I love food with healthy and simple ingredients. I am a recipe developer and food blogger who is inspired by many cultures around the world. Today, I could be in Thailand having a Tom Yum Soup, and tomorrow I will be in France eating bouillabaisse!
Rogue Foodies is for everyone who loves to travel through the food they eat without borders, labels, or travel restrictions!
Become a member to get new recipes in your email every week
While trying out the invalid host technique, I noticed pingbacks arriving from a small pool of IP addresses for payloads sent to completely unrelated companies, including cloud.mail.ru. I initially assumed that these companies must collectively be using the same cloud WAF solution, and noted that I could trick them into misrouting my request to their internal administration interface. Something wasn't quite right, though; the reverse DNS for this IP pool resolved to bn-proxyXX.ealing.ukcore.bt.net - BT being British Telecom, my company's ISP. Getting a pingback from Kent, UK for a payload sent to Russia is hardly expected behavior. I decided to investigate this using Burp Repeater, and noticed that the responses were coming back in 50ms, which is suspiciously fast for a request that's supposedly going from England to Russia, then to the collaborator server in a datacenter in Ireland, then back to England via Russia. A TCP traceroute to port 80 revealed the truth:
However, the forums database was also stolen, so your email likely ended up on pwned from that. The hacker got usernames and emails, along with an encrypted (but crackable) password. If you use the same username, email and/or password anywhere else you should change them ASAP.
Unless the website in question does careful html filtering of what users upload, any other site visitor who so much as views this comment will have the do_something_bad() script executed by his or her browser. The script might email information about the target user to the attacker, or might attempt to exploit a browser vulnerability on the target system in order to take it over completely. The script and its enclosing tags will not appear in what the victim actually sees on the screen. 153554b96e