Web application security assessment scoping questionnaire
I’ve got frustrated couple of days ago when I needed to send quickly a scoping questionnaire focusing on web application security assessment and was not able to find a single one in my archives. I was sure that I’ve put together at least couple of those during the past 3 years but no find regardless…
The H Security news introducing 5 years old CSRF tool – seriously?
While reading my RSS feeds a new article from The H security popped in the list. The title was promising “Detecting CSRF vulnerabilities”. Happy to read something new on that topic I followed the link only to find with a great disappointment that the article author Stefan Schurtz is talking about a 5 years old…
BurpSuitePro Proxy History Logs to plain text
Couple of months ago I finally switched to BurpSuitePro after so many years using the free version and … I do not regret at all. I adapted pretty quickly to the extra options it provides compared to the free version. There are many differences between the free and the commercial product versions but this post…
Yet another “Play the game”
It seems that the wargames are flourishing. You can see something new popping up almost every day. Ethical Hacker Network just published another wargame. The life of this one is short so hurry up. The reward for the first 3 to score is entry tickets fro DerbyCon. Enjoy!
Some more wargames sources
I’m posting some more links to wargames and hacking challenges sites. I cannot give more details about the quality of those, but just keeping the challenges link archive alive in case of sudden boredom attacks. http://www.smashthestack.org/ http://www.overthewire.org https://github.com/JohnathanKuskos/StripeCTF
Well structured SQL injection reference
There are many SQL injection cheat sheets out there, but I just stumbled upon another one. It features very nice interface to quickly find what you need. It is a work of Roberto Salgado from Websec.ca. The company also published some SQL injection challenges so you can test your skill and have fun. Enjoy!
Project Hell Fire leak analysis – one step further
On 25th of August Team GhostShell published a list with leaks from hacks they supposedly committed. I will not discuss what data leaked. Everyone can go and take a look. I was more interested in the Team GhostShell modus operandi and how intelligent was the attack. How did they do it and how much skill…
Cool interview with Jeri Ellsworth on Twitch
This post is a bit away from the security but is about a geeky person I read about recently. If you do not know who is Jeri Ellsworth I can understand. She is a hardware geek with interesting history. I accidentally came around one of her hack projects – bass guitar built from old Comodore…
GDBOP website malfunctioning … again
I just found out, with no surprise, that the website of GDBOP (Bulgarian government cybersecurity team) hosted on http://www.cybercrime.bg does not function properly … again. The reason is that the the front-end app cannot connect the back-end MySQL server. Of course the error is not handled securely :). I wonder how long it will take…
Security source code review scoping questionnaire
Usually when a customer comes with request for security source code review one of the main questions is “How long it will take?”. And the answer of that particular question is not an easy one because it depends on so many factors: – application architecture and complexity – documentation absence or presence – code quality…
