Inn for security folks
Introduction NetModule Router Software (NRSW) is a Linux-based software solution developed by NetModule for managing data connections across various devices. It applies to a various devices, including stationary and mobile routers, gateways, and IoT devices. NRSW provides consistent configuration processes and functions across all NetModule devices. It includes security features and supports…
Roxy-WI was created for people who want a fault-tolerant infrastructure but do not want to dive deep into the details of setting up and creating a cluster based on HAProxy / NGINX and Keepalived, or just need a convenient interface for managing all services in one place. Advisory Information Remotely Exploitable: YesAuthentication Required: NoVendor URL: [ ]
GLPI stands for Gestionnaire Libre de Parc Informatique is a Free Asset and IT Management Software package, that provides ITIL Service Desk features, licenses tracking and software auditing. Advisory Information Remotely Exploitable: YesAuthentication Required: Depends on ConfigurationVendor URL: glpi-project.orgCVSSv3.1 Score: 9.1 (CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:C/C:H/I:L/A:L)Date of found:…
LiderAhenk is an open source software system that enables centralized management, monitoring and control of systems and users on the corporate network. In this blog post, you will see how bad it can get when you have a critical security vulnerability on your centralized client management system. Architecture and Our Target LiderAhenk software has 2 [ ]
A couple of days ago, I came up with news that Pardus will organize a report-bug contest. I love to contribute to open-source projects. So that was a pretty good chance to revisit one of my old friends, Pardus, and uncover security and/or privacy issues. What is Pardus ? Pardus is a Linux distribution developed with support from [ ]
It has been a while since I haven t published a post on our beloved blog. Today I would like to share technical details and POC for a pretty funny vulnerability that I ve found at GravCMS. As I ve been saying since 2015, my pentest team and I love to chase after 0days during penetration test engagements. [ ]
I believe that doing a security research is all about trying to understand high-level of architecture of the products and finding a creative attack vectors. I hope this blog post will show some the readers how to start doing security research. Installation You can install that software Debian/Ubuntu or CentOS. I’ve installed it on Ubuntu [ ]
In this article, I will be sharing several critical vulnerabilities of Seagate Central Storage NAS product. Advisory Informations Remotely Exploitable: YesAuthentication Required: NOVendor URL: https://www.seagate.com/as/en/support/external-hard-drives/network-storage/seagate-central/Date of found: 19 Dec 2019 Technical Details Upon obtaining the latest device firmware from the Seagate download…
I ve been doing security researches on softwares for a quite long time. During these researchs, I often find myself in a situation where in I think about the state of mind of developers, problems that occur during developments and core problems of nature of software crafting teams. Thinking about these questions always lead me to [ ]
Throughout the Art of Anti Detection series we have mainly looked at methods for bypassing automated security products, but in this part we will focus on several self-defense methods for protecting our foothold on the target machines against actual users. These users may be technically insufficient employees or they may be blue team members in [ ]