SecuObs - L'observatoire de la sécurite internet - Site d'informations professionnelles francophone sur la sécurité informatique

Les derniers commentaires publiés sur SecuObs (1-5):

- WepBuster v1.0 beta0.5 released - 130232 downloads of BackTrack 4 Pre-Final since the release - Latest version virtualbox 3.0.0 released - ESRT @mubix A very effective SSH bruteforcer by @laramies recently updated - ESRT @mubix - Middler gets some more updates today Les derniers commentaires publiés sur SecuObs (6-25) Tous les commentaires publiés sur SecuObs avant les 5 derniers

Top des 100 failles les plus recensées :

Nombre	Nom du test	Place
3537	Nessus Scan Information	1
3389	Host Fully Qualified Domain Name FQDN Resolution	2
901	ICMP Timestamp Request Remote Date Disclosure	3
324	Web Server Directory Enumeration	4
306	HTTP TRACE / TRACK Methods	5
227	Network Time Protocol NTP Server Information Disclosure	6
188	Open Port Re-check	7
179	Identd scan	8
147	DNS Server Cache Snooping Information Disclosure	9
143	DNS Server Recursive Query Enabled	10
142	ISC BIND Remote Version Disclosure	11
131	SSL Certificate	12
129	RPC Services Enumeration	13
117	DNS Server Fingerprinting	14
95	Default community names of the SNMP Agent	15
92	Obtain system info type via SNMP	16
81	HyperText Transfer Protocol Information	17
75	Service Identification 2nd pass	18
75	Apache UserDir Directive Username Enumeration	19
75	SMB log in	20
68	Web Server robots.txt Information Disclosure	21
65	IMAP Service Banner Retrieval	22
63	Windows Terminal Services Enabled	23
58	Authentication Failure - Local Checks Not Run	24
56	VNC security types	25
49	scan for UPnP/Tcp hosts	26
43	Microsoft Windows Remote Desktop Protocol Server Private Key Disclosure Vulnerability	27
35	Identd Service Enabled	28
32	Anonymous FTP Enabled	29
29	SSH protocol version 1 enabled	30
28	Identifies services like FTP, SMTP, NNTP...	31
27	TCP timestamps	32
25	Microsoft Windows SMB Shares Access	33
24	DNS Server on UDP and TCP	34
24	SSL Certificate Expiry	35
23	Apache Banner Linux Distribution Disclosure	36
23	ISC BIND 9 AUTHORS Map Remote Version Disclosure	37
22	HTTP TRACE	38
20	Mailman private.py Directory Traversal Vulnerability	39
19	Microsoft IIS Authentication Method Enumeration	40
19	Web Server HTTP Header Internal IP Disclosure	41
18	Obtains the password policy	42
17	Mailman Password Retrieval	43
17	Chargen UDP Service DoS	44
16	SSL Cipher Suites Supported	45
15	Apache < 1.3.31 / 2.0.49 Socket Connection Blocking Race Condition DoS	46
15	Apache < 1.3.29 Multiple Modules Local Overflow	47
13	Squid < 2.5.STABLE8 Multiple Vulnerabilities	48
13	MS Task Scheduler vulnerability	49
13	Private IP address Leaked using the PROPFIND method	50
12	ProFTPD < 1.3.0rc2 Multiple Remote Format Strings	51
12	Horde Parent Frame Page Title XSS	52
12	ProFTPD Login Timing Account Name Enumeration	53
11	PHP Image File Format Denial Of Service Vulnerabilities	54
11	PHP < 4.3.10 / 5.0.3 Multiple Vulnerabilities	55
11	PHP php_variables.c Multiple Variable Open Bracket Memory Disclosure	56
11	Installed Windows Hotfixes	57
11	Web Server Unconfigured - Default Install Page Present	58
11	Web Server Generic Cross-Site Scripting Vulnerability	59
10	Horde Turba Contact Manager common-footer.inc Parent Frame Page Title XSS	60
10	Identify unknown services with GET	61
10	Apache mod_proxy Content-Length Overflow	62
10	Qpopper Username Information Disclosure	63
10	/doc Directory Browsable??	64
9	Apache < 2.2.8 Multiple Vulnerabilities XSS, DoS	65
9	SMB NULL session	66
9	Obtain installed software via SNMP	67
9	IMP common-footer.inc Parent Frame Page Title XSS	68
9	Horde Application Framework Help Window Multiple Parameter XSS	69
9	Horde IMP HTML MIME Viewer Multiple XSS	70
9	Nmap NASL wrapper	71
9	OpenSSL denial of service	72
9	Apache < 1.3.28 Multiple Vulnerabilities DoS, ID	73
9	PHP Mail Function Header Spoofing	74
8	PHP < 5.2.5 Multiple Vulnerabilities	75
8	SSL Weak Cipher Suites Supported	76
8	Web Server Uses Plain Text Authentication Forms	77
8	phpSysInfo < 2.4.1 Multiple Vulnerabilities	78
8	Authenticated Check: OS Name and Installed Package Enumeration	79
8	Apache < 1.3.27 Multiple Vulnerabilities DoS, XSS	80
7	PHP 5 < 5.2.7 Multiple Vulnerabilities	81
7	FTP Supports Clear Text Authentication	82
7	Apache < 2.2.9 Multiple Vulnerabilities DoS, XSS	83
7	Mail relaying thorough test	84
7	Hidden WWW Server Name	85
7	ICMP Netmask Request Information Disclosure	86
6	Apache mod_proxy_ftp Directory Component Wildcard Character Globbing XSS	87
6	PHP < 5.2.4 Multiple Vulnerabilities	88
6	PHP < 5.2.3 Multiple Vulnerabilities	89
6	Vulnerability in SMB Could Allow Remote Code Execution 896422 - Network Check	90
6	Detect Apache HTTPS	91
6	Horde IMP with MSIE MIME Viewer E-mail Message XSS	92
6	mod_ssl hook functions format string vulnerability	93
6	IMP Content-Type Header XSS	94
6	mod_ssl SSL_Util_UUEncode_Binary Overflow	95
6	TCP sequence number approximation	96
6	Apache2 double slash dir index	97
6	Microsoft IIS 404 Response Service Pack Signature	98
6	Horde IMP IMP_MIME_Viewer_html Class XSS	99
6	Portable OpenSSH PAM timing attack	100

