Hash Spraying Attack

-

Hello folks,

A couple of weeks ago I put together a Medium Story about the Hash Spraying Attack. Enjoy it!


Comments

Post a Comment

Popular posts from this blog

The forgotten JBOSS Admin Console and CVE 2010-1871

-
Image
Well, we are in 2013 and It’s amazing how many JBOSS administration interfaces (jmx-console, web-console, invokers etc) are still exposed on the internet, however we are not going to talk about it. A couple of days ago I was performing a penetration testing and I found an environment with JBOSS AS 6. The JMX-Console wasn’t password protected but one console in special attracted my attention: the Admin Console. It seems that this console, I do not know the reason, is kind of forgotten by the security community as an attack vector. The default access credential for this console is admin/admin and it is also built upon a vulnerable version of Seam framework CVE 2010-1871 . This console provides a powerful JBOSS administration allowing a user to check the server’s configuration, to deploy and to delete applications, to read datasources etc. I checked out for the default credential but they were changed. There were other ways to hack this JBOSS but I was quite interes...
Read more

Various SSRF conditions on KeyCDN tools

-
Image
Hi There, It is common to find websites/tools on the internet which performs speed test, loading third party images, load external JavaScript files etc. to be vulnerable to Server Side Request Forgery. I've found a couple of them, reported but some of them did not take it seriously. I've recently ran into KeyCDN tools website , a site owned and operated by KeyCDN , a CDN company and reported to be one of the best solution according to the TechRadar info . After looking at some functionalities presented on the web site I've found a few SSRF conditions. Here it goes: 1) Using the Trace Route utility to discovery some Internal IP Address When I used the Trace Route functionality there was an internal IP address 10.0.10.1 (which seems  no longer there) belonging to the Frankfurt POP. 2) Using the Ping utility to confirm the above finding (and maybe Brute Force some hosts?) I will discuss the FQDN you are seeing there soon! 3) Using the Performance Test  ...
Read more