Help in security issue for Sobi2 Joomla Component

Old stuff, but heh too lazy to update my blog.

The news 

Thanks to Radek Suski because entertain my report :D

Listed on Adobe Security Acknowledgments

thanks Adobe :)

updating my resume immediately! LOL~

XSS in HP.com subdomain.

Its been a while :)

Found an XSS bug in one of Hewlett-Packard  subdomain recently.
Reported and they fixed it. Their team do take this thing seriously and fixed it immediately. kudos to them :D

Above was the original url that I found XSS in it.

Proof of concept

Done!

Thanks. That's all for now :D

XSS on La Liga turn

hi again.
i'm soo into XSS at the moment.so here another two xss found in fcbarcelona and realmadrid for today post

RVP agree joining MUFC

so, today
RVP agree joining MUFC

its not fair if just MUFC got xssed :P.
so here some of the other EPL team.

Wargames2012 - Crypto100,200 Writeups

again, there's a wargames conducted by HiTB KL Crews this year. I'm participated but not doing well just like previous year..since..there were some other commitments during that weekends. So, here are two writeups for crypto

  Crypto100

Easy crypto: 82 73 81 81 61 83 52 62 63 41 74 22 01 42 73 31 74 52 01 21 74 01 71 83 83 01 92 73 83 32 61 73 01 81 62 43 01 74 63 51 01 71 43 92 32 92 92 22 23 43 42 61 01 51 51 72 41 62 81 72 42 22 91 01 74 91 52 74 01 42 33 23 61 23 43 21 61 52 22 01 52 74 42 01 82 63 43 94 92 93 91 32 23 32 01 94 43 01 21 62 21 74 52 81 32 71 91 33 93 01 43 51 63 42 01 32 01 52 53 32 94 63 74 91 42 01 52 81 83 92 92 01 21 74 01 91 31 41 53 82 91 62 63 01 73 42 82 91 21 22 51 71 01 91 94 32 01 51 83 22 62 61 51 63 52 94 82 01 41 33 01 83 73 01 92 82 41 62 61 41 32 42 83 01 61 94 91 53 42 52 21 01 41 93 53 82 91 31 01 63 53 92 01 52 43 93 23 82 81 72 93 01 81 94 41 21 82 61 61 43 83 01 93 42 91 31 94 42 01 61 83 01 83 21 72 33 41 42 51 01 81 23 43 01 42 93 61 23 91 32 53 63 01 21 62 21 74 52 81 32 71 91 33 93 01 73 33 53 81 01 21 22 21 53 01 32 22 52 71 72 83 32 93 01 83 92 51 61 53 91 83 93 91 52 01 81 23 43 52 53 33 82 01 31 43 71 33 31 82 93 61 41 62 01 93 51 52 73 93 91 91 31 01 52 43 52 94 74 51 41 01 52 94 01 41 41 01 81 23 43 01 53 42 72 21 01 41 94 93 33 91 01 91 51 83 32 52 01 21 91 33 01 33 93 42 01 74 62 93 01 92 21 53 01 32 94 51 83 93 91 01 41 33 01 63 53 92 01 51 74 43 31 53 32 42 51 01 81 23 43 01 33 53 92 31 23 82 31 01 92 52 32 93 01 92 42 01 51 32 62 33 71 01 94 92 53 01 23 61 23 43 21 74 42 23 92 51 01 52 74 83 94 01 33 92 51 74 43 74 01 94 93 33 51 32 83 91 22 82 52 42 61 01 81 94 71 42 53 94 22 01 81 82 42 01 32 42 51 01 53 74 42 53 31 41 81 21 61 52 22 01 31 94 82 91 01 91 31 42 92 94 81 62 74 73 63 ------------- Description: ------------ Look carefully! Does it look like hex?

the numbers refers phone keypad. decode it and then you'll get another cipher which is a vignere cipher. decrypt it and you'll get an article about cryptography. the 'key' is a hint to this challenge's flag.

  Crypto200

FN1hJU9XAJZhTF8qbnJENt1XBMd6i0utzJpHCGyVt4yp8LsHYHUJP+/M+37eNjldkx4T5xnliSrIsz/qQHB9PA==

as you can see,this is just a normal base64. decode it and you'll get some scrabble/rubbish/random words+symbols.view hex of the decoded base64 just like below.

yerp.its an md5 hash.you just need to decrypt in and you'll get the flag :) this year,these two are the only crypto challenges that the crew released. maybe quite hard compared last year so players struggle to solve them. thanks.

