Categoria: exploit

pfSense 2.4.1 CSRF Error Page Clickjacking
13 12
Pubblicato in CLICKJACKING Nessun commento

pfSense 2.4.1 CSRF Error Page Clickjacking

This Metasploit module exploits a Clickjacking vulnerability in pfSense versions 2.4.1 and below. pfSense is a free and open source firewall and router. It was found that the pfSense WebGUI is vulnerable to Clickjacking. By tricking an authenticated admin into interacting with a specially crafted webpage it is possible for an attacker to execute arbitrary […]

The post pfSense 2.4.1 CSRF Error Page Clickjacking appeared first on MondoUnix.

Fortinet FortiClient VPN Credential Disclosure
13 12
Pubblicato in Credential Nessun commento

Fortinet FortiClient VPN Credential Disclosure

FortiClient stores the VPN authentication credentials in a configuration file (on Linux or Mac OSX) or in registry (on Windows). The credentials are encrypted but can still be recovered since the decryption key is hardcoded in the program and the same on all installations. Above all, the aforementioned storage is world readable, which actually lays […]

The post Fortinet FortiClient VPN Credential Disclosure appeared first on MondoUnix.