Search This Blog

Powered by Blogger.

Blog Archive

Labels

Showing posts with label Defencely. Show all posts

Defencely Website vulnerable to Non Persistent XSS

Security Researcher Vedachala has discovered a post based Cross site Scripting vulnerability in the Defencely website - A company that provides web application penetration testing service.

The main page of the Defencely allows user to enter their website to get a security report.  The form gets the input and pass the website address as "website_url" parameter to "Defencely.com/report_submit.php".

"If a web application is getting user's input, it is always better to double check and make sure the parameter is sanitized." 

Post based xss in Defencely

Veda has identified that "website_url" parameter is not sanitized and vulnerable to post request based XSS.  He successfully managed to get the injected-script executed.

In one of the facebook group related to Security , the researcher provided the proof-of-concept(You can also find the details at pastebin.com/9JeJ1HK6).  We have successfully verified the vulnerability.  At the time of writing, the website is still vulnerable.

*Update:
 Another Security Researcher named QuisterTow has discovered one more xss Vulnerability in the Defencely website.

The researcher provided the following POC in the pastebin(http://pastebin.com/yZzyezqG):
www.defencely.com/getstarted.php?id=Ij48aW1nIHNyYz14IG9uZXJyb3I9cHJvbXB0KCd4c3NlZCcpIC8+&price=OTk=&plan=c3RhcnRlcg==

At the time of writing, we are still able to reproduce the vulnerability.

An Interview with Mr. Dependent of Defencely.com : Tushar. R. Kumbhare

1. Introduce yourself:
Hello EHN readers and everyone else from the World Wide Web Community, I’m Tushar Rajhans Kumbhare from India. Probably, your next question would be related to my work, so here goes: I am pursuing a B.E Degree in Telecommunication & Electronics.

At the moment, I am awaiting my study completion, which is going to take a while. However, what I actually do right now and something that has become my destiny as of last few weeks, is my role as a Security Analyst and Pen Tester at Defencely.Com.

Am I too chatty, aren’t I? To cut it short, Defencely is India’s number one and upcoming online cloud penetration services company. Prior to joining their team, I was independently working as a security researcher, and got several awards of recognition from:

• Microsoft
• Apple
• Adobe
• RedHat
• PayPal
• ZenDesk
• Weraki
• Avira
• iFixit
That’s about it… I guess.

2. How did you get into Information Security Field?
Yeah, that is an interesting tale. Generally speaking, I belong to the modern generation, where kids are fascinated with the idea of computers, website hacking, security intrusion, whether good or bad, and reverse engineering. I guess it kind of gives them a sense of control and purpose in life.

However, there are hardly any cases when these “kids” grow up to pursue their dreams. I, for one, loved the idea of computer and website hacking. Not that I was a hardcore hacker, I did things ethically and wanted to become part of the good guys team :P

I just got my laptop 3 years ago. Before that, I was using computers at par level. It is unbelievable, right? It took me 3 years to get better at online security penetration related stuff. As the story goes, there I was in my 2nd Semester’s Programming class. They have that mandatory C language course for everyone.

The first day when I was in C language lab, I was the only student sitting in front of a computer that wasn’t even powered on. How so? I didn’t know how to turn that “darn PC” On. The snobbish teacher walked up to me, thinking that I was just wasting her time, and said, “Why don’t I see you writing any program like the rest of the class?”

I hesitated. By then the dialogue took a wild turn when I admitted to know nothing about powering on computers. Her words: “What” and “Get out of my class, young man” still echo in my head. Besides, I was the laughing stock of the entire university for about two weeks.

My parents were very supportive of me. They spent a chunk of their savings to buy me a laptop. Since then, I have been pursuing my fascination, which is computer and website hacking. From then on, I scavenged all kinds of knowledge about Hall of Fame security acknowledgements.

Hard work and persistence took the better of me, and there I was, trying to get listed on these company pages.

3. Why did you choose to become a Security Researcher?
Curiosity is the harbinger of dreams - (I just came up with this quote myself. Dibs on that) I already said that security research always inspired something in me. Therefore, I set off to develop my “how stuff works” mentality. My long term goal was to get listed in various websites’ Hall of Fame pages. They have these pages set up for security analysts; anyone who points out a vulnerability in the system.

But it wasn’t easy. Endless nights and countless hours were spent to achieve this dream. I worked diligently and was finally able to become a part of society that believes in making the internet a better place for all.



