+- Hack Forums (https://hackforums.net)
+-- Forum: Hacks, Exploits, and Various Discussions (https://hackforums.net/forumdisplay.php?fid=45)
+--- Forum: Grayhat • Purple Team • Hybrid Security (https://hackforums.net/forumdisplay.php?fid=449)
+---- Forum: Website Hacking (https://hackforums.net/forumdisplay.php?fid=43)
+---- Thread: O'boy look at dis beautiful .gov coldfusion vuln! (/showthread.php?tid=3558276)
Pages: Pages
1
2
O'boy look at dis beautiful .gov coldfusion vuln! - Becky G - Jun 17, 2013
https://www.newbedford-ma.gov/CFIDE/administrator/enter.cfm
* - MiRP_Anon - Jun 17, 2013
You found a login page? Congrats /sarcasm
* - Becky G - Jun 17, 2013
It's coldfusion 8 you have a 30 second time frame to take the salt and password encrypt it to HMAC and then use it to log into the panel, jackass.
* - Cognitive - Jun 17, 2013
(Jun 17, 2013 01:56 PM)lordsql Wrote: It's coldfusion 8 you have a 30 second time frame to take the salt and password encrypt it to HMAC and then use it to log into the panel, jackass.
Then do it? It's not impressive unless you actually exploit it.
* - Becky G - Jun 17, 2013
I gave it away, and cold fusion is not very impressive. If you guys literally can't figure it out then i think you guys are half minded, I was expecting a "Thanks for the vuln .gov" or something. And i can't just give a login for it because the vuln changes every 30 seconds to a different HMAC.
For people who have no clue what is even going on or that need a guide for this for some reason... http://www.blackhatlibrary.net/Coldfusion_hacking
* - Flaaffy - Jun 17, 2013
Thanks for the vuln .gov!
but guess what, i dont give a shit! find a vulnerabillity in cisco and then i will be impressed!
* - Cognitive - Jun 17, 2013
(Jun 17, 2013 01:59 PM)lordsql Wrote: I gave it away, and cold fusion is not very impressive. If you guys literally can't figure it out then i think you guys are half minded, I was expecting a "Thanks for the vuln .gov" or something. And i can't just give a login for it because the vuln changes every 30 seconds to a different HMAC.
For people who have no clue what is even going on or that need a guide for this for some reason... http://www.blackhatlibrary.net/Coldfusion_hacking
Never said I didn't understand the vulnerability. I'm saying how come you don't exploit it yourself, and show you did it? It's one thing to find vulnerabilities, but another to exploit them.
* - Becky G - Jun 17, 2013
1. I don't post what I do because i don't post stuff to you guys of what I do because no one needs to know what I do
2. This was a freebie for you guys
You guys try to defend yourselves so much when the only person that i had anger directed towards was MiRP. I didn't post this the rip on Hf, and you guys are just anger posting as if I was directing my post towards you.
* - Han. - Jun 17, 2013
By the way you're dodging it and changing the subject, you're clearly not able to exploit it.
* - Pendragon - Jun 17, 2013
(Jun 17, 2013 02:03 PM)Vitanis Mate Wrote: Never said I didn't understand the vulnerability. I'm saying how come you don't exploit it yourself, and show you did it? It's one thing to find vulnerabilities, but another to exploit them.
He didn't exploit it and "gave it away" because it's patched. He can't exploit it.
Adobe has released patches for everything < CF9 regarding the LFD in the login panel.
* - Becky G - Jun 17, 2013
Wow this forum post turned into idiocy. .gov websites are not anything to be proud of on Hf these days nor do people get any props for finding them, so i just posted the vuln.
* - Andrew Downsend - Jun 17, 2013
Thanks for the vuln, exploited with no issues. Good job OP.
* - Becky G - Jun 17, 2013
Np. I just don't see why people went crazy over this easy vuln.
* - The Fail Collective - Jun 17, 2013
(Jun 17, 2013 02:13 PM)Andrew Downsend Wrote: Thanks for the vuln, exploited with no issues. Good job OP.
Are you sure? I mean... are you really sure?
Seems like it's not vuln to RFD
* - Kavalli † - Jun 17, 2013
(Jun 17, 2013 02:01 PM)PacketMaster Wrote: Thanks for the vuln .gov!
but guess what, i dont give a shit! find a vulnerabillity in cisco and then i will be impressed!
Why the fuck would he try to impress YOU?