jonaslejon

6 mesi fadiscuss

Memories! I was at the hacking conference HAL2001 and listening to Dug Song and Solar Designer, who were talking about their SSH timing analysis: https://download.openwall.net/pub/advisories/OW-003-ssh-traf...

Time flies

jonaslejon

2 anni fadiscuss

Nice tool! Will check it out. I have used jdam in the past to fuzz JSON: https://gitlab.com/michenriksen/jdam

jonaslejon

2 anni fadiscuss

OpenSSH 9.8p1 was released July 1, 2024 according to https://www.openssh.com/releasenotes.html#9.8p1

jonaslejon

4 anni fadiscuss

This was quite funny:

if name == "boring_wozniak" /* Steve Wozniak is not boring */ { goto begin }

jonaslejon

5 anni fadiscuss

I personally use OSSEC for File Integrity Monitoring. And it has also actually caught an intruder that modified some PHP-code on a webserver. The attacker forgot to use the prefix @ in the PHP-code so a new error message was sent to the logfile and reported by OSSEC.

jonaslejon

5 anni fadiscuss

You need to have a really good relationship with your ISP and get their acknowledge prior to the scanning

jonaslejon

5 anni fadiscuss

I don't really understand the thread. This guy X writes about the harassments and then someone replies and asks about the release versions?

jonaslejon

9 anni fadiscuss

Great move for transparency

jonaslejon

9 anni fadiscuss

Old: https://news.ycombinator.com/item?id=8216853

jonaslejon

11 anni fadiscuss

Since the vulnerability is in pdf.js, is the Tor Browser Bundle vulnerable?

jonaslejon

13 anni fadiscuss

Why is he using Google Analytics for sending the XSS?

jonaslejon

13 anni fadiscuss

I bought a copy. Nice book! The format of the book seems kinda odd thought. This is a screenshot from my iPad Mini with Readmill (eBook reader): https://dl.dropboxusercontent.com/u/947269/IMG_0053.PNG

jonaslejon

13 anni fadiscuss

Good idea. There might be a number of rules that can limit their communication with the routers (and even OOB)

jonaslejon

14 anni fadiscuss

The best way is to start from the beginning, in other words read "Smashing the stack for fun and profit". These technics doesn't work on current operating systems but gives to a great start http://insecure.org/stf/smashstack.html

jonaslejon

14 anni fadiscuss

Bootstrap 2.0 + WordPress = #win ? Anyone knows if there is any theme out there w/ Bootstrap?

jonaslejon

14 anni fadiscuss

Maybe add or use http://listjs.com/ ?

jonaslejon

Submissions

The Full Story of CVE-2024-6386: Remote Code Execution in WPML

How to Inspect TLS Encrypted Traffic

Critical Security Flaw in the WooCommerce Payments Plugin

Wpsec.com Docker WordPress Vulnerability Scanner Command Line Client

Wpsec.com Python Command-Line Client

Eight-Year Study Shows the Dark Side of WordPress Plugins

Security in WordPress Plugin Development

Discovering Vulnerabilities in WordPress Plugins at Scale

Backdooring WordPress Using PyShell

Security Features We Wish Were Included in WordPress

WordPress and the new vulnerability Trojan Source

Malicious PDF Generator

WooCommerce Unauthenticated SQL Injection Vulnerability

WordPress PHPMailer Vulnerability Analysis

WordPress XXE Vulnerability in Media Library – CVE-2021-29447

Are WordPress Websites That Vulnerable? – WPSec

What You Need to Know About WordPress 5.7 and One-Click HTTPS Migration

Truly Doubling Down on Open Source

Write-up about the WordPress Contact Form 7 plugin vulnerability

WordPress 5.5.2 Security Release

comments