I recently tried new static application security testing solution – solaredappscreener.com. It was quiet an interesting experience. I created a trial account on the demo website and immediately fell into the product UI. I was able to scan 2 applications in terms of my trial, but wish I...
Continue reading
November 27, 2017 cjchamber
General Security, Other Resources, Tools & Goodies
No Comment
Original post date: Oct. 3, 2017 Updates: Oct. 4, 2017 Today like many others I was in complete shock to learn that the IRS had awarded a contract to Equifax, to “ establish an order for third party data services from Equifax to verify taxpayer identity and to assist...
Continue reading
October 4, 2017 cjchamber
General Security, Random Crap
No Comment
I realized the other day when doing some OSINT research that I’ve collected quite the set of tools online. My bookmarks are getting a little out of hand so for my own reference, I figured I’d dump them into a blog post so when I’m trying to remember...
Continue reading
September 15, 2017 cjchamber
General Security, Tools & Goodies
No Comment
Older versions of OpenCart < v5 had a reflective Cross Site Scripting Vulnerability. I requested this CVE, but never published it because I got busy with other work. So I thought better late than never 🙂 Discovery Date: 04/28/2014 Vendor Notified: 04/30/2014 CVE Assigned: 05/01/2014 Update Released: 06/01/2014...
Continue reading
March 19, 2016 cjchamber
Malware Analysis
No Comment
* Exploit Title: Reflective XSS * Discovery Date: 02/09/2016 * Public Disclosure Date:03/10/2016 * Exploit Author: CJ Chamberland * Contact: @cjchamberland - http://cjchamberland.com * Vendor Homepage: formtoemail.com * Software Link: formtoemail.com (formtoemail.php free is available for download from this site) * Version: 2.5 * Tested on: apache/mac os...
Continue reading
March 11, 2016 cjchamber
Malware Analysis
No Comment
I come across a site every once in a while where the malware isn’t actually in the files – but in the database. I would say this type of occurrence happens in about 1 out of every 100 sites I see. Here is a very easy way to...
Continue reading
March 12, 2015 cjchamber
Malware Analysis
No Comment
Today I came across a nasty little booger. It’s added to the wp-includes/swfobject.js file and they used the wp-includes/tempate-loader.php to load it. I did noticed from another message board that it has been around for at least a few weeks, but apparently people are just now discovering it...
Continue reading
December 15, 2014 cjchamber
Malware Analysis
No Comment
So yesterday, like many others I was reading my email and got an interesting one from Elance: “Hello, We’re writing because a routine system review of your account identified an unusually high number of disputes, client concerns, poor feedback, or evidence of moving work off the platform. As...
Continue reading
August 30, 2014 cjchamber
Random Crap
No Comment
I have had a few clients ask about their sites being framed to load on other sites without their permission and if their is anything they can do about it. Attackers sometimes do this in “Phishing” attempts. Visitors think they are going to the legitimate site, when in...
Continue reading
January 26, 2014 cjchamber
Malware Analysis
No Comment
This was uncovered in several joomla installs last week. Apparently the attackers install some “Fake” modules (in these cases it was mod_administrator, mod_msn, and mod_araticlhess that were discovered and removed) not sure yet if they are related, but it appears they are, I just need to do more...
Continue reading
January 15, 2014 cjchamber
Malware Analysis
No Comment
