SecurityFocus

Re: Linksys WRT54 GL - Session riding (CSRF) Jan 11 2008 10:54AM
Florian Weimer (fw deneb enyo de) (1 replies)

RE: Linksys WRT54 GL - Session riding (CSRF) Jan 14 2008 07:20AM
Tomaz (tomaz bratusa teamintell com) (2 replies)

Re: Linksys WRT54 GL - Session riding (CSRF) Jan 14 2008 06:58PM
Jan Heisterkamp (janheisterkamp web de) (1 replies)

Re: Linksys WRT54 GL - Session riding (CSRF) Jan 15 2008 06:14PM
Valdis Kletnieks vt edu

Re: Linksys WRT54 GL - Session riding (CSRF) Jan 14 2008 05:31PM
J. Oquendo (sil infiltrated net)

> | Isn't your exploit somewhat complicated? Just put
> |
> | <img
> src="http://192.0.2.1/level/15/configure/-/enable/secret/mypassword"/>
> |
> | on a web page, and trick the victim to visit it while he or she is
> | logged into the Cisco router at 192.0.2.1 over HTTP. This has been
> | dubbed "Cross-Site Request Forgery" a couple of years ago, but the
> | authors of RFC 2109 were already aware of it in 1997.

With an swf file using php one wouldn't need to trick someone entirely,
just hope they don't have a pop up blocker

http://www.infiltrated.net/nojava.pimp

--
====================================================
J. Oquendo

SGFA #579 (FW+VPN v4.1)
SGFE #574 (FW+VPN v4.1)

