03-31-2026, 02:05 PM
Forum: Seminari, predavanja, radionice, konferencije
- Replies (5)
Call for Papers je objavljen, najavljujući sledeći BalCCon.
glavni sajt https://2k26.balccon.org/
CFP https://cfp.balccon.org/balccon2k26-2026/cfp
Dates and deadline
- March 29th, 2026 (00:00 UTC): CFP Submission open
- July 1st, 2026 (23:59 UTC): CFP Submission deadline
- July 15, 2026: Final notification of acceptance
- September 18th – 2oth, 2026: Balkan Computer Congress
19.03.2026. istekao je sertifikat portala "Registar neplaćenih novčanih kazni i drugih novčanih iznosa"
Skoro je takođe dokumentovan problem Detektovane maliciozne aktivnosti sa servera pravosuđa (mail.sud.rs)
Nakon malo istrazivanja sa slike koju je novinar objavio uspio sam naci ko stoji iza sajta sakupljanja kapilarnih glasova.
www[.]webdeveloper[.]rs - naravno da imam ime ali mi se neda kaciti. Bitno da smo nasli kompaniju koja stoji iza toga.
Sve vam je u slikama.
Imate KLADOVO Login sa sifrom admin-admin123
JSON ovdje:
{
"port": 443,
"protocol": "HTTP",
"transport_protocol": "TCP",
"misconfigs": [],
"exposures": [],
"vulns": [],
"software": [
{
"evidence": [],
"type": [],
"vendor": "apache",
"product": "http_server",
"update": "",
"edition": "",
"components": []
},
{
"evidence": [],
"type": [],
"vendor": "php",
"product": "php",
"version": "",
"update": "",
"edition": "",
"components": []
}
],
"hardware": [],
"operating_systems": [
{
"evidence": [],
"type": [],
"vendor": "canonical",
"product": "linux",
"version": "",
"update": "",
"edition": "",
"components": []
}
],
"threats": [],
"labels": [
{
"evidence": [],
"value": "LOGIN_PAGE"
}
],
"ip": "194.146.57.90",
"scan_time": "2026-03-30T13:55:32.376722208Z",
"tls": {
"version_selected": "UNKNOWN",
"fingerprint_sha256": "a1bf19b520524b9f71a9dd7306ed409834c175d8230c1ca735539b30a83a891d",
"presented_chain": [
{
"fingerprint_sha256": "131fce7784016899a5a00203a9efc80f18ebbd75580717edc1553580930836ec",
"subject_dn": "C=US, O=Let's Encrypt, CN=R12",
"issuer_dn": "C=US, O=Internet Security Research Group, CN=ISRG Root X1"
}
],
"versions": []
},
"screenshots": [],
"banner_hex": "",
"cert": {
"fingerprint_sha256": "a1bf19b520524b9f71a9dd7306ed409834c175d8230c1ca735539b30a83a891d",
"fingerprint_sha1": "2fbd111312e833deee3cef5717379fb609ae9864",
"fingerprint_md5": "d305cd3865fc6dbfe02c097af3703c8d",
"tbs_fingerprint_sha256": "152e79a68e7f2003c2b2ca6d95d00eed95a527c24551c48005bef90e985a74e1",
"tbs_no_ct_fingerprint_sha256": "ffbe20e477a8aa78368c76764cb041dbab751e6439426903ea80c32f71d82df8",
"spki_fingerprint_sha256": "b72c75a82d83ec2e37a000e0b43ea81cdf45e89d9acb537e05bf6f776b812499",
"parent_spki_fingerprint_sha256": "976d0142e295f487c42f6f852711101a954e68d9ddf89fe4c746f9a271e38171",
"parsed": {
"version": 3,
"serial_number": "436464025363551748631984705381334342845154",
"issuer_dn": "C=US, O=Let's Encrypt, CN=R12",
"issuer": {
"common_name": [
"R12"
],
"serial_number": [],
"country": [
"US"
],
"locality": [],
"province": [],
"street_address": [],
"organization": [
