Attacks
HTTP Basic Authentication Dictionary and Brute-force attacks with Burp Suite
HTTP Basic Authentication brief explanation HTTP supports several authentication mechanisms. Upon a request for resource within a protected space the server should respond with authentication challenge using WWW-Authenticate header. In order to receive authorization the client should send requested identification information using Authorization header. When the client is not authorised a 401 “Unauthorised” response status…
forum.arenabg.com members table dumped and published in the Internet
Yesterday a partial dump containing email addresses and hashed passwords for the forum.arenabg.com members leaked. According to The Hackers News the leak was published by a Russian hacker. I will not comment the story, but if you ever used forum.arenabg.com make sure that you not reuse the same password for your email or somewhere else.…
Well structured SQL injection reference
There are many SQL injection cheat sheets out there, but I just stumbled upon another one. It features very nice interface to quickly find what you need. It is a work of Roberto Salgado from Websec.ca. The company also published some SQL injection challenges so you can test your skill and have fun. Enjoy!
Project Hell Fire leak analysis – one step further
On 25th of August Team GhostShell published a list with leaks from hacks they supposedly committed. I will not discuss what data leaked. Everyone can go and take a look. I was more interested in the Team GhostShell modus operandi and how intelligent was the attack. How did they do it and how much skill…
The reason behind the fraudulent Google cert – DigiNotar security breach
VASCO subsidiary DigiNotar admits that a security breach in their CA infrastructure had been identified. As a result of the attack several fraudulent certificates had been issued among which a fraudulent Google certificate. Microsoft, Mozila ana Google already removed the DigiNotar root certificate form their trusted lists.
First look at the Zeus source code – leak 2
So the first thing I did was to search the source code to see which banks had been targeted and for my surprize – one of the Bulgarian banks was targeted – ProCredit. The link to the e-banking login page thou is invalid, but the name of the password field is correct 🙂 Stay tuned…
Online Banking targeted by new Zeus version for Windows mobile
For those of you that never heard for Zeus trojan – this is special bread that targets online banking users, stealing their credentials. It does implement pretty old idea for key logging. Zeus botnet however is huge and estimated to contain millions of compromised computer. Internet is full of detailed information. The trojan is active…
Basic information security attack types
Purely technical The attacker count on weaknesses in protocol implementation, application, OS, firmware etc.. Those attacks can be easily automated and if the vulnerability is well known pretty easy to defend of. On the other hand the attack can come basically from any part of the world and is very hard to trace, because it…
Don’t ever do this 🙂
To miss the target and to hit someone else instead can happen easily in a mil operation, but to deface a site believing that it is your real target and to make a mistake should be a shame for every so called hacker. The lesson from the story: http://www.itproportal.com/portal/news/article/2010/9/1/algerian-hackers-attack-wrong-website/ Do your homework!
Recent Posts
Tags
bruteforce bug bounty bug hunting Burp Suite d3 data leak data recovery dictionary entropy pool fix fuzzing hackaday image processing Journalistic tools log analysis malware mindmap online courses Practical Reverse Engineering randomness sandbox skype SQL injection SSL technical visualisaiton visualisation Vulnerability Management Wanda the fish Zeus