Year: 2012
Security source code review scoping questionnaire – v 2
Here is amended version of the security source code review questionnaire. I added couple of questions and reworded couple of existing ones to eliminate some ambiguities. Security Source Code Review Questionnaire – v2 (English) Security Source Code Review Scoping Questionnaire – v2 (Bulgarian)
forum.arenabg.com members table dumped and published in the Internet
Yesterday a partial dump containing email addresses and hashed passwords for the forum.arenabg.com members leaked. According to The Hackers News the leak was published by a Russian hacker. I will not comment the story, but if you ever used forum.arenabg.com make sure that you not reuse the same password for your email or somewhere else.…
Web application security assessment scoping questionnaire
I’ve got frustrated couple of days ago when I needed to send quickly a scoping questionnaire focusing on web application security assessment and was not able to find a single one in my archives. I was sure that I’ve put together at least couple of those during the past 3 years but no find regardless…
The H Security news introducing 5 years old CSRF tool – seriously?
While reading my RSS feeds a new article from The H security popped in the list. The title was promising “Detecting CSRF vulnerabilities”. Happy to read something new on that topic I followed the link only to find with a great disappointment that the article author Stefan Schurtz is talking about a 5 years old…
BurpSuitePro Proxy History Logs to plain text
Couple of months ago I finally switched to BurpSuitePro after so many years using the free version and … I do not regret at all. I adapted pretty quickly to the extra options it provides compared to the free version. There are many differences between the free and the commercial product versions but this post…
Yet another “Play the game”
It seems that the wargames are flourishing. You can see something new popping up almost every day. Ethical Hacker Network just published another wargame. The life of this one is short so hurry up. The reward for the first 3 to score is entry tickets fro DerbyCon. Enjoy!
Some more wargames sources
I’m posting some more links to wargames and hacking challenges sites. I cannot give more details about the quality of those, but just keeping the challenges link archive alive in case of sudden boredom attacks. http://www.smashthestack.org/ http://www.overthewire.org https://github.com/JohnathanKuskos/StripeCTF
Well structured SQL injection reference
There are many SQL injection cheat sheets out there, but I just stumbled upon another one. It features very nice interface to quickly find what you need. It is a work of Roberto Salgado from Websec.ca. The company also published some SQL injection challenges so you can test your skill and have fun. Enjoy!
Project Hell Fire leak analysis – one step further
On 25th of August Team GhostShell published a list with leaks from hacks they supposedly committed. I will not discuss what data leaked. Everyone can go and take a look. I was more interested in the Team GhostShell modus operandi and how intelligent was the attack. How did they do it and how much skill…
Cool interview with Jeri Ellsworth on Twitch
This post is a bit away from the security but is about a geeky person I read about recently. If you do not know who is Jeri Ellsworth I can understand. She is a hardware geek with interesting history. I accidentally came around one of her hack projects – bass guitar built from old Comodore…
Recent Posts
Tags
bruteforce bug bounty bug hunting Burp Suite d3 data leak data recovery dictionary entropy pool fix fuzzing hackaday image processing Journalistic tools log analysis malware mindmap online courses Practical Reverse Engineering randomness sandbox skype SQL injection SSL technical visualisaiton visualisation Vulnerability Management Wanda the fish Zeus