"Let's Encrypt"
],
"organizational_unit": [],
"postal_code": [],
"domain_component": [],
"email_address": [],
"given_name": [],
"surname": [],
"jurisdiction_country": [],
"jurisdiction_locality": [],
"jurisdiction_province": [],
"organization_id": []
},
"subject_dn": "CN=2538453625.in.rs",
"subject": {
"common_name": [
"2538453625.in.rs"
],
"serial_number": [],
"country": [],
"locality": [],
"province": [],
"street_address": [],
"organization": [],
"organizational_unit": [],
"postal_code": [],
"domain_component": [],
"email_address": [],
"given_name": [],
"surname": [],
"jurisdiction_country": [],
"jurisdiction_locality": [],
"jurisdiction_province": [],
"organization_id": []
},
"subject_key_info": {
"key_algorithm": {
"name": "RSA",
"oid": "1.2.840.113549.1.1.1"
},
"rsa": {
"exponent": "65537",
"modulus": "b8086e4aebdb174ed9f788e5d7390888568efed0a33ecc77c63dfad78754d16ebb4eeee4a1a8bddd68dd228cb57af0a4aa0f2899abcefd2f87232bbf156aa07d31636a74f52cd4473198f441f8885f86753c7c2ed4794c3f0f7fd02cbe687e8451cdc9f8f5ead437d77b1a267fb79c2c3b681e196cffc44ffd16db907a3556ca783709177f6d981705f9d23f11ac7e08be8569aa7d698edde05a3e86af356aa09409e1b8d122ab28d416076eeb3fa9e81d6ecfe2548c8d55aecd9ccae7aa11e58bdc34c637da024f1f056541ead9493dedfe427af99653a6e724d4bfbdd262bf2e7a40e306bc11021f45a5d837c99f9b5ce01bb2f288ab9f38c36dd3841518fb",
"length": "2048"
},
"fingerprint_sha256": "a1c7a011c0169366f984a68d15443d6be1fb11c2948182e712906b648ae4c3a0"
},
"validity_period": {
"not_before": "2026-03-27T13:36:59Z",
"not_after": "2026-06-25T13:36:58Z",
"length_seconds": "7776000"
},
"signature": {
"signature_algorithm": {
"name": "SHA256-RSA",
"oid": "1.2.840.113549.1.1.11"
},
"value": "838e3138ffa72ab5aa9c07dd67c1602e4364a810566a7503ae641c2c518daa394dad84bbc019ca96d0ddd8be7a4118d5447b0d77171e1dce530a32c012e3d121edf8229b4c32d458f4d357c11addceda2451647a98767bba61f67ed029e431e5d5d4fae766ef8e70ae22e125a06b687bc535567160ff31eb3b9bb2fadae4a56df19058688e37023e7a4ef1b0cf21e42ab964be058b12d729c043677331ab137c82176409e859b80a38edc0ce087fb2bdc327f230209db8c6ad44f3b2932401bdb8f73212d181dfbff779f0ea03c8dff18399e8b36c2a19e9f47e9396a47a38803f7017cf858d1868e3152d391145868bf83965162e4ad1494e558350c730d046",
"valid": true,
"self_signed": false
},
"unknown_extensions": [],
"redacted": false,
"serial_number_hex": "0502a7099c0b2b5f09f513fd4165c17242e2",
"ja4x": ""
},
"precert": false,
"revoked": false,
"names": [
"2538453625.in.rs",
"www.2538453625.in.rs"
],
"validation_level": "DV",
"validation": {
"nss": {
"is_valid": true,
"ever_valid": true,
"has_trusted_path": true,
"had_trusted_path": true,
"chains": [
{
"sha256fp": [
"131fce7784016899a5a00203a9efc80f18ebbd75580717edc1553580930836ec",
"96bcec06264976f37460779acf28c5a7cfe8a3c0aae11a8ffcee05c0bddf08c6"
]
}
],
"parents": [
"131fce7784016899a5a00203a9efc80f18ebbd75580717edc1553580930836ec"
],
"in_revocation_set": false,
"type": "LEAF"
},
"microsoft": {
"is_valid": true,
"ever_valid": true,
"has_trusted_path": true,
"had_trusted_path": true,
"chains": [
{
"sha256fp": [
