Security Operations
Well structured SQL injection reference
There are many SQL injection cheat sheets out there, but I just stumbled upon another one. It features very nice interface to quickly find what you need. It is a work of Roberto Salgado from Websec.ca. The company also published some SQL injection challenges so you can test your skill and have fun. Enjoy!
Project Hell Fire leak analysis – one step further
On 25th of August Team GhostShell published a list with leaks from hacks they supposedly committed. I will not discuss what data leaked. Everyone can go and take a look. I was more interested in the Team GhostShell modus operandi and how intelligent was the attack. How did they do it and how much skill…
An Introduction To Keyloggers, RATS And Malware – book review
Yesterday I stumbled across yet another “hacking” site. My curiosity motivated me to mirror the site content and go through all the files. Most of them were books and tutorials. After I finished reviewing some of them I realised that I hadn’t include any book reviews in this blog so far and that may be…
Kaspersky Lab source code analysis of Duqu
Kaspersky Lab has been analysing the infamous duqu worm code for several months. In one of the latest writeups, Igor Soumenkov describes part of Duqu code – for which there is an open debate around what language was used for its development. The discussion is quite interesting so I compiled a list of the relevant…
The reason behind the fraudulent Google cert – DigiNotar security breach
VASCO subsidiary DigiNotar admits that a security breach in their CA infrastructure had been identified. As a result of the attack several fraudulent certificates had been issued among which a fraudulent Google certificate. Microsoft, Mozila ana Google already removed the DigiNotar root certificate form their trusted lists.
Anubis sandbox or “Analyse this!”
If you would like to know more about the behavior of a particular malware, but you do not want to build your own sandbox or you just have not the resources to build it then may be you can find Anubis service suitable for your needs and pretty convenient. Anubis had been developed by IsecLab.…
MITRE issued their perspective on most dangerous software errors
Software is everywhere those days, and unfortunately bad codding practices together with tight schedules and demanding market brings tones of vulnerabilities. Of course there are people that are happy to find out the holes and exploit them. CWE recently published their opinion regarding the software errors summarizing it in a document called “2011 CWE/SANS Top…
First look at the Zeus source code – leak 2
So the first thing I did was to search the source code to see which banks had been targeted and for my surprize – one of the Bulgarian banks was targeted – ProCredit. The link to the e-banking login page thou is invalid, but the name of the password field is correct 🙂 Stay tuned…
Zeus code posted online
So … Here it is Zeus source code is online! It’s already few days old info, but I just red about it and luckily the download links were still alive. I was able to find information about the both leaks on http://pastebin.com/VqHq9WeD. Enjoy!
Forensic books on mobile platforms expected in 2011
Two books from Syngress on mobile platforms security and forensics are to be on the market in June 2011. One of them is focused on iOS security and forensic techniques and is authored by bobile forensic experts Andrew Hoog and Katie Strzempka. The other one is solo work of Andrew Hoog. According to the draft…
Recent Posts
Tags
bruteforce bug bounty bug hunting Burp Suite d3 data leak data recovery dictionary entropy pool fix fuzzing hackaday image processing Journalistic tools log analysis malware mindmap online courses Practical Reverse Engineering randomness sandbox skype SQL injection SSL technical visualisaiton visualisation Vulnerability Management Wanda the fish Zeus