wget -qO - www.infiltrated.net/sig|perl

http://pgp.mit.edu:11371/pks/lookup?op=get&search=0xF684C42E

0? *?H?÷
?0?10 +0? *?H?÷
?0??0?r 'ôêôz?Än»n©0
*?H?÷
0o10 USE10U
AddTrust AB1&0$UAddTrust External TTP Network1"0 UAddTrust External CA Root0
050607080910Z
200530104838Z0®10 UUS10 UUT10USalt Lake City10U
The USERTRUST Network1!0Uhttp://www.usertrust.com1604U-UTN-USERFirst-Clien
t Authentication and Email0?"0
*?H?÷
?0?
?²9?¤ò}«A;bF7®ÍÁ`u¼9eùJG¢¹ÌHÌj?ÕM5¹¤BåÎIâ?/|Ò1ÇN´?d.)Õ¢dÄ?½?Q5y¤
Nh{z¤?¨ò?ò?ÌÉ¤2?»O0½? ?ån¢Fúx¼¢o«Y^¥/ÏÊÚmª/ë¬¡³jª·.g5?yái?âæFÍ ¥ê¾Îv:z?êüÚ'[=s"æHaÆ
Lói±¨.¶Ô1 ,¼???¤¥×?CüZ¯q×YÚº?
¯úóáÂð¤Åg?ÖÖT:Þ
¤ºw³eÈýÓtbªÊh?¡?~õGeËøMW(tÒ4ÿ0¶îöb0?,ë£á0Þ0U#0?½?z4´
&÷úÄ&Tï½à$ËT0U??g}Ä&pK´PH|Þ=®n}0Uÿ0Uÿ
0ÿ0{Ut0r08 6 4?2http://crl.comodoca.com/AddTrustExternalCARoot.c
rl06 4 2?0http://crl.comodo.net/AddTrustExternalCARoot.crl0
*?H?÷
?Ø?o(¬¦¢ç?Á?Û~¡ýóâð©?TBk? Ä m×?fyCqüøo¯ÛvEâ7=ÝäYx¬ô?FózÏ[?r-åFÁº)óËIy?<ºm¤mhOr6¨¹±ý¿Ï
ð¤j?5PÏmU±ÝY0Jßm ?dI|ï6»ôãiôø9ZK?:·íÓÏ
D¢û¿ä/p?%ûZT³ÐÄ¼mûs2,é??$-Ö?zhP?MéÌõ»gèÜ.;üNÍþ?ã¨
¥&DeéòMR§®Ü>Êk2\Alþõ] êÿÑú??Xm=?Gåþ.?ÂÌ?¡ò»0?;0?# Çêæ¦yâ²?ó
ójWÀ0
*?H?÷
0®10 UUS10 UUT10USalt Lake City10U
The USERTRUST Network1!0Uhttp://www.usertrust.com1604U-UTN-USERFirst-Clien
t Authentication and Email0
071009000000Z
081008235959Z0Ù1503U,Comodo Trust Network - PERSONA NOT VALIDATED1F0DU=Terms and Conditions of use: http://www.comodo.net/repository10U(c)2003 Comodo Limited10U
J. Oquendo1"0 *?H?÷
sil (at) infiltrated (dot) net0 [email concealed]?"0
*?H?÷
?0?
?¼Î?ÁL{ÐocÂùfÄ5j?¼lRë*ZpâA5&ØÇ*z??¤u?¤d_±mAV,p!2
Ã1àE]£ O,'ÈÖd©µØå¹A!ñj?+*n»X®6á³¦T¯VMk?Wm»[Y¥í+a¥KÍv§ËÌ½~,/rVÁ*?µ?L¬þëäl¾
??¹Ú¡|´,Â³fyýQÅá.Z±<?âêgöÎË_?- =´Ú?}×D?1?_°¼S?ª¦3Q
¹¸«Æ£Í?iWOÕáXæ?¹«8æíÙ`¼§õ#Fæ?µé;.|.ÎOR`?tH?£?%0?!0U
#0???g}Ä&pK´PH|Þ=®n}0UÏN#ÍÙ?jÉË/º:Ã?ðd]x0Uÿ
0Uÿ00 U%0++²10 `?H?øB 0FU ?0=0;+²10+0)+https://secure.comodo.net/CPS0¥U0?0
L J H?Fhttp://crl.comodoca.com/UTN-USERFirst-ClientAuthenticationandEmai
l.crl0J H F?Dhttp://crl.comodo.net/UTN-USERFirst-ClientAuthenticationand
Email.crl0|+p0n06+0?*http://crt.comodoca.com/UTNAAACli
entCA.crt04+0?(http://crt.comodo.net/UTNAAAClientCA.crt0U
0sil (at) infiltrated (dot) net0 [email concealed]
*?H?÷
?¿¦ÃÆ3GL§7
x4?ÞõE"`¡Èw?R!gµE]nËÙLíh¹uOÒö%?Ùdâ??ÚJ¼(WnZ?·×Naëù+1( qiÔªE
ûOµ <a( k?á¢loq[éô?uZ´gÊË³ -0ïZÅÛZ$HQØ<??ÐæêaMiB?,P½ fu©ZðØëaùv%IÀ8???¤_AÀ@_Õõãè(
ÿqÁ#mñÔ¯?÷,!?"¡??®é£2rañgúf Ö>ú??.R=Äi~ëä¤V#?ÉTpcê£°$ ??taupNt¬& ïfÎh??rZøÌ ?0?;0?# Çêæ¦yâ²?óójWÀ0
