full-disclosure - Re: Flash that simulates virus scan

lists.openwall.net		lists / announce owl-users owl-dev john-users john-dev passwdqc-users yescrypt popa3d-users / oss-security kernel-hardening musl sabotage tlsify passwords / crypt-dev xvendor / Bugtraq Full-Disclosure linux-kernel linux-netdev linux-ext4 linux-hardening linux-cve-announce PHC
Open Source and information security mailing list archives

Hash Suite: Windows password security audit tool. GUI, reports in PDF.

[<prev] [next>] [<thread-prev] [thread-next>] [day] [month] [year] [list]

Message-ID: <47295162.3060207@bellsouth.net>
Date: Thu, 01 Nov 2007 00:09:06 -0400
From: scott <redhowlingwolves@...lsouth.net>
To: full-disclosure@...ts.grok.org.uk
Subject: Re: Flash that simulates virus scan

-----BEGIN PGP SIGNED MESSAGE-----
Hash: SHA1

It would be nice if the people who ridicule pdp would actually do some
research in the field of JS exploits before passing judgement.

Two places I can think of are RSnake's blog at http://ha.ckers.org/
and also the forum: http://sla.ckers.org/forum/
You might learn something regarding the dangers of XSS.

Cheers,
Scott
reepex wrote:
> dont you listen to pdp ever? the government uses xss and bruteforces
> remote desktop logins
>
> http://seclists.org/fulldisclosure/2007/Oct/0417.html
>
> pdp: "military grade exploits? :) dude, I am sorry man.. but you are living
> in some kind of a dream world. get real, most of the military hacks
> are as simple as bruteforcing the login prompt.. or trying something
> as simple as XSS."
>
> ------
>
> pdp is an hero and a computer security expert and based on his fans
> from the list he is the greatest researched since lcamtuf. his word =
> gold
>
>
>
> On 11/1/07, jf <jf@...glingpointers.net> wrote:
>> must be on one of the .gov red teams ;]
>>
>>
>> On Wed, 31 Oct 2007, reepex wrote:
>>
>>> Date: Wed, 31 Oct 2007 16:56:20 -0500
>>> From: reepex <reepex@...il.com>
>>> To: Joshua Tagnore <joshua.tagnore@...il.com>,
>>> full-disclosure@...ts.grok.org.uk
>>> Subject: Re: [Full-disclosure] Flash that simulates virus scan
>>>
>>> resulting to se in a pen test cuz you cant break any of the actual
machines?
>>>
>>> lulz
>>>
>>> On 10/31/07, Joshua Tagnore <joshua.tagnore@...il.com> wrote:
>>>> List,
>>>>
>>>> Some time ago I remember that someone posted a PoC of a small site that
>>>> had a really nice looking flash animation that "performed a virus
scan" and
>>>> after the "virus scan" was finished, the user was prompted for a
"Download
>>>> virus fix?" question. After that, of course, a file is sent to the
user and
>>>> he got infected with some malware. Right now I'm performing a
penetration
>>>> test, and I would like to target some of the users of the corporate
LAN, so
>>>> I think this approach is the best in order to penetrate to the LAN.
>>>>
>>>> I searched google but failed to find the URL, could someone send it to
>>>> me ? Thanks!
>>>>
>>>> Cheers,
>>>> --
>>>> Joshua Tagnore
>>>> _______________________________________________
>>>> Full-Disclosure - We believe in it.
>>>> Charter:
>>>> http://lists.grok.org.uk/full-disclosure-charter.html
>>>> Hosted and sponsored by Secunia - http://secunia.com/
>>>>
>>> _______________________________________________
>>> Full-Disclosure - We believe in it.
>>> Charter: http://lists.grok.org.uk/full-disclosure-charter.html
>>> Hosted and sponsored by Secunia - http://secunia.com/
>>>
>
> _______________________________________________
> Full-Disclosure - We believe in it.
> Charter: http://lists.grok.org.uk/full-disclosure-charter.html
> Hosted and sponsored by Secunia - http://secunia.com/
>

-----BEGIN PGP SIGNATURE-----
Version: GnuPG v1.4.6 (GNU/Linux)
Comment: Using GnuPG with Mozilla - http://enigmail.mozdev.org

iD8DBQFHKVFfxajqy/aNaRsRAtfEAKC8sRWj8i4IQGQ0jEnjFveg0T9SLACfeykj
ptS9bqw+XU+R9KQaSkcVdpM=
=+wFb
-----END PGP SIGNATURE-----

_______________________________________________
Full-Disclosure - We believe in it.
Charter: http://lists.grok.org.uk/full-disclosure-charter.html
Hosted and sponsored by Secunia - http://secunia.com/