"131fce7784016899a5a00203a9efc80f18ebbd75580717edc1553580930836ec",
"96bcec06264976f37460779acf28c5a7cfe8a3c0aae11a8ffcee05c0bddf08c6"
]
}
],
"parents": [
"131fce7784016899a5a00203a9efc80f18ebbd75580717edc1553580930836ec"
],
"in_revocation_set": false,
"type": "LEAF"
},
"apple": {
"is_valid": true,
"ever_valid": true,
"has_trusted_path": true,
"had_trusted_path": true,
"chains": [
{
"sha256fp": [
"131fce7784016899a5a00203a9efc80f18ebbd75580717edc1553580930836ec",
"96bcec06264976f37460779acf28c5a7cfe8a3c0aae11a8ffcee05c0bddf08c6"
]
}
],
"parents": [
"131fce7784016899a5a00203a9efc80f18ebbd75580717edc1553580930836ec"
],
"in_revocation_set": false,
"type": "LEAF"
},
"chrome": {
"is_valid": true,
"ever_valid": true,
"has_trusted_path": true,
"had_trusted_path": true,
"chains": [
{
"sha256fp": [
"131fce7784016899a5a00203a9efc80f18ebbd75580717edc1553580930836ec",
"96bcec06264976f37460779acf28c5a7cfe8a3c0aae11a8ffcee05c0bddf08c6"
]
}
],
"parents": [
"131fce7784016899a5a00203a9efc80f18ebbd75580717edc1553580930836ec"
],
"in_revocation_set": false,
"type": "LEAF"
}
},
"revocation": {
"ocsp": {
"revoked": false,
"reason": "UNKNOWN"
},
"crl": {
"revoked": false,
"reason": "UNSPECIFIED"
}
},
"ct": {
"entries": {
"cloudflare_nimbus_2026": {
"index": "3327620674",
"added_to_ct_at": "2026-03-27T14:36:49.295Z",
"ct_to_censys_at": "2026-03-27T15:32:15.319881972Z"
},
"google_argon_2026_h1": {
"index": "2691143776",
"added_to_ct_at": "2026-03-27T14:35:31.218Z",
"ct_to_censys_at": "2026-03-27T14:41:24.189013992Z"
},
"google_xenon_2026_h1": {
"index": "2436113666",
"added_to_ct_at": "2026-03-27T14:35:31.303Z",
"ct_to_censys_at": "2026-03-27T14:43:32.134187648Z"
},
"sectigo_elephant_2026_h1": {
"index": "1962159378",
"added_to_ct_at": "2026-03-27T14:36:48.537Z",
"ct_to_censys_at": "2026-03-27T14:45:09.768653493Z"
},
"sectigo_tiger_2026_h1": {
"index": "1893689341",
"added_to_ct_at": "2026-03-27T14:36:48.665Z",
"ct_to_censys_at": "2026-03-27T14:47:40.150990925Z"
},
"trustasia_log_2026_a": {
"index": "1155710659",
"added_to_ct_at": "2026-03-27T14:36:49.989Z",
"ct_to_censys_at": "2026-03-27T14:49:23.534915365Z"
},
"trustasia_log_2026_b": {
"index": "1176083108",
"added_to_ct_at": "2026-03-27T14:36:49.598Z",
"ct_to_censys_at": "2026-03-27T14:48:33.924439699Z"
}
}
},
"ever_seen_in_scan": true,
"added_at": "2026-03-27T14:41:24Z",
"modified_at": "2026-03-28T08:56:01Z",
"validated_at": "2026-03-29T23:40:03Z",
"parse_status": "CERTIFICATE_PARSE_STATUS_SUCCESS",
"spki_subject_fingerprint_sha256": "b72c75a82d83ec2e37a000e0b43ea81cdf45e89d9acb537e05bf6f776b812499",
"parent_spki_subject_fingerprint_sha256": "976d0142e295f487c42f6f852711101a954e68d9ddf89fe4c746f9a271e38171"
},
"endpoints": [
{
"hostname": "194.146.57.90",
"port": 443,
"path": "/",
"endpoint_type": "HTTP",
"transport_protocol": "TCP",
"scan_time": "2026-03-30T13:55:32.376722208Z",
"ip": "194.146.57.90",
"screenshots": [],
"http": {
"uri": "https://194.146.57.90/",
"protocol": "HTTP/1.1",
"status_code": 403,
"status_reason": "Forbidden",
"headers": {
