SecuObs.com http://www.secuobs.com Observatoire de la securite Internet fr webmaster@secuobs.com Hmm If SSL relies on email for cert verif/exchange, and outbound mail servers ignore snakeoil certs2012-09-20 07:59:33 - RSnake : Hmm If SSL relies on email for cert verif/exchange, and outbound mail servers ignore snakeoil certshttp://www.secuobs.com/twitter/news/345370.shtmlhttp://www.secuobs.com/twitter/news/345370.shtml Finally got around to donating the XSS cheat sheet to @OWASP http://tco/EI1zI9AK Now everyone can edit/modify at willSecuobs.com : 2012-09-19 08:40:18 - RSnake - Finally got around to donating the XSS cheat sheet to @OWASP http://tco/EI1zI9AK Now everyone can edit/modify at willhttp://www.secuobs.com/twitter/news/345057.shtmlhttp://www.secuobs.com/twitter/news/345057.shtml @superevr @ryancbarnett Agreed, and even phishing most of the time will be custom tooSecuobs.com : 2012-09-19 08:40:18 - RSnake - @superevr @ryancbarnett Agreed, and even phishing most of the time will be custom toohttp://www.secuobs.com/twitter/news/345056.shtmlhttp://www.secuobs.com/twitter/news/345056.shtml @theharmonyguy Interesting, I like the nduja worm example too as a way to explain exponential XSS, albeit more PoC than weaponized codeSecuobs.com : 2012-09-19 08:40:18 - RSnake - @theharmonyguy Interesting, I like the nduja worm example too as a way to explain exponential XSS, albeit more PoC than weaponized codehttp://www.secuobs.com/twitter/news/345055.shtmlhttp://www.secuobs.com/twitter/news/345055.shtml @_mwc That assumes the user has already visited - lest HSTS never gets displayed to the user via the mitm w/ the bad cert ; @jeremiahgSecuobs.com : 2012-09-14 10:38:46 - RSnake - @_mwc That assumes the user has already visited - lest HSTS never gets displayed to the user via the mitm w/ the bad cert ; @jeremiahghttp://www.secuobs.com/twitter/news/343871.shtmlhttp://www.secuobs.com/twitter/news/343871.shtml @fielding Gotcha, not unintended then Love to chat w/ you about other Apache stuff sometime otp when you have some free timeSecuobs.com : 2012-09-11 12:50:50 - RSnake - @fielding Gotcha, not unintended then Love to chat w/ you about other Apache stuff sometime otp when you have some free timehttp://www.secuobs.com/twitter/news/342851.shtmlhttp://www.secuobs.com/twitter/news/342851.shtml @brianwilson When I said no egress, I meant from the SSH server sideSecuobs.com : 2012-09-06 09:14:07 - RSnake - @brianwilson When I said no egress, I meant from the SSH server sidehttp://www.secuobs.com/twitter/news/340845.shtmlhttp://www.secuobs.com/twitter/news/340845.shtml @JasonD except that they'll still contune to send the creds Makes mitm slighly more interesting actually if the creds are still cachedSecuobs.com : 2011-01-10 11:41:11 - RSnake - @JasonD except that they'll still contune to send the creds Makes mitm slighly more interesting actually if the creds are still cachedhttp://www.secuobs.com/twitter/news/161134.shtmlhttp://www.secuobs.com/twitter/news/161134.shtml Hahah my book stallown3d Amazon: http://drwettereu/amazon/Secuobs.com : 2010-12-18 08:44:25 - RSnake - Hahah my book stallown3d Amazon: http://drwettereu/amazon/http://www.secuobs.com/twitter/news/154999.shtmlhttp://www.secuobs.com/twitter/news/154999.shtml You can turn reflected XSS into