Les derniers commentaires publiés sur SecuObs (6-25):

- Vidéo : P. Kleissner Stoned Bootkit preview, full at BH 09 Las Vegas - SSTIC 2009 Challenge vs Metasm - Vidéo : Password cracking with L0phtcrack 6 - DLL injection by modifying an executable file - reverse shell from SQLi with 1 HTTP request, no extra channel to upload initial - Hackers crack ColdFusion - Vidéo : Hiding Files with NTFS Alternative Data Streams - Whitepaper Understanding and using RFID - phpMyAdmin exploited in masses - Update: PyLoris 1.8 - ESRT @dougburks - Richard Bejtlich's Wireshark 12 Tutorial - ESRT @Carlos_Perez @joswr1ght WPA2-PSK cracker Cowpatty 46 with less teh suck - ESRT @dougburks Synjunkie on DNS BackTrack 4 tools Fierce and DNSRecon - Draft 2 of OVAL Version 5.6 Now Available - Microsoft Gazelle browser : A layperson explanation - ESRT @bytz @developerworks Analysis Tool for Java data race and deadlock connect - ESRT @bytz @unixmen New Kernel Vulnerabilities Affect Ubuntu 6.06, 8.04 and 8.10 - ModSecurity Denial of Service - OpenFlow 0.9.0 RC1 has been released - ESRT @davegball Tool to detect Metasploit Meterpreter anti-forensics tactics Les cinq derniers commentaires publiés sur SecuObs Tous les commentaires publiés sur SecuObs avant les 25 derniers

SecuToolBox :

Bluetooth Stack Smasher v0.6 / Bluetooth Stack Smasher v0.8 / Slides Bluetooth Eurosec 2006 / Exposé vidéo Windows Shellcode - Kostya Kortchinsky / Exposé audio Reverse Engineering - Nicolas Brulez / Exposé vidéo Securitech - Pierre Betouin / WEP aircrack + Ubiquiti (MadWifi) 300 mW + Yagi / Secure WIFI WPA + EAP-TLS + Freeradius / Audit Windows / Captive Password Windows / USBDumper / USBDumper 2 / Hacking Hardware / WishMaster backdoor / DNS Auditing Tool / Ettercap SSL MITM / Exploit vulnérabilités Windows / Memory Dumper Kernel Hardening / Reverse Engineering / Scapy / SecUbuLIVE CD / Metasploit / eEye Blink Sec Center / eEye Retina Scanner + d'outils / + de tutoriels

