Article Malware Analysis: Classifying with ClamAV and YARA On a daily basis,we are encountering thousands of new types of malware with unknown content. This malware can come from honeypots, infected websites…
Article Computer Forensics: Snort Logs Analysis Sometimes the best evidence of a network intrusion resides in network or traffic logs. Snort is a well known open-source traffic analysis and…
Article OWASP Top 10 Deeper Dive – A5: Cross-Site Request Forgery (CSRF) Description: Parsing the OWASP Top Ten with a closer look at Cross-Site Request Forgery (CSRF). No freely available or open source tools…
Article Grep Essentials grep The grep utility, which allows files to be searched for strings of words, uses a syntax similar to the regular expression syntax of the vi, ex,…
Article SQL Injection – Another hacking how-to We wanted to get up a brief demo of the ubiquitous SQL Injection. We use it here to get control of the OS. We'll have a lot more angles on SQL…
Article Microsoft Virtual Server Security: 10 Tips and Settings Virtualization brings significant value to business managers and engineers attempting to keep pace with business pressure for additional servers. It…
Article IT auditing and controls - An introduction Auditing is an evaluation of a person, organization, system, process, enterprise, project or product, performed to ascertain the validity and…
Article The Case of the Great Router Robbery NEWSFLASH: AnyTown Local News reports this Monday morning that the recent spate of office break-ins has continued with a weekend raid on the…
Article Creepy, the geolocation information aggregator What is creepy? So what is Creepy actually and how does it come into the “Geolocation” picture ? Creepy is a geolocation information aggregation…
Article Web application testing with Arachni What is Arachni? In very simple terms, Arachni is a tool that allows you to assess the security of web applications. [pkadzone zone="main_top"] [pka
Article IT auditing and controls - IT governance and controls “IT Governance and Controls” or “IT Monitoring and Assurance Practices for Board and Senior Management” Take your choice of titles of this article,…
Article OWASP Top 10 Deeper Dive - A8: Failure to Restrict URL Access [highlight color="blue"]Interested in formal OWASP Top 10 Training? Check out our OWASP Top 10 Training course OWASP Top 10 Training. [/highlight]…
Article Cracking WPA2 Tutorial In this video we will demonstrate how to crack WPA2 using the Airmon-ng suite. We will do it by: Identifying an access point Capturing traffic from…
Article Are your backup systems secure? All seemed well with backup operations at my company, until I got a visit from an operations center engineer. The lock already hanging open, he was…
Article Attacking web services Pt 1 - SOAP I often receive testing related questions from AppSec folks new to web services about the techniques used to discover and attack them. Often, web…
Article Attacking web services Pt 2 - