Resource icon

WinSCP 5.9.6

No permission to download
Overview History Discussion
Qraktzyl

Qraktzyl

Retired Staff
Contributor
Nov 2, 2015
997
728
161
This is very nice but not very hard to find on the web... (AND FROM THE OFFICIAL WEBSITE)
 
Jackbox

Jackbox

Active Member
Jan 2, 2016
197
96
74
Qraktzyl said:
https://winscp.net/eng/download.php

Directly from the winscp website...
Click to expand...
Yeah, you can also download 500 other software installers from 500 other websites. Is it safer?

https://observatory.mozilla.org/analyze.html?host=winscp.net
https://observatory.mozilla.org/analyze.html?host=r4p3.net

While our grade is not much better it is still better and I know that simply because:
WinSCP
https://goo.gl/nZk59s
https://goo.gl/jUWixX

R4P3
https://goo.gl/HwT6XJ
https://goo.gl/WX4jsz

I plan on doing this with Putty especially because Putty is served over non-https.
 
Qraktzyl

Qraktzyl

Retired Staff
Contributor
Nov 2, 2015
997
728
161
So you are telling me that the download can be easily replaced by sql injection? Or you are just showing that the winscp website isn't secure in general?
 
Jackbox

Jackbox

Active Member
Jan 2, 2016
197
96
74
Qraktzyl said:
So you are telling me that the download can be easily replaced by sql injection? Or you are just showing that the winscp website isn't secure in general?
Click to expand...
I am saying that IF (I have a very strong hunch) there exists a vulnerability within WinSCP anywhere chances are likely this could lead to SQLi from there an attacker could escalate access and yes replace a file hosted on their server as hosted on same box: https://winscp.net/download/WinSCP-5.9.6-Setup.exe

By the way: http://ipinfo.io/87.106.181.237

1&1 sucks imo, friends used to SE (Social Engineer) 'em all the time and while they have gotten stronger winscp.net should really put themselves behind a gateway/proxy of some kind. It is truly the safer way to serve websites in my eyes. People may have their own opinions though but exposing a real (direct IP to dedicated server) hosting IP is brave. :D
 
Last edited:
Qraktzyl

Qraktzyl

Retired Staff
Contributor
Nov 2, 2015
997
728
161
Jackbox said:
I am saying that IF (I have a very strong hunch) there exists a vulnerability within WinSCP anywhere chances are likely this could lead to SQLi from there an attacker could escalate access and yes replace a file hosted on their server as hosted on same box: https://winscp.net/download/WinSCP-5.9.6-Setup.exe
Click to expand...
That would be a shame, good thing r4p3 is here to be a more secure alternative download server!
 
Jackbox

Jackbox

Active Member
Jan 2, 2016
197
96
74
Qraktzyl said:
That would be a shame, good thing r4p3 is here to be a more secure alternative download server!
Click to expand...

I promise not to start posting random downloads, only things relevant to server admin, security, and communications. :p
 
You must log in or register to reply here.
Top