exploit the possibilities
Home Files News &[SERVICES_TAB]About Contact Add New
Showing 1 - 8 of 8 RSS Feed

Files from Nathan Power

Real NameNate Power
Email addressprivate
Websitewww.securitypentest.com
First Active2011-01-01
Last Active2014-08-03
View User Profile

Personal Background

Strong background in networking and security.

Experienced in the following:

Security solution development, security architecture, application security testing, network testing, vulnerability assessments, vulnerability research, penetration testing, intrusion detection, computer forensics, public speaking.


CAS Autodiscover Enumeration
Posted Aug 3, 2014
Authored by Nathan Power

The Microsoft Exchange Client Access Server (CAS) that services Autodiscover has been found vulnerable to an information disclosure. It has been discovered that a standard domain user without Exchange permissions can enumerate Autodiscover configuration files of Exchange users by an XML SOAP parameter injection.

tags | exploit, info disclosure
SHA-256 | 54c985d67107ade894f094c2b0fe43f071b3e549fb3bf44c8d221541460ae91e
CAS Timing Attack
Posted Aug 3, 2014
Authored by Nathan Power

The Client Access Server (CAS) that services Autodiscover and Outlook Web App (OWA) has been found to be vulnerable to time-based authentication attacks. It has been discovered that when sending authentication requests to the CAS, behavior in the timing of the responses can be used to verify Active Directory (AD) realms and usernames within those realms. Authentication timing issues have been found in specific IIS file paths and OWA form-based authentication. This issue can allow an attacker to confirm the existence of a specific username in the directory, and will make other attacks such as password guessing or social engineering attacks more successful.

tags | advisory, web
SHA-256 | 061b94a5edc404d05361b21ffb528c06f80aa1cef15fbbc558442730005bf285
Microsoft Exchange Internal IP Disclosure
Posted Aug 3, 2014
Authored by Nathan Power

Multiple issues have been discovered that makes it possible to disclose internal IP addresses of remote Microsoft Exchange environments.

tags | exploit, remote
SHA-256 | 1583d0211f9142e47c610ac0fa845c95f421e39d1782f40c8b7bdb1923355789
Facebook.com Attach EXE Bypass
Posted Oct 27, 2011
Authored by Nathan Power

Facebook.com suffers from a bypass vulnerability where an executable can be attached to a message if a spaced is added to the name.

tags | advisory, bypass
SHA-256 | d50f0c387bdb7f361f67403ec07249d408f5a19eed5358e240b208741277268f
Multi-Tech Systems Cross Site Scripting
Posted Jun 2, 2011
Authored by Nathan Power

Multi-Tech Systems MultiModem iSMS suffers from multiple cross site scripting vulnerabilities. MultiModem iSMS Web Management Interface versions 1.47 and below are affected.

tags | advisory, web, vulnerability, xss
SHA-256 | 857d2a189b2061187d191edcd0432fd735cd894adbea85bee5dfbb848ba0063c
TrustWave WebDefend Static Database Password
Posted May 27, 2011
Authored by Nathan Power

Trustwave WebDefend suffers from a static database password vulnerability. It was discovered in various DLLs and EXEs and affects WebDefend Enterprise Manager Appliance / Console software versions 5.0 and 4.0.

tags | advisory
SHA-256 | af8e8db72fb21529ddd405451250cf64c1245de881c6b67c33191743d4d5a7f7
Unidesk Management Administrative Bypass
Posted Mar 25, 2011
Authored by Nathan Power

The Unidesk Management Console versions 1.3 and below suffer from a direct access vulnerability that allows an attacker direct access to administrative resources.

tags | exploit, bypass
SHA-256 | 0d22cc882b3d6c110e94623b1274d806e3e68239274da8ea4c92fd017f31ea87
PayPal Cross Site Scripting
Posted Jan 1, 2011
Authored by Nathan Power

PayPal's send money feature suffered from a cross site scripting vulnerability.

tags | advisory, xss
SHA-256 | 3de760a1d3613532edb3bcb89657f899c49fc5641c61f9d37414668b5825366f
Page 1 of 1
Back1Next

File Archive:

October 2022

  • Su
  • Mo
  • Tu
  • We
  • Th
  • Fr
  • Sa
  • 1
    Oct 1st
    10 Files
  • 2
    Oct 2nd
    0 Files
  • 3
    Oct 3rd
    12 Files
  • 4
    Oct 4th
    15 Files
  • 5
    Oct 5th
    18 Files
  • 6
    Oct 6th
    16 Files
  • 7
    Oct 7th
    0 Files
  • 8
    Oct 8th
    0 Files
  • 9
    Oct 9th
    0 Files
  • 10
    Oct 10th
    0 Files
  • 11
    Oct 11th
    0 Files
  • 12
    Oct 12th
    0 Files
  • 13
    Oct 13th
    0 Files
  • 14
    Oct 14th
    0 Files
  • 15
    Oct 15th
    0 Files
  • 16
    Oct 16th
    0 Files
  • 17
    Oct 17th
    0 Files
  • 18
    Oct 18th
    0 Files
  • 19
    Oct 19th
    0 Files
  • 20
    Oct 20th
    0 Files
  • 21
    Oct 21st
    0 Files
  • 22
    Oct 22nd
    0 Files
  • 23
    Oct 23rd
    0 Files
  • 24
    Oct 24th
    0 Files
  • 25
    Oct 25th
    0 Files
  • 26
    Oct 26th
    0 Files
  • 27
    Oct 27th
    0 Files
  • 28
    Oct 28th
    0 Files
  • 29
    Oct 29th
    0 Files
  • 30
    Oct 30th
    0 Files
  • 31
    Oct 31st
    0 Files

Top Authors In Last 30 Days

File Tags

Systems

packet storm

© 2022 Packet Storm. All rights reserved.

Hosting By
Rokasec
close