David Sopas – Web Security Researcher

10/08/15 Interesting Readings # , , ,

Cobalt.io published a nice interview about me

For those who want to know more about me and my work at Cobalt.io check the interview I gave to their blog.


#kudos to Cobalt.io

no responses
09/08/15 Interesting Readings # , ,

Drive it like you hack it – Samy Kamkar at Defcon 23

Drive it like you hacked slides at Defcon 23 by Samy Kamkar. Very cool car hacking talk.


no responses
08/08/15 Advisories # , , ,

ArubaNetworks Avatar Image XSPA

ArubaNetworks Avatar Image XSPA

I found out that was possible to run a XSPA [Cross Site Port Attacks] using Avatar URL option on any registered community profile.
XSPA allows attackers to abuse available functionality in most web applications to port scan intranet and external Internet facing servers.
An application is vulnerable to Cross Site Port Attacks if the application processes user supplied URLs and does not verify/sanitize the backend response received from the server.

In this type of attack I always use Nmap testing machine – scanme.nmap.org to check what ports are open on the server.
Using Nmap on my operating system I tested 3 ports on scanme.nmap.org:

80/tcp open http
81/tcp closed http
443/tcp closed https

I now entered the following external URL on my Avatar web option – https://community.arubanetworks.com/t5/user/myprofilepage/tab/user-icons%3Aexternal:

No server error.

I modified it to:

And after to:

The following errors were returned on the server:

http://scanme.nmap.org:81 – GET http://scanme.nmap.org:81/ net::ERR_CONNECTION_REFUSED

http://scanme.nmap.org:443 – GET http://scanme.nmap.org:443/ net::ERR_CONNECTION_REFUSED

You can even check that the port is stored in the avatar HTML:

<img id="display" class="lia-user-avatar-message" title="dsopas" src="http://scanme.nmap.org:443/" alt="dsopas" />


Aruba security team already fixed this issue so I decided to share with you guys.

no responses
06/08/15 Interesting Readings , News # , ,

Details on the Cross-Site Request Forgery Vulnerability Disclosed at Black Hat

no responses
06/08/15 Bug Bounty , Swag # , ,

First to reach 1000 rep score on Cobalt.io

First to reach 1000 rep score on Cobalt.io

Yes! I made it.

Since my registration on March this year I reached more than 1000 reputation points on Cobalt.io and become the first to do it.
Most of the points were made on private/invite only programs but a couple of them were also public in companies like Nexmo, Weebly, DoSomething and Circle.

My next goal? Keep having fun with the guys on Cobalt.io. They’ve a great team and are supported by many talented security researchers.

If you are a company who needs security checked by professionals just register your program.

no responses
06/08/15 Bug Bounty , Donations # , ,

Sharing is caring!

Sharing is caring!

I always try to help the local dogs and cats shelter with food and medications.
Some extra cash from bug bounties helped me to give more often so I try to do my best.

The reward is priceless! Dogs and cats that were abandoned with a better way of life.

Hope you guys do the same…

no responses