{"id":938,"date":"2013-01-29T08:23:17","date_gmt":"2013-01-29T16:23:17","guid":{"rendered":"http:\/\/www.infosecurity.pro\/?p=938"},"modified":"2019-04-20T16:25:10","modified_gmt":"2019-04-20T16:25:10","slug":"iranian-penetration-testers-exploit-tm-domain","status":"publish","type":"post","link":"https:\/\/www.infosecurity.pro\/?p=938","title":{"rendered":"Iranian penetration testers exploit .tm domain"},"content":{"rendered":"<p>\t\t\t\t<![CDATA[\n<div class=\"al_found1\">\n <a onMouseOut=\"al_link_out()\" onMouseOver=\"al_gen_multi(1643136967, {us : 'A-1849517746'}, 'us', 'default');\"  rel=\"nofollow\" href=\"http:\/\/www.amazon.com\/gp\/product\/1849517746?ie=UTF8&amp;linkCode=xm2&amp;camp=2025&amp;creative=6738&amp;tag=infosecpro0c-20&amp;creativeASIN=1849517746&amp;SubscriptionId=\"><img alt=\" \" title=\" \" src=\"https:\/\/www.infosecurity.pro\/wp-content\/plugins\/amazon-link\/images\/no-img-lg-uk.gif\" class=\"wishlist_image\"><\/a>\n<img src=\"\/\/www.assoc-amazon.com\/e\/ir?t=infosecpro0c-20&l=as2&o=1&a=1849517746\" width=\"1\" height=\"1\" border=\"0\" alt=\"\" style=\"border:none !important; margin:0px !important;\" \/>\n<\/div>\n\nThe Turkmenistan domain registry has been hacked with an SQL injection sent into hidden form fields which had invalid supporting data.  The result received by the Iranian pentesting team was a database dump of plaintext (rather than hashed) passwords accompanied by their email derived customer logins.  Some of the domains affected include gmail.tm, google.tm, youtube.tm, yahoo.tm, etc.. <img decoding=\"async\" src=\"http:\/\/www2.umt.edu\/cali\/MapTurkmenistan.jpg\" alt=\"Turkmenistan flag\" \/>\nThe control panel for the nameserver management authentication is a simple email and password challenge.  Some of the revealed passwords were dictionary attack susceptible such as wendy, sunshine, etc..  ]]>\t\t<\/p>\n","protected":false},"excerpt":{"rendered":"<p>\t\t\t\t<![CDATA[]]>\t\t<\/p>\n","protected":false},"author":1,"featured_media":0,"comment_status":"closed","ping_status":"open","sticky":false,"template":"","format":"standard","meta":{"amazonpipp_noncename":"","amazon-product-isactive":"","amazon-product-single-asin":"","amazon-product-content-location":"","amazon-product-content-hook-override":"","amazon-product-excerpt-hook-override":"","amazon-product-singular-only":"","amazon-product-amazon-desc":"","amazon-product-show-gallery":"","amazon-product-show-features":"","amazon-product-newwindow":"","amazon-product-show-list-price":"","amazon-product-show-used-price":"","amazon-product-show-saved-amt":"","amazon-product-timestamp":"","amazon-product-new-title":"","amazon-product-use-cartURL":"","amazon_featured_post_meta_key":"","_amazon_featured_alt":"","amazon-product-template":"","footnotes":""},"categories":[66,63,67],"tags":[],"class_list":["post-938","post","type-post","status-publish","format-standard","hentry","category-breaches","category-education","category-practices"],"_links":{"self":[{"href":"https:\/\/www.infosecurity.pro\/index.php?rest_route=\/wp\/v2\/posts\/938","targetHints":{"allow":["GET"]}}],"collection":[{"href":"https:\/\/www.infosecurity.pro\/index.php?rest_route=\/wp\/v2\/posts"}],"about":[{"href":"https:\/\/www.infosecurity.pro\/index.php?rest_route=\/wp\/v2\/types\/post"}],"author":[{"embeddable":true,"href":"https:\/\/www.infosecurity.pro\/index.php?rest_route=\/wp\/v2\/users\/1"}],"replies":[{"embeddable":true,"href":"https:\/\/www.infosecurity.pro\/index.php?rest_route=%2Fwp%2Fv2%2Fcomments&post=938"}],"version-history":[{"count":1,"href":"https:\/\/www.infosecurity.pro\/index.php?rest_route=\/wp\/v2\/posts\/938\/revisions"}],"predecessor-version":[{"id":8047,"href":"https:\/\/www.infosecurity.pro\/index.php?rest_route=\/wp\/v2\/posts\/938\/revisions\/8047"}],"wp:attachment":[{"href":"https:\/\/www.infosecurity.pro\/index.php?rest_route=%2Fwp%2Fv2%2Fmedia&parent=938"}],"wp:term":[{"taxonomy":"category","embeddable":true,"href":"https:\/\/www.infosecurity.pro\/index.php?rest_route=%2Fwp%2Fv2%2Fcategories&post=938"},{"taxonomy":"post_tag","embeddable":true,"href":"https:\/\/www.infosecurity.pro\/index.php?rest_route=%2Fwp%2Fv2%2Ftags&post=938"}],"curies":[{"name":"wp","href":"https:\/\/api.w.org\/{rel}","templated":true}]}}