XSS on Airasia Subdomain

Found a bug on one of airasia.com subdomain. noticed the security team and they fixed it. well,they did fix the current form used, but the one that I found previously still unfixed and maybe will be terminated soon :)

XSS Collections

So I was trying to learn to bypass XSS filtering. and search around google. found that in hackforums or other hacking forums, some of the members always challenge the others to solve their challenge. and some of the sites that they challenge are the famous one. and I manage to solve some of them as well :) Here are some of my XSS collections.Just for fun. Its just a non-persistent xss btw. isohunt.com

Burgerking bk.com

KickAssTOrrent kat.ph

st-secure.com

Shell Oil shell.com

Kaskus Indonesian Forum kaskus.co.id

Puma puma.com

AT&T att.com

and others that you can see from athere

Wargames.My 2011 - crypto200

 Above is the ciphered words given to the players. What the players need to do? Decode it,simple :P Google images for "logo cipher" or "code image". And lots of images with their own cipher code from the images. Find the one that similar to the crypto200.png There are some that you can list in. 1 - freemason cipher 2 - pigpen cipher 3 - more.. I chose pigpen cipher since that's the most similar to the crypto200.png.. My friend said it is ok to chose either one since the next step after deciphering this cipher is the real challenge. once decode it to words,this is what i got

ndeunf ofqugzdg cdru kuus zdpul
dsl giyisp uatvsuseiannf ev kgisp
lvzs ovgghtecl pvrugswusey dsl eh
ogudeu egdsytdgusof dsl kgispisp
tvzug kdom ev ecu tuvtnu!zlugu
ecugu iy sv riyivs,ecu tuvtnu zinn
tugiyc

svz dsyzug;zcioc pgvht zdy gfds
onudgf doohyul vx ev ku dyyvoideul
ziec?wl5 ecudsyzug dsl yhkwie ecu
yhw.ecde iy fvhgxnp.

End? not yet! you still need to decode the 2nd cipher,Substitution Cipher! Here's a wikilink for this cipher. how this cipher works? here's an example rabbit - real words. so the person who want to send this message want to cipher it,so he substitute letter r = x, a = w, b = e, i = k, t = u so the rabbit,once ciphered will become xweeku. so,how to get the real answer for this challenge? reverse the decoded words up there :P thanks.

Wargames.My 2011 - crypto100

Crypto100
Players given this code.

fvrwslwslswhgacsremfberbubgrihgbtvi

Hint given was : I like big,long and yellow
the first thing came in my mind once read the hint was = banana!!..so the answer/passphrase should be monkey.

I googled a little bit about type of ciphers that need a passphrase/key to decrypt it.
I found vignere ciphers.Then try to use online cracker available to crack it, and wollah~ lucky me :D
Flag is = themonkeyisjumpingaroundinthejungle


Here's a python code made by johnburn to solve this challenge. its a dictionary attack btw.

#!/usr/bin/python
charset   = 'abcdefghijklmnopqrstuvwxyz'
encoded = 'fvrwslwslswhgacsremfberbubgrihgbtvi'

keys = open("wordlist.txt", "r")
for key in  keys.read().split('\n'):
    message = ''
    for i in range(len(encoded)) :
        p = charset.index(encoded[i])
        k = charset.index(key[i % len(key)])
        if k - p < 0 :
                   message += charset[((p - k) + 26) % len(charset)]
        else :
                   message += charset[(p - k) % len(charset)]
    if message[:-2].count('the')>1:
        print 'The key: ' + key        
        print 'The message: ' + message
        break

Wargames.My 2011 - writeups

This year there'll be another online ctf games a.k.a wargames in malaysia.Thanks to hackerspace community + TheSexyKambing
http://wargames.my/wgmy2012/
Last year,the game dominated by Kueytiow. He/She manage to solve two binary bonus challenge which made him started the game in a comfort zone.
Can view the last year result here
result

So for those that have interest to join this year wargames do register ASAP.

In my blog I'm gonna share with you some of the writeups for the previous challenge.

Web100
Available in wargames website, web100 writeups

Forensic200

OHMAIGAWD! It seems like we've been hacked! But what did the hackers 
steal? From the logs, it seems like they exploited an SQL injection bug 
on our website. Help us find the name of the database that they stole 
and we shall reward you handsomely.

So players were given with a log to analyze them. You can get it here
From the logs, the attacker just use an automated tool;sqlmap to exploit the web. The injection use Blind technique. If you are good enough in Blind SQL injection,you should get the flag in less than a minute :) goodluck.
Flag = wgmy2011

more will be in my next post...hopefully :P