CGISecurity Logo

Topics

Tags

  • My experience coleading purple team

    Posted by Robert A on

    in
    , , , , , , , , , ,
    | |

    I've been fortunate enough to manage a red team program for several years and since it's inception it has gone through many changes. What started out as adhoc engagements trying to see how far we could get/what problems we could find, turned into a mechanism to work more closely, and regularly with operations/it teams. More…

  • Presentation: Problems you’ll face when building a software security program

    Posted by Robert A on

    in
    , , , ,
    | |

    A video for a talk I gave at LASCON last year made it online that some folks may find interesting. I rarely give public talks, but felt this information would have been useful to learn earlier in my career. Basically it goes through problems I've had to deal with building out appsec programs at companies…

  • Google’s intentions are good, but implementation leave MORE users vulnerable to hacking than before

    Posted by Robert A on

    in
    , , , , , , ,
    | |

    In 2010 I wrote an article about a flaw Google discovered, and published working exploit code when no fix or mitigation existed. This allowed attackers to immediately start using the flaw to hack Google's own users (in this case, the world).  Since then Google has announced a new program 'Project Zero' which from the project…

  • Poll: How do you rank the importance of a vulnerability?

    Posted by Robert A on

    in
    , ,
    | |

    I've added a new poll to the WASC linkedin group that a few of you may be interested in. Specifically asking how people rank the importance of vulnerabilities. Poll Linkhttp://www.linkedin.com/groups/How-do-you-rank-importance-83336.S.202840840

  • Updating the WASC Threat Classification

    Posted by Robert A on

    in
    , , ,
    | |

    I've been pretty busy the past few months which has resulted in zero site updates. The good news is I've kicked off the next phase of the WASC Threat Classification and our first update is the completion of the TC's missing crypto section.

  • Oracle website vulnerable to SQL Injection

    Posted by Robert A on

    in
    , , ,
    | |

    Someone has published a SQL Injection in labs.oracle.com at http://www.thehackernews.com/2011/07/oracle-website-vulnerable-to-sql.html . That is all.  

  • Results of internet SSL usage published by SSL Labs

    Posted by Robert A on

    in
    , , , ,
    | |

    Ivan Ristic (of modsecurity fame) has published the results of an evaluation against over 900,000 websites supporting SSL. The goal of this evaluation was to see how people really use/misuse ssl in the wild, as well as report on the usage of browser protections such as the Secure cookie flag, and Strict-Transport-Security. Details can be…

  • Another use of Clickjacking, Cookiejacking!

    Posted by Robert A on

    in
    , , , ,
    | |

    Rosario Valotta has published an interesting attack against IE that takes advantage of clickjacking. In a nutshell it combines origin flaws within IE with clickjacking to trick a user into copying/pasting their own cookies from any site! Demonstration below The technical details can be found at https://sites.google.com/site/tentacoloviola/cookiejacking and his slides at https://docs.google.com/viewer?a=v&pid=sites&srcid=ZGVmYXVsdGRvbWFpbnx0ZW50YWNvbG92aW9sYXxneDoxMWJlZTI5ZjVhYjdiODQx  

  • NIST publishes 50kish vulnerable code samples in Java/C/C++, is officially krad

    Posted by Robert A on

    in
    , , , , , , ,
    | |

    NIST has published a fantastic project (its been out since late December, but I only just became aware of it) where they've created vulnerable code test cases for much of MITRE's CWE project in Java and c/c++. From the README "This archive contains test cases intended for use by organizations and individuals that wish to…

  • How not to publish SCADA security advisories

    Posted by Robert A on

    in
    , , , ,
    | |

    "Luigi Auriemma" has posted an interesting series of SCADA vulnerabilities to the bugtraq security list this morning. From his email "The following are almost all the vulnerabilities I found for a quick experiment some months ago in certain well known server-side SCADA softwares still vulnerable in this moment. In case someone doesn't know SCADA (like…

  • Announcing WASC Web Hacking Incident Database (WHID) Mail-list

    Posted by Robert A on

    in
    , , ,
    | |

    Ryan Barnett (Leader of the WASC Web Hacking Incidents Database Project) has announced a new mailing list where users can subscribe to hear about the latest hacking incidents. From his email to The Web Security Mailing List "Greetings everyone,I wanted to let everyone know that we have setup a mail-list for those of you who…

  • Tracking and understanding security related defects: Useful data points for shaping your SDLC program

    Posted by Robert A on

    in
    , , ,
    | |

    In addition to CGISecurity, I also run a website called QASEC.com where I post SDLC related content. I've just published a lightweight article discussing tips and tricks for tracking software level vulnerabilities in larger organizations. Abstract:"If you work in infosec for a large organization it can be difficult to easily track the state of every…

  • Improving ASP.NET Security with Visual Studio 2010 Code Analysis

    Posted by Robert A on

    in
    , , , , ,
    | |

    Sacha Faust has published a great article on some of the security checking functionality in Visual Studio. From the article "Anyone doing ASP.NET development probably admits, openly or not, to introducing or stumbling upon a security issue at some point during their career. Developers are often pressured to deliver code as quickly as possible, and…

  • Phrack #67 is out for 25th anniversary!

