New OWASP WebGoat movies

By YGN Ethical Hacker Group - 

We have added the following movies to our OWASP WebGoat page in accordance with the latest version 5.4 - http://yehg.net/lab/pr0js/training/webgoat.php :

- CSRF Prompt By-Pass
- CSRF Token By-Pass
- Off-by-One Buffer Overflow
- Blind Numeric SQL Injection
- Modify Data with SQL Injection
- Add Data with SQL Injection


Enjoy Haxing WebGoat! 























































Popular posts from this blog









OxWall 1.1.1 <= Multiple Cross Site Scripting Vulnerabilities (CVE-2012-0872)







By


YGN Ethical Hacker Group



-















 1. OVERVIEW  OxWall 1.1.1 and lower versions are vulnerable to Cross Site Scripting.   2. BACKGROUND  Oxwall is a free open source software package for building social  networks, family sites and collaboration systems. It is a flexible  community website engine developed with the aim to provide people with  a well-coded, user-friendly software platform for social needs. It is  easy to set up, configure and manage Oxwall while you focus on your  site idea. We are testing the concept of free open source community  software for complete (site,sub-site setups) and partial  (widgets,features) community and collaboration solutions for companies  and individuals.   3. VULNERABILITY DESCRIPTION  Multiple parameters were not properly sanitized, which allows attacker  to conduct Cross Site Scripting attack. This may allow an attacker to  create a specially crafted URL that would execute arbitrary script  code in a victim's browser.   4. VERSIONS AFFECTED  1.1.1 and lower   5. PROOF-OF-CONCE








Read more










Open-Realty CMS 3.x | Persistent Cross Site Scripting (XSS) Vulnerability







By


YGN Ethical Hacker Group



-















 1. OVERVIEW   Open-Realty CMS 3.x versions are vulnerable to Persistent Cross Site  Scripting (XSS).    2. BACKGROUND   Open-Realty is the world's leading real estate listing marketing and  management CMS application, and has enjoyed being the real estate web  site software of choice for professional web site developers since  2002.    3. VULNERABILITY DESCRIPTION   Multiple parameters are not properly sanitized, which allows attacker  to conduct Cross Site Scripting attack. This may allow an attacker to  create a specially crafted URL that would execute arbitrary script  code in a victim's browser.    4. VERSIONS AFFECTED   3.x    5. PROOF-OF-CONCEPT/EXPLOIT   /admin/ajax.php (parameter: title, full_desc, ta)   ///////////////////////////////////////////////////////   POST /admin/ajax.php?action=ajax_update_listing_data HTTP/1.1  Host: localhost  Content-Length: 574  Origin: http://localhost   X-Requested-With: XMLHttpRequest  Content-Type: application/x-www-form-urlencoded  








Read more










Jcow CMS 4.x:4.2 <= , 5.x:5.2 <= | Arbitrary Code Execution







By


YGN Ethical Hacker Group



-















1. OVERVIEW
 
 Jcow CMS versions  (4.x: 4.2 and lower, 5.x: 5.2 and lower) are vulnerable to Arbitrary Code Execution.
 
 
 2. BACKGROUND
 
 Jcow is a flexible Social Networking software written in PHP. It can help you to build a social network for your interests and passions, a member community for your existing website and a social networking site like facebook/myspace/twitter.
 
 
 3. VULNERABILITY DESCRIPTION
 
 The parameter "attachment" is not properly sanitized upon submission to /index.php, which allows attacker to execute arbitrary PHP code of his own. 
 
 
 4. VERSIONS AFFECTED
 
 Free version:  4.x: 4.2 and lower
 Commercial version:  5.x: 5.2 and lower)
 
 
 5. PROOF-OF-CONCEPT/EXPLOIT
 
 http://dev.metasploit.com/redmine/attachments/1660/jcow_eval.rb
 
 jcow 4.2.1:
 file: /includes/libs/ss.inc.php
 line: 167
 
         $app = $_POST['attachment'];
     if (strlen($app) && $app != 'status') {
         include_once('modules/'.$app.&#








Read more