Clickjacking: http://bitly/ar5gIUSecuobs.com : 2010-06-14 23:31:50 - RSnake - You can turn reflected XSS into Clickjacking: http://bitly/ar5gIUhttp://www.secuobs.com/twitter/news/103572.shtmlhttp://www.secuobs.com/twitter/news/103572.shtml Finally getting a chance to sit down and finish reading Ivan Ristic's Mod_Security book Great read: https://wwwfeistyduckcom/Secuobs.com : 2010-06-12 05:13:21 - RSnake - Finally getting a chance to sit down and finish reading Ivan Ristic's Mod_Security book Great read: https://wwwfeistyduckcom/http://www.secuobs.com/twitter/news/102819.shtmlhttp://www.secuobs.com/twitter/news/102819.shtml Looks like I'm speaking at Blackhat W00t: http://wwwblackhatcom/html/bh-us-10/bh-us-10-speaker_bioshtmlSecuobs.com : 2010-05-06 19:22:37 - RSnake - Looks like I'm speaking at Blackhat W00t: http://wwwblackhatcom/html/bh-us-10/bh-us-10-speaker_bioshtmlhttp://www.secuobs.com/twitter/news/90470.shtmlhttp://www.secuobs.com/twitter/news/90470.shtml Go go ATT MITM: http://bitly/a349sqSecuobs.com : 2010-04-15 07:19:10 - RSnake - Go go ATT MITM: http://bitly/a349sqhttp://www.secuobs.com/twitter/news/83255.shtmlhttp://www.secuobs.com/twitter/news/83255.shtml Gotta love Chrome: http://hackersorg/blog/20100414/chrome-phishing/Secuobs.com : 2010-04-15 07:19:10 - RSnake - Gotta love Chrome: http://hackersorg/blog/20100414/chrome-phishing/http://www.secuobs.com/twitter/news/83254.shtmlhttp://www.secuobs.com/twitter/news/83254.shtml MalaRIA malicious RIA proxy released: http://bitly/bWzYotSecuobs.com : 2010-04-07 08:26:03 - RSnake - MalaRIA malicious RIA proxy released: http://bitly/bWzYothttp://www.secuobs.com/twitter/news/80641.shtmlhttp://www.secuobs.com/twitter/news/80641.shtml @ChrisJohnRiley All port 80 thus far It follows the proxy settings in Windows, so I've been seeing it using a typical MITM proxy BurpSecuobs.com : 2010-03-18 05:46:16 - RSnake - @ChrisJohnRiley All port 80 thus far It follows the proxy settings in Windows, so I've been seeing it using a typical MITM proxy Burphttp://www.secuobs.com/twitter/news/74568.shtmlhttp://www.secuobs.com/twitter/news/74568.shtml Facebook Patents Social Feeds and I Patent XSS http://bitly/96JSZlSecuobs.com : 2010-02-27 04:04:56 - RSnake - Facebook Patents Social Feeds and I Patent XSS http://bitly/96JSZlhttp://www.secuobs.com/twitter/news/69062.shtmlhttp://www.secuobs.com/twitter/news/69062.shtml Google Buzz Persistent XSS http://bitly/bvVaIeSecuobs.com : 2010-02-17 01:06:32 - RSnake - Google Buzz Persistent XSS http://bitly/bvVaIehttp://www.secuobs.com/twitter/news/65825.shtmlhttp://www.secuobs.com/twitter/news/65825.shtml @achillean how many records does shodan have That's a useful thing to know when building stats Maybe something for the homepageSecuobs.com : 2010-02-14 16:46:03 - RSnake - @achillean how many records does shodan have That's a useful thing to know when building stats Maybe something for the homepagehttp://www.secuobs.com/twitter/news/65285.shtmlhttp://www.secuobs.com/twitter/news/65285.shtml RT @owasp_podcast: OWASP Podcast 60, an interview with @RSnake and @jeremiahg, is now live mp3 http://bitly/bTdQ4uSecuobs.com : 2010-02-06 02:04:02 - RSnake - RT @owasp_podcast: OWASP Podcast 60, an interview with @RSnake and @jeremiahg, is now live mp3 