"Content-Type": {
"headers": [
"text/html; charset=iso-8859-1"
]
},
"Date": {
"headers": [
"<REDACTED>"
]
},
"Server": {
"headers": [
"Apache/2.4.29 (Ubuntu)"
]
},
"Transfer-Encoding": {
"headers": [
"chunked"
]
}
},
"html_tags": [
"<title>403 Forbidden</title>"
],
"body_size": 279,
"body": "<!DOCTYPE HTML PUBLIC \"-//IETF//DTD HTML 2.0//EN\">\n<html><head>\n<title>403 Forbidden</title>\n</head><body>\n<h1>Forbidden</h1>\n<p>You don't have permission to access this resource.</p>\n<hr>\n<address>Apache/2.4.29 (Ubuntu) Server at 194.146.57.90 Port 443</address>\n</body></html>\n",
"favicons": [],
"html_title": "403 Forbidden",
"body_hash_sha256": "6951fad060a0f6ae0f113350b99bdd35927153a6ac7ade02d368dcd173e63846",
"body_hash_sha1": "6dcd255e3cfa7eaf6580c5ac0854287b79c05eb0",
"supported_versions": [
"HTTP/1.1"
],
"body_hash_tlsh": "",
"redirect_chain": []
},
"uri": "https://194.146.57.90/",
"protocol": "HTTP/1.1",
"status_code": 403,
"status_reason": "Forbidden",
"headers": {
"Content-Type": {
"headers": [
"text/html; charset=iso-8859-1"
]
},
"Date": {
"headers": [
"<REDACTED>"
]
},
"Server": {
"headers": [
"Apache/2.4.29 (Ubuntu)"
]
},
"Transfer-Encoding": {
"headers": [
"chunked"
]
}
},
"html_tags": [
"<title>403 Forbidden</title>"
],
"body_size": 279,
"body": "<!DOCTYPE HTML PUBLIC \"-//IETF//DTD HTML 2.0//EN\">\n<html><head>\n<title>403 Forbidden</title>\n</head><body>\n<h1>Forbidden</h1>\n<p>You don't have permission to access this resource.</p>\n<hr>\n<address>Apache/2.4.29 (Ubuntu) Server at 194.146.57.90 Port 443</address>\n</body></html>\n",
"favicons": [],
"html_title": "403 Forbidden",
"body_hash_sha256": "6951fad060a0f6ae0f113350b99bdd35927153a6ac7ade02d368dcd173e63846",
"body_hash_sha1": "6dcd255e3cfa7eaf6580c5ac0854287b79c05eb0",
"supported_versions": [
"HTTP/1.1"
],
"body_hash_tlsh": "",
"redirect_chain": []
},
{
"hostname": "194.146.57.90",
"port": 443,
"path": "/login.php",
"endpoint_type": "HTTP",
"transport_protocol": "TCP",
"scan_time": "2026-03-29T09:54:51.488506602Z",
"ip": "194.146.57.90",
"screenshots": [],
"http": {
"uri": "https://194.146.57.90/login.php",
"protocol": "HTTP/1.1",
"status_code": 200,
"status_reason": "OK",
"headers": {
"Server": {
"headers": [
"Apache/2.4.29 (Ubuntu)"
]
},
"Content-Encoding": {
"headers": [
"gzip"
]
},
"Set-Cookie": {
"headers": [
"PHPSESSID=mv23jajtani8o5hcrhigg0se8c; path=/"
]
},
"Expires": {
"headers": [
"Thu, 19 Nov 1981 08:52:00 GMT"
]
},
"Cache-Control": {
"headers": [
"no-store, no-cache, must-revalidate"
]
},
"Vary": {
"headers": [
"Accept-Encoding"
]
},
"Content-Length": {
"headers": [
"384"
]
},
"Pragma": {
"headers": [
"no-cache"
]
},
"Content-Type": {
"headers": [
"text/html; charset=UTF-8"
]
},
"Date": {
"headers": [
"<REDACTED>"
]
}
},
"html_tags": [
"<title>Kladovo - Login</title>",
"<meta charset=\"utf-8\">",
"<meta name=\"viewport\" content=\"width=device-width, initial-scale=1\">"
],
"body_size": 703,
