full-disclosure - @(#)Mordred Labs - web security notices ?

lists.openwall.net		lists / announce owl-users owl-dev john-users john-dev passwdqc-users yescrypt popa3d-users / oss-security kernel-hardening musl sabotage tlsify passwords / crypt-dev xvendor / Bugtraq Full-Disclosure linux-kernel linux-netdev linux-ext4 linux-hardening linux-cve-announce PHC
Open Source and information security mailing list archives

Hash Suite: Windows password security audit tool. GUI, reports in PDF.

[<prev] [next>] [day] [month] [year] [list]

From: mordred at s-mail.com (Sir Mordred)
Subject: @(#)Mordred Labs - web security notices ?

Hi,

Well, security admins build honeypots/honeynets to discover
the attack methods, but the only thing they are capable is catching 
a damn kid, who just scanned a very big range of ip addresses and finally
discovered that one host with the ip "1.2.3.4" and the name
"honeypot1.mycompany.com" (and RedHat 6 default install) is vulnerable to a
remote overflow,
for which (i.e. overflow) that kid happen to have an exploit,
which (i.e. exploit) have been coded and published by gobbles one
or two year ago (that kid does not remember such sort of things of
course)...., long preface, yeah? :-)

Note i did not mention about web application security guides, asp best
practices ... etc ... etc

So what?

We are planning to release "security notices" on a regular basis. 
They will be containing an information on the real state of web application
security, with the real world examples.
The examples will be well known high profile web sites/enterprise portals,
mostly the ones which claims to be security related (yeah, even some
hack-groups sites :-) ),
and blame us if our notices will be disclosuring that
when you reguest url http://phpbb.com/news.php?id=11',
you get back something like:
[snip]
Could not query news database
109
/home/virtual/phpbb.com/news.php
SELECT * FROM phpbb_news WHERE news_id = 11\'
[snip]

Leave the anwser to the question "could i actually own the website which
suffers from such vulnerability" as a exercise to the reader.
Remember the article "How i hacked packetstorm" by rfp?
Perhaps we should call these notices "How i almost hacked victim.com"
:-)

We greatly appreciate any thoughts and ideas, even flames, concerning this
topic.

Best regards,
// Sir Mordred

________________________________________________________________________
This letter has been delivered unencrypted. We'd like to remind you that
the full protection of e-mail correspondence is provided by S-mail
encryption mechanisms if only both, Sender and Recipient use S-mail.
Register at S-mail.com: http://www.s-mail.com