<?xml version="1.0" encoding="UTF-8"?>
<!-- generator="wordpress" -->
<rss version="2.0" 
	xmlns:content="http://purl.org/rss/1.0/modules/content/"
	xmlns:wfw="http://wellformedweb.org/CommentAPI/"
	xmlns:dc="http://purl.org/dc/elements/1.1/"
	>

<channel>
	<title>Metaeye Security Group</title>
	<link>http://www.metaeye.org</link>
	<description>Metamorphic Security</description>
	<pubDate>Mon, 14 Jan 2008 14:28:29 +0000</pubDate>
	<generator>http://wordpress.org/</generator>
	<language>en</language>
			<item>
		<title>SQID - SQL Injection Digger.</title>
		<link>http://www.metaeye.org/projects/29</link>
		<comments>http://www.metaeye.org/projects/29#comments</comments>
		<pubDate>Mon, 14 Jan 2008 13:25:44 +0000</pubDate>
		<dc:creator>msg</dc:creator>
		
	<category>projects</category>
		<guid isPermaLink="false">http://www.metaeye.org/projects/29</guid>
		<description><![CDATA[SQL injection digger is a command line program that looks for SQL injections and
common errors in web sites. Current version can perform the following operations:
    * Look for SQL injections and common errors in web site URLs found by performing
       a google search.
    [...]]]></description>
		<wfw:commentRSS>http://www.metaeye.org/projects/29/feed/</wfw:commentRSS>
		</item>
		<item>
		<title>Unrar for Linux Denial Of Service vulnerability.</title>
		<link>http://www.metaeye.org/advisories/55</link>
		<comments>http://www.metaeye.org/advisories/55#comments</comments>
		<pubDate>Wed, 11 Jul 2007 23:09:52 +0000</pubDate>
		<dc:creator>msg</dc:creator>
		
	<category>advisories</category>
		<guid isPermaLink="false">http://www.metaeye.org/blog/55</guid>
		<description><![CDATA[Vendor: RARLABS (http://www.rarlabs.com)
Product: Unrar for linux (freeware).
Versions affected: All upto 3.70 beta 4
Severity: Moderate
Issue
The unrar for Linux results in crash due to processing of standard filters in RAR VM, while
processing a special crafted compressed RAR file. This happens only while extracting the
contents from the compressed file.
Impact
Any programs/softwares using the code from unrar for Linux from [...]]]></description>
		<wfw:commentRSS>http://www.metaeye.org/advisories/55/feed/</wfw:commentRSS>
		</item>
		<item>
		<title>Clam AntiVirus RAR File Handling  Denial Of Service Vulnerability.</title>
		<link>http://www.metaeye.org/advisories/54</link>
		<comments>http://www.metaeye.org/advisories/54#comments</comments>
		<pubDate>Wed, 11 Jul 2007 15:04:37 +0000</pubDate>
		<dc:creator>msg</dc:creator>
		
	<category>advisories</category>
		<guid isPermaLink="false">http://www.metaeye.org/advisories/54</guid>
		<description><![CDATA[Vendor: Clam AntiVirus (http://www.clamav.net)
Product: Clamav (libclamav)
Versions Affected: All before 0.91
Severity: Moderate
Issue
Clamav crashes due to processing of standard filters in RAR VM, while processing a
corrupted RAR file. Processing the corrupted file results in a null pointer deference. 
Impact
Processing the corrupted file will result in crashing of clamscan application and
clamd daemon.
Fix
Upgrade to version 0.91.
PoC
http://www.metaeye.org/codes/corrupted.rar
Vendor Status
Reported: 25/06/2007
Fixed:  [...]]]></description>
		<wfw:commentRSS>http://www.metaeye.org/advisories/54/feed/</wfw:commentRSS>
		</item>
		<item>
		<title>Watch out for writable samba shares.</title>
		<link>http://www.metaeye.org/hunch/56</link>
		<comments>http://www.metaeye.org/hunch/56#comments</comments>
		<pubDate>Thu, 21 Jun 2007 22:20:33 +0000</pubDate>
		<dc:creator>warl0ck</dc:creator>
		
	<category>hunch</category>
		<guid isPermaLink="false">http://www.metaeye.org/hunch/56</guid>
		<description><![CDATA[Noticed a security issue with default samba configurations shipped with most Linux distros.
For example lets say we have a system A with a writable share XYZ. On an other system B,
we mount the share and create a link to /, i.e to the root directory.

[root@B] smbmount //A/XYZ /mnt/share -o username=test
Password:
[root@B] ln -s /  /mnt/share/ROOT

Now [...]]]></description>
		<wfw:commentRSS>http://www.metaeye.org/hunch/56/feed/</wfw:commentRSS>
		</item>
		<item>
		<title>Fingerprinting web servers with a %00.</title>
		<link>http://www.metaeye.org/hunch/43</link>
		<comments>http://www.metaeye.org/hunch/43#comments</comments>
		<pubDate>Thu, 17 May 2007 11:27:55 +0000</pubDate>
		<dc:creator>warl0ck</dc:creator>
		