    Posted by Robert A on

    in
    , , , ,
    | |

    To celebrate 25 years the phrack team has published issue #67. Introduction    The Phrack Staff Phrack Prophile on Punk    The Phrack Staff Phrack World News    EL ZILCHO Loopback (is back)    The Phrack Staff How to make it in Prison    TAp Kernel instrumentation using kprobes    ElfMaster ProFTPD with mod_sql pre-authentication, remote root    FelineMenace The House Of…

  • Interesting IE leak via window.onerror

    Posted by Robert A on

    in
    , , ,
    | |

    Chris Evans has posted an interesting bug in IE involving using JavaScript's window.onerror to leak cross domain data. From his blog "The bug is pretty simple: IE supports a window.onerror callback which fires whenever a Javascript parse or runtime error occurs. Trouble is, it fires even if www.evil.com registers its own window.onerror handler and then…

  • Why publishing exploit code is *generally* a bad idea if you’re paid to protect

    Posted by Robert A on

    in
    , , , ,
    | |

    Update2: Further proof that people are abusing this in a wide scale and likely wouldn't have had the exploit code not been released. Update: I've clarified a few points and added a few others. Recently Tavis Ormandy (a google employee) discovered a security issue in windows, and days after notifying Microsoft published a working exploit…

  • A reminder that CSRF affects more than websites

    Posted by Robert A on

    in
    , , , ,
    | |

    Maksymilian Arciemowicz has published an advisory outlining how one can perform CSRF attacks against FTP services, in this case Sun Solaris 10 ftpd. An attacker could embed a payload such as the following to execute commands on ftpd.     <img src=”ftp://…..////SITE%20CHMOD%20777%20FILENAME”;> The NetBSD team addressed this issue by failing on large commands. The interesting thing…

  • Multiple Adobe products vulnerable to XML External Entity Injection And XML Injection

    Posted by Robert A on

    in
    ,
    | |

    I haven't really been posting advisories on this website for the past year, however a series of XML Injection/XXe vulnerabilities in Adobe products caught my eye. XML Injection is to web services, what XSS is to web pages (an attacker controllable application response able to perform abuses against the consumer). This advisory provides a good…

  • Nikto version 2.1.1 released

    Posted by Robert A on

    in
    , , , ,
    | |

    Sullo has sent the following announcement to the full disclosure mailing list indicating a new release of Nikto. "I'm happy to announce the immediate availability of Nikto 2.1.1! Nikto is an open source web server scanner which performscomprehensive tests against web servers for multiple items, includingover 6100 potentially dangerous files/CGIs, checks for outdatedversions of over…

  • Announcement: WASC Threat Classification v2 is Out!

    Posted by Robert A on

    in
    , , , , , , , , , ,
    | |

    I am very pleased to announce that the WASC Threat Classification v2 is finally out the door. This project has by far been one of the most challenging, intellectually stimulating projects I've had the chance to work on. I have included the official announcement below. "The Web Application Security Consortium (WASC) is pleased to announce…

  • Experimenting With WASC Threat Classification Views: Vulnerability Root Cause Mapping

    Posted by Robert A on

    in
    , , ,
    | |

    I currently lead the WASC Threat Classification Project and we're expecting to publish our latest version next month. One of the biggest changes between the TCv2 and TCv1 is that we're doing away with single ways to represent the data. In the TCv1 we had a single tree structure to convey appsec concepts. After months…

  • Clientless SSL VPN products break web browser domain-based security models

    Posted by Robert A on

    in
    , ,
    | |

    A new CERT advisory has been published outlining a weakness in the way web based SSL clients operate, resulting in a Same Origin Policy breakage. Here's the meaty details. "As the web VPN retrieves web pages, it rewrites hyperlinks so that they are accessible through the web VPN. For example, a link to http://<www.intranet.example.com>/mail.html becomes…

  • Nozzle: A Defense Against Heap-spraying Code Injection Attacks

    Posted by Robert A on

    in
    , , , ,
    | |

    Microsoft has been working on a tool called 'Nozzle' to prevent the exploitation of heap spraying attacks and released a whitepaper describing the process. From the whitepaper. "Heap spraying is a new security attack that significantly increasesthe exploitability of existing memory corruption errors in type-unsafeapplications. With heap spraying, attackers leverage their ability toallocate arbitrary objects…

  • Heading out to AppsecDC

    Posted by Robert A on

    in
    , , ,
    | |

    I'll be heading out to AppSecDC to present Transparent Proxy Abuse on Thursday, so if you're attending and want to chat about appsec I'll be available after my talk. Here's a teaser of my presentation I'll be presenting a video demonstrating this abuse case against Squid and Mac OS X Parental Control software prior to…

  • TLS negotiation flaw published

    Posted by Robert A on

    in
    , , , , ,
    | |

    Steve Dispensa and Marsh Ray have published a paper describing a weakness in the TLS negotiation process. This is the same attack discussed on the IETF TLS list. From the whitepaper "Transport Layer Security (TLS, RFC 5246 and previous, including SSL v3 and previous) is subject to a number of serious man-in-the-middle (MITM) attacks related…

Favorite Links

Twitter

Twitter

Popular Pages

WASC Threat Classification

Copyright 2000-2026 CGISecurity.com – The oldest application security site online, predating OWASP.