4. How did your first vulnerability report go? How did you find it and what did it feel like at that time?
I’m very glad you asked that question. No one forgets his first encounter with a big company. For me, it was Microsoft back then. After detecting a vulnerability in their network, I reported it without any hopes of seeing my name at their website’s Hall of Fame section. Time went on, and one day I got confirmation from the guys at Microsoft. They thanked me as their company’s custom goes.

It was the most wonderful moment of my life. I was ecstatic, speechless, happy and downright surprised at myself. The incident sparked confidence in me and motivated me to pursue cloud penetration professionally.

Here I’d love to tell all aspiring security analysts that you are your own boss. The so-called “experts” will not only laugh at you, but they’ll also refuse to help you. People hardly part ways with their knowledge in this field. Therefore, you have to work hard and one day you’ll overcome your dreams.



5. What's your research that makes you especially proud?

3 months ago was a “Bug Hunting and Reporting” season for me. I’m not talking about pesticides and actual insects lurking around; it was kind of a virtual online thing. Jokes apart, it took me a lot of time to cover the gaps. No one guided me, or helped me; all upcoming security researchers know this by heart.

The crux of my research is to manually scan any online resource for security threats, and then report it to the concerned authorities. Other than computer related stuff, I also submitted a research paper on Einstein’s Theory of Relativity in 12th Standard. They thanked me and gave me a certificate. I guess this “research” factor comes to me by blood :P



6. How do you feel after being part of Defencely?

How did I feel? I can’t give words to my feelings. First of all, Defencely is the only cloud penetration services company that purely hails from India. There are others too, but most of them are headed in the U.S of A, with some team members scattered around in India.

So it was a big deal for me to be a part of a network that belongs to my country. Defencely also inspired me to chase my dreams with due diligence. Besides that, my parents were damn proud of me… at last. I was kind of a lazy bum in studies, so my dad started doubting my future. I’m going to dedicate the rest of my time and effort to Defencely and brute force ethical standard hacking.



7. What is your advice for new bug hunters?

Dear brothers, I know it is quite easy to give advices but bear with me. As an upcoming security researcher of high caliber, you have to throw yourself at it. No one is going to teach you or hold your finger.

Keep in mind the high competition factor and make the internet your new teacher. On your way, you’ll meet all kinds of people. Some of them will vow to help you but they won’t. Others, though EXTREMELY rare, will give you in depth knowledge about hacking and security assessment. That’s about it. The rest of the stuff, you’re going to have to handle it on your own.

Stay motivated and don’t lose hope, no matter what kind of field you are interested in. By the way, start immediately with OWASP standards. Move your skills across WASC classes and learn anything that any online tutorial has to churn out.

Got it? Why are you still here, then? Go and start your work!

Here’s another one of my chin up speeches for you: To be successful in this field (or any field) you must have a positive and “can do” approach in life. Don’t let haters and their negative energy take you down. You will feel like a loser every now and then – this happens, but don’t give up on anything.

As a matter of fact, you can connect with me on:





8. What do you think about E Hacking News?

EHN is a great opportunity for anyone who is connected to the internet. Granted that you are contributing to someone or something and it is related to the scope of this website, talk to their super friendly admins. They will love to interview you; expose your skills to the world and help you meet fellow community members.

Already EHN has created buzz with its published content. I can only wish you guys all the best for your future endeavors.

9. Is there anything else you like to add?

I would like to add a few things here. First of all, a very special thank you note goes to Mr. Ritesh A. Sarvaiya, CEO and Founder of Defencely.Com. His character and role definitely bypasses as that of a CEO, which itself is a big responsibility these days.

Ritesh Sir (as everyone likes to call him that) has a knack for finding talent all over the world. One thing that I love about him is the fact that he is one of the very few people who would go to extremes to give your destiny a shape. As long as you have the talent to show for, and something that Ritesh Sir can work on, you’ll have it.

Atul Shedage. To me, Atul is like a brother and a great mentor. He is CTO (Chief Technology Officer) at Defencely. We have already heard a lot about him. He is the youngest Indian CTO to receive multiple awards of recognition from many online companies.

Lastly, I would like to thank Sabari Selvan; EHN website webmaster and owner. Without his unmatched support, I wouldn’t be here talking about my dreams and everything that you just read. Thanks Sabari, and good luck to you with whatever you are up against in life. A bunch of appreciation also goes to the entire Defencely and EHN panel. You guys rock.

