MACROMEDIA COLDFUSION 5-CFML manuals

Macromedia COLDFUSION 5 - CFML User Manual (102 pages)

Brand: Macromedia | Category: Books | Size: 4.69 MB |

English

Table of contents

ColdFusion for Pentesters

1

• Chris Gates (CG)

2

• Attacking ColdFusion

3

• Defense?

3

Why This Talk?

4

What Is ColdFusion?

5

Who Uses ColdFusion?

6

• inurl:/index.cfm

10

• inurl:login.cfm

11

• Delicious 

15

ColdFusion Hit list

16

ColdFusion Scanner

22

Attacking ColdFusion

24

• Common Vulnerabilities

25

• Information Disclosure

26

• Enterprise

27

• Standard

28

<script> tags

34

</cfquery>

37

• Insta-Shell

39

• Patching

40

• Pro Tip

41

– Checked on 7-9

42

• Gotta work for it…

57

• Admin Interfaces

62

• Metasploit Module

68

Your passwords suck

69

• Other Stuff

70

• Interacting with CFC’s

73

• Example Admin Cookie:

75

• Base64Decodes to:

75

• OMGWTFBBQ!!!

78

• But real world?

79

• Scheduling Tasks

84

Post Exploitation

84

• Go to DataSource Selection

91

• View Source, get value

93

• CFM Shells

96

ColdFusion Stuff To Read

101

Questions?

102

MACROMEDIA devices