"body": "<!doctype html>\n<html lang=\"sr\">\n<head>\n <meta charset=\"utf-8\">\n <meta name=\"viewport\" content=\"width=device-width, initial-scale=1\">\n <title>Kladovo - Login</title>\n <link rel=\"stylesheet\" href=\"style.css\">\n</head>\n<body>\n<main class=\"container narrow\">\n <h1>Prijava</h1>\n <p class=\"muted\">Admin default: <code>admin</code> / <code>admin123</code></p>\n <form method=\"post\" class=\"card\">\n <label>Korisnicko ime\n <input type=\"text\" name=\"username\" required>\n </label>\n <label>Lozinka\n <input type=\"password\" name=\"password\" required>\n </label>\n <button type=\"submit\">Uloguj se</button>\n </form>\n</main>\n</body>\n</html>\n",
"favicons": [],
"html_title": "Kladovo - Login",
"body_hash_sha256": "656633340ad01a453c98e6f980ba7aa909cd152bc7fff53650e50a78f9a2ec62",
"body_hash_sha1": "25f5890cce8dee167fee9a87c422a6b85d3e8933",
"supported_versions": [
"HTTP/1.1"
],
"body_hash_tlsh": "",
"redirect_chain": []
},
"uri": "https://194.146.57.90/login.php",
"protocol": "HTTP/1.1",
"status_code": 200,
"status_reason": "OK",
"headers": {
"Server": {
"headers": [
"Apache/2.4.29 (Ubuntu)"
]
},
"Content-Encoding": {
"headers": [
"gzip"
]
},
"Set-Cookie": {
"headers": [
"PHPSESSID=mv23jajtani8o5hcrhigg0se8c; path=/"
]
},
"Expires": {
"headers": [
"Thu, 19 Nov 1981 08:52:00 GMT"
]
},
"Cache-Control": {
"headers": [
"no-store, no-cache, must-revalidate"
]
},
"Vary": {
"headers": [
"Accept-Encoding"
]
},
"Content-Length": {
"headers": [
"384"
]
},
"Pragma": {
"headers": [
"no-cache"
]
},
"Content-Type": {
"headers": [
"text/html; charset=UTF-8"
]
},
"Date": {
"headers": [
"<REDACTED>"
]
}
},
"html_tags": [
"<title>Kladovo - Login</title>",
"<meta charset=\"utf-8\">",
"<meta name=\"viewport\" content=\"width=device-width, initial-scale=1\">"
],
"body_size": 703,
"body": "<!doctype html>\n<html lang=\"sr\">\n<head>\n <meta charset=\"utf-8\">\n <meta name=\"viewport\" content=\"width=device-width, initial-scale=1\">\n <title>Kladovo - Login</title>\n <link rel=\"stylesheet\" href=\"style.css\">\n</head>\n<body>\n<main class=\"container narrow\">\n <h1>Prijava</h1>\n <p class=\"muted\">Admin default: <code>admin</code> / <code>admin123</code></p>\n <form method=\"post\" class=\"card\">\n <label>Korisnicko ime\n <input type=\"text\" name=\"username\" required>\n </label>\n <label>Lozinka\n <input type=\"password\" name=\"password\" required>\n </label>\n <button type=\"submit\">Uloguj se</button>\n </form>\n</main>\n</body>\n</html>\n",
"favicons": [],
"html_title": "Kladovo - Login",
"body_hash_sha256": "656633340ad01a453c98e6f980ba7aa909cd152bc7fff53650e50a78f9a2ec62",
"body_hash_sha1": "25f5890cce8dee167fee9a87c422a6b85d3e8933",
"supported_versions": [
"HTTP/1.1"
],
"body_hash_tlsh": "",
"redirect_chain": []
}
]
}
Promenom odredjenih parametra u odredjenoj putanji moguće pristupiti podacima drugih korisnika, pri čemu web aplikacija ne vrši adekvatnu autorizaciju, što dovodi do IDOR (Insecure Direct Object Reference) ranjivosti i omogućava otkrivanje osetljivih informacija poput email adresa (npr. Gmail naloga) u odgovoru aplikacije.
