######################### Securitylab.ir ########################
# Application Info:
# Name: ECSHOP
# Version: 2.5.0
# Website: http://www.ecshop.com
#################################################################
 

There are a number of privilege escalation attacks known for oracle. These are mainly because by default PL/SQL procedures and functions run with the privilege of the definer and not that of invoker. Think of it like SUID files.

Well, I usually don’t blog about these bugs but phpMyAdmin is a project that is used almost everywhere and this is a quick and dirty way to get code execution. This issue affects phpMyAdmin 3.x before 3.1.3.2 and it was disclosed on 14 April 2009. 

感谢雨中风铃的投递

影响版本：3.0
信息来源：零客网安 www.0kee.com
Author：bink
漏洞文件：action.asp

The pupose of this post is to describe and list WMIC commands that can be used to derive information from a target, and that information could be useful to either a Sys Admin, a Malware Hunter or just a plain old Evil Attacker. As I will demonstrate WMIC can be used to modify settings also.

感谢Netpatch的投递

With Oracle 11g, Oracle introduced some  security enhancements by default, e.g. the ACL for PLSQL packages accessing the network. These packages are UTL_HTTP, UTL_INADDR, UTL_TCP, … Some old well known tricks like the usage of utl_inaddr are no longer working for non-DBAs in 11g… The following tutorial will show how to bypass these restrictions and will show some new tricks…

 当你在渗透中挂机嗅探的时候，如果管理员上来发现就不好了所以有了这个bat 的用处

#Trace: 仅供参考，不全正确。

（本文中你將看到實際的演練，在真實的網路上，我們會示範如何藉由攔截式代理伺服器的漏洞，取得路由器與其他內網伺服器的管理介面與登入prompt。測試點不在台灣。）

BY Flyh4t

http://bbs.wolvez.org

校内网在发blog时对插入图片过滤不严格，存在xss漏洞.

 Since a buddy asked for some clarification on using incognito extension with Metasploit/Meterpreter I'll post some more notes on it.

  The most advanced GUI tool for aiding in full compromises of MSSQL servers via SQL injection.

有需求,网上找不到相关工具,所以自己写了个.没有提供给用户自行定义线程数量的接口.本程序不直接读取IO文件中的密码,而是将每个要用到的密码文件映射到内存操作,所以同时最大只支持32个线程,密码文件不宜过大,从性能上来说越小越好,以免过多的造成内存碎片,降低机器的性能.很抱歉,因为写它的时候我并没有打算去写个内存池来优化它的内存操作.我仅仅是做个测试而已,没有考虑会利用它来做些什么.