Last week, Larry Suto published a report entitled “Accuracy and Time Costs of Web Application Security Scanner Report”.  I’ve started to investigate in detail the results from this report. And I’ve found a list of inaccuracies. Here is a direct quote from his paper: Methodology…
e107 CMS system website compromised
As part of my job here at Invicti, from time to time I analyze source code looking for security problems. Using this information I adjust Invicti WVS to detect these problems automatically (when it’s possible). Monday, I downloaded e107 from e107.org and started analyzing the…
Security is hard
The year debuted with ‘Operation Aurora‘: Google and over 30 other companies were hit by a spear phishing attack which resulted in theft of intellectual property from Google and probably other companies. Spear phishing is a targeted form of phishing in which an e-mail message might look…
AcuSensor, curl and Zen Cart
Recently we’ve released a new build, build number 20091124. This build includes a new AcuSensor check named “curl_exec() url is controlled by user”. This new check will verify if the user can control the URL passed to curl_exec. In case you are not familiar with curl, below is…
Changes coming to the OWASP Top 10 in 2010
In the spirit of improving Web application security worldwide the folks at OWASP have released the OWASP Top 10 2010 ârelease candidateâ. Itâs currently open for comments and scheduled for final release the first quarter of next year. The biggest change youâll see in this…
PHP "multipart/form-data" denial of service
PHP version 5.3.1 was just released. This release contains a patch for a denial of service condition we’ve reported some time ago. The problem is related with PHP’s handling of RFC 1867 (Form-based File Upload in HTML). When you send a POST request to a…
US Air Force uses Invicti WVS to identify and mitigate web application vulnerabilities
The US Air Forceâs mission is to fly, fight and win⌠in air, space and Cyberspace. US Air Force has an elite force defending people from millions of cyber attacks every day in their newest battlefield; Cyberspace. In a battle field, youâre always a target,…
Looking back at 2009 through SQL Injection goggles
The earliest public mention I could find of SQL Injection (âpiggybacking SQL statementsâ as the author put it) was from someone who called himself Rain Forest Puppy (RFP). In 1998 RFP wrote an article for Phrack Magazine (Volume 9, Issue 54) in which he talks…
CubeCart 4 session management bypass leads to administrator access
Release Date: 2009/10/29 Author: Bogdan Calin (bogdan [at] acunetix [dot] com) Severity: Critical Vendor Status: Vendor has released an updated version Release Date : 2009/10/29 Author : Bogdan Calin (bogdan [at] acunetix [dot] com) Severity : Critical Vendor Status : Vendor has released an updated…