Showing 9 results for: September 2012 ×Security Research ×

Announcing the availability of ModSecurity extension for Nginx

ModSecurity for Nginx ModSecurity for Nginx is a web server plug-in for the Nginx web server platform. This module was created through a collaboration between Trustwave SpiderLabs Research, Microsoft Security Research Center (MSRC), Yandex and community members. With the addition...

TrustKeeper Scan Engine Update - September 28, 2012

The TrustKeeper Scan Engine has been updated and is packed with even more wonderful goodness than ever before! This update includes coverage for four recently discovered ISC BIND vulnerabilities. These vulnerabilities, when leveraged, can result in denial of service conditions...

Oops, I pwned your router - Part Two

In the last blog post, "Opps I pwned your router Part One", I talked about some of poor security that went into the basic embedded router operating systems. In this post I will flush out in more detail how one can go about reverse engineering these devices, what tools worked for me, and some of the results that I was able to get to. Hint: Having root on your hardware is good for me, bad for you.

Hey, I just met you, and this is crazy, but here's my hashes, so hack me maybe?

Those familiar with password cracking know that KoreLogic's rule set for John the Ripper has become the de facto standard for password cracking.However, as with anything technology related, the rules are slightly starting to show their age, specifically with rules designed to take into account years. So, I decided to take on the task of making a few modifications to the rule set, this includes updating them to take into account the current and prior year, but also reworking some of the rules to eliminate some redundancy.

Web Application Defense: Bayesian Attack Analysis

Regular Expressions for Input Validation If your web application defensive strategy against injection attacks relies solely upon the use of blacklist regular expression for input validation, it is only a matter of time before an attacker finds an evasion. Want...

Blackhole Exploit Kit v2

A few days ago a new version of THE most common exploit kit was released. Unlike most exploit kit authors, who try to keep a low profile, the author of Blackhole publishes his work in Russian forums and even writes...

TrustKeeper Scan Engine Update - September 14, 2012

Yes folks, it is time again for another update on the new developments in the TrustKeeper Scan Engine. This update includes coverage for three new vulnerabilities for phpMyAdmin. These vulnerabilities are cross-site scripting vulnerabilities in a variety of components that...

Getting a Start in the Security Industry

This has been a fairly common topic over the last year and I've seen plenty of blog posts and presentations about the subject. For me personally, many just don't cover the information I've found to be essential during my entrance...