<?xml version="1.0" encoding="UTF-8"?><!-- generator="WordPress/2.6.3" -->
<rss version="0.92">
<channel>
	<title>www.notsosecure.com</title>
	<link>http://www.notsosecure.com/folder2</link>
	<description>From Pentesters To Pentesters</description>
	<lastBuildDate>Tue, 04 Nov 2008 21:49:21 +0000</lastBuildDate>
	<docs>http://backend.userland.com/rss092</docs>
	<language>en</language>
	
	<item>
		<title>MySql Stored Procedures And Functions</title>
		<description><![CDATA[Although, a lot has been written about oracle&#8217;s stored procedure and the weak permissions etc. I looked into the same issues for mysql and it turned out that mysql suffers from the same flaws/features. The only difference is that mysql does not come with any default stored procedure.
Like oracle, mysql stored procedure(and functions) are by [...]]]></description>
		<link>http://www.notsosecure.com/folder2/2008/11/04/mysql-stored-procedures-and-functions/</link>
			</item>
	<item>
		<title>MS08-067</title>
		<description><![CDATA[As everyone is talking about this, i thought i will also mention it here briefly. Microsoft released an out of band  patch for this vulnerability. More Technical details about it can be read here. Its a remote code execution in server service which surprisingly everyone missed in the previous version of a similar vulnerability(MS06-040).
Currently [...]]]></description>
		<link>http://www.notsosecure.com/folder2/2008/10/31/ms08-067/</link>
			</item>
	<item>
		<title>SNMP v3 Foo</title>
		<description><![CDATA[Recently I encountered a snmp port which nmap said was open. Nmap version scan said it was cisco snmp service whereas without the version scan it said open/filtered.
snmpwalk with community string public(and thousand more) did not return anything.
the packet dump while running nmap showed that snmp service had actually responded to nmap and showed its [...]]]></description>
		<link>http://www.notsosecure.com/folder2/2008/10/22/snmp-v3-foo/</link>
			</item>
	<item>
		<title>Windows 2003 Token Kidnapping Privilege Escalation</title>
		<description><![CDATA[In case you haven&#8217;t seen this exploit on milw0rm (http://milw0rm.com/exploits/6705), its worth having a look. It will be very handy particularly in following 2 instances:
1. SQL injection in SQL Server 2005, with backend server running as &#8216;SA&#8217;.
2. File Upload functionality allowing you to run code.
Its worth noting that SQL server 2005 run as &#8216;network service&#8217; [...]]]></description>
		<link>http://www.notsosecure.com/folder2/2008/10/18/windows-2003-token-kidnapping-privilege-escalation/</link>
			</item>
	<item>
		<title>Gmail on iphone..notsosecure</title>
		<description><![CDATA[If you are concerned about the security of your emails, accessing Gmail from a mobile device may not be a great idea. 
1. A few weeks ago, google introduced a new feature in GMAIL, through which you can force the gmail session to not use HTTP at all, and only talk over HTTPS. This unfortunately [...]]]></description>
		<link>http://www.notsosecure.com/folder2/2008/10/14/gmail-on-iphonenotsosecure/</link>
			</item>
	<item>
		<title>New Theme</title>
		<description><![CDATA[NotSoSecure became slighlty more secure with the new Wordpress update.
This update is highly recommended if your wordpress allows user registration.
Its amazing how many vulnerabilities have been identified in wordpress over the years and i wonder how many are yet to come.
]]></description>
		<link>http://www.notsosecure.com/folder2/2008/09/12/new-theme/</link>
			</item>
	<item>
		<title>SQL Column Truncation Vulnerabilities</title>
		<description><![CDATA[I wonder how many web sites will get effected because of this issue. Stefan Esser has a great write up here and the wordpress exploit here.
the following may help you understand this issue better:-
 mysql&#62; create table users (username varchar(10), password varchar(20)); Query OK, 0 rows affected (0.12 sec)
 mysql&#62; insert into users values(&#39;admin&#39;,&#39;Passw0rd&#39;); Query [...]]]></description>
		<link>http://www.notsosecure.com/folder2/2008/09/11/sql-column-truncation-vulnerabilities/</link>
			</item>
	<item>
		<title>Injection in Order by, Group by Clause</title>
		<description><![CDATA[Exploiting SQL Injections when the input goes in the order by clause, is a bit tricky as after &#39;order by&#39; clause union queries are not permitted. The following could be used in such scenario to form blind sql injection cases:
mysql&#62; select id from news where id =1 order by 1, (select case when (1=1) then [...]]]></description>
		<link>http://www.notsosecure.com/folder2/2008/08/01/injection-in-order-by-clause/</link>
			</item>
	<item>
		<title>Input Length restriction in SQL Injections</title>
		<description><![CDATA[Often While exploiting SQL Injections, one encounters restrictions on the length of input a vulnerable parameter can take. e.g

http://myhost/vuln.asp?vuln=a&#39; union all select 1,2,3,4,5,6,@@version&#8211; works


http://myhost/vuln.asp?vuln=a&#39; union all select 1,2,3,4,5,6,table_name from information_schema.tables&#8211; may not work(too long) 

One solution to this problem could be:-

http://myhost/vuln.asp?vuln=a&#39;;select * into xx from information_schema.tables&#8211;


http://myhost/vuln.asp?vuln=a&#39;;exec sp_rename &#39;xx.table_name&#39;,&#39;xx.tn&#39;&#8211;


http://myhost/vuln.asp?vuln=a&#39;union all select 1,2,3,4,5,6,tn from xx&#8211; 

 &#160;Thanks [...]]]></description>
		<link>http://www.notsosecure.com/folder2/2008/07/23/input-length-restriction-in-sql-injections/</link>
			</item>
	<item>
		<title>Bsqlbf V2, Blind SQL Injection Brute Forcer</title>
		<description><![CDATA[Bsqlbf was originally written by &#160;A. Ramos from www.514.es and was intended to exploit blind sql injection against mysql backend database. This is a modified version of the same tool. It supports blind sql injection against the following databases:-
MS-SQL
MY-SQL
PostgreSQL
Oracle
It supports injection in string and integer fields. The feature which separates this tool from all other [...]]]></description>
		<link>http://www.notsosecure.com/folder2/2008/06/21/bsqlbf-v2-blind-sql-injection-brute-forcer/</link>
			</item>
</channel>
</rss>
