# notsosecure.com

> AI-optimized mirror of notsosecure.com containing 24 pages totalling 7,427 words of clean markdown content, structured data, and semantic HTML. Original source: https://notsosecure.com/. Last updated: 2026-06-16T03:16:16.482Z.

Each page is available as HTML (with JSON-LD structured data) and Markdown (text-only, ideal for LLMs and RAG).

## Homepage

- [Join us at Black Hat events Worldwide!](/content/site-root.html): NotSoSecure is one of the largest training providers at Black Hat conferences and trains hundreds of individuals throughout the year. Our trainers are also pen testers and we use a research led approach to ensure our training and testing is always of the highest quality. (324 words)

## Articles & Blog Posts

- [Owning IIS 6.0 When Webserver Supports Put and Move HTTP Methods](/content/owning-iis-60-when-webserver-supports-put-and-move-http-methods.html): Credits: ice  and ferruh In IIS 6.0 you can upload the backdoor scripts but u may not be able to execute the default cmd.exe present in the iis box, so u need to upload your own cmd.exe first and then make your asp backdoor point to the cmd.exe which you uploaded. Steps: 1. Upload cmd.exe to /scripts/ folder: Use the script below published by (691 words)
- [wordpress admin-ajax.php Sql Injection](/content/wordpress-admin-ajaxphp-sql-injection/index.html): Apologies for not posting anything on my blog for so long. I saw this wordpress exploit yesterday and its just awesome work by waraxe. Unlike my xmlrpc.php exploit this doesnot even need any privilidges and the exploit works fine. To me, it is yet another example of why magic_quote setting of php is not sufficient protection against SQL injections. Although, i have explained (322 words)
- [SQL Injection In Oracle](/content/sql-injection-oracle/index.html): 1. Finding table names select table_name from+user_tables Example:- 192.168.2.199/ora.php?id=101+union+all+select+ table_name+from+user_tables Blind Injection:192.168.2.199/ora.php?id=101 and ascii(substr((select+table_name+from+user_tables where rownum=1),1,1))>100 ----------------------------------------------- 2. Iterating through the different rows: Unfortunately it is not (266 words)
- [Insecure PHP Coding](/content/insecure-php-coding/index.html): While testing a web application today, i noticed an unusual 302 HTTP response. Normally a 302 response just has a header and no html code, becuase its meant to be redirecting you to the page cited in the 'Location' field of the http header.� The 302 response had the html code which will be presented to the authenticated admin user, but, we didnt have the admin credentials. (350 words)
- [Exploiting SQL Injections In Insert Statements](/content/exploiting-sql-injections-insert-statements/index.html): Exploiting SQL Injections in Insert Statement, is not trivial as most of the times you do not directly see the output of the injected query. Unlike MS-SQL, mysql 'generally' do not support use of multiple queries which is a common trick of exploiting SQL Injections when backend database is MS-SQL. (250 words)
- [Session Fixation Attacks](/content/session-fixation-attacks/index.html): Session Fixation is an attack technique that forces a user's session ID to an explicit value. Depending on the functionality of the target web site, a number of techniques can be utilized to "fix" the session ID value. These techniques range from Cross-site Scripting exploits to peppering the web site with previously made HTTP requests. After a user's session ID has been (454 words)
- [SQL Injection And UTF 7 encoding](/content/sql-injection-and-utf-7-encoding/index.html): Query:- There is a web application vulnerable to SQL Injection, but the web server has added protection like magic_quotes or the application calls the function add_slashes, which means i can't insert  a single quote and thus cant exploit a SQL Injection. The injection point is in a string field. Does it means, its safe?????? Answer:- To the best of my knowledge, it is safe if (283 words)
- [Ten Cents](/content/ten-cents/index.html): Some information about MS-SQL server. You may find this info useful for exploiting SQL injection: Finding Table Names: Donot use:- Select name from sysobjects where xtype='U' Use:- SELECT table_name FROM INFORMATION_SCHEMA.TABLES [WHERE table_schema = 'db_name'] [WHERE|AND table_name LIKE 'wild'] The first query will only return the table names which belong to current (232 words)
- [SQL Injection And OOB](/content/sql-injection-and-oob/index.html): I attended this talk in defcon 15. So, if you have identified a SQL injection and outbound connections are not blocked for udp port 53, than this probably is the best way to get data out of database Server. The most beautiful part of this attack is, you can get data from database server in form of dns requests, even without being 'sa' or 'dbo'. Things you will need:- Access to (215 words)
- [MySql Default [Insecure] Installation in Debian](/content/mysql-default-insecure-installation-debian/index.html): i recently updated my MySql server and i am currently using the version.5.0.38-Debian_1-log If you ever wondered how MySql saves data on your hard disk, then this is best explained here. I will quote from the same website "Each database is a directory, with each table stored in a separate set of files. For an individual table, the .frm file contains information about the table (500 words)
- [Wordpress 2.1.2 xmlrpc Security Issues](/content/wordpress-212-xmlrpc-security-issues/index.html): Wordpress 2.1.2 xmlrpc Multiple Vulnerabilities: Affected Versions: These issues were reported in version 2.1.2,(current stable version) and its very likely that previous versions may also be vulnerable. 1. Privilidge Escalation: Under normal circumstances (through web interface) a user in contributor role only has access to following functions: a. read b. edit_posts (420 words)
