This tutorial gives you a basic understanding of a ColdFusion exploit. A scary thing is, very many government and military websites use this software… but only about 15% are vulnerable. If you use ColdFusion on your web server, I would recommend you check it against such an attack. Well, let’s get started! You will need: […]
read more »
ColdFusion has several very popular LFI’s that are often used to fetch CF hashes, which can then be passed or cracked/reversed. A lesser use of this LFI, one that I haven’t seen documented as of yet, is actually obtaining a shell. When you can’t crack or pass, what’s left? The less-than-obvious solution is to exploit CFML’s parser, […]
read more »
So this attack has been published for a while now and I just never posted but I still have found it fruitful during pen tests. For that reason I wanted to collect all the information I have read and learned while performing this attack into one location for my reference. The basic concept of this […]
read more »
Preface Recently, I have been working in an environment with lots of Adobe ColdFusion installations, most of them unpatched, having nice, exploitable vulnerabilities. You can find almost everything about hacking ColdFusion on different blogs / forums / etc. but for convenience, I wanted to collect those tricks that I was able to use in real […]
read more »