First results from modus.py

Ok. Here we go again... During last few days after I had a pleasure to received some 'results' from CVE Team (1,2,3). I decided that it should be good ('enough';]) idea to create a small 'poc script' (again) to automate a little bit the process of 'finding bugs' (for example: like those mentioned in CVE's reference(s)). Below you will find few details collected after few days of 'research' and pinging the Vendors...

'modus operandi' - Horde 5.2.x

Last time we saw few 'moments' when modus.py was started against GeniXCMS. Today we will do the same with Horde (partially described here as well as [1],[2],[3]). So...

'modus operandi' - GeniXCMS 1.1.5

During last few days I tried to rewrite few parts of modus.py to get more similar results to those described for the 'latest' version of Horde.

 TL;DR - we have a new version of modus.py =]

'modus operandi' - Piwigo 2.9.2

As I 'promised': Vendor received the details but after all* - to this day - I have no idea what's goin on now... No response, no feedback, so "Vendor don't care" in my opinion. Full disclosure.

Post-auth SQL injection in FreePBX

Last time I found new cool CTF (you will find it at VulnHub) I would like to play. This time it will be something related to some Voip-scenario... Ok. I decided that it will be a good idea to take break for a moment and check the 'latest' available ISO for FreePBX ;]

Because of some problems (VirtualBox and SNG7-PBX-64bit-1712-2) I tried the 'historical' version: 10.13.66-32bit. Below you will find results (related only to the SQL injection bug I found...

Few bugs in latest Nagios XI 5.4.13

As you probably already know from time to time I'm trying to work on small and simple python script - called modus.py[1,2]. It's also fun to run some VM in the background (for example with some webapp - like Bitnami's VM collection [3,4,5]) and start to do a blackbox test to find some cases to future analysis... This time below you will find few results for 'latest' Nagios XI - 5.4.13. Here we go...