Oktober 2009
M	D	M	D	F	S	S
		Dez »
	1	2	3	4
5	6	7	8	9	10	11
12	13	14	15	16	17	18
19	20	21	22	23	24	25
26	27	28	29	30	31

Archive für Oktober 2009

Things that sometimes get overlooked

19.10.2009 von matti.

During a network assessment there should always be some investigation for public information on the Internet. This includes of course a look at the registrars.

One thing that sometimes gets overlooked is the auth method within the whois records:

http://www.ripe.net/db/news/MD5-HOWTO.html

So what could be the issue here ?

Geschrieben in hacking | Drucken | Keine Kommentare »

Fash hacking 101

19.10.2009 von matti.

As it had been mentioned before there some standard tools that can be utilized for assessing a flash based web application.

http://www.nowrap.de/

Offers two different applications. One is flare and the other one is flasm. The first just extracts the ActionScript of a swf file. Nothing else gets extracted. The later disassembles the complete file. Therefore both should be used to get the complete picture.

http://www.owasp.org/index.php/Category:SWFIntruder

Is an OWASP project that helps with the practical application exploitation. Basically you download the flash from the web site and place it on a local running Apache web server. It must be seen more as a framework as you can define your own attacking strings and so for. There are a few exploitation strings that come along but more focused on XSS within the swf file. This should never be the only tool utilized during the assessment and more seen as an exploitation framework. The main problem is of course that you do the exploitation on your on machine and therefore the client can easily argue against it.

https://h30406.www3.hp.com/campaigns/2009/wwcampaign/1-5TUVE/index.php?key=swf

SWFScan from HP does a really good job in decompiling the swf file and analyze it for known weaknesses. This should defiantly be part of the assessment.

All this tools have of course the limitation that they do not take the communication with the database into account. SWFScan looks for insecure calls from the swf file but that does not give you a complete picture.

Therefore it is essential to perform a complete web application test. The fash application normally results in quite a lot of post requests.

The problem you are facing with such a test is that you have to scope it. The best approach from my point of view is to look at the application and make an estimate of how many interactions the user has with the application and how many calls the application does to the infrastructure (web server, database, etc.)

Geschrieben in hacking | Drucken | Keine Kommentare »

Link: from a pro perspective: should this be seen as good or bad

15.10.2009 von matti.

http://googleonlinesecurity.blogspot.com/2009/10/show-me-malware.html

Geschrieben in general | Drucken | Keine Kommentare »

Things that need to be said 2…

12.10.2009 von matti.

Geschrieben in humour, opinion, general | Drucken | Keine Kommentare »

Link: In the Future - Do related tags tell you something?

12.10.2009 von matti.

http://www.librarything.com/tag/geek,+--nerds

http://www.librarything.com/tag/nerds,+--geek

Look at the related tags on the right

And then have fun comparing…But wait:

Ok now that I think about it this is actually not a bad thing.

I just remember http://www.infosecwriters.com/hhworld/hh10/dns.htm especially dnspredict.pl for finding new DNS entries. I used it also to make educated guesses for password attacks. So here is the new idea for educated password guesses. Profile your target and enter it into a search engine that comes up with related tags. Then of course the usual stuff with appending 2 numbers and so on…

Geschrieben in humour, link, hacking, general | Drucken | Keine Kommentare »