Exploiting POST Method XSS Silently

POST HTTP method XSS exploitation without the target filling out a form... SILENTLY

"One does not simply finds a DOM based XSS without js analysis"

Checkout this cool blog from Prakhar Prasad (http://blog.prakharprasad.com/), they setup an interesting XSS challenge that requires code analysis to solve, here: xss.prakharprasad.com (also thanks to MaXoNe who I think contributed to it).

CGI-C Shell - PHP disabled functions/Safe Mode Bypass Shell source [Windows/Linux]

When Safe mode is on it can be a pain to do what you want to do on the system. Being able to access CGI solves this problem, and here is my implementation of a shell (safe mode bypass) in C for windows and linux.

Persistent XSS in wysiwyg module CKEditor below 4.1 - drupal 6.x 7.x

This persistent XSS vulnerability requires a little bit social engineering to work, see the report below:

How to shell a server via image upload and bypass extension + real image verification

During a website audit, upload forms and other interactive 'user-content' driven facilities are often found to be protected by client side and/or server side security checks. This tutorial presents the methods that can be used to circumvent these security checks. In this case we're specifically considering image uploads that allow JPG files in particular.

2nd Cross-site-scripting vulnerability find in Microsoft.com

Another Microsoft find for the wall! http://technet.microsoft.com/en-us/security/cc308589.aspx

C Source Release:

C Source Release:

LastDoor - Root Backdoor and Log-Cleaner for Linux

[+] What is it?

 

A backdoor for retaining root access and a log cleaner with several functions.

XSS find in Google.com - on the hall of fame at last!

March update:

Google updated their wall of fame for Jan-March (http://www.google.co.uk/about/appsecurity/hall-of-fame/reward/). I disclosed a cross site scripting (XSS) vulnerability last month, and Google were kind enough to put me on their wall (and give me a few pennies to spend at the sweet shop).