Security tools
So you want to setup and run whistle blowing platform — SecureDrop
SecureDrop is a great tool and the to-go open-source solution for organisations opening an anonymous tip line for whistleblowers. It has been around for years (10 in fact) and is used by many media and public sector organisations. The benefits SecureDrop provides in terms of secure communication and anonymity can be invaluable for investigative journalism. For…
Autodafe fuzzer compile fix
I wanted to take a look at an old fuzzer called AutoDafe because its name popped up in several papers I read in regards to protocol and file formats fuzzing. The last version is from August 2006 which is far back in time, but still – it might be worthy looking at. It is available…
Vulnerable web applications to play with
This is just a list with applicaitons and frameworks out there that could be used to test your web application pentesting kung fu skills or to test your automated tools. I am trying to keep copy of those with me, because projects tend to die. So if you find that some of the links is…
Doxygen & PHP static code analysis call graphs
This post is more to document my own “discovery” and not to get into the loop of researching the same topic again and again. And if someone finds it helpful its great. I was searching for PHP static code analysis tools that generate call graphs and for my surprise the tool that I found most useful…
Automatic code analysis by Deutsche Telecom
The Developer Garden (Deutsche Telecom “ecosystem”) announced a new service – automatic code analysis for applications developed using the following technologies – .NET, ASP, VB, JAVA, C/C++, PHP, RUBY, Perl, Java Script. Aside from the typical marketing sentences about what you are getting out of their product it reads “Amplify your know-how by analyzing your…
Fix metasploit “Database not connected or cache not built”
This is a short post explaining how to deal with metasploit instance not connected to its database (I’m using the new Kali Linux but it is the same for Backtrack 5). The issue usually surfaces when you try to search auxiliary or exploit. Assuming that you use msfconsole you get something like this: msf >…
Malware Sandbox – Free Public Cuckoo instance
I’m writing this down for my own reference and if someone else benefits this I’ll be more than happy. Here is the URL (https://malwr.com/) to the public cuckoo sandbox – free to submit executables for malware analysis. Enjoy
Kali Linux – the new toy from Offensive Security
I’m very pleased to write this down – Offensive Security (the maker of Backtrack distro) came up earlier this month with a stable release of their new penetration distribution called Kali. It comes as s BackTrack successor but on the other hand it is a completely new build. There are some new stuff compared to BT5 in terms of tool…
HTTP Basic Authentication Dictionary and Brute-force attacks with Burp Suite
HTTP Basic Authentication brief explanation HTTP supports several authentication mechanisms. Upon a request for resource within a protected space the server should respond with authentication challenge using WWW-Authenticate header. In order to receive authorization the client should send requested identification information using Authorization header. When the client is not authorised a 401 “Unauthorised” response status…
Security source code review scoping questionnaire – v 2
Here is amended version of the security source code review questionnaire. I added couple of questions and reworded couple of existing ones to eliminate some ambiguities. Security Source Code Review Questionnaire – v2 (English) Security Source Code Review Scoping Questionnaire – v2 (Bulgarian)
Recent Posts
Tags
bruteforce bug bounty bug hunting Burp Suite d3 data leak data recovery dictionary entropy pool fix fuzzing hackaday image processing Journalistic tools log analysis malware mindmap online courses Practical Reverse Engineering randomness sandbox skype SQL injection SSL technical visualisaiton visualisation Vulnerability Management Wanda the fish Zeus