http://bitly/bTdQ4uhttp://www.secuobs.com/twitter/news/62639.shtmlhttp://www.secuobs.com/twitter/news/62639.shtml Looks like my previous list made it into Nikto http://trac2assemblacom/Nikto_2/ticket/119 w00tSecuobs.com : 2010-02-01 05:19:12 - RSnake - Looks like my previous list made it into Nikto http://trac2assemblacom/Nikto_2/ticket/119 w00thttp://www.secuobs.com/twitter/news/60816.shtmlhttp://www.secuobs.com/twitter/news/60816.shtml @fmavituna it wasn't in the wild Just a proof of concept Samy also did an smpt ipe + there's another xss in imap3 all poc thoughSecuobs.com : 2010-01-31 02:00:46 - RSnake - @fmavituna it wasn't in the wild Just a proof of concept Samy also did an smpt ipe + there's another xss in imap3 all poc thoughhttp://www.secuobs.com/twitter/news/60605.shtmlhttp://www.secuobs.com/twitter/news/60605.shtml @egyp7 wish I did, most are just txt files Some are 0day from our logs tooSecuobs.com : 2010-01-30 03:58:40 - RSnake - @egyp7 wish I did, most are just txt files Some are 0day from our logs toohttp://www.secuobs.com/twitter/news/60409.shtmlhttp://www.secuobs.com/twitter/news/60409.shtml Fun lil JavaScript backdoor: http://bitly/bLrSnESecuobs.com : 2010-01-27 01:22:54 - RSnake - Fun lil JavaScript backdoor: http://bitly/bLrSnEhttp://www.secuobs.com/twitter/news/59372.shtmlhttp://www.secuobs.com/twitter/news/59372.shtml @dakami Cloud = intranet in that case It's up to the admin to define, by policy ABE + MOM is close to the right answerSecuobs.com : 2010-01-26 00:46:07 - RSnake - @dakami Cloud = intranet in that case It's up to the admin to define, by policy ABE + MOM is close to the right answerhttp://www.secuobs.com/twitter/news/59042.shtmlhttp://www.secuobs.com/twitter/news/59042.shtml @jeremiahg I would, but there's no way that would fit in a twitter window But you name some cloud providers and I have sensitive RFC1918Secuobs.com : 2010-01-26 00:46:07 - RSnake - @jeremiahg I would, but there's no way that would fit in a twitter window But you name some cloud providers and I have sensitive RFC1918http://www.secuobs.com/twitter/news/59041.shtmlhttp://www.secuobs.com/twitter/news/59041.shtml For those testing the great Chinese firewall use falun short for falun gong http://wwwbaiducom/swd=falunSecuobs.com : 2010-01-14 20:20:48 - RSnake - For those testing the great Chinese firewall use falun short for falun gong http://wwwbaiducom/swd=falunhttp://www.secuobs.com/twitter/news/55553.shtmlhttp://www.secuobs.com/twitter/news/55553.shtml @Google how is an attack against your cloud based wire-tap not an assault on cloud computing http://bitly/7SabbNSecuobs.com : 2010-01-14 03:14:00 - RSnake - @Google how is an attack against your cloud based wire-tap not an assault on cloud computing http://bitly/7SabbNhttp://www.secuobs.com/twitter/news/55251.shtmlhttp://www.secuobs.com/twitter/news/55251.shtml @MisterGlass uh right, but they used that to attack the cloud so it's an attack against the cloudSecuobs.com : 2010-01-14 03:14:00 - RSnake - @MisterGlass uh right, but they used that to attack the cloud so it's an attack against the cloudhttp://www.secuobs.com/twitter/news/55250.shtmlhttp://www.secuobs.com/twitter/news/55250.shtml @MisterGlass if the data is in the cloud and that's what they got How is that not an attack against the cloud You trolling meSecuobs.com : 2010-01-14 