Archive for the 'Exploits' Category

Hack a GOV for black hat SEO

on Saturday, August 11th, 2007

It was weird when I see a keyword, that I’ve regularly watched, poped up at a .gov site.

Some blackhats, hoping to get the page rank benefits of a .gov site, hacked the forum of the site and placed a gateway like page. I guess search results come from google as well.

Check it out yourself.
nevadacityca.gov

PS: the keyword I was looking was the name of one of my sites, not cealis lol.

Immunity on Duplicate Content

on Tuesday, June 5th, 2007

I’m trying to understand how google handles the duplicate contents and wondering why some sites are luckier than others, almost having an immunity for duplicate content issues.
Some collective sites like answers.com is seems to be immune to the duplicate content penalties.
See this page about smokey bear(PR4). Correct me if I’m wrong but all I’m seeing is a rip of wikipedia page(PR6) along with lots and lots of advertisements.
Who can really say that this page benefits surfers when wikipedia page is exactly the same thing. I guess answers.com is taking this duplication tactics to the roof. Google is also helping them to drive traffic by hardlinking to their content as the “definition” reference.
I’m expecting no comments from Matt Cutts :) , just thinking laudly.

Cisco’s shame

on Wednesday, August 3rd, 2005

I was one of the guys who really liked Cisco products etc.
I even got the CCNA courses. However this news is not something that I can put together with Cisco.

A researcher followed through with a presentation on a security hole in Cisco’s IOS even after the network equipment company theatened to shut down the conference if the information wasn’t suppressed.

Also:
video of the cencorship : here
and the presentation on Cisco bugs which was removed from the books are here.

PHP Blogging Apps Vulnerable to XML-RPC Exploits

on Monday, July 4th, 2005

Many popular PHP-based blogging, wiki and content management programs can be exploited through a security hole in the way PHP programs handle XML commands. The flaw allows an attacker to compromise a web server, and is found in programs including PostNuke, WordPress, Drupal, Serendipity, phpAdsNew, phpWiki and phpMyFAQ, among others.

The flaw affects the XML-RPC function, which has many uses in web applications, including “ping” update notifications for RSS feeds. PHP libraries that allow applications to exchange XML data using remote procedure calls(RPC) fail to fully check incoming data for malicious commands. The affected libraries, including PHPXMLRPC and Pear XML-RPC, are included in many interactive applications written in PHP.

Thankfully Wordpress has already responded to that.