- [SQL Injection, Getting past the magic quote](/content/sql-injection-getting-past-magic-quote/index.html): I recently encountered a SQL Injection, against a MS-SQL database. It happened to be an integer based injection.  Developers thought, that checking for a single quote(') in the input, would be sufficient to protect against SQL Injection attacks. What this meant was i can ask the server to return information like this:- id=1 and 1=(select @@version)--  However, becuase the (182 words)
- [Apache Axis CRLF And Content Injection](/content/apache-axis-crlf-and-content-injection/index.html): Version tested:- 1.4 vendor's website:- http://ws.apache.org/axis/ Details:- The vulnerability reported earlier this year, was later addressed by apache axis group and the error messages in version 1.4  do not leak the document root or any directory structure. However, the error message returned for an non-existing WSDL is vulnerable to CRLF injection and although, it html (191 words)
- [Pen Testing Windows Active Directory](/content/pen-testing-windows-active-directory/index.html): I have put together some thoughts on conducting a penetration test on a windows active directory. Currently this article focus on these 2 scenarios:- 1. A pentester is allowed to plug his laptop into the target network. 2. A pentester is not allowed to plug his laptop and only has access to a standard workstation. You can read it as a ".doc" file here and as a pdf here. PS: I (154 words)
- [Abusing Trackback utility](/content/abusing-trackback-utility/index.html): I was researching a bit into the wordpress trackback utility. This is how it works: You submit a post with trackback urls, and when you publish the post, the wordpress sends out a request to the URL you mentioned in the trackback URLs. Essentially this happens in the background. You-----> Wordpress Server---------->Trackback URL The trackback request to the trackback URL is (353 words)
- [Yet Another Insecure Wordpress Code](/content/yet-another-insecure-wordpress-code/index.html): Package:- wordpress 2.2.2.zip file:/wp-admin/admin- functions.php function validate_file( $file, $allowed_files = '' ) {         if ( false !== strpos( $file, './' ))                 return 1;         if (':' == substr( $file, 1, 1 ))                 return 2;         if (!empty ( $allowed_files ) && (!in_array( $file, $allowed_files ) ) )                 return 3;         (234 words)
- [Cookie Analysis](/content/cookie-analysis/index.html): Webscarab is perhaps the only tool i can think of for this. I use this tool to figure out whether the session ids are predictable or not. The 'visualisation' feature is just great. Although the interface is not a very well designed and if you are a new user you have difficulties operating this tool but once you learn this tool its very handy. Some other great features include (262 words)
- [Undisclosed Wordpress 2.0 Security Issues](/content/undisclosed-wordpress-20-security-issues/index.html): I recently came across this security advisory and decided to find out what the undisclosed issues could be. I downloaded wordpress 2.0 to find these undisclosed issues. Why i am interested in wordpress 2.0 is a different story though. :) It was trivial to figure out that this version has no protection against CSRF attacks. the file wp-admin/options-reading.php has a parameter (262 words)
- [Recommended Books For Pentesting](/content/recommended-books-pentesting/index.html): Although, i don't have the habit of reading books, here are a few books which you may consider reading. -----------  Database Hackers Handbook.(David Litchfield) Oracle Hacker's handbook (David Litchfield)  Hacking Web Applications Exposed (TMH Publications) Essential PHP Security (Chris Shifflett) TCP/IP Illustrated (Comer). Hacking Linux Exposed.  -------  As this list is (146 words)
- [Abusing TCP/IP Name Resolution in Windows to Carry Out Phishing Attacks](/content/abusing-tcpip-name-resolution-windows-carry-out-phishing-attacks.html): I was playing with name resolution in windows and i found that it sends broadcast requests over the network for the hostnames not resolved by DNS or WINS services. This is characteristic behaviour of windows and *nix boxes do not send any such broadcast requests. As these are the broadcast request, these can easily be abused to carry out phishing attacks. I wrote a small paper (225 words)
- [Man In The Middle Tools](/content/man-middle-tools/index.html): This weekend as i have nothing better to do, lemme talk about my experiences with proxy tools: Proxy Tool: Parameter Manipulation is a very important stage of web app testing, and without this, the test will be incomplete. I was using tools like Paros and Achillies for achieveing this, but the problem with both of them was they were highly unstable and would crash every now (277 words)
- [Word Press: Md5 hash in Cookie](/content/word-press/index.html): I realised word press uses a static cookie, even when u have not enabled remember-me option. This static value holds the md5 of your password (md5(md5 of password)), which remains static. Thus an xss exploit in wordpress could be really handy as the cookie remains the same unless the password for the user is changed. (122 words)
- [sitemap-xml.html](/content/sitemap-xml.html) (712 words)

## Resources

- [Full Page Index](/index.html): Browse all cached pages with rich metadata
- [About This Cache](/content/about.html): Methodology, technical details, and usage guidelines
- [XML Sitemap](/sitemap.xml): Machine-readable sitemap for crawler discovery
- [Robots.txt](/robots.txt): Crawler directives