	<category>hunch</category>
		<guid isPermaLink="false">http://www.metaeye.org/blog/43</guid>
		<description><![CDATA[The %00 is the famous null character when encoded in a URL. It is interesting to see how
different web servers behave when a null character is there in the GET request.
I use a simple python program that accepts the website name and URL to get, responds with the
web server version if available in the header [...]]]></description>
		<wfw:commentRSS>http://www.metaeye.org/hunch/43/feed/</wfw:commentRSS>
		</item>
		<item>
		<title>Redirection Vulnerability in wp-login.php</title>
		<link>http://www.metaeye.org/advisories/40</link>
		<comments>http://www.metaeye.org/advisories/40#comments</comments>
		<pubDate>Tue, 20 Mar 2007 14:50:58 +0000</pubDate>
		<dc:creator>msg</dc:creator>
		
	<category>advisories</category>
		<guid isPermaLink="false">http://www.metaeye.org/blog/40</guid>
		<description><![CDATA[Vendor: Wordpress (http://www.wordpress.org).
Severity: Moderate.
Dated: 03 March 2007.
Versions Affected: All.
Issue
The wp-login.php page redirects a user to arbitrary page after
successful login by setting the redirect_to url parameter.
For example if a user logins successfully with his credentials
on the following page
http://www.foo.com/wp-login.php?redirect_to=http://www.google.co.in
He will be redirected to www.google.co.in.
Impact
This can lead to credentials stealing. Also cookie stealing
is possible coupled with some browser [...]]]></description>
		<wfw:commentRSS>http://www.metaeye.org/advisories/40/feed/</wfw:commentRSS>
		</item>
		<item>
		<title>ZmbScap  -  Zombie Scapper.</title>
		<link>http://www.metaeye.org/projects/39</link>
		<comments>http://www.metaeye.org/projects/39#comments</comments>
		<pubDate>Mon, 19 Feb 2007 11:45:35 +0000</pubDate>
		<dc:creator>msg</dc:creator>
		
	<category>projects</category>
		<guid isPermaLink="false">http://www.metaeye.org/projects/39</guid>
		<description><![CDATA[The zombie scapper is an automated perl tool for detecting and stopping distributed denial of
service programs. The tool automatically searches and scans the desired target for programs
by looking for the ports that are used by the zombie masters. It stops the zombie masters by
sending a kill/stop command.
Find out more at its project page.
]]></description>
		<wfw:commentRSS>http://www.metaeye.org/projects/39/feed/</wfw:commentRSS>
		</item>
		<item>
		<title>wbkdr - Winamp Backdoor.</title>
		<link>http://www.metaeye.org/codes/30</link>
		<comments>http://www.metaeye.org/codes/30#comments</comments>
		<pubDate>Sat, 30 Dec 2006 13:31:55 +0000</pubDate>
		<dc:creator>warl0ck</dc:creator>
		
	<category>codes</category>
		<guid isPermaLink="false">http://www.metaeye.org/codes/30</guid>
		<description><![CDATA[wbkdr is a proof of concept WinAmp backdoor that makes use of the plugin interface.
It spawns cmd.exe on port 24501.
Download: wbkdr.zip.

]]></description>
		<wfw:commentRSS>http://www.metaeye.org/codes/30/feed/</wfw:commentRSS>
		</item>
		<item>
		<title>Global.asa Story</title>
		<link>http://www.metaeye.org/hunch/13</link>
		<comments>http://www.metaeye.org/hunch/13#comments</comments>
		<pubDate>Mon, 23 Oct 2006 06:41:21 +0000</pubDate>
		<dc:creator>warl0ck</dc:creator>
		
	<category>hunch</category>
		<guid isPermaLink="false">http://www.metaeye.org/?p=13</guid>
		<description><![CDATA[It is interesting that global.asa has never caught eyes of penetration testers while fingerprinting an IIS web server.(Could not find any tool that does it).

I have a simple python script called gr.py, which does a get request fo
global.asa, prints Web Server version reported and HTTP status returned.

#!/usr/bin/env python
import httplib
import sys
if __name__=="__main__":
&#160;&#160;&#160;if len(sys.argv) != 2:
&#160;&#160;&#160;&#160;&#160;sys.exit(0)
&#160;&#160;&#160;z=httplib.HTTPConnection(sys.argv[1])
&#160;&#160;&#160;z.request('GET','/global.asa')
&#160;&#160;&#160;a=z.getresponse()
&#160;&#160;&#160;print '+ [...]]]></description>
		<wfw:commentRSS>http://www.metaeye.org/hunch/13/feed/</wfw:commentRSS>
		</item>
		<item>
		<title>Who&#8217;s Blocking</title>
		<link>http://www.metaeye.org/hunch/12</link>
		<comments>http://www.metaeye.org/hunch/12#comments</comments>
		<pubDate>Mon, 23 Oct 2006 06:39:36 +0000</pubDate>
		<dc:creator>warl0ck</dc:creator>
		
	<category>hunch</category>
		<guid isPermaLink="false">http://www.metaeye.org/?p=12</guid>
		<description><![CDATA[Generally for ports reported filtered by nmap for a host, it is hard to
tell who blocked the probes, for example.


#nmap -sS -p 139,135,445 203.197.219.33

Starting Nmap 4.01 ( http://www.insecure.org/nmap/ ) at 2006-04-12 22:38 IST
Interesting ports on delhi-203.197.219-33.vsnl.net.in (203.197.219.33):
PORT STATE SERVICE
135/tcp filtered msrpc
139/tcp filtered netbios-ssn
445/tcp filtered microsoft-ds

Nmap finished: 1 IP address (1 host up) scanned in 9.848 [...]]]></description>
		<wfw:commentRSS>http://www.metaeye.org/hunch/12/feed/</wfw:commentRSS>
		</item>
	</channel>
</rss>
