Date Author Title

IIS ASP INJECTION

2010-06-09Deborah HaleMass Infection of IIS/ASP Sites

IIS

2015-04-15/a>Johannes UllrichMS15-034: HTTP.sys (IIS) DoS And Possible Remote Code Execution. PATCH NOW
2010-12-22/a>John BambenekIIS 7.5 0-Day DoS (processing FTP requests)
2010-06-09/a>Deborah HaleMass Infection of IIS/ASP Sites
2009-12-29/a>Rick WannerMicrosoft responds to possible IIS 6 0-day
2009-12-28/a>Johannes Ullrich8 Basic Rules to Implement Secure File Uploads http://jbu.me/48 (inspired by IIS ; bug)
2009-12-27/a>Patrick NolanPressure increasing for Microsoft to patch IIS 0 day
2009-12-24/a>Guy BruneauMicrosoft IIS File Parsing Extension Vulnerability
2009-09-08/a>Adrien de BeaupreMicrosoft Security Advisory 975191 Revised
2009-09-04/a>Adrien de BeaupreVulnerabilities (plural) in MS IIS FTP Service 5.0, 5.1. 6.0, 7.0
2009-05-24/a>Raul SilesIIS admins, help finding WebDAV remotely using nmap
2009-05-21/a>Adrien de BeaupreIIS admins, help finding WebDAV
2009-05-15/a>Daniel WesemannIIS6.0 WebDav Remote Auth Bypass
2009-01-12/a>William SaluskyWeb Application Firewalls (WAF) - Have you deployed WAF technology?
2008-04-18/a>John BambenekIIS Vulnerability Documented by Microsoft - Includes Workarounds

ASP

2022-08-30/a>Johannes UllrichTwo things that will never die: bash scripts and IRC!
2022-05-03/a>Johannes UllrichSome Honeypot Updates
2021-03-15/a>Didier StevensFinding Metasploit & Cobalt Strike URLs
2020-07-27/a>Didier StevensAnalyzing Metasploit ASP .NET Payloads
2020-06-25/a>Johannes UllrichTech Tuesday Recap / Recordings: Part 2 (Installing the Honeypot) release.
2020-02-27/a>Xavier MertensOffensive Tools Are For Blue Teams Too
2019-08-28/a>Johannes Ullrich[Guest Diary] Open Redirect: A Small But Very Common Vulnerability
2019-08-05/a>Rick WannerScanning for Bluekeep vulnerable RDP instances
2017-11-06/a>Didier StevensMetasploit's Maldoc
2017-08-03/a>Johannes UllrichUsing a Raspberry Pi honeypot to contribute data to DShield/ISC
2017-05-03/a>Bojan ZdrnjaPowershelling with exploits
2015-03-08/a>Brad DuncanWhat Happened to You, Asprox Botnet?
2015-02-17/a>Rob VandenBrinkA Different Kind of Equation
2014-09-10/a>Johannes UllrichContent Security Policy (CSP) is Growing Up.
2014-07-11/a>Rob VandenBrinkMetasploit Update Alert
2014-06-12/a>Johannes UllrichMetasploit now includes module to exploit CVE-2014-0195 (OpenSSL DTLS Fragment Vuln.)
2013-10-25/a>Rob VandenBrinkKaspersky flags TCPIP.SYS as Malware
2013-05-27/a>Johannes UllrichNuclear Scientists, Pandas and EMET Keeping Me Honest
2013-03-13/a>Johannes UllrichIPv6 Focus Month: Kaspersky Firewall IPv6 Vulnerability
2013-01-22/a>Richard PorterUsing Metasploit for Patch Sanity Checks
2013-01-02/a>Russ McReeEMET 3.5: The Value of Looking Through an Attacker's Eyes
2012-07-13/a>Russ McRee2 for 1: SANSFIRE & MSRA presentations
2012-06-18/a>Guy BruneauCVE-2012-1875 exploit is now available
2012-04-26/a>Richard PorterPacketstorm Security and Metasploit have Exploit code for MS12-027
2011-12-29/a>Richard PorterASP.Net Vulnerability
2011-11-01/a>Russ McReeSecure languages & frameworks
2011-08-02/a>Mark HofmanMetsploit 4 hits the downloads
2011-07-27/a>Daniel WesemannOWASP Session Management "Cheat Sheet"
2011-05-07/a>Rick WannerBelated May 2: Metasploit 3.7.0 released. http://blog.metasploit.com/2011/05/metasploit-framework-370-released.html
2011-02-21/a>Adrien de BeaupreKaspersky update servers unreachable
2010-09-28/a>Daniel WesemannMS10-070 OOB Patch for ASP.NET vulnerability
2010-09-27/a>Adrien de BeaupreMS OOB patch tomorrow for Security Advisory 2416728
2010-09-18/a>Rick WannerMicrosoft Security Advisory for ASP.NET
2010-07-20/a>Manuel Humberto Santander PelaezLNK vulnerability now with Metasploit module implementing the WebDAV method
2010-07-18/a>Manuel Humberto Santander PelaezNew metasploit GUI written in Java
2010-06-14/a>Manuel Humberto Santander PelaezMetasploit 101
2010-06-09/a>Deborah HaleMass Infection of IIS/ASP Sites
2010-05-19/a>Kyle HaugsnessMetasploit 3.4.0 released
2009-12-28/a>Johannes Ullrich8 Basic Rules to Implement Secure File Uploads http://jbu.me/48 (inspired by IIS ; bug)
2009-11-17/a>Guy BruneauMetasploit Framework 3.3 Released
2008-06-10/a>Swa FrantzenRansomware keybreaking

