Andrew Mohawk Security research, hardware builds, and radio notes.
← Back to categories

Web Security

4 posts filed here.

Posts

4 posts
  1. B-Uggs
    B-Uggs
    • Security

    Title: Thats uggzactly what I thought! TLDR; ugg.com orders could be enumerated from just the orderid which was an incrementing number. Any order that was not already dispatched could be cancelled,...

  2. Joomla 2.51 Blind SQL Attack
    Joomla 2.51 Blind SQL Attack
    • Security

    <responsible_disclosure> Before i discuss this, let me just say that the bug has been patched (was in 2.5.1) and at the time of writing this Joomla is already 2 increments away - 2.5.3 is currently...

  3. VMWare User Information Leak
    VMWare User Information Leak
    • Security

    Click here to search the VMWare user database! So last week some time Chris Hadnagy linked me to the following URL: http://info.vmware.com/content/opt-out which was pretty interesting last week. Ba...

  4. Persistent XSS: more than a popup :)
    Persistent XSS: more than a popup :)
    • Security

    So a while ago I asked if I was allowed to play with http://www.bravadogaming.com/ and I got a positive response, I kinda looked around at their custom CMS, didnt see anything immediately available...