Cloudberry Engineering

2015-04-09 Beyond Superfish: a Journey on SSL MitM in the Wild
2015-02-28 FakeCommerce, an exercise in OSINT
2013-03-19

Video:

Also available on WordPress.tv.

Slides: Available on SlideShare
# / #wordpress #security #wordcamp
2012-11-22 Vulnerable SWF Bundled in 40 Wordpress Plugins
2012-08-26 DOM XSS Honeypot
2012-08-14 Hunting Wordpress Exploitation in the Wild
2012-05-30 DLL and Code Injection in Python
2012-02-24 What's New in xsssniper 0.8.x
2012-01-21 WordPress Mingle Forum <= 1.0.32.1 Multiple Vulnerabilities

2012-01-21

# Exploit Title: WordPress Shortcode Redirect plugin <= 1.0.01 Stored XSS
# Dork: inurl:/wp-content/plugins/shortcode-redirect/
# Date: 2012/01/18 
# Author: Gianluca Brindisi (g@brindi.si @gbrindisi http://brindi.si/g/)
# Software Link: http://downloads.wordpress.org/plugin/shortcode-redirect.1.0.01.zip
# Version: 1.0.01

Vulnerability

You need permissions to write a post (HTML mode) to exploit the shortcode:

[redirect url='http://wherever.com"[XSS]' sec='500"[XSS]']

# / #wordpress #advisory #stored-xss