Author Archives: Phil

Extending Burp Suite to solve reCAPTCHA

Posted on January 19, 2012 by Phil

By extending the Burp Suite and integrating it with a CAPTCHA solving farm you can enable the automated bypassing of CAPTCHA within all burp tools; seamlessly replacing all CAPTCHA with their correct solutions. This post will show how I’ve extended … Continue reading →

Posted in Burp | Tagged , | 1 Comment

Decrypting suhosin sessions and cookies.

Posted on November 30, 2011 by Phil

The suhosin module provides transparent cookie and session encryption out of the box to PHP applications. Once enabled any session values stored on disk are encrypted with rijndael and a slight variation on base64 encoding, the same applies to any … Continue reading →

Posted in PHP | Tagged , , , | 2 Comments

Clickjacking and XSS for reading autocomplete credentials.

Posted on October 26, 2011 by Phil

By combining Cross Site Scripting (XSS) with Clickjacking and JavaScript it is possible to extract passwords and data stored within the browsers Autocomplete cache. Autocomplete is a feature supported by all browsers to cache input field values – it can … Continue reading →

Posted in JavaScript | Tagged , , | Leave a comment

JavaScript and Daylight Savings for tracking users.

Posted on October 2, 2011 by Phil

Each country has their own timezone – although timezones are not generally unique variations in the offset can enable a website using JavaScript to pinpoint your location and operating system to an alarming degree of accuracy. Most countries time differs … Continue reading →

Posted in JavaScript | Tagged , , | Leave a comment

Google TOTP Two-factor Authentication for PHP

Posted on July 25, 2011 by Phil

At the beginning of the year Google released 2 Factor Authentication (2FA) for G-Mail providing an application for Android, IPhone and Blackberry called Google Authenticator to generate one time login tokens. This post will show how to implement Google 2FA … Continue reading →

Posted in PHP | Tagged , , , , | Leave a comment

Exploit: PHPCaptcha / Securimage is not secure.

Posted on May 25, 2011 by Phil

Recently I discovered an easy way to bypass PHPCaptcha also known as SecurImage. The method described below will break the CAPTCHA every time, without fail and affects versions 1.0.4 and above. Previous versions are also probably vulnerable tho only exploit … Continue reading →

Posted in Exploits, PHP | Tagged , , , , | 11 Comments

Javascript keylogger in JQuery.

Posted on May 21, 2011 by Phil

I needed to capture someone’s login credentials using cross site scripting. However I had 3 problems. Firstly there was no XSS on the login page, secondly the only XSS was reflected, meaning it only affected the current page and thirdly … Continue reading →

Posted in Exploits, JavaScript | Tagged , , , | Leave a comment

Clickjacking and Phishing with help from the HTML5 JavaScript Sandbox

Posted on May 1, 2011 by Phil

HTML5 has some nice new features one of which is JavaScript Sandboxing using iframes. Chrome is currently the only browser to support this but you can be sure others will soon follow. The sandbox allows control over what can be … Continue reading →

Posted in HTML5 | Tagged , , , , | 5 Comments

PHP Remote File Inclusion command shell using data://

Posted on March 24, 2011 by Phil

PHP 5.2 and above provides stream wrappers. The general idea behind the stream wrapper is that you write one that interfaces with other protocols or services and you can still reference the data using your favourite functions. Here we open … Continue reading →

Posted in PHP | Tagged , , | 2 Comments

Hardening and securing PHP on Linux

Posted on February 28, 2011 by Phil

Hardening PHP on linux to increase security is a complex process involving a plethora of  settings. A while back I developed a script in order to check for any security settings that were out of place. The idea is that … Continue reading →

Posted in PHP | Tagged , , , , , | 12 Comments