websecurity@lists.webappsec.org

The Web Security Mailing List

View all threads

DAVOSET v.1.2.1

M
MustLive
Tue, Oct 28, 2014 4:28 PM

Hello participants of Mailing List.

After making public release of DAVOSET
(http://lists.webappsec.org/pipermail/websecurity_lists.webappsec.org/2013-June/008850.html),
I've made next update of the software. At 23rd of October DAVOSET v.1.2.1
was released - DDoS attacks via other sites execution tool
(http://websecurity.com.ua/davoset/).

Video demonstration of DAVOSET: http://www.youtube.com/watch?v=RKi35-f346I

Also yesterday I opened a repository for DAVOSET:
https://github.com/MustLive/DAVOSET

Download DAVOSET v.1.2.1:

http://websecurity.com.ua/uploads/2014/DAVOSET_v.1.2.1.rar

In new version there was added support of attacks via WordPress, based on
XML support since v.1.1.2 (released at 31.07.2013). After vulnerability in
XML-RPC PingBack API in WordPress was found last year, I added support for
XML in DAVOSET (to use with XXE vulnerabilities, but it also can be used
with this vulnerability). After that people many times asked me to add this
support, but nobody wanted to do it by himself, so I added it. Also there
were added new services into both lists of zombies and removed non-working
services from lists of zombies.

In total there are 175 zombie-services in the list. I added 3 and removed 18
zombie-services. I removed a lot of vulnerable sites from the lists, because
admins became fixing holes at their web sites in summer - after significant
increase of use of my tool.

Best wishes & regards,
MustLive
Administrator of Websecurity web site
http://websecurity.com.ua

Hello participants of Mailing List. After making public release of DAVOSET (http://lists.webappsec.org/pipermail/websecurity_lists.webappsec.org/2013-June/008850.html), I've made next update of the software. At 23rd of October DAVOSET v.1.2.1 was released - DDoS attacks via other sites execution tool (http://websecurity.com.ua/davoset/). Video demonstration of DAVOSET: http://www.youtube.com/watch?v=RKi35-f346I Also yesterday I opened a repository for DAVOSET: https://github.com/MustLive/DAVOSET Download DAVOSET v.1.2.1: http://websecurity.com.ua/uploads/2014/DAVOSET_v.1.2.1.rar In new version there was added support of attacks via WordPress, based on XML support since v.1.1.2 (released at 31.07.2013). After vulnerability in XML-RPC PingBack API in WordPress was found last year, I added support for XML in DAVOSET (to use with XXE vulnerabilities, but it also can be used with this vulnerability). After that people many times asked me to add this support, but nobody wanted to do it by himself, so I added it. Also there were added new services into both lists of zombies and removed non-working services from lists of zombies. In total there are 175 zombie-services in the list. I added 3 and removed 18 zombie-services. I removed a lot of vulnerable sites from the lists, because admins became fixing holes at their web sites in summer - after significant increase of use of my tool. Best wishes & regards, MustLive Administrator of Websecurity web site http://websecurity.com.ua