Full Disclosure mailing list archives
Re: Decrypting SSL for Network Monitoring
From: adam <adam () papsy net>
Date: Tue, 28 Jun 2011 15:12:56 -0500
I wasn't intentionally being vague, and I don't honestly know much about wordpress so the "feature" I exploited may very well be a [popular?] module and not something custom. In any case, the issue is with the section at the bottom that parses the referer to determine search engine queries (that resulted in users landing on the page). It's an excellent concept for SEO purposes, since relevant keywords will be linked together automagically through user interaction but it's not really worth the trade off when the "search query" isn't sanitized. Also, you shouldn't modify files in real-time since it can (and did) lead to information disclosure (revealed full path of wordpress installation, I assume during one of your saves). All in all, something as simple as $_SERVER['HTTP_REFERER'] = @strip_tags($_SERVER['HTTP_REFERER']); at the top of one of the class files would likely be enough to fix it for the time being. On Tue, Jun 28, 2011 at 2:30 PM, adam <adam () papsy net> wrote:
My thoughts? Before posting a URL to FD, make damn sure that it isn't vulnerable to any type of injection attacks. Luckily for you, I simply hid everything on the page. A malicious attacker could have done significantly worse. Fix that, and *then* I'll read the article. On Tue, Jun 28, 2011 at 11:09 AM, Adam Behnke <adam () infosecinstitute com>wrote:InfoSec Institute resources author Alec Waters gives you step by step instructions on how to decrypt SSL for network monitoring:**** ** ** http://resources.infosecinstitute.com/ssl-decryption/**** ** ** Your thoughts? **** ** ** ** ** _______________________________________________ Full-Disclosure - We believe in it. Charter: http://lists.grok.org.uk/full-disclosure-charter.html Hosted and sponsored by Secunia - http://secunia.com/
_______________________________________________ Full-Disclosure - We believe in it. Charter: http://lists.grok.org.uk/full-disclosure-charter.html Hosted and sponsored by Secunia - http://secunia.com/
Current thread:
- Decrypting SSL for Network Monitoring Adam Behnke (Jun 28)
- Re: Decrypting SSL for Network Monitoring adam (Jun 28)
- Re: Decrypting SSL for Network Monitoring adam (Jun 28)
- Re: Decrypting SSL for Network Monitoring Michael Holstein (Jun 28)
- Re: Decrypting SSL for Network Monitoring coderman (Jun 28)
- Re: Decrypting SSL for Network Monitoring adam (Jun 28)