Hacking WEP using WEPbuster

ever heard about aircrack-ng suite? yeah..its a wep cracking programm. its really common now among wardrivers.

but do u know there's a new toolkit that is one step easier than aircrack?
i heard this from my colleague. the tool called WEPBuster.
just run it in Backtrack and it will automatically crack the wep around u!

available in unix only.so,windows user..u know what to do :D

read more about WEPbuster here
and here

p/s read the first link.make sure ur pc meet the requirements.


p0pc0rn

WAF != WARF

warf warf! sounds like a barking sound.

will hear that sound when some anonymous skidds found a vuln website and try to inject it but failed.
"warf! this page non-injectable...dont waste your time!"

and hey..warf also sounds like when we say wadefff!!!
(not wadefak my friend. but the 'wtf' word)

arh..here's the topic.
just learned a little bit about WAF = Web Application Filter.
nowdays u can get a lot of vuln sites. when u put a singe quote (') as example,there'll be a mysql error or etc.
but when try to inject (based on the tutorials given after some googling) and failed, does this mean that site is non-injectable?

NO. this is because of WAF

so hey noobs out there(including me) lets learn about WAF!

WAF from owasp


p0pc0rn

isCollection search form Designed by dubuweb XSS vulnerability

# Exploit Title: isCollection search form Designed by dubuweb XSS vulnerability
# http://www.dubuweb.com
# dork : intext:Designed by dubuweb
# Date: 20/11/2010
# Author: p0pc0rn
# Risk level: Medium
# Vulnerability Details:
User can execute arbitrary JavaScript code within the vulnerable application.

XSS
===
http:site.com/search/search.php?isCollection=webpage&k=[xss]

POC
===
http://www.greeninc.co.kr/search/search.php?isCollection=webpage&k=[xss]

Screenshot
==========

http://img600.imageshack.us/img600/4213/dubuweb.png



p0pc0rn

p/s : there are more vuln in this cms

ZMSE v2.0 (ZaLab Meta Search Engine) XSS vulnerability

# Exploit Title: ZMSE v2.0 (ZaLab Meta Search Engine) XSS vulnerability
# http://lab.zagia.com/
# Date: 20/11/2010
# Author: p0pc0rn
# Risk level: Medium
# Vulnerability Details:
User can execute arbitrary JavaScript code within the vulnerable application.

XSS
===
http://site.com/[search]/?where=[]&query=[xss]

Screenshot
==========

http://img251.imageshack.us/img251/6649/74928518.png


p0pc0rn

E-commerce by Hinetmedia™ XSS Vulnerability

Title:E-commerce by Hinetmedia™ XSS Vulnerability
Vendor:http://hinetmedia.com
Vulnerability Type: XSS (Cross Site Scripting)
Found by : p0pc0rn 09/11/2010
Risk level: Medium
Vulnerability Details:
User can execute arbitrary JavaScript code within the vulnerable application.

===
XSS
===
http://site.com/default.hm?store=[]&keywords=[XSS]


Status
=======
Fixed by technical support this evening.so fast! :D

Screenshot
==========


http://img513.imageshack.us/img513/6277/59796609.png


p0pc0rn