Re: [Full-disclosure] NO-IP service Flaw

Fabio,

What if you are sniffing the traffic for any http session the information is submitted in clear text. The only way this is a real problem is if someone does a mitm attack so for now that's not really a disclosure but a function of the protocol.
Sent from my Verizon Wireless BlackBerry

-----Original Message-----
From: ghost <ghosts@xxxxxxxxx>

Date: Mon, 26 Jan 2009 19:12:33
To: Tribal MP<tribalmp@xxxxxxxxx>
Cc: <full-disclosure@xxxxxxxxxxxxxxxxx>
Subject: Re: [Full-disclosure] NO-IP service Flaw


Posts like these are just as bad as n3td3v posts. Here's an idea,
learn security, then come back with something interesting.

kthnx


On Mon, Jan 26, 2009 at 10:47 AM, Tribal MP <tribalmp@xxxxxxxxx> wrote:
A flaw exists in NO-IP service while updating the status. The problem
reside in the URL and corresponding variables because they are send in
plain text.

By monitoring HTTP traffic in a machine using NO-IP DUC it's possible
to intercept the username, password and subdomain for the account.

Example:
http://dynupdate.no-ip.com/ducupdate.php?username=email@xxxxxxxxx&pass=123456789&h[]=subdomain.no-ip.biz


Fabio Pinheiro
http://dicas3000.blogspot.com

_______________________________________________
Full-Disclosure - We believe in it.
Charter: http://lists.grok.org.uk/full-disclosure-charter.html
Hosted and sponsored by Secunia - http://secunia.com/


_______________________________________________
Full-Disclosure - We believe in it.
Charter: http://lists.grok.org.uk/full-disclosure-charter.html
Hosted and sponsored by Secunia - http://secunia.com/
_______________________________________________
Full-Disclosure - We believe in it.
Charter: http://lists.grok.org.uk/full-disclosure-charter.html
Hosted and sponsored by Secunia - http://secunia.com/

Relevant Pages

  • Re: [Full-disclosure] AntiAntiSec / Endgame
    ... protect little snots like yourselves. ... Full-Disclosure - We believe in it. ... Charter: http://lists.grok.org.uk/full-disclosure-charter.html ... Hosted and sponsored by Secunia - http://secunia.com/ ...
    (Full-Disclosure)
  • Re: [Full-disclosure] Two bulletins from Microsoft on Patch Tuesday
    ... and restraint by not responding to your personal jabs, ... Full-Disclosure - We believe in it. ... Charter: http://lists.grok.org.uk/full-disclosure-charter.html ... Hosted and sponsored by Secunia - http://secunia.com/ ...
    (Full-Disclosure)
  • Re: [Full-disclosure] Barack Obama <-- Not Appropriate
    ... That basically proves you are here to do propaganda - either voluntarily ... Mossad and being paid to post on full-disclosure. ... Charter: http://lists.grok.org.uk/full-disclosure-charter.html ... Hosted and sponsored by Secunia - http://secunia.com/ ...
    (Full-Disclosure)
  • Re: [Full-disclosure] e-Holocaust
    ... The .com domains were actually Israeli, ... Full-Disclosure - We believe in it. ... Charter: http://lists.grok.org.uk/full-disclosure-charter.html ... Hosted and sponsored by Secunia - http://secunia.com/ ...
    (Full-Disclosure)
  • Re: [Full-disclosure] The war in Palestine
    ... But people like Schneider ask for this hate. ... Full-Disclosure - We believe in it. ... Charter: http://lists.grok.org.uk/full-disclosure-charter.html ... Hosted and sponsored by Secunia - http://secunia.com/ ...
    (Full-Disclosure)
Loading