Francesco 'ascii' Ongaro

Research

• PHP filesystem attack vectors - Take Two
• PHP filesystem attack vectors
• XSS Cheat Sheet: non repeating payloads
• 25C3 (CCC Congress 2008) Tricks: makes you smile
• Slides @System 2008 - Dipartimento di Informatica dell’Universita’ di Pisa
• Shared hosting “file” handler PHP session dumper
• LFI2RCE (Local File Inclusion to Remote Code Execution) advanced exploitation: /proc shortcuts
• Local File Inclusion (LFI) of session files to root escalation
• mod_negotiation: directory listing, filename bruteforcing
• Detect NoScript POC
• Skype 1.4.118 for Linux = Panacea
• Scanning DMZ hosts with remote file opening
• Architecture detection by PHP anomaly
• Why the Skype 0day exploit is a fake
• Clientside security: Hardening Mozilla Firefox
• XSS Cheat Sheet: two stage payloads
• XSS Cheat Sheet: the PLAINTEXT tag
• Linuxpersec2 a Verona (16/17 Giugno)
• Install Firefox XPI without whitelist
• Interview with Rain Forest Puppy
• Bad url redirections (AKA: Many thanks to our partners!)
• Pseudo threading with BASH
• HttpOnly Cookies Reference
• IE7 ping back home, MS and your browsing history
• LugVR Contest 01: Google Maps Reverse Solution
• LugVR Contest 01: Google Maps Reverse
• Pratical XSS n1
• Port scanning with online services
• Port scanner with dnsstuff
• Truffa ai sondaggi di mambo
• HttpOnly Cookies and Mozilla Firefox
• EXIF Phun
• Arin.net XSS
• Windows software

Repositories

• basehttpserver-base64-webshell A self-serving Python 2.7 HTTP GET/POST Web Shell
• dropzone-no-autoload A fork of https://github.com/enyo/dropzone that works with jQuery
• hotpotato An hot Access Point
• insecure-php-file-upload Vulnerable PHP File Upload
• php5-security Secure configuration for PHP
• blanker-slate-child Blanker Slate Child Theme
• blanker-slate Blanker, blankest slate
• perfect-bash Perfect Bash RC
• secure-ssh-server The perfect /etc/ssh/sshd_config
• ricoh-spc250dn Ricoh SP C250DN/C252DN
• wikileaks-spyfiles4-customers FinFisher Customers Analisys
• openmagic OpenSSL TLS heartbeat read overrun (CVE-2014-0160)
• ocz-revodrive-2.6-proxmox Support for OCZ RevoDrive3, RevoDrive3 X2, zDrive R4 in Proxmox
• flipper Convert lines of a stream to columns or an associative array
• selfoss_sqlite2mysql Convert the Selfoss DB from Sqlite to MySQL
• asterisk-recording Monitoring and recording scripts for Asterisk
• aruba-logparse Parse Aruba Network log messages

Advisories

• Veeam Backup & Replication Local Privilege Escalation Vulnerability
• Nginx, Varnish, Cherokee, thttpd, mini-httpd, WEBrick, Orion, AOLserver, Yaws and Boa log escape sequence injection
• Jetty 6.x and 7.x Multiple Vulnerabilities
• Vtiger CRM 5.0.4 Multiple Vulnerabilities
• SugarCRM 5.2.0e Remote Code Execution
• FormMail 1.92 Multiple Vulnerabilities
• Zabbix 1.6.2 Frontend Multiple Vulnerabilities
• Remote Command Execution in Moodle
• Collabtive 0.4.8 Multiple Vulnerabilities
• Mantis Bug Tracker 1.1.1 Multiple Vulnerabilities
• WiKID wClient-PHP <= 3.0-2 Multiple XSS Vulnerabilities
• Cacti 0.8.7a Multiple Vulnerabilities
• GreenSQL, a MySQL firewall, bypassed
• Original Photo Gallery Remote Command Execution
• Firefox <= 2.0.0.3 DOM Keylogger (bypass same-origin policy)
• Shadowpage vulnerability: the page that doesn’t exists (Multiple browsers affected)
• PHP import_request_variables() arbitrary variable overwrite
• Php Nuke wild POST XSS
• Milkeyway Captive Portal Multiple Vulnerabilities
• PmWiki remote file inclusion exploit
• PHP5 Globals Vulnerability
• PmWiki Multiple Vulnerabilities
• PHP iCalendar Remote File Inclusion
• PHP Web Statistik Multiple Vulnerabilities
• FreeWebStat Multiple XSS Vulnerabilities
• Multiple Vulnerabilities in WebCalendar

Conferences

I had the pleasure to be part of many conferences as a speaker, including CCC Chaos Communication Congress, International Journalism Festival, ESC End Summer Camp, MOCA Metro Olografix CAmp, Infosecurity, Università di Pisa, Università di Verona, Università di Camerino.

• Best practices per una cyber defense proattiva ESET Mar 16, 2021
• Dall’antivirus all’EDR e alle soluzioni Mdr ESET Apr 13, 2021
• Secure smartworking. Lavorare in modo agile in sicurezza. WatchGuard Sep 17, 2021
• Cyber Resilienza, dove la tradizionale cybersecurity non arriva Bitdefender Nov 10, 2021
• The lost war on information security International Journalism Festival 2016
• The hacking landscape International Journalism Festival 2015
• Social network: siamo tutti controllati? Mistero, Italia Uno - National television, Mediaset 2014

• Ringobongo LTD Annual Report 2014 Moca 20 Metro 0lografix 2014
• Non chiamateci smanettoni! Playboy Italia 2009
  

  
• Terminal Madness: High level of ownage coming from the terminal End Summer Camp (ESC) 2009
• Bypassing Web Application Firewalls (WAF) Università degli studi di Camerino - Security Date 2009
• Lollobox, hardened notebook system Università degli studi di Camerino & CameLug - GNU/Linux come punto di forza 2009
• Tricks: Makes you smile v4 Chaos Computer Club (CCC) - Chaos Communication Congress 2008
  
• IT Security agency essentials Storia di un Penetration Test immaginario Università di Pisa - Real life security 2008
• Web Application Security Bug Hunting e Code Review Università di Pisa - Real life security 2008
• Tricks: Makes you smile v3 End Summer Camp (ESC) 2008
• Linux physical (in)security LugVR - LinuxDay Verona 2008
• Tricks: Makes you smile v2 Metro Olografix Summer Camp (MOCA) 2008
• Lollobox: free and happy as a butterfly Metro Olografix Summer Camp (MOCA) 2008
• Tricks: Makes you smile v1 HAT - Relax underground is dead (HAT) 2008
• Get hacked: pericoli della navigazione Linuxpersec 2 2007
• Secure MySQL Clusters End Summer Camp (ESC) 2006
• Exif phun End Summer Camp (ESC) 2006
• Hardening di un ambiente LAMP LinuxDay Verona 2006