exploit the possibilities
Home Files News &[SERVICES_TAB]About Contact Add New
Showing 1 - 8 of 8 RSS Feed

Files from Nathan Power

Real NameNate Power
Email addressprivate
Websitewww.securitypentest.com
First Active2011-01-01
Last Active2014-08-03
View User Profile

Personal Background

Strong background in networking and security.

Experienced in the following:

Security solution development, security architecture, application security testing, network testing, vulnerability assessments, vulnerability research, penetration testing, intrusion detection, computer forensics, public speaking.


CAS Autodiscover Enumeration
Posted Aug 3, 2014
Authored by Nathan Power

The Microsoft Exchange Client Access Server (CAS) that services Autodiscover has been found vulnerable to an information disclosure. It has been discovered that a standard domain user without Exchange permissions can enumerate Autodiscover configuration files of Exchange users by an XML SOAP parameter injection.

tags | exploit, info disclosure
SHA-256 | 54c985d67107ade894f094c2b0fe43f071b3e549fb3bf44c8d221541460ae91e
CAS Timing Attack
Posted Aug 3, 2014
Authored by Nathan Power

The Client Access Server (CAS) that services Autodiscover and Outlook Web App (OWA) has been found to be vulnerable to time-based authentication attacks. It has been discovered that when sending authentication requests to the CAS, behavior in the timing of the responses can be used to verify Active Directory (AD) realms and usernames within those realms. Authentication timing issues have been found in specific IIS file paths and OWA form-based authentication. This issue can allow an attacker to confirm the existence of a specific username in the directory, and will make other attacks such as password guessing or social engineering attacks more successful.

tags | advisory, web
SHA-256 | 061b94a5edc404d05361b21ffb528c06f80aa1cef15fbbc558442730005bf285
Microsoft Exchange Internal IP Disclosure
Posted Aug 3, 2014
Authored by Nathan Power

Multiple issues have been discovered that makes it possible to disclose internal IP addresses of remote Microsoft Exchange environments.

tags | exploit, remote
SHA-256 | 1583d0211f9142e47c610ac0fa845c95f421e39d1782f40c8b7bdb1923355789
Facebook.com Attach EXE Bypass
Posted Oct 27, 2011
Authored by Nathan Power

Facebook.com suffers from a bypass vulnerability where an executable can be attached to a message if a spaced is added to the name.

tags | advisory, bypass
SHA-256 | d50f0c387bdb7f361f67403ec07249d408f5a19eed5358e240b208741277268f
Multi-Tech Systems Cross Site Scripting
Posted Jun 2, 2011
Authored by Nathan Power

Multi-Tech Systems MultiModem iSMS suffers from multiple cross site scripting vulnerabilities. MultiModem iSMS Web Management Interface versions 1.47 and below are affected.

tags | advisory, web, vulnerability, xss
SHA-256 | 857d2a189b2061187d191edcd0432fd735cd894adbea85bee5dfbb848ba0063c
TrustWave WebDefend Static Database Password
Posted May 27, 2011
Authored by Nathan Power

Trustwave WebDefend suffers from a static database password vulnerability. It was discovered in various DLLs and EXEs and affects WebDefend Enterprise Manager Appliance / Console software versions 5.0 and 4.0.

tags | advisory
SHA-256 | af8e8db72fb21529ddd405451250cf64c1245de881c6b67c33191743d4d5a7f7
Unidesk Management Administrative Bypass
Posted Mar 25, 2011
Authored by Nathan Power

The Unidesk Management Console versions 1.3 and below suffer from a direct access vulnerability that allows an attacker direct access to administrative resources.

tags | exploit, bypass
SHA-256 | 0d22cc882b3d6c110e94623b1274d806e3e68239274da8ea4c92fd017f31ea87
PayPal Cross Site Scripting
Posted Jan 1, 2011
Authored by Nathan Power

PayPal's send money feature suffered from a cross site scripting vulnerability.

tags | advisory, xss
SHA-256 | 3de760a1d3613532edb3bcb89657f899c49fc5641c61f9d37414668b5825366f
Page 1 of 1
Back1Next

File Archive:

March 2024

  • Su
  • Mo
  • Tu
  • We
  • Th
  • Fr
  • Sa
  • 1
    Mar 1st
    16 Files
  • 2
    Mar 2nd
    0 Files
  • 3
    Mar 3rd
    0 Files
  • 4
    Mar 4th
    32 Files
  • 5
    Mar 5th
    28 Files
  • 6
    Mar 6th
    42 Files
  • 7
    Mar 7th
    17 Files
  • 8
    Mar 8th
    13 Files
  • 9
    Mar 9th
    0 Files
  • 10
    Mar 10th
    0 Files
  • 11
    Mar 11th
    15 Files
  • 12
    Mar 12th
    19 Files
  • 13
    Mar 13th
    21 Files
  • 14
    Mar 14th
    38 Files
  • 15
    Mar 15th
    15 Files
  • 16
    Mar 16th
    0 Files
  • 17
    Mar 17th
    0 Files
  • 18
    Mar 18th
    10 Files
  • 19
    Mar 19th
    32 Files
  • 20
    Mar 20th
    46 Files
  • 21
    Mar 21st
    16 Files
  • 22
    Mar 22nd
    13 Files
  • 23
    Mar 23rd
    0 Files
  • 24
    Mar 24th
    0 Files
  • 25
    Mar 25th
    12 Files
  • 26
    Mar 26th
    31 Files
  • 27
    Mar 27th
    19 Files
  • 28
    Mar 28th
    42 Files
  • 29
    Mar 29th
    0 Files
  • 30
    Mar 30th
    0 Files
  • 31
    Mar 31st
    0 Files

Top Authors In Last 30 Days

File Tags

Systems

packet storm

© 2022 Packet Storm. All rights reserved.

Services
Security Services
Hosting By
Rokasec
close