+- Hack Forums (https://hackforums.net)
+-- Forum: Hacks, Exploits, and Various Discussions (https://hackforums.net/forumdisplay.php?fid=45)
+--- Forum: Grayhat • Purple Team • Hybrid Security (https://hackforums.net/forumdisplay.php?fid=449)
+---- Forum: Website Hacking (https://hackforums.net/forumdisplay.php?fid=43)
+---- Thread: O'boy look at dis beautiful .gov coldfusion vuln! (/showthread.php?tid=3558276)
Pages: Pages
1
2
* - Pendragon - Jun 17, 2013
(Jun 17, 2013 02:11 PM)lordsql Wrote: Wow this forum post turned into idiocy. .gov websites are not anything to be proud of on Hf these days nor do people get any props for finding them, so i just posted the vuln.
It isn't vulnerable, that's the problem.
(Jun 17, 2013 02:13 PM)Andrew Downsend Wrote: Thanks for the vuln, exploited with no issues. Good job OP.
Lie.
(Jun 17, 2013 02:30 PM)The Fail Collective Wrote: Are you sure? I mean... are you really sure?
Seems like it's not vuln to RFD
I hope you're trolling.
* - Flaaffy - Jun 17, 2013
".gov websites are not anything to be proud of on Hf these days nor do people get any props for finding them"
so if you know people get no props for finding them then why would you post it here, move on -.-
also @ versace , did I say he should impress me? no i said, then i would be impressed. dont be such a mentresual dick
* - The Fail Collective - Jun 17, 2013
(Jun 17, 2013 02:34 PM)Pendragon Wrote: I hope you're trolling.
What do you mean you hope I'm trolling?
* - Becky G - Jun 17, 2013
@Packet, i was just giving a freebie, not sure why everyone started flaming. And my title was of a joking matter if that's what it's over.
* - Pendragon - Jun 17, 2013
If you say that this is actually vulnerable, and extremely easy to exploit, why not provide a PoC to prove us all wrong? Something like this would suffice: http://turf.unl.edu/CFIDE/skad.txt
* - Becky G - Jun 17, 2013
Nice, I've been trying to find a good tutorial on CF9, can't find one.
* - amus3d - Jun 17, 2013
(Jun 17, 2013 01:53 PM)MiRP_Anon Wrote: You found a login page? Congrats /sarcasm
yes, a login page that is, well running a patched version but unpatched is obvs, vuln to an old exploit - it shows it is CF v8 aka one of the vuln versions.
(Jun 17, 2013 01:57 PM)Vitanis Mate Wrote: Then do it? It's not impressive unless you actually exploit it.
it still wouldnt be impressive even if he exploited it.
(Jun 17, 2013 02:01 PM)PacketMaster Wrote: Thanks for the vuln .gov!
okay. have an unrefined google dork for a lot of govs that run CF either patched or already hacked by kids, like yourself:
inurl:.gov ext:cfm
(Jun 17, 2013 03:05 PM)lordsql Wrote: Nice, I've been trying to find a good tutorial on CF9, can't find one.
0dayz.
big hecks, no whammies,
amus3d.
* - Becky G - Jun 17, 2013
Amus3d sums it up once again. u da best.
congratz on 3,333 posts.
* - Sylvester - Jun 17, 2013
A. fucking. Mazing!! You found a god damn motha fucking Admin login page -.- Woow.
* - Flaaffy - Jun 17, 2013
(Jun 17, 2013 04:26 PM)amus3d Wrote: yes, a login page that is, well running a patched version but unpatched is obvs, vuln to an old exploit - it shows it is CF v8 aka one of the vuln versions.
it still wouldnt be impressive even if he exploited it.
okay. have an unrefined google dork for a lot of govs that run CF either patched or already hacked by kids, like yourself:
inurl:.gov ext:cfm
0dayz.
big hecks, no whammies,
amus3d.
Mmm becuase in my post I blatantly said that in a non sarcastic tone, quote the rest of my post asshole. I don't even hack that much nowdays, to busy