03:14:00 - RSnake - @MisterGlass if the data is in the cloud and that's what they got How is that not an attack against the cloud You trolling mehttp://www.secuobs.com/twitter/news/55249.shtmlhttp://www.secuobs.com/twitter/news/55249.shtml @MisterGlass it's all connected Political dissidents shouldn't trust the cloud because it can't protect from one dumb Googler with PDFSecuobs.com : 2010-01-14 03:14:00 - RSnake - @MisterGlass it's all connected Political dissidents shouldn't trust the cloud because it can't protect from one dumb Googler with PDFhttp://www.secuobs.com/twitter/news/55248.shtmlhttp://www.secuobs.com/twitter/news/55248.shtml PCI compliance wasn't enough to stop Heartland: http://bitly/50EjlzSecuobs.com : 2010-01-07 18:05:32 - RSnake - PCI compliance wasn't enough to stop Heartland: http://bitly/50Ejlzhttp://www.secuobs.com/twitter/news/53129.shtmlhttp://www.secuobs.com/twitter/news/53129.shtml RT @samykamkar: NAT Pinning: I can penetrate your router/firewall and connect to you on any port You just hit a URL No XSS/CSRF http: Secuobs.com : 2010-01-07 07:22:06 - RSnake - RT @samykamkar: NAT Pinning: I can penetrate your router/firewall and connect to you on any port You just hit a URL No XSS/CSRF http: http://www.secuobs.com/twitter/news/53034.shtmlhttp://www.secuobs.com/twitter/news/53034.shtml @randomdross - I did mention the proxy concept here as well as how upstream DNS providers could tackle it: http://threatpostcom/en_us/iKESecuobs.com : 2009-12-06 22:06:48 - RSnake - @randomdross - I did mention the proxy concept here as well as how upstream DNS providers could tackle it: http://threatpostcom/en_us/iKEhttp://www.secuobs.com/twitter/news/44656.shtmlhttp://www.secuobs.com/twitter/news/44656.shtml Uploaded a DNS Rebinding video: http://hackersorg/blog/20091201/dns-rebinding-video/Secuobs.com : 2009-12-01 21:05:24 - RSnake - Uploaded a DNS Rebinding video: http://hackersorg/blog/20091201/dns-rebinding-video/http://www.secuobs.com/twitter/news/42894.shtmlhttp://www.secuobs.com/twitter/news/42894.shtml Google Phishing Site: http://wwwgoogle-accom/accounts/signinhtmlSecuobs.com : 2009-11-28 11:42:03 - RSnake - Google Phishing Site: http://wwwgoogle-accom/accounts/signinhtmlhttp://www.secuobs.com/twitter/news/42050.shtmlhttp://www.secuobs.com/twitter/news/42050.shtml A watched MD5 hash never cracksSecuobs.com : 2009-11-26 01:36:37 - RSnake - A watched MD5 hash never crackshttp://www.secuobs.com/twitter/news/41502.shtmlhttp://www.secuobs.com/twitter/news/41502.shtml Add spamming and scraping to the list of problems DNS Rebinding enables: http://bitly/1JCJ6D/Secuobs.com : 2009-11-18 20:29:56 - RSnake - Add spamming and scraping to the list of problems DNS Rebinding enables: http://bitly/1JCJ6D/http://www.secuobs.com/twitter/news/39266.shtmlhttp://www.secuobs.com/twitter/news/39266.shtml @randomdross DNS Rebinding just keeps getting worse, doesn't it: http://bitly/4cxuKQ/Secuobs.com : 2009-11-18 01:45:53 - RSnake - @randomdross DNS Rebinding just keeps getting worse, doesn't it: http://bitly/4cxuKQ/http://www.secuobs.com/twitter/news/38991.shtmlhttp://www.secuobs.com/twitter/news/38991.shtml @randomdross @mckt_ DNS Rebinding Session Fixation http://bitly/3hxTJN More to comeSecuobs.com : 2009-11-17 04:32:08 - RSnake - @randomdross @mckt_ DNS