lists.openwall.net   lists  /  announce  owl-users  owl-dev  john-users  john-dev  passwdqc-users  yescrypt  popa3d-users  /  oss-security  kernel-hardening  musl  sabotage  tlsify  passwords  /  crypt-dev  xvendor  /  Bugtraq  Full-Disclosure  linux-kernel  linux-netdev  linux-ext4  linux-hardening  linux-cve-announce  PHC 
Open Source and information security mailing list archives
 
Hash Suite for Android: free password hash cracker in your pocket
[<prev] [next>] [<thread-prev] [thread-next>] [day] [month] [year] [list]
Message-Id: <09FFFC8F-E7B3-43E8-8AB4-9CA08D1C01AC@gmail.com>
Date: Mon, 19 Feb 2007 13:48:58 -0800
From: Andrew Farmer <andfarm@...il.com>
To: <auto400208@...hmail.com>
Cc: <bugtraq@...urityfocus.com>, full-disclosure@...ts.grok.org.uk
Subject: Re: [Full-disclosure] Drive-by Pharming Threat

On 19 Feb 07, at 09:54, <auto400208@...hmail.com> wrote:
> I am curious as to how one "automatically" logs on?

Memorized passwords.

Also, if a password is required for a subsidiary resource, the  
browser will ask the user for it. In IE, at least, a sequence like  
the one I describe below will pop up a series of password dialogs if  
the user attempts to cancel. Most users will eventually try typing in  
the correct password to try to make the password dialogs go away.

> Also when you do reset or
> change parameters in the router, does it not require a reboot of
> the router (auto after you hit save), whereby your connection is
> lost for x amount of time?

Depends on the router. It doesn't really matter much, though -
once the settings are saved the damage's been done.

> Also not to mention find a method to cross domains into the routers
> html, for each and every router out there.

Try them all at once:

<iframe src="http://192.168.0.1/csrf-for-one-router"></iframe>
<iframe src="http://192.168.0.1/csrf-for-another-router"></iframe>
<iframe src="http://192.168.0.1/csrf-for-a-third-router"></iframe>
<iframe src="http://192.168.0.1/csrf-for-a-fourth-router"></iframe>
...

Powered by blists - more mailing lists

Powered by Openwall GNU/*/Linux Powered by OpenVZ