*?H?÷
0®10 UUS10 UUT10USalt Lake City10U
The USERTRUST Network1!0Uhttp://www.usertrust.com1604U-UTN-USERFirst-Clien
t Authentication and Email0
071009000000Z
081008235959Z0Ù1503U,Comodo Trust Network - PERSONA NOT VALIDATED1F0DU=Terms and Conditions of use: http://www.comodo.net/repository10U(c)2003 Comodo Limited10U
J. Oquendo1"0 *?H?÷
sil (at) infiltrated (dot) net0 [email concealed]?"0
*?H?÷
?0?
?¼Î?ÁL{ÐocÂùfÄ5j?¼lRë*ZpâA5&ØÇ*z??¤u?¤d_±mAV,p!2
Ã1àE]£ O,'ÈÖd©µØå¹A!ñj?+*n»X®6á³¦T¯VMk?Wm»[Y¥í+a¥KÍv§ËÌ½~,/rVÁ*?µ?L¬þëäl¾
??¹Ú¡|´,Â³fyýQÅá.Z±<?âêgöÎË_?- =´Ú?}×D?1?_°¼S?ª¦3Q
¹¸«Æ£Í?iWOÕáXæ?¹«8æíÙ`¼§õ#Fæ?µé;.|.ÎOR`?tH?£?%0?!0U
#0???g}Ä&pK´PH|Þ=®n}0UÏN#ÍÙ?jÉË/º:Ã?ðd]x0Uÿ
0Uÿ00 U%0++²10 `?H?øB 0FU ?0=0;+²10+0)+https://secure.comodo.net/CPS0¥U0?0
L J H?Fhttp://crl.comodoca.com/UTN-USERFirst-ClientAuthenticationandEmai
l.crl0J H F?Dhttp://crl.comodo.net/UTN-USERFirst-ClientAuthenticationand
Email.crl0|+p0n06+0?*http://crt.comodoca.com/UTNAAACli
entCA.crt04+0?(http://crt.comodo.net/UTNAAAClientCA.crt0U
0sil (at) infiltrated (dot) net0 [email concealed]
*?H?÷
?¿¦ÃÆ3GL§7
x4?ÞõE"`¡Èw?R!gµE]nËÙLíh¹uOÒö%?Ùdâ??ÚJ¼(WnZ?·×Naëù+1( qiÔªE
ûOµ <a( k?á¢loq[éô?uZ´gÊË³ -0ïZÅÛZ$HQØ<??ÐæêaMiB?,P½ fu©ZðØëaùv%IÀ8???¤_AÀ@_Õõãè(
ÿqÁ#mñÔ¯?÷,!?"¡??®é£2rañgúf Ö>ú??.R=Äi~ëä¤V#?ÉTpcê£°$ ??taupNt¬& ïfÎh??rZøÌ ?1?S0?O0Ä0®10 UUS10 UUT10USalt Lake City10U
The USERTRUST Network1!0Uhttp://www.usertrust.com1604U-UTN-USERFirst-Clien
t Authentication and EmailÇêæ¦yâ²?óójWÀ0 + ?c0 *?H?÷
1 *?H?÷
0 *?H?÷
1
080114173141Z0# *?H?÷
1?³óüí?7¢éi+??_Û0Èì0R *?H?÷
1E0C0
*?H?÷
0*?H?÷
?0
*?H?÷
@0+0
*?H?÷
(0Õ +?71Ç0Ä0®10 UUS10 UUT10USalt Lake City10U
The USERTRUST Network1!0Uhttp://www.usertrust.com1604U-UTN-USERFirst-Clien
t Authentication and EmailÇêæ¦yâ²?óójWÀ0×*?H?÷
1Ç Ä0®10 UUS10 UUT10USalt Lake City10U
The USERTRUST Network1!0Uhttp://www.usertrust.com1604U-UTN-USERFirst-Clien
t Authentication and EmailÇêæ¦yâ²?óójWÀ0
*?H?÷
?¥MùVá¾BB?)Éa?0·?O)?spnû
Âs#xtû:d?ÿM`?ðºlý_})Z:à?ÁÑyè?|=??m1buf¢Ã/ãtM×Ü¨?tDR¸¼?r´<¢\;0cÚ??
¦>ð6á)µìB\1ß?cR+f|¼WÓ¹u£ª?B?ª?óìvI>´?d3?Ïf+ÅýæH¤·åþ??ØFõ¥ÔN¯?©?ËåÐ
F×¤Ú7ù.CüQA?oH@î©¦ãÝ±r'Ev8DüD9ß[sþÉQ2ñnÇJãñüh6hÞ~¨?TÏ\Þ^¹É8V?j
&~©ûXzFÉ©jÃ

[ reply ]

Re: Linksys WRT54 GL - Session riding (CSRF) Jan 07 2008 07:42PM
Jan Heisterkamp (janheisterkamp web de)

Re: Linksys WRT54 GL - Session riding (CSRF) Jan 07 2008 07:19PM
Jan Heisterkamp (janheisterkamp web de)