Youtube

YouTube is a video-sharing website headquartered in San Bruno, California, United States. The service was created by three former PayPal employees in February 2005. In November 2006, it was bought by Google for US$1.65 billion. YouTube now operates as one of Google’s subsidiaries. The site allows users to upload, view, and share videos, and it makes use of WebM, H.264, and Adobe Flash Video technology to display a wide variety of user-generated and corporate media video. Available content includes video clips, TV clips, music videos, and other content such as video blogging, short original videos, and educational videos.

Joomla Administrator

Joomla Administrator

 

As a website administrator you might be concerned about the visual appearance of a website but will pass responsibility for making changes and improvements to a web designer. Similarly, when changes to functionality are required you will contract a web developer to do the necessary work. As a website administrator you are responsible for the day-to-day operation and maintenance of the website. Activities might include ensuring that the site is properly backed up; managing user access; possibly installing extensions. You will also have responsibility for maintaining the security of the website.

 

 

Share this post from Rbcafe :
Share on FacebookTweet about this on TwitterPin on PinterestShare on Google+Share on LinkedInEmail this to someoneShare on RedditBuffer this page

Bitrix Admin

Bitrix Admin

 

Bitrix Site Manager is the core on which you can build any complex web projects. With Bitrix Site Manager, you do not need any special programming or web design knowledge and skills. Bitrix Site Manager installs to the root directory of a remote server. An administrator can manage sites via the web interface. To function properly, the server configuration should meet the following minimum requirements:

  • Apache web server version 1.3 or higher;
  • PHP version 5.0.0 or higher;
  • MySQL version 4.1.11 or higher / Oracle 10g or MSSQL 2000 or higher;
  • 10 Mb of free disk space (for the Update System).

 

 

Share this post from Rbcafe :
Share on FacebookTweet about this on TwitterPin on PinterestShare on Google+Share on LinkedInEmail this to someoneShare on RedditBuffer this page

iOS Mail app

iOS’s Mail app

 

Demonstration of proof-of-concept attack on iOS’s Mail app. Apple was notified about technical details of this vulnerability on 2015-01-15

 

The source of this iOS’s Mail app exploit was posted here : https://github.com/jansoucek/iOS-Mail.app-inject-kit

 

iOS 8.3 Mail.app inject kit

Back in January 2015 I stumbled upon a bug in iOS’s mail client, resulting in HTML tag in e-mail messages not being ignored. This bug allows remote HTML content to be loaded, replacing the content of the original e-mail message. JavaScript is disabled in this UIWebView, but it is still possible to build a functional password “collector” using simple HTML and CSS.

It was filed under Radar #19479280 back in January, but the fix was not delivered in any of the iOS updates following 8.1.2. Therefore I decided to publish the proof of concept code here.

Update 2015-06-30:

The exploit got a nice CVE-2015-3710 sticker and was fixed by Apple in iOS 8.4 and OS X 10.10.4. Kudos to Apple for prompt response once it was published publicly.

Usage

  • Edit the e-mail address you would like to use for password collection in framework.php
  • Upload index.php, framework.php and mydata.txt to your server
  • Send an e-mail containing HTML code from e-mail.html to the research subject
  • Don’t forget to change the modal-username GET parameter value to the e-mail address of the recipient
  • You can use https://putsmail.com for testing purposes

Credits

Framework7: Vladimir Kharlampidi (http://www.idangero.us/framework7/) – Framework7’s CSS code was used for the login dialog styling

License

MIT

Notes

The code detects that the research subject has already visited the page in the past (using cookies) and it stops displaying the password prompt to reduce suspicion.

The e-mail address and password are submitted via GET to framework.php, which then saves them to the mydata.txt file, sends them out via e-mail to the specified “collector” e-mail address and then returns the research subject back to Mail.app using redirect to message://dummy.

The password field has autofocus enabled. We then use focus detection to hide the login dialog once the password field loses its focus (e.g. after the subject clicks on OK and submits the password). Why even bother with this redirect nonsense when you can put <form> directly inside the HTML e-mail?

 

Share this post from Rbcafe :
Share on FacebookTweet about this on TwitterPin on PinterestShare on Google+Share on LinkedInEmail this to someoneShare on RedditBuffer this page
Página 1 de 512345
Rbcafe © 2004- | Rb Cafe 1.3 | Contacto Rbcafe | Rbcafe en Twitter | Rbcafe en Facebook | Política de privacidad