Cloud Security

0x00Some time ago, a friend asked me a question about "no port is available. In the Intranet environment shown in, firewall only allows port 80 of the Web Server to establish a network connection, and port 80 on the Web Server has been occupied by

Modern browsers provide security-related response headers. To use these response headers, you only need to modify the server configuration, and do not need to modify the program code. The cost is very low. This article introduces some of the

As information security awareness increases, more and more information system front-ends are deployed with firewalls. The system administrator maps necessary internal service ports to the public network through port ing and other means, as shown in

Affected Versions:FooSun> 5.0 vulnerability description:In the file UserawardawardAction. asp: Integral = NoSqlHack (request. QueryString ("Integral") // 14th rows If action = "join" then User_Conn.execute ("Insert into FS_ME_User_Prize (prizeid,

Dedicated waiting The Administrator account and password of zhimeng are saved in the dede_admin table of the database.At first glance, I thought the password was encrypted with MD5, but there were 20 strange characters!After careful analysis, the

Attackers can use the application's dynamic data display function to embed malicious code into html pages. When a user browses this page, the malicious code embedded in html will be executed, and the user's browser will be controlled by attackers to

Many people are discussing how to protect themselves.WebShell permissions are not found.Share something I use.Download the DLL dynamic library and install it in iis6. [change the file name, file storage location, and extension as you like. How to

Method 1: Add a custom page (6.0 the experiment was successful) Template Management --> Add custom page --> casual Page name --> file name: xx.asp;.html --> page content --> copy the pony content Save and Click Manage to view your Trojan, which is

With the popularization of web, various web pages have become increasingly useful, which also gives hackers a chance. They found that CSS code used to make webpage special effects can also be used to mount Trojans. The irony is that CSS Trojans have

I recently worked very busy, so I seldom published articles. Recently, BEESCMS v1.1.0 saw another getip injection, which is a problem. Introduction:BEES is an enterprise website management system based on the PHP + Mysql architecture. BEES is

Before I published the vulnerability, I seriously despised Destoon's official customer service QQ: 537074901I told her that your system has a vulnerability and the consequences are very serious.Always back to me: "non-commercial users do not have

Jaf cms is a content management system used to create a personal homepage. jaf cms 4.0 RC2 has multiple security vulnerabilities, including command execution and Remote File Inclusion vulnerabilities. [+] Info:~~~~~~~~~Jaf cms 4.0 RC2 Multiple

Affected Versions:VBulletin 4.0.8 Vulnerability description: VBulletin is an open-source PHP Forum program. The Profile mizmization function of vBulletin has the persistent cross-site scripting vulnerability. In the Custom Field of the

Do not use a single statement as a SHELL. It is best to use the SHELL to be verified. And then add it to the SHELL. OK.Go to the background-system settings-manage data tables-Manage System Models-import new modules and rename the modified php

1. Introduction1.1. Document Description:1.2. Document organization:2. Text2.1. SQL Injection2.1.1. Attack Mode:2.1.2. Defense methods:2.2. Script Injection2.2.1. Attack Mode2.2.2. Defense methods2.3. Cross-Site attack2.3.1. Attack Mode2.3.2.

Author: Mormoroth Affected Version: ALL VersionVulnerability Type: SQL InjectionVulnerability Description: The Dejcom Market CMS showbrand. aspx page parameters are not strictly filtered, resulting in the SQL injection vulnerability. Dork:

Vulnerability Description: from the source code, you only need to upload a copy-bound Trojan to include it normally. The vulnerability file is in wap/index. php. The key code is as follows: Error_reporting (7 );Define (IN_ET, TRUE );Include

The second FCKeditor upload takes shell as a typical FCKeditor vulnerability. This second upload requires support for aspx and FckEditor, editor, filemanager, connectors, aspx, and connector. the aspx file is deleted. The secondary upload

CnCxzSec's Blog Today, I saw an article Exploitation of "Self-Only" XSS in Google Code in exploit-db, which is about the "cross-Self XSS" on Google Code ". In the past, I found that some mainstream domestic mailboxes "only cross-user XSS" were found.

 System: IdeaCMS2.0Keyword: inurl: about/indexlist. asp? SortID =Default Database: dateIdea_Site.mdbShell in the background:  The following code saves the HTML modification URL! HTML code template background management-EXP modify a template file