full-disclosure - www.whois.sc

lists.openwall.net		lists / announce owl-users owl-dev john-users john-dev passwdqc-users yescrypt popa3d-users / oss-security kernel-hardening musl sabotage tlsify passwords / crypt-dev xvendor / Bugtraq Full-Disclosure linux-kernel linux-netdev linux-ext4 linux-hardening linux-cve-announce PHC
Open Source and information security mailing list archives

Hash Suite: Windows password security audit tool. GUI, reports in PDF.

[<prev] [next>] [<thread-prev] [thread-next>] [day] [month] [year] [list]

Message-ID: <42AF00FB.000001.31516@camay.yandex.ru>
Date: Tue Jun 14 17:08:40 2005
From: tgoogle at yandex.ru (tgoogle)
Subject: www.whois.sc

Hi all, again!

I try use some scanner to find vulnerability in www.yandex.ru site. Sorry, for some programm i use cracked version. 

Nikto - didn't find any vulnerabilites  .

www.freescan.ru - I can not scan yandex.ru (my account is blocked)

Ns-stealth - didn't find any vulnerabilites.

AppScan QA (http://www.watchfire.com/) - didn't find any vulnerabilites  .

Maxpatrol (www.Maxpatrol.com, cracked version) - find 34 XSS vulnerabilites. some expamle:

http://www.yandex.ru/yandsearch?text=1&holdreq="><script>alert('maxpatrol.com')</script>&rstr=-213---&stype=www&how=tm
http://www.yandex.ru/cgi-bin/customize.pl?yxqs="><script>alert('maxpatrol.com')</script>&nl=0&text=1&how=tm
http://www.yandex.ru//yandsearch?how=tm"><script>alert('maxpatrol.com')</script>.com&nl=0&stype=1&text=1&rstr=-225
and more other...

I try scan some other site with similar result - Maxpatrol find some SQL injection and PHP include in unknown script. 

Thanks alex and Gordeychik.