An Interesting Interview with Security Researcher & CTO of Defencely.com : Atul Shedage

E Hacking News had an interesting Interview with Atul Shedage, a Security researcher and CTO of Defencely.com. Here we go,

1. Please Introduce yourself to EHN's readers

Hello EHN World let me take this fragment of a moment to thank you all for this interview. That being said, I’m Atulkumar Hariba Shedage from Maharashtra – Pune. But you can call me “Atul”, as I am mostly known for my short name in the online world.

I am currently assigned as the CTO (Chief Technology Officer at Defencely.) It is an online platform for detecting, reporting and fixing website vulnerabilities for clients from all over the globe. Nothing pleases us more than being able to render our skills for popular companies, such as;

  • Google
  • GitHub
  • ZenDesk
  • RedHat
  • PayPal
  • Apple
  • Zendesk
  • Zynga

At the moment, I am in the middle of pursuing my academic career in Masters of Computer Science from Pune University. Besides pushing in boring assignments and taking notes, hacking and critically analyzing online security vulnerabilities is my second passion.

2. Why did you choose to become a security researcher?

Hmmm… this security researcher field wasn’t really planned. I’d say it was my destiny to become known in the online security field. Upon enrollment in the Bachelor Degree program, I had hopes of being one of the best web designers or programmers for that matter.

Back in 2008, I met this guy: Anil, who, later on, befriended me. He gave me the idea of giving online security a shot. As they say, “You ain’t got nothing to lose if you are going to try.” I put my hunches ahead of me and started taking introductory tutorials from every possible source.

Before you know it, I was drenched in the passion of creating or doing something worthwhile in this field, which is why we are having this interview. Fate and hard work brought me here; destiny brought us face to face

3. Tell me something about www.Defencely.com

Defencely is completely different than any automated website scanning or monitoring service. That’s because we take steps to secure your website before something goes wrong, rather than trying to pinpoint and clean up the mess after the fact. Our security experts have been trusted by dozens of top corporations, Fortune 500 companies and small businesses around the world to provide flexible, lightning-fast responses to security threats the moment they’re found.
What really matters is how we operate and render our services – these two elements are the crux of helping us signify ourselves. Defencely believes that nothing on the Internet is secure, which is the first and the foremost rule of online security services.

Secondly, we not only detect vulnerabilities, but we also provide long lasting solutions / fixes to them. On common grounds, any web security company can detect vulnerabilities. They can get small time scanner software to take the sting out of “manual labor”, if you’d like to put it that way. Defencely team, on the other hand, is able to fix and detect vulnerabilities because of robust knowledge base and real life experience of dealing with such situations.

4. What's your research that makes you especially proud?

Something that has made me proud…? Hmmm <scratching my chin>. I can’t or maybe I don’t want to say for sure about what has made me truly proud… yet. I believe that one can only feel proud when he or she has indeed achieved a lifelong goal.

However, I did stumble upon moments of happiness and rejoice. For instance, being able to talk to big online companies about gaping holes in their security system, contacting big shots such as; “Adam” from Google’s security panel, getting acknowledgements from ZenDesk security team and vice versa – this is what is taking the Defencely team and myself to an unknown destiny in the skies above.

Overall, it is a killer experience.

5. What advice would you give a website admin to secure their site?

As stated a little while ago, there is no such thing as security. Once your product or website has gone live, it is always exposed to unknown threats from all over. I would implore web admins to secure their websites by hiring able security researchers to help stop any possible damages.

Yes, it is true that you can never secure anything to a 100% extent. But, if adequate steps are taken, you can prevent a great deal of hassle in the long run. Also, your security levels will reach a point where so called hackers would have a hard time breaching all the parameters.

6. How did you step in the Information Security field?

It was year 2008; I was freshly enrolled in the BSC 1st Year Degree Program. Within a few months of meeting new people, the subject of online security piqued my interest way too much. I had to do something about it.

I joined forums, read stuff at Google, trained myself through various web security tutorials and never looked back. It was those hours of sheer self-motivation, endless nights of reading, watching and self-mentoring, which eventually paid off in huge dividends.

I also followed a couple of security researchers at Twitter, and made friends with some very interesting individuals. I am thankful to everyone for believing in me and supporting me throughout those tumultuous times.