INJECTION

2022-09-14/a>Xavier MertensEasy Process Injection within Python
2022-02-10/a>Johannes UllrichZyxel Network Storage Devices Hunted By Mirai Variant
2022-01-20/a>Xavier MertensRedLine Stealer Delivered Through FTP
2021-12-21/a>Xavier MertensMore Undetected PowerShell Dropper
2021-12-10/a>Xavier MertensPython Shellcode Injection From JSON Data
2021-11-20/a>Guy BruneauHikvision Security Cameras Potentially Exposed to Remote Code Execution
2021-07-06/a>Xavier MertensPython DLL Injection Check
2021-06-12/a>Guy BruneauFortinet Targeted for Unpatched SSL VPN Discovery Activity
2021-04-29/a>Xavier MertensFrom Python to .Net
2021-02-13/a>Guy BruneauvSphere Replication updates address a command injection vulnerability (CVE-2021-21976) - https://www.vmware.com/security/advisories/VMSA-2021-0001.html
2020-11-19/a>Xavier MertensPowerShell Dropper Delivering Formbook
2020-09-24/a>Xavier MertensParty in Ibiza with PowerShell
2020-08-28/a>Xavier MertensExample of Malicious DLL Injected in PowerShell
2020-07-30/a>Johannes UllrichPython Developers: Prepare!!!
2018-09-28/a>Xavier MertensMore Excel DDE Code Injection
2018-09-05/a>Xavier MertensMalicious PowerShell Compiling C# Code on the Fly
2017-05-05/a>Xavier MertensHTTP Headers... the Achilles' heel of many applications
2016-02-15/a>Bojan ZdrnjaExploiting (pretty) blind SQL injections
2013-10-19/a>Johannes UllrichYet Another WHMCS SQL Injection Exploit
2013-07-16/a>Johannes UllrichWhy don't we see more examples of web app attacks via POST?
2013-02-17/a>Guy BruneauHP ArcSight Connector Appliance and Logger Vulnerabilities
2013-01-25/a>Johannes UllrichVulnerability Scans via Search Engines (Request for Logs)
2013-01-09/a>Rob VandenBrinkSQL Injection Flaw in Ruby on Rails
2012-10-05/a>Richard PorterReports of a Distributed Injection Scan
2012-07-31/a>Daniel WesemannSQL injection, lilupophilupop-style
2011-12-01/a>Mark HofmanSQL Injection Attack happening ATM
2011-06-06/a>Johannes UllrichThe Havij SQL Injection Tool
2011-04-19/a>Bojan ZdrnjaSQL injection: why can’t we learn?
2011-04-01/a>John BambenekLizaMoon Mass SQL-Injection Attack Infected at least 500k Websites
2010-12-02/a>Kevin JohnsonSQL Injection: Wordpress 3.0.2 released
2010-08-15/a>Manuel Humberto Santander PelaezObfuscated SQL Injection attacks
2010-06-09/a>Deborah HaleMass Infection of IIS/ASP Sites
2010-02-06/a>Guy BruneauLANDesk Management Gateway Vulnerability
2009-07-16/a>Bojan ZdrnjaOWC exploits used in SQL injection attacks
2009-05-19/a>Bojan ZdrnjaAdvanced blind SQL injection (with Oracle examples)
2009-05-09/a>Patrick NolanShared SQL Injection Lessons Learned blog item
2009-04-21/a>Bojan ZdrnjaWeb application vulnerabilities
2009-02-11/a>Robert DanfordProFTPd SQL Authentication Vulnerability exploit activity
2008-12-12/a>Johannes UllrichMSIE 0-day Spreading Via SQL Injection
2008-12-01/a>Jason LamInput filtering and escaping in SQL injection mitigation
2008-11-20/a>Jason LamLarge quantity SQL Injection mitigation
2008-09-29/a>Daniel WesemannASPROX mutant
2008-09-01/a>John BambenekThe Number of Machines Controlled by Botnets Has Jumped 4x in Last 3 Months
2008-08-23/a>Mark HofmanSQL injections - an update
2008-08-08/a>Mark HofmanMore SQL Injections - very active right now
2008-07-24/a>Bojan ZdrnjaWhat's brewing in Danmec's pot?
2008-06-30/a>Marcus SachsMore SQL Injection with Fast Flux hosting
2008-06-24/a>Jason LamSQL Injection mitigation in ASP
2008-06-24/a>Jason LamMicrosoft SQL Injection Prevention Strategy
2008-06-23/a>donald smithPreventing SQL injection
2008-06-13/a>Johannes UllrichSQL Injection: More of the same
2008-05-20/a>Raul SilesList of malicious domains inserted through SQL injection
2008-04-24/a>donald smithHundreds of thousands of SQL injections
2008-04-16/a>Bojan ZdrnjaThe 10.000 web sites infection mystery solved
2008-03-14/a>Kevin Liston2117966.net-- mass iframe injection
2008-01-09/a>Bojan ZdrnjaMass exploits with SQL Injection
2007-02-24/a>Jason LamPrepared Statements and SQL injections