Chickenfoot dictionary attack

Hello everyone... This time we'll learn how to write a very cool script using a superset of javascript functions. This is achieved through a firefox extension called chickenfoot that you can install from here. The script will automate the filling of username and password given two different files. If you receive an error its probably because the script doesn't find the fileio.js file. In this case you can find it on your system , open it and copy the content before my script begins. Credits also go to my friend "Daigoro"

MySql painless deployment on Slackware

Hello everyone....I've decided to use my blog as a repository of material not strictly related to security so as to post more often and most of all to keep a track of useful configuration. As you can infer from the title we are going through a quick and painless MySql deployment on Slackware (my one and only distro of choice). First of all download MySql package from a slackware repository and install it with: - installpkg MySql-ver.tgz then we need to install the db with: - mysql_install_db change the permission of the mysql library to mysql user - cd /var/lib/;chown -R mysql:mysql mysql finally fire up the mysql daemon - /usr/bin/mysqld_safe & If you want to start the daemon at start-up you gotta issue: - chmod a+x /etc/rc.d/rc.mysqld This concludes the little guide.

Lotus Domino Session Hijacking

Hi everyone, I've been very busy lately so this is why I haven't posted for so long... By the way, I might have discovered a new vulnerability in Lotus Domino Web Access. Here's what I've found As soon as you successfully authenticate to the Lotus Notes Web Interface, you receive a session token called DomAuthSessId. I've discovered that if you steal this token from a logged user, and set it in your browser then you can impersonate the victim. Obviously Lotus Notes allow the same user to authenticate concurrently from two different IPs. The Lotus Notes version were 5 and 6. To steal the cookie you can use the commom methods, like sniffing, using XSS etc. To view and set the cookie you can use a very nice firefox extension called web developer toolbar. As a side note this article was posted on bugtraq but was refused, the answer was: "Hmm this doesn't seem out of the ordinary for a webmail application -- the trick is stealing the token in the first place" Now...I've tested the same thing on openwebmail and that didn't work, so to me It doesn't look so normal. As for stealing the cookie, we have already talked about it. Credits also go to my collegue Dave Nigro for helping me testing the vulnerability.

My first post

Hi everyone, I wanna introduce myself to you... I'm a computer enthusiastic (geek), mainly self-taught that works, at the moment, as a paid ethical hacker. English is not my native language so please bear with me if you encounter any errors. As a self-taught person I often found that the real problem is not to find computer related articles on the web, but to find quality articles. For quality I mean articles explained very clearly, but that often implies a very deep knowledge of the subject treated by writer. I think that many people write some useless posts just to show-off, copying and pasting from all around. My aim is to do the opposite, e.g. write about IT or IT Sec. related matters in a way that most of the people can understand. I also invite you to partecipate in with comments that can better the resulting post. Stay tuned more to come soon.