夜雨山庄

     监测数据显示目前有10%-15%的中国网民在使用浏览器、即时通讯、游戏等软件时，曾访问钓鱼网站，接触过欺诈信息。

» 阅读全文

      赛门铁克近日监测到假冒CNN报道杰克逊去世新闻的垃圾邮件，并发现其中包含了恶意链接。如果用户出于好奇心点击该链接，便被重新定向到一个恶意网页。

» 阅读全文

影响版本:
v6版
漏洞描述:
在do/job.php文件:

...
}elseif(ereg("^([-_0-9a-zA-Z]+)$",$_GET[job])||ereg("^([-_0-9a-zA-Z]+)$",$_POST[job])){
    require(dirname(__FILE__)."/"."global.php");
    if(is_file(PHP168_PATH."inc/job/$job.php")){
        include(PHP168_PATH."inc/job/$job.php");
    }
}

» 阅读全文

Someone decided to contact mybb's staff informing about this vulnerability with the obvious result that this will not work anymore.
Fucking moron.

I'm releasing a non-finished version of the exploit. No help, PoC and with the necessity of --admindir flag.
Going to update it in the next days.
For historical reason, i'm leaving the original title, but note that is <= 1.4.6

» 阅读全文

/* deslock-dlpcrypt.c
 *
 * Copyright (c) 2009 by <mu-b@digit-labs.org>
 *
 * DESlock+ 4.0.2 local kernel SYSTEM exploit
 * by mu-b - Thu 18 Jun 2009
 *
 * - Tested on: dlpcrypt.sys 0.1.1.27
 *
 * .text:0001BB2E: 'what do ya want for nothing?'
 *  - hmmm, something that doesn't pass kernel mode pointers
 *    between kernel and userland?
 *
 * Compile: MinGW + -lntdll
 *
 *    - Private Source Code -DO NOT DISTRIBUTE -
 * http://www.digit-labs.org/ -- Digit-Labs 2009!@$!

» 阅读全文

ordpress Photoracer Plugin => SQL injection
http://wordpress.org/extend/plugins/photoracer/

Author: Kacper
Website: http://devilteam.pl/

Pozdrawiam wszystkich z huba dc++, oraz wszystkich z forum,

Pozdro: Ratman, Kopaczka, FDJ

» 阅读全文

　由于存储过程中存在用于字符串连接的 + 号连接SQL语句,这就造成SQL注入的可能性

» 阅读全文

163 filter 08年底升级后,有不少改进.但还是明显落后于其它webmail.比如,除掉<script>,expression,eval.

onerror变on_error,等.其实精心构造语句可以反利用filter过滤语句. 此法思路己有技术文章指出.在此暂且不论.

163基于语法分析的filter还是不能很好地预期浏览器表现.

» 阅读全文