7. What vulnerabilities have you discovered so far in your career as a Security Researcher?

I have gone through the OWASP Top 10 vulnerabilities, ClickJacking incidents, WASC 26 Vulnerability Classes and etc. Practically speaking, I don’t limit my knowledge to a particular set of vulnerabilities, as I try to learn and discover something new each day.

These days, I’m mostly focusing on collaborating with Defencely and 0 Day Vulnerabilities. So far, the result and the feedback have been quite good. We also reported some vulnerabilities in WordPress Plugin and a Gallery Project that was patched right after we sent notifications to the developers.

8. Where do you see Defencely in a few years?

Right now, it is still too early to say where Defencely would be in a few years. Things look very bright and there are no worse case scenarios to foresee. The reason being is that Defencely excels where others don’t. We are all backed up by very supportive individuals and a set of minds that are extremely proficient in their relevant fields.

Like I said before, it takes knowledge of the unknown and vast experience to report those vulnerabilities that aren’t even discovered yet. We don’t work a lot with scanners. Manual man hours and lots of hard work are going to take Defencely to new heights of stardom in the tech niche industry. The next few years are absolutely going to be rewarding, and awesome.

I have strong faith in Leadership of Ritesh Sarvaiya, who is CEO of Defencely.com & with his vision I look forward to see Defencely growing leaps and bounce in coming years to come.

9. What is your advice to newbie who interested in PenTesting field?

Newbie testers and ethical hackers are strongly advised to stay motivated. As a friend, I am telling you guys to never give up on your dreams. Keep learning and keep looking for answers. I know it is very easy to partake in words of wisdom but I have experienced adversity in my life.

The key to remaining successful in online security field or anything is to believe in what you’re doing. Believe in your goals wholeheartedly as if your entire life depends on them. By the way, join forums, engage in talking to security panel members and start by reporting vulnerabilities for the sake of helping other individuals on the internet.

Soon you will start getting recognition.

If you guys need any kind of extended support from my end do not hesitate to connect with me on FaceBook, Twitter & LinkedIn

10. It is nice to talk to you. What do you think about E Hacking News?

I think that with a staggering 18K + Facebook users, a constantly updated content database and lots of interesting information, ‘E Hacking News’ is aggressively doing the right thing. You guys are one of the few who believe in creating a buzz with actual reports and not just filler articles.

I’d love for ‘E Hacking News’ to go beyond the horizon and get more recognition from the entire World Wide Web Community. Thank you Sabari and two thumbs up to you for undyingly pursuing your goals on the internet.

11. Is there anything else you like to add?

I’m glad you asked this question. Without mentioning a few names, I would be feeling ethically impugned, which is why I need to give credit where it is due.

Let me thank Mr. Ritesh A. Sarvaiya; CEO and Founder of Defencely. With his ingenious thinking skills and a drive to find new talent, Ritesh is always at the verge of creating something new. I believe that he has a brain of a whizz kid because of the way he has been creating teams and helping people discover their true potential.

Followed by that, I’d like to thank Mr. Rahul Varshneya. He is Defencely Advisory Board Member. But trust me; Rahul’s position goes beyond as that of an advisor. He has more than a decade of pure entrepreneurial skills, a knack for mentoring and aiding startup businesses get up on their feet.

Rahul is currently administering several ongoing projects and businesses. There is Arkenea Technology, a partner to entrepreneurs and clients, who seek professional help concerning mobile apps and businesses. Then there is his invite only membership to the ‘YEC – Young Entrepreneurs Council’, which he is using to guide bright minds.

Mr. Rahul Varshneya is also a writer, and a pretty good one at that. He is a published author at ‘Under30CEO’, Entrepreneur.Com and VentureBeat. His experience is indeed enlightening way for digital marketers and various internet based brands.

Finally, there’s Bilal Malik, who is designated at Defencely as our ‘Lead Content Manager’. Mr. Ritesh scooped him up after believing in his talents at the break of their first online encounter.

Anything that needs to go down in written form, it is always run by this guy. Be it documentation, haphazard survival guides for security service seekers, PRs – I mean anything. Merely calling Bilal: a writer, would probably be unnerving for us.

All other members of Defencely; and people from technical departments are equally acknowledged. Without you guys, and without an amazing team, I wouldn’t have been here today working together as brothers in arms.

Sabari, it was fun answering all your questions. My regards to you and your loved ones. Have a great day