PoC:
Test acc:
Preostala su još dva dana do objavljivanja poverljivih podataka iz sistema grada Rovinja od strane ozloglašene ransomware grupe LockBit.
Preostalo je još samo 15 sati do objavljivanja poverljivih podataka kompanije DOT Networks od strane ozloglašene ransomware grupe LockBit.
Ozloglašena Lockbita sajber kriminalna grupa koja nudi ransomver kao uslugu u trenutnoj 5.0 inkarnaciji je 04.03.2026 objavila da je kompromitovala i ukrala podatke od Sport Vision-a u BiH.
Rok za otkup je bio 19.03.2026 posle čega su javno objavili podatke.
Stavili su oko 35GB kompresovanih podataka.
Prema datumu pravljenja foldera na spisku podataka prenos podataka se možda desio 25.11.2025
Dodatnom analizom infrastrukture akademske mreže Univerziteta u Beogradu (UB-AS), potvrđena je kompromitacija poddomena microbiology[.]bg[.]ac[.]rs i IP adrese 91[.]187[.]138[.]61, koji se od februara 2026. godine zloupotrebljavaju za širenje malvera StrelaStealer i NetSupportManager RAT.
https://threatfox.abuse.ch/asn/13092/
Blog:
https://malpedia.caad.fkie.fraunhofer.de...elastealer
https://malpedia.caad.fkie.fraunhofer.de...anager_rat
U međuvremenu su identifikovana tri kompromitovana domaća domena koja služe kao infrastruktura za isporuku zlonamernog softvera. Analizom je potvrđeno prisustvo malvera StrelaStealer, koji je primarno dizajniran za krađu kredencijala iz e-mail klijenata Microsoft Outlook i Mozilla Thunderbird. Aktivnost je locirana na mreži operatera SBB (AS31042) početkom marta 2026. godine.
https://threatfox.abuse.ch/asn/31042/
Blog StrelaStealer:
https://malpedia.caad.fkie.fraunhofer.de...elastealer
Pojavila se nova šema koja neodoljivo podseća na OKE Green piramidalna šema i prevara
Zove se DistributeX i vijesti.me je uradila reportažu o širenju šeme u Crnoj Gori: Kripto šema za prazne novčanike: Brojni građani moguće uvučeni u piramidalnu onlajn prevaru
Quote:Stručnjaci za sajber bezbjednost upozoravaju da je model po kojem “posluje” DistributeX, čija je kancelarija nedavno otvorena u Podgorici, globalno prepoznat kao kripto prevara
Oni koji se tek uključuju uplaćuju iznos od 256 eura, a potom uključuju nove članove. Nakon uplate, članovi se pozivaju da svakodnevno odrade po pet klikova za kriptovalute
Čak su osnovali i kancelariju, kao što je radio i OKE Green :
Piramidalni sistem nagrada :
Ovo bi trebalo da je sajt, iza Cloudflare-a naravno :
Dostupni jezici, Srbija izgleda nije ciljana za sada :
Postoji i dx818 .com koji otvara isti sajt
bave se humanitarnim donacijama isto kao i što je radio OKE Green :