full-disclosure - Oh noes, the 0x90 NOP crew have been NOP'd!

lists.openwall.net		lists / announce owl-users owl-dev john-users john-dev passwdqc-users yescrypt popa3d-users / oss-security kernel-hardening musl sabotage tlsify passwords / crypt-dev xvendor / Bugtraq Full-Disclosure linux-kernel linux-netdev linux-ext4 linux-hardening linux-cve-announce PHC
Open Source and information security mailing list archives

Hash Suite: Windows password security audit tool. GUI, reports in PDF.

[<prev] [next>] [thread-next>] [day] [month] [year] [list]

Date: Wed Dec  7 13:34:49 2005
From: coardump at gmail.com (cranium pain)
Subject: Oh noes, the 0x90 NOP crew have been NOP'd!

---------------------------------------
!!!0-Day Alert  0-Day Alert!!!
---------------------------------------
Who Is Vulnerable:   0x90.org
Who Are They:         Developers of Web Based security tools
Impact:                    Red Faces For l33t Haxxors
Time Line:               Today
---------------------------------------

0x90.org is a site ran by a bunch of hacker wanna-be's that write stuff to
audit web sites and web applications, stuff like XXS / Java script
injection, HTML injection and SQL injection.

They are also the proud developers of Absynth. No, not that favorite
alchoholic beverage that you use to intoxicate helpless females on a
Saturday night, dulling their senses so that you can more easily social
engineer them in to believeing that you are really a hot sex puppy and a mad
leet haxxor that speaks at all the cons while wearing your "I read your
mail" t-shirt, rather than the noob you are!

Absynth is the web auditing tool which is commonly used by many CCISP
certified security professionals and professional penetration testers, 99%
of whom release top notch, serious remote 0day exploits to the community
daily.

Well, these jokers obviously never run their tools on their own web site, as
such they have left their self open to some injection flaws of their own:

POC:
--------

POST http://www.0x90.org/passwd/index.php?password=">Oh Noooeeessssss!!!

doh..
-------------- next part --------------
An HTML attachment was scrubbed...
URL: http://lists.grok.org.uk/pipermail/full-disclosure/attachments/20051207/245706bf/attachment.html