Rebinding Session Fixation http://bitly/3hxTJN More to comehttp://www.secuobs.com/twitter/news/38644.shtmlhttp://www.secuobs.com/twitter/news/38644.shtml I covered quite a bit of DNS rebinding in the book Same mitigatigations, different problems: http://bitly/3hxTJNSecuobs.com : 2009-11-17 04:32:08 - RSnake - I covered quite a bit of DNS rebinding in the book Same mitigatigations, different problems: http://bitly/3hxTJNhttp://www.secuobs.com/twitter/news/38643.shtmlhttp://www.secuobs.com/twitter/news/38643.shtml @t3rmin4t0r RT @sambowne: My Defcon Talk with @rsnake is up in video http://trim/EYLV -- SlowLoris and SSLStrip demosSecuobs.com : 2009-11-15 12:47:36 - RSnake - @t3rmin4t0r RT @sambowne: My Defcon Talk with @rsnake is up in video http://trim/EYLV -- SlowLoris and SSLStrip demoshttp://www.secuobs.com/twitter/news/38151.shtmlhttp://www.secuobs.com/twitter/news/38151.shtml @marcinw Their bank and their QSA That's how PCI works and does hold water assuming they still respect OWASP top 10Secuobs.com : 2009-11-15 03:00:59 - RSnake - @marcinw Their bank and their QSA That's how PCI works and does hold water assuming they still respect OWASP top 10http://www.secuobs.com/twitter/news/38100.shtmlhttp://www.secuobs.com/twitter/news/38100.shtml @t3rmin4t0r yessir, that was my DefCon speech with Sam Bowne My part was on Slowloris and the Iranian rebelsSecuobs.com : 2009-11-15 03:00:59 - RSnake - @t3rmin4t0r yessir, that was my DefCon speech with Sam Bowne My part was on Slowloris and the Iranian rebelshttp://www.secuobs.com/twitter/news/38099.shtmlhttp://www.secuobs.com/twitter/news/38099.shtml @djtechnocrat PCI is about protecting card data Client side risks count I do worry about removing info disclosure though, you're rightSecuobs.com : 2009-11-15 03:00:59 - RSnake - @djtechnocrat PCI is about protecting card data Client side risks count I do worry about removing info disclosure though, you're righthttp://www.secuobs.com/twitter/news/38098.shtmlhttp://www.secuobs.com/twitter/news/38098.shtml @djtechnocrat You'd have to ask the OWASP leadership, I guess Good questionSecuobs.com : 2009-11-15 03:00:59 - RSnake - @djtechnocrat You'd have to ask the OWASP leadership, I guess Good questionhttp://www.secuobs.com/twitter/news/38097.shtmlhttp://www.secuobs.com/twitter/news/38097.shtml @djtechnocrat right which you need to use some social engineering to exploit XSS or redirects sent in email, etcSecuobs.com : 2009-11-15 03:00:59 - RSnake - @djtechnocrat right which you need to use some social engineering to exploit XSS or redirects sent in email, etchttp://www.secuobs.com/twitter/news/38096.shtmlhttp://www.secuobs.com/twitter/news/38096.shtml Unvalidated redirects part of #OWASP top 10 Guess Google fails PCI once this gets ratified No more feeling lucky #AppSecDCSecuobs.com : 2009-11-14 01:51:53 - RSnake - Unvalidated redirects part of #OWASP top 10 Guess Google fails PCI once this gets ratified No more feeling lucky #AppSecDChttp://www.secuobs.com/twitter/news/37832.shtmlhttp://www.secuobs.com/twitter/news/37832.shtml @mayscript SQLi is a joke That's a new one Do you really believe thatSecuobs.com : 2009-11-14 01:51:53 - RSnake - @mayscript SQLi is a joke That's a new one Do you really believe thathttp://www.secuobs.com/twitter/news/37831.shtmlhttp://www.secuobs.com/twitter/news/37831.shtml