Showing 35 results for: September 2012 ×

Oracle DBMS_Scheduler Fun on Windows!

So, last time I showed how to get a Unix reverse shell up and running just by using Oracle PL/SQL commands making use of DBMS_Scheduler. My next challenge was to try and get a similar method to work on a...

Web Application Defense: Bayesian Attack Analysis

Regular Expressions for Input Validation If your web application defensive strategy against injection attacks relies solely upon the use of blacklist regular expression for input validation, it is only a matter of time before an attacker finds an evasion. Want...

Exploiting Users By Non-technical Means; or, "S*** Users Do"

Numerous technical articles emerge each day about the latest vulnerabilities, flaws, exploits, and whatnot. That's great and all (who hasn't simultaneously groaned and cheered when they find an MS08-067 exploitable machine on a pentest, 4+ years after the vulnerability was...

Chat server fuzzing, Part 1. The Beginning

This article (along with subsequent articles) will cover the journey I've taken in learning about the XMPP (eXtensible Messaging and Presence Protocol) standard and how I used that knowledge to fuzz various servers, starting with the eJabberd server available from...

Blackhole Exploit Kit v2

A few days ago a new version of THE most common exploit kit was released. Unlike most exploit kit authors, who try to keep a low profile, the author of Blackhole publishes his work in Russian forums and even writes...

TrustKeeper Scan Engine Update - September 14, 2012

Yes folks, it is time again for another update on the new developments in the TrustKeeper Scan Engine. This update includes coverage for three new vulnerabilities for phpMyAdmin. These vulnerabilities are cross-site scripting vulnerabilities in a variety of components that...

No, the Internet Does Not 'Just Work'

The recent GoDaddy DNS outage illustrates that the Internet does not just work and sometimes stuff still breaks just for the sake of breaking and not because it was 'attacked'. The parts of the Internet that just work are exceedingly...

Getting a Start in the Security Industry

This has been a fairly common topic over the last year and I've seen plenty of blog posts and presentations about the subject. For me personally, many just don't cover the information I've found to be essential during my entrance...

CryptOMG Walkthrough - Challenge 1

It has been about 3 months since CryptOMG was released and I will start going through the challenges one-by-one. CryptOMG is CTF-style testbed for exploiting various flaws in cryptographic implementations. It is available for free on the SpiderLabs Github. The...