what you don't know can hurt you
Home Files News &[SERVICES_TAB]About Contact Add New
Showing 1 - 8 of 8 RSS Feed

Files from Nathan Power

Real NameNate Power
Email addressprivate
First Active2011-01-01
Last Active2014-08-03
View User Profile

Personal Background

Strong background in networking and security.

Experienced in the following:

Security solution development, security architecture, application security testing, network testing, vulnerability assessments, vulnerability research, penetration testing, intrusion detection, computer forensics, public speaking.

CAS Autodiscover Enumeration
Posted Aug 3, 2014
Authored by Nathan Power

The Microsoft Exchange Client Access Server (CAS) that services Autodiscover has been found vulnerable to an information disclosure. It has been discovered that a standard domain user without Exchange permissions can enumerate Autodiscover configuration files of Exchange users by an XML SOAP parameter injection.

tags | exploit, info disclosure
SHA-256 | 54c985d67107ade894f094c2b0fe43f071b3e549fb3bf44c8d221541460ae91e
CAS Timing Attack
Posted Aug 3, 2014
Authored by Nathan Power

The Client Access Server (CAS) that services Autodiscover and Outlook Web App (OWA) has been found to be vulnerable to time-based authentication attacks. It has been discovered that when sending authentication requests to the CAS, behavior in the timing of the responses can be used to verify Active Directory (AD) realms and usernames within those realms. Authentication timing issues have been found in specific IIS file paths and OWA form-based authentication. This issue can allow an attacker to confirm the existence of a specific username in the directory, and will make other attacks such as password guessing or social engineering attacks more successful.

tags | advisory, web
SHA-256 | 061b94a5edc404d05361b21ffb528c06f80aa1cef15fbbc558442730005bf285
Microsoft Exchange Internal IP Disclosure
Posted Aug 3, 2014
Authored by Nathan Power

Multiple issues have been discovered that makes it possible to disclose internal IP addresses of remote Microsoft Exchange environments.

tags | exploit, remote
SHA-256 | 1583d0211f9142e47c610ac0fa845c95f421e39d1782f40c8b7bdb1923355789
Facebook.com Attach EXE Bypass
Posted Oct 27, 2011
Authored by Nathan Power

Facebook.com suffers from a bypass vulnerability where an executable can be attached to a message if a spaced is added to the name.

tags | advisory, bypass
SHA-256 | d50f0c387bdb7f361f67403ec07249d408f5a19eed5358e240b208741277268f
Multi-Tech Systems Cross Site Scripting
Posted Jun 2, 2011
Authored by Nathan Power

Multi-Tech Systems MultiModem iSMS suffers from multiple cross site scripting vulnerabilities. MultiModem iSMS Web Management Interface versions 1.47 and below are affected.

tags | advisory, web, vulnerability, xss
SHA-256 | 857d2a189b2061187d191edcd0432fd735cd894adbea85bee5dfbb848ba0063c
TrustWave WebDefend Static Database Password
Posted May 27, 2011
Authored by Nathan Power

Trustwave WebDefend suffers from a static database password vulnerability. It was discovered in various DLLs and EXEs and affects WebDefend Enterprise Manager Appliance / Console software versions 5.0 and 4.0.

tags | advisory
SHA-256 | af8e8db72fb21529ddd405451250cf64c1245de881c6b67c33191743d4d5a7f7
Unidesk Management Administrative Bypass
Posted Mar 25, 2011
Authored by Nathan Power

The Unidesk Management Console versions 1.3 and below suffer from a direct access vulnerability that allows an attacker direct access to administrative resources.

tags | exploit, bypass
SHA-256 | 0d22cc882b3d6c110e94623b1274d806e3e68239274da8ea4c92fd017f31ea87
PayPal Cross Site Scripting
Posted Jan 1, 2011
Authored by Nathan Power

PayPal's send money feature suffered from a cross site scripting vulnerability.

tags | advisory, xss
SHA-256 | 3de760a1d3613532edb3bcb89657f899c49fc5641c61f9d37414668b5825366f
Page 1 of 1

File Archive:

September 2023

  • Su
  • Mo
  • Tu
  • We
  • Th
  • Fr
  • Sa
  • 1
    Sep 1st
    2 Files
  • 2
    Sep 2nd
    21 Files
  • 3
    Sep 3rd
    0 Files
  • 4
    Sep 4th
    17 Files
  • 5
    Sep 5th
    34 Files
  • 6
    Sep 6th
    29 Files
  • 7
    Sep 7th
    11 Files
  • 8
    Sep 8th
    25 Files
  • 9
    Sep 9th
    0 Files
  • 10
    Sep 10th
    0 Files
  • 11
    Sep 11th
    26 Files
  • 12
    Sep 12th
    23 Files
  • 13
    Sep 13th
    17 Files
  • 14
    Sep 14th
    22 Files
  • 15
    Sep 15th
    16 Files
  • 16
    Sep 16th
    0 Files
  • 17
    Sep 17th
    0 Files
  • 18
    Sep 18th
    19 Files
  • 19
    Sep 19th
    60 Files
  • 20
    Sep 20th
    23 Files
  • 21
    Sep 21st
    15 Files
  • 22
    Sep 22nd
    8 Files
  • 23
    Sep 23rd
    0 Files
  • 24
    Sep 24th
    0 Files
  • 25
    Sep 25th
    17 Files
  • 26
    Sep 26th
    3 Files
  • 27
    Sep 27th
    0 Files
  • 28
    Sep 28th
    0 Files
  • 29
    Sep 29th
    0 Files
  • 30
    Sep 30th
    0 Files

Top Authors In Last 30 Days

File Tags


packet storm

© 2022 Packet Storm. All rights reserved.

Security Services
Hosting By