- Save the date: 23 & 24 Sept 2011 – brucon.org
For those who like to plan ahead, keep Friday and Saturday 23 & 24 September 2011 free.
- BSidesOttawa Schedule Confirmed! – andrewhay.ca
BSides Ottawa is fast approaching and today we can share the schedule of superb talks that cover a broad spectrum of Information Security subjects.
- WACCI Digital Forensics (Part 2) – sans.org
The day began with a light breakfast followed by a few conference announcements. There were to be no keynote speeches that day, so next up were the breakout sessions.
- CIS Apple iPhone Benchmark v.1.2.0 – cisecurity.org
This document, Security Configuration Benchmark for Apple iOS 4.1.0, provides prescriptive guidance for establishing a secure configuration posture for the Apple iOS version 4.1.0.
- Free Online Course & Downloads – benchmarkdevelopment.mitre.org
The PowerPoint briefing slides below are used in MITRE’s E-Learning Benchmark Development Course.
- Verizon PCI Report is Out – chuvakin.blogspot.com
Organizations struggled most with requirements 10 (track and monitor access), 11 (regularly test systems and processes), and 3 (protect stored cardholder data).
- Cross-site scripting explained (video) – itsecuritylab.eu
Actually it’s a live scenario of persistent XSS exploitation, so may be quite interesting for you to watch as well.
- DEF CON 18 Talks – Video is Live! – djtechnocrat.blogspot.com
DEF CON 18 talks with the speaker video and slides has been processed and posted.
- The Open Checklist Interactive Language (OCIL) – scap.nist.gov
The Open Checklist Interactive Language (OCIL) defines a framework for expressing a set of questions to be presented to a user and corresponding procedures to interpret responses to these questions.
- Security Checklists – disa.mil
STIGs, and checklists
- Download and execute Script Shellcode on Windows 7 – grey-corner.blogspot.com
I have just released a new version of my Download and Execute Script shellcode which now works on Windows 7.
- Social-Engineering Ninja V0.2 Download – grey0.wordpress.com
Now you can download Social-Engineering Ninja.
- pywebfuzz v0.6.0 – neohaxor.org
There are a few improvements to the file reads happening to retrieve data in the fuzzdb.py module.
- UPDATE: Andiparos v1.0.6! – pentestit.com
Andiparos is a fork of the famous Paros Proxy. It is an open source web application security assessment tool that gives penetration testers the ability to spider websites, analyze content, intercept and modify requests, etc.
- Padbusterdotnet: A Microsoft .NET Framework Padding Attack Tool! – pentestit.com
Padbusterdotnet is a tool that concentrates on exploiting padding attacks on the .NET Ajax Framework.
- NSDECODER – Automated Website Malware Detection Tool – darknet.org.uk
Also, NSDECODER will analyze which vulnerability has been exploited and the original source address of malware.
- USBsploit 0.3b – Generate Reverse TCP Backdoors & Malicious .LNK Files – darknet.org.uk
PoC to generate Reverse TCP backdoors (x86, x64, all ports), running Autorun or LNK USB infections, but also dumping all USB files remotely on multiple targets at the same time.
- UPDATE: Samurai Web Testing Framework 0.9! – pentestit.com
The Samurai Web Testing Framework is a live linux environment that has been pre-configured to function as a web pen-testing environment.
- PinDr0p: Voice-routing Call Fingerprint System. – marcoramilli.blogspot.com
The PinDr0p analysis can’t produce an IP address or geographical location for a given caller, but once it has a few calls via a given route, it can subsequently recognise further calls via the same route with a high degree of accuracy: 97.5 per cent following three calls and almost 100 per cent after five.
- Exploit Next Generation® SQL Fingerprint™ – code.google.com/p/esf/
The Exploit Next Generation® SQL Fingerprint™ uses well-known techniques based on several public tools that are capable to identify the Microsoft SQL Server version.
- Java DSN Rebinding + Java Same IP Policy = The Internet Mayhem – mindedsecurity.com
Consider the following points: Java DNS Rebinding: an attacker can point a controlled host to any IP of the web. Java applet same IP Host access: an attacker can read the response of any host which points to the same IP the applet originates.
- Adobe Shockwave player rcsL – exploit-db.com
There is a 4bytes value in the undocumented rcsL chunk in our sample director movie and it may be possible to find similar rcsL chunks in other director samples.
- Upstream Attacks from Distributed Devices – digitalbond.com
Control4 doesn’t necessarily fall into the category of a device that has upstream connectivity but there are some parallels about the device design that I think are going to present some security challenges for those that do need to communicate back to the local utility company.
- Cracking 14 Character Complex Passwords in 5 Seconds – cyberarms.wordpress.com
One article in March of this year stated that the technique using SSD drives could crack passwords at a rate of 300 billion passwords a second, and could decode complex password in under 5.3 seconds.
So how does it work? “xxd -r -p” converts from hex to ASCII, but it’s expecting the hex digits to be space delimited.