full-disclosure - DAVOSET v.1.0.9

lists.openwall.net		lists / announce owl-users owl-dev john-users john-dev passwdqc-users yescrypt popa3d-users / oss-security kernel-hardening musl sabotage tlsify passwords / crypt-dev xvendor / Bugtraq Full-Disclosure linux-kernel linux-netdev linux-ext4 linux-hardening linux-cve-announce PHC
Open Source and information security mailing list archives

Hash Suite: Windows password security audit tool. GUI, reports in PDF.

[<prev] [next>] [day] [month] [year] [list]

Message-ID: <002c01ce7a75$7e32bde0$9b7a6fd5@pc>
Date: Sat, 6 Jul 2013 21:19:58 +0300
From: "MustLive" <mustlive@...security.com.ua>
To: <full-disclosure@...ts.grok.org.uk>
Subject: DAVOSET v.1.0.9

Hello participants of Mailing List.

After making public release of DAVOSET
(http://lists.webappsec.org/pipermail/websecurity_lists.webappsec.org/2013-June/008850.html),
I've made next update of the software. On Friday, 05.07.2013, DAVOSET
v.1.0.9 was released - DDoS attacks via other sites execution tool
(http://websecurity.com.ua/davoset/).

Download DAVOSET v.1.0.9:

http://websecurity.com.ua/uploads/2013/DAVOSET_v.1.0.9.rar

Use, don't abuse.

Among other improvements in new version, in 1.0.9 there was added support of
CSRF tokens. And there was added new service into full lists of zombies
(exactly for requests with CSRF tokens). This is browsershots.org, I wrote
about vulnerabilities in it in 2010 and informed admins, which lamerly
ignored to fix vulnerabilities (only added token, which is easy bypassed as
I showed). One request to this service leads to 158 requests to target site.

Best wishes & regards,
MustLive
Administrator of Websecurity web site
http://websecurity.com.ua 

_______________________________________________
Full-Disclosure - We believe in it.
Charter: http://lists.grok.org.uk/full-disclosure-charter.html
Hosted and sponsored by Secunia - http://secunia.com/