Tools: CANVAS 6.47 Includes the VMware 6.5.0/6.5.1 workstation/player breakout “cloudburst” vulnerability Not free, but certainly should be in a penetration testers bag of goodies DVWA – Damn Vulnerable Web App A PHP/MySQL web application that is vulnerable to be used for learning the art of web application security. Author’s blog is ethicalhack3r.co.uk KeyKeriki Open source [...]

The latest Microsoft Security Intelligence Report (SIR) is now out. The Microsoft Security Intelligence Report (SIR) provides an in-depth perspective on the changing threat landscape including software vulnerability disclosures and exploits, malicious software (malware), and potentially unwanted software. Using data derived from hundreds of millions of Windows users, and some of the busiest online services [...]

Starting this month, Microsoft will be providing exploitability information about their patches to everyone. The Microsoft Exploitability Index is designed to provide additional information to help customers better prioritize the deployment of Microsoft security updates. This index provides customers with guidance on the likelihood of functioning exploit code being developed for vulnerabilities addressed by Microsoft [...]

Vendor parties during Black Hat USA is always interesting, because the conference is in Las Vegas. Here is a list of vendors that I know of that are throwing parties this year at Black Hat USA 2008. Tuesday, August 5th Qualys Fortify Wednesday, August 6th Arbor Networks MANDIANT WASC / OWASP Thursday, August 7th Accuvant [...]

With my ever growing RSA party list, my friends made me decide which party we should  attend, so I selected Microsoft’s party. I figured you can’t go wrong with a huge company, and it was at the Cartoon Art Museum. The current theme for the main exhibit was Sex and Sensibility, and it contained many [...]

Now that I have my RSA schedule in place, I have to figure out what I am doing in the evenings. So far I’ve been invited to seventeen (17!) vendor parties. In no particular order, the list of vendors are: Blue Coat, MessageLabs, SenSage, ESET, Ping Identity, Microsoft, Secure Computing, WASC, F-Secure, Voltage, Commtouch, Porter [...]