Mini-Tagwall des articles publiés sur SecuObs :

sécurité, windows, exploit, microsoft, réseau, attaque, vulnérabilité, système, audit, outil, virus, internet, données, linux, présentation, bluetooth, vista, metasploit, protocol, shell, scanner, réseaux, trames, téléphone, paquet, wishmaster, rootkit, engineering, sysun, https, black, mobile, noyau, téléphones, conférence, mémoire, source, scapy, google, reverse, détection, malveillant, snort, sécurise, patch + de mots clés avec l'annuaire des articles publiés sur SecuObs

Archives Failles Secunia :

- SA35687 Gentoo update for mod_security - SA35686 Gentoo update for libwmf - SA35699 Red Hat update for ruby - SA35697 Red Hat update for pidgin - SA35688 Ubuntu update for nagios2 and nagios3 + d'archives failles avec Secunia et SecuMail

Archives Mailing Full Disclosure :

- Full-disclosure Cisco Security Advisory: Vulnerabilities in Cisco Video Surveillance Products - Full-disclosure Cisco Security Advisory: Cisco Physical Access Gateway Denial of Service Vulnerability - Full-disclosure Cisco Security Advisory: Cisco Unified Communications Manager IP Phone Personal Address Book Synchronizer Privilege Escalation Vulnerability - Full-disclosure Cisco Security Advisory: Cisco Unified MeetingPlace Web Conferencing Authentication Bypass Vulnerability - Full-disclosure SSANZ - Server Systems Administration NZ. + d'archives Full Disclosure avec SecuMail

Archives Mailing Bugtraq :

- Cisco Security Advisory: Vulnerabilities in Cisco Video Surveillance Products - Cisco Security Advisory: Cisco Physical Access Gateway Denial of Service Vulnerability - Cisco Security Advisory: Cisco Unified Communications Manager IP Phone Personal Address Book Synchronizer Privilege Escalation Vulnerability - Cisco Security Advisory: Cisco Unified MeetingPlace Web Conferencing Authentication Bypass Vulnerability - Re: Cross-Site Scripting vulnerabilities in Mozilla, Internet Explorer, Opera and Chrome - SECURITY DSA 1825-1 New nagios2/nagios3 packages fix arbitrary code execution + d'archives Bugtraq avec SecuMail

Mini-Tagwall de l'annuaire video :

virus, spyware, vmware, firmware, security, malware, lockpicking, biometric, kernel, iphone, windows, adware, password, wimax, botnet, tutorial, phish, linux, symantec, rootkit, knoppix, metasploit, network, attack, server, virtual, internet, jailbreak, notacon, conference, exploit, google, wireshark, defcon, hacker, backtrack, openbsd, intel, ettercap, firewall, source, samsung, reprap, wireless, norton + de mots clés avec l'annuaire des videos

Mini-Tagwall des articles de la revue de presse :

security, microsoft, vulnérabilité, windows, vulnerability, network, attack, google, hacker, exploit, inject, internet, remote, server, mobile, malware, apple, iphone, black, patch, sécurité, virus, linux, ebook, conficker, crypt, source, intel, virtual, facebook, access, trojan, twitter, research, firefox, overflow, pirate, phish, vista, cisco, obama, office, local, opera, adobe + de mots clés avec l'annuaire de la revue de presse

Mini-Tagwall des Tweets de la revue Twitter :

security, cisco, linux, defcon, firewall, vmware, metasploit, attack, server, phish, network, twitter, windows, exploit, nessus, backtrack, botnet, inject, crypt, wireshark, vulnerabi, python, acking, iphone, black, source, engineering, google, conficker, social, clouds, vulnerability, podcast, patch, virus, pentest, juniper, hacker, apple, client, proxy, virtual, complianc, apache, javascript + de mots clés avec l'annuaire de la revue Twitter