Vulnerabilities can be find in on any server and application, even the big companies are not secure you can find vulnerabilities on their servers. BlackBerry, I think there is no need to introduce BlackBerry a high risk vulnerability has been found on BlackBerry Enterprise server components that process images could allow remote code execution.
RIM has released a security warning with advisory about a hole on BlackBerry server that can be use by an attacker to compromise a system remotely. The vulnerabilities have a Common Vulnerability Scoring System (CVSS) score of 10.0 (high severity). Vulnerabilities exist in components of the BlackBerry Enterprise Server that process PNG and TIFF images for rendering on the BlackBerry smartphone.
To exploit these vulnerabilities in how the BlackBerry MDS Connection Service processes PNG and TIFF images, an attacker would need to create a specially crafted web page and then persuade the BlackBerry smartphone user to click a link to that web page. The attacker could provide the link to the user in an email or instant message.
Affected Software
- BlackBerry® Enterprise Server version 5.0.1 through 5.0.3 MR2 for Microsoft Exchange
- BlackBerry® Enterprise Server version 5.0.1 through 5.0.3 MR2 for IBM Lotus Domino
- BlackBerry® Enterprise Server version 4.1.7 and version 5.0.1 through 5.0.1 MR3 for Novell GroupWise
- BlackBerry® Enterprise Server Express version 5.0.1 through 5.0.3 for Microsoft Exchange
- BlackBerry® Enterprise Server Express version 5.0.2 and 5.0.3 for IBM Lotus Domino
BlackBerry smartphones and the device software's are not affected so as a end user you dont need to worry about it.
Note: If you want to learn more about Linux and Windows based Penetration testing, you might want to subscribe our RSS feed and Email Subscription or become our Facebook fan! You will get all the latest updates at both the places.
Posted: 12 Aug 2011 07:32 AM PDT
Information is a weapon, a successful penetration testing and a hacking process need a lots of relevant information that is why, information gathering so called foot printing is the first step of hacking. An intelligent penetration tester use some intelligent tools and techniques to get the right information on a right time, for social engineering (human hacking) you need relevant information about a person. So the point of this little discussion is to realize the importance of information gathering.
What Is TheHarvester
After getting some knowledge about information gathering you might be interested to know how to perform it. TheHarvester is a tool for gathering e-mail accounts, user names and hostnames/subdomains from different public sources like search engines and PGP key servers. This tools has designed to help the penetration tester on a earlier stage, it is an effective and simple tool that is very easy to use.
Supported Sources for Information Gathering
- Google - emails,subdomains/hostnames
- Google profiles - Employee names
- Bing search - emails, subdomains/hostnames,virtual hosts
- Pgp servers - emails, subdomains/hostnames
- Linkedin - Employee names
- Exalead - emails,subdomain/hostnames
Related Information Gathering Tutorials
Foot-printing or information gathering is not a new term and we have discussed so many articles with different tools and techniques before for both Windows and Linux (Ubuntu, Backtrack), here is the comprehensive list of articles.
FootPrinting-First Step Of Ethical Hacking
Maltego- Information Gathering Tool Tutorial
Dnsmap- DNS Network Mapper
Backtrack 5- DNSenum Information Gathering Tool
Download Theharvester
If you are using backtrack 5 and other versions of backtrack than you not need to download and run harvester because it is available on backtrack, while for other Linux distributions like ubuntu download and install it. However you can use Theharvester for other Operating system because it need python to run.If you are using Blackbuntu than theharvester available on it.
TheHarvester Tutorial
Theharvester is a very easy tool to use just follow the tutorial to get the best result. For backtrack open terminal and locate the directory.
root@bt:/pentest/enumeration/theharvester#
For other distributions locate the directory. For best result I use the command
root@bt:/pentest/enumeration/theharvester# ./theHarvester.py -d google.com -l 500 -b googleroot@bt:/pentest/enumeration/theharvester# ./theHarvester.py -d targetsite.com -l 500 -b google
So here is the result with complete details.
I hope you are enjoying the reading, now use the wonderful tool by yourself and if you have any question ask via comment box.
Note: If you want to learn more about Linux and Windows based Penetration testing, you might want to subscribe our RSS feed and Email Subscription or become our Facebook fan! You will get all the latest updates at both the places.
No comments:
Post a Comment