Cloud Security

Data Hiding Technology 0x00 Preface Data Hiding has penetrated into all aspects of life, and has always been very interested in data hiding. However, there are few articles on data hiding on wooyun. After reading the summary of implicit writing, I

HPE ArcSight ESM information leakage (CVE-2016-1992)HPE ArcSight ESM information leakage (CVE-2016-1992) Release date:Updated on:Affected Systems: HP ArcSight ESM Description: CVE (CAN) ID: CVE-2016-1992HP ArcSight ESM is an enterprise

How to Use Graph Theory to automatically search for domain administrators AD domain permission escalation is an important part of penetration testing. The commonly used domain permission escalation is centered on collecting plain text authentication

Simply bypassing Chome password to view the logic and how to view the Saved Password in the browser View logic:When you want to view the password saved in Chrome, click it to display a dialog box asking you to enter the Windows Password to verify

PHP Utility Belt Code Execution Vulnerability Originally, I only wanted to create a wheel to analyze the article, so I started the code audit process.This is the story of his vulnerability. It's too easy to find.Determine whether to post and then

55bbs email system SQL injection requires parameter Filtering 55bb mail system SQL Injection injection link: http://pop3.55bbs.com/extmail/cgi/index.cgihttp://smtp.55bbs.com/extmail/cgi/index.cgi Injection Parameter: domain (POST) Type:

Pseudo-static SQL injection (with verification script) exists in a station in flush) Pseudo-static SQL injection at a site in huashun The injection point is http://data.10jqka.com.cn/ifyyb/yybstockxt/code/600811/date/1?input parameter. The asterisk

Webfront game station has SQL injection (delayed blind injection includes multiple bypassing + encoding) Webfront game station has SQL injection (including multiple bypassing and encoding) Objective: To detect game.feng.com and find SQL injection in

Getshell can be used on the official website of UUCall. (root permission + main site + client shell + large amount of sensitive information leakage) Can I use the previous homepage? Target: http ://**.**.**.**/Start with the next station, http: // **

A website in HC has the SQL injection vulnerability involving more than 20 thousand user data entries. A website in HC has the SQL injection vulnerability, involving more than pieces of user data. Continued: WooYun-2016-173045The Operating Analysis

Cool music main site SQL injection vulnerability requires parameter filtering (ROOT injection/Intranet ip leakage) Cool music main site SQL Injection Vulnerability (ROOT injection/Intranet ip leakage) Different from WooYun: The domain name of a

Mysql injection vulnerability in a website in Rong 360 RT, Chinese New Year. Enjoy a red envelope RTThe following is an integrated app designed to study logical vulnerabilities. injection was found during the test... Mobile Packet

51CTO an SQL injection may cause more than 19.4 million mailbox list leakage (requires parameter filtering) 51CTO SQL injection may cause more than 19.4 million mailbox list Leakage Link: http://newsletter2.51cto.com/new/openStats.php? Serial = 5629

In those years, we will explore the global protection of SQL injection and the second injection of Bypass.0x01 background Currently, WEB programs basically have global filtering for SQL injection, such as enabling GPC in PHP or common in global

Some of my systems are improperly configured to make all hosts controllable. ~~~~~ Accidentally swept this http://cr.kuwo.cn/.svn/entries No way to download the source code, but there is an ip in it, 60.28.201.5 direct access to only one test

User-defined XML file Blind XXE vulnerability exists in a substation of Sohu Changyou See http://wooyun.org/bugs/wooyun-2016-0168457Problematic Website:Http://im.changyou.com/live800/services/IVerification? Wsdl  The custom XML file is as follows: 

A website of Air China has a vulnerability in which you can obtain information about other user audio and video cards. This vulnerability allows you to obtain a large number of user's audio and video card accounts, and perform point transfer,

Security experts warned: Install plug-ins to grab red packets and be careful about "not worth the candle" Information security expert reminds me that the New Year's mobile phone hongbao is in "Level 1 Preparation" Tomorrow is New Year's Eve, and the

SQL Injection exists somewhere in Sina financial Rt affects user data Injection point: http://vip.stock.finance.sina.com.cn/fund_center/data/jsonp.php/funds_smsy/PEFundService.getHowBuyData? Page = 1 & num = 10 & sort = jjjz * & asc = 0 & ccode = &

Arbitrary File Upload on an important website of the chain leads to getshell (the root permission can be roaming through the Intranet) Arbitrary File Upload on an important website of the chain leads to getshell (the root permission can be roaming