vhost runs an application that store the vhost sent by the client before it processes it further. Still, it's interesting because it's not so obvious to exploit.

The database engine is SQL Server. The version is unknown. Here comes the fun part: the "Host" HTTP header is validated by IIS first, so most symbols are filte… Continue

So any Windows box can be quickly owned when the computer is equipped with a Firewire (IEEE 1394) port. I tried to reproduce the attacks by carefully following online guides, but it proved much more difficult than it seemed.

In my work environment, I couldn't find any workstation equipped with a 6-pin 1394 port, and I only had two types of Firewire cables: 4-pin to 6-pin and 6-pin to 6-pin. Laptops ar… Continue

I modified rainbowcrack 1.2 to add support for generating MySQL rainbow tables. Modifications are light and straightforward, but I'm now running into this problem:

---

$ ./rtgen mysql323 numeric 1 3 0 300 10000 test
hash routine: mysql323
hash length: 8
plain charset: 0123456789
plain charset in hex: 30 31 32 33 34 35 36 37 38 39
plain length range: 1 - 3
plain charset name: numeric
plain space total: 1110
rainbow table index: 0
reduce offset: 0

generating...
10000 of 10000 rainbow chains gen… Continue

To all of you SQL injection gurus.

Suppose there's this vulnerable application we have to test for a client. It's a classic example of a SQL injection vulnerability where the webapp miserably fails if a single quote is included in a URL parameter. However it's an unusual environment.

Some facts:
* The application is written in .NET.
* It probably runs on Windows 2003 Server (not confirmed, just assuming).
* Debug output is still turned on so there's some disclosure of the C# source code along… Continue

I stumbled upon this page where the author relates how easy it is for counterfeiters to capture credit card information off an ATM or PoS. What I found most interesting was Michael Janke's comment about how security could be improved on credit card tra… Continue