So another IE 0-Day has been uncovered, and is in use in the wild for drive-by attacks on unwitting web users. I have to say, technically speaking, this attack is rather impressive – in terms of the exploit, the delivery method and the way that it runs. It retrieves the PE headers from a DLL […]
First up, happy new year – let’s hope 2011 is an interesting year for the infosec community. Anyway today’s story is about the recently released tool cross_fuzz by Michal Zalewski and an inadvertent leak that have occurred. tl;dr version is something like this: Michal Zalewski writes a DOM fuzzer, fuzzes IE, finds flaws, Chinese dudes […]
There’s a lot of circumstantial evidence surround this as Microsoft themselves haven’t clarified or publicly announced anything related to the CSS Cross-Origin Theft bug – but it seems fairly clear. Some media sources are quoting it as a ‘new bug‘ – which it isn’t, according to other sources it has been known about for at […]
Ah Microsoft is treating this one seriously after France and Germany advised users to avoid IE. The current strain being exploited only targets IE6 users, but one security company has developed an exploit for IE8 which also bypasses DEP (Data Execution Prevention). It was rumoured this was the exploit used last week to compromise Google […]
Tags: crc-16, data execution prevention, dep, exploit, hacking-IE, ie 0day, IE-exploit, IE-security, IE-vulnerability, internet explorer security, internet explorer vulnerability, internet explorere 0day, internet-explorer-exploit, microsoft, microsoft patch tuesday, microsoft security, oob patch, out of band patch, vulnerability
Posted in: General Hacking | Add a CommentI’m sure you’ve heard about the Microsoft IE7 Exploit that allows Remote Code Execution on XP & Vista, it turns out it’s actually much worse than first expected. The exploit also affects IE5.01, IE6 and IE8 on all OS versions! That’s a pretty worrying turn of events for MS especially as they are seemingly leaving […]
Tags: 0 day exploit, 0day, 0day ie exploit, hacking internet explorer, hacking-windows, IE, IE-exploit, ie5 exploit, ie6 exploit, ie7, ie7 exploit, ie8 exploit, internet explorer security, internet explorer vulnerability, internet-explorer, internet-explorer-7, internet-explorer-exploit, remote code execution, windows vulnerability, windows-security
Posted in: Exploits/Vulnerabilities, Windows Hacking | Add a CommentIt seems a new, fairly serious flaw has been discovered in Internet Explorer 7 – and as accounts go it’s been around for a couple of months in the underground. The worrying part is, patch Tuesday was yesterday and after testing it’s been discovered that this flaw WAS NOT patched in the updates. ISC reports […]
Tags: 0 day exploit, 0day, 0day ie exploit, hacking internet explorer, hacking-windows, IE, IE-exploit, ie7, ie7 exploit, internet explorer security, internet explorer vulnerability, internet-explorer, internet-explorer-7, internet-explorer-exploit, patch-tuesday, remote code execution, windows vulnerability, windows-security
Posted in: Exploits/Vulnerabilities, Windows Hacking | Add a CommentPretty interesting and imaginative way to exploit the flaw in IE…yeah I know linked to ActiveX again, all the more reason to use Firefox right? It just shows that the browser really is a point of entry, this could be useful for a penetration test, another way to show how easy it is to get […]
Well how many does that leave unpatched? 30+ if I remember correctly from the PivX page that got taken down mysteriously. Microsoft on Tuesday released a “critical” Internet Explorer update that fixes 10 vulnerabilities in the Web browser, including a high-profile bug that is already being used in cyberattacks. The Redmond, Wash., software giant sent […]
Tags: exploit, IE-exploit, internet-exploder, internet-explorer-exploit, vulnerability
Posted in: Exploits/Vulnerabilities, Windows Hacking | Add a CommentInternet Storm Center’s always informative Diary has some good information. At the urging of Handler Extraordinaire Kyle Haugsness, I tested the sploit on a box with software-based DEP and DropMyRights… here are the results: Software-based DEP protecting core Windows programs: sploit worked Software-based DEP protecting all programs: sploit worked DropMyRights, config’ed to allow IE to […]
Tags: browser, darknet, exploit, firefox, hack, hacking, IE, IE-exploit, internet-explorer-exploit, poc, vulnerability, windows
Posted in: Exploits/Vulnerabilities, Windows Hacking | Add a Comment
