PlugBot Research Project
We are pleased to announce the launch of a new research project called The PlugBot, led by RedTeam Security penetration tester and security researcher Jeremiah Talamantes.
PlugBot is a patent-pending hardware bot. It's a covert penetration testing device designed for use during physical penetration tests by professional penetration testers. PlugBot is a tiny computer the size of a power adapter; this small size allows it to go physically undetected whereby reducing face-to-face social engineering interaction and greatly lessening the chance for detection. All the while, the PlugBot is powerful enough to covertly scan, collect and ...
RedTeam Discovers CSRF in PHPWCMS
RedTeam Discovers Cross Site Request Forgery vulnerability in PHPWCMS
Jeremiah Talamantes, Principal Security Consultant and Security Researcher at RedTeam, has discovered a cross-site request forgery vulnerability in PHPWCMS version 1.4.5. The security vulnerability in the open source content management system revolves around a lack of security controls around input validation.
The CSRF vulnerability in PHPWCMS could be exploited to conduct cross-site request forgery attacks. This issue is caused due to input validation errors in the administrative interface when processing HTTP requests, which could be exploited by attac...
RedTeam Discovers CSRF in FrogCMS
RedTeam Discovers Cross Site Request Forgery vulnerability in Frog CMS
Jeremiah Talamantes, Principal Security Consultant and Security Researcher at RedTeam, has discovered a cross-site request forgery vulnerability in FrogCMS version 0.9.5. The security vulnerability in the open source content management system revolves around a lack of security controls that check for CSRF attempts. An attacker can execute a CSRF attack by enticing an authenticated user to visit a malicious website (via phishing attack) causing the default header Snippet to be overwritten with arbitrary code.
Jeremiah has developed proof of concept code ...
RedTeam Labs Awarded CVE-2010-2028
We are pleased to announce that a vulnerability discovered by RedTeam Labs was awarded a CVE just recently (CVE-2010-2028). We feel that not only does this demonstrate the security expertise of our team, but it also demonstrates our commitment to contributing to the security community through research.
As further contribution to the security community, we've ported the proof of concept code to the Metasploit framework. Click here for the Metasploit proof of concept code.
About CVE
The Common Vulnerabilities and Exposures or CVE system pr...
RedTeam in @RISK Bulletin by SANS
This weekend we were pleased to see three of four security vulnerabilities that RedTeam security researcher (Jeremiah Talamantes) discovered this month were published in the @RISK Security Bulletin by SANS and Qualys. The vulnerabilities included:
* TYPSoft DELE Command DoS
* File Thingie File Security Bypass
* SmallFTPD RETR Command DoS
Thank you SANS and Qualys!
About @RISK
@RISK is the SANS community's consensus bulletin summarizing the most important vulnerabilities and exploits identified during the past week and providing guidance on appropriate actions to protect your syste...
Categories
Contact Us
Phone number:
1-612-234-7848
E-mail: