full-disclosure - Re: Decrypting SSL for Network Monitoring

lists.openwall.net		lists / announce owl-users owl-dev john-users john-dev passwdqc-users yescrypt popa3d-users / oss-security kernel-hardening musl sabotage tlsify passwords / crypt-dev xvendor / Bugtraq Full-Disclosure linux-kernel linux-netdev linux-ext4 linux-hardening linux-cve-announce PHC
Open Source and information security mailing list archives

Hash Suite: Windows password security audit tool. GUI, reports in PDF.

[<prev] [next>] [<thread-prev] [thread-next>] [day] [month] [year] [list]

Date: Tue, 28 Jun 2011 15:12:56 -0500
From: adam <adam@...sy.net>
To: Adam Behnke <adam@...osecinstitute.com>
Cc: full-disclosure@...ts.grok.org.uk
Subject: Re: Decrypting SSL for Network Monitoring

I wasn't intentionally being vague, and I don't honestly know much about
wordpress so the "feature" I exploited may very well be a [popular?] module
and not something custom. In any case, the issue is with the section at the
bottom that parses the referer to determine search engine queries (that
resulted in users landing on the page). It's an excellent concept for SEO
purposes, since relevant keywords will be linked together automagically
through user interaction but it's not really worth the trade off when the
"search query" isn't sanitized.

Also, you shouldn't modify files in real-time since it can (and did) lead to
information disclosure (revealed full path of wordpress installation, I
assume during one of your saves).

All in all, something as simple as $_SERVER['HTTP_REFERER'] =
 @strip_tags($_SERVER['HTTP_REFERER']); at the top of one of the class files
would likely be enough to fix it for the time being.

On Tue, Jun 28, 2011 at 2:30 PM, adam <adam@...sy.net> wrote:

> My thoughts?
>
> Before posting a URL to FD, make damn sure that it isn't vulnerable to any
> type of injection attacks. Luckily for you, I simply hid everything on the
> page. A malicious attacker could have done significantly worse.
>
> Fix that, and *then* I'll read the article.
>
> On Tue, Jun 28, 2011 at 11:09 AM, Adam Behnke <adam@...osecinstitute.com>wrote:
>
>> InfoSec Institute resources author Alec Waters gives you step by step
>> instructions on how to decrypt SSL for network monitoring:****
>>
>> ** **
>>
>> http://resources.infosecinstitute.com/ssl-decryption/****
>>
>> ** **
>>
>> Your thoughts? ****
>>
>> ** **
>>
>> ** **
>>
>> _______________________________________________
>> Full-Disclosure - We believe in it.
>> Charter: http://lists.grok.org.uk/full-disclosure-charter.html
>> Hosted and sponsored by Secunia - http://secunia.com/
>>
>
>

Content of type "text/html" skipped

_______________________________________________
Full-Disclosure - We believe in it.
Charter: http://lists.grok.org.uk/full-disclosure-charter.html
Hosted and sponsored by Secunia - http://secunia.com/