illmob.org

WordPress Remote Admin Password Reset Vulnerability

August 11th, 2009 by Dev Team in News, Uncategorized

A new post appeared on the WordPress discussion list today revealing more details about the process. Everyone is apparently able to reset a WordPress password if the email address of the WordPress user is known. All that needs to be done is to point the web browser at http://www.domain.com/wp-login.php?action=lostpassword to reset the password. The email address of the account holder has to be supplied in the form. WordPress usually will send a confirmation email first asking the email account owner if the password should be reset. The vulnerability manipulates the query to skip this step.

It is not possible to exploit this vulnerability further which means attackers cannot get access to the user account. It can however be theoretically be used to reset the password regularly to lock the user or admin out of the WordPress blog.

A temporary fix for the remote admin password reset vulnerability was posted. WordPress administrators need to change one line of code in the wp-login.php file of the WordPress installation to protect their blog from the attack. There is no official release fixing this problem, apply this changeset to your wp-login.php.

change line 190 in wp-login.php to

if ( empty( $key ) )

With

    if ( empty( $key ) || is_array( $key ) )

It is advised to apply the temporary fix as soon as possible to WordPress installations.

ChromePasswordDecryptor

July 23rd, 2009 by Dev Team in Uncategorized

Google Chrome browser is the latest entry into the ongoing web browser’s war which is mainly ruled by IE and Firefox. The word Google behind the Chrome has given it lot of hype and popularity than any other browser got in such a short duration. However some of the features such as searching from the same address bar, thumbnails of top sites, private browsing etc makes it stand apart from other browsers in the market.

Like other browsers Chrome also has built-in login password manager functionality which keeps track of the login secrets of all visited websites. Whenever user logins to any website, he/she will be prompted to save the credentials for later use and if user chooses so, then the username & passwords will be stored in internal login database. So next time onwards whenever user visits that website, he/she will be automatically logged in using these stored credentials which saves hassle of entering the credentails every time.

ChromePasswordDecryptor is standalone application which does not require any installation and can be directly executed after copying to local system.

* Launch the ChromePasswordDecryptor on the system.
* By default it will automatically display the default chrome profile path for current user. However you can change the path using the ‘browse’ button besides it.
* Then you can click on ‘Show’ button to decrypt and display all the stored login secrets from Chrome.
* Next you can click on ‘Export’ button to save all the secrets to standard HTML file.
Download chromepassworddecryptor

Saved Password Locations

November 25th, 2008 by admin in Firefox, Password Info, Trillian, windows, Yahoo

Many people ask about the location in the Registry or file system that applications store the passwords. Here is a list of password storage locations for popular applications compiled by Nir Sofer.
Be aware that even if you know the location of the saved password, it doesn’t mean that you can move it from one computer to another. many applications store the passwords in a way that prevent you from moving them to another computer or user profile. (more…)

Recovering Internet Explorer Passwords: Theory and Practice

July 6th, 2008 by Dev Team in News, Password Info, windows

Brief introduction on how Internet Explorer stores its passwords

(more…)