Came up with some new ideas around DNS rebining yesterday while chatting with Dan Kaminsky BoomSecuobs.com : 2009-11-13 19:36:23 - RSnake - Came up with some new ideas around DNS rebining yesterday while chatting with Dan Kaminsky Boomhttp://www.secuobs.com/twitter/news/37746.shtmlhttp://www.secuobs.com/twitter/news/37746.shtml @mckt_ hah, no just typical DNS rebinding A few more uses for it though I'll write it up in the next few daysSecuobs.com : 2009-11-13 19:36:23 - RSnake - @mckt_ hah, no just typical DNS rebinding A few more uses for it though I'll write it up in the next few dayshttp://www.secuobs.com/twitter/news/37745.shtmlhttp://www.secuobs.com/twitter/news/37745.shtml RT @rafallos Win a big prize in my talk today, stand up when I mention Monty PythonSecuobs.com : 2009-11-13 05:49:37 - RSnake - RT @rafallos Win a big prize in my talk today, stand up when I mention Monty Pythonhttp://www.secuobs.com/twitter/news/37440.shtmlhttp://www.secuobs.com/twitter/news/37440.shtml @Beaker Awesome Glad you like it I hope the rest of the book stacks upSecuobs.com : 2009-10-27 01:42:01 - RSnake - @Beaker Awesome Glad you like it I hope the rest of the book stacks uphttp://www.secuobs.com/twitter/news/32651.shtmlhttp://www.secuobs.com/twitter/news/32651.shtml Releasing my low bandwidth HTTP DoS tool tomorrow Hope no one runs Apache out there :PSecuobs.com : 2009-06-17 12:41:08 - RSnake - Releasing my low bandwidth HTTP DoS tool tomorrow Hope no one runs Apache out there :Phttp://www.secuobs.com/twitter/news/3637.shtmlhttp://www.secuobs.com/twitter/news/3637.shtml @packetlife the 3rd attack isn't typical MITM which creates longevity Metasploit guys talked about exploit persistence based on thisSecuobs.com : 2009-06-09 00:59:45 - RSnake - @packetlife the 3rd attack isn't typical MITM which creates longevity Metasploit guys talked about exploit persistence based on thishttp://www.secuobs.com/twitter/news/2330.shtmlhttp://www.secuobs.com/twitter/news/2330.shtml @RafalLos Firewalls that protect you from me are like the swedish bikini team Both sound fantastic, but neither exist in real lifeSecuobs.com : 2009-06-01 03:07:41 - RSnake - @RafalLos Firewalls that protect you from me are like the swedish bikini team Both sound fantastic, but neither exist in real lifehttp://www.secuobs.com/twitter/news/1114.shtmlhttp://www.secuobs.com/twitter/news/1114.shtml Cisco patches out Potential Sockstress mitigator for their stuff Go and update if you use Cisco productsSecuobs.com : 2009-05-24 20:11:12 - RSnake - Cisco patches out Potential Sockstress mitigator for their stuff Go and update if you use Cisco productshttp://www.secuobs.com/twitter/news/573.shtmlhttp://www.secuobs.com/twitter/news/573.shtml @mubix - hah Do they have a section for mitigating vulnerabilities using nmapSecuobs.com : 2009-05-24 18:39:59 - RSnake - @mubix - hah Do they have a section for mitigating vulnerabilities using nmaphttp://www.secuobs.com/twitter/news/456.shtmlhttp://www.secuobs.com/twitter/news/456.shtml World of Warcraft phishing site: http://accountwow-battlenet/Secuobs.com : 2009-05-24 18:39:59 - RSnake - World of Warcraft phishing site: http://accountwow-battlenet/http://www.secuobs.com/twitter/news/455.shtmlhttp://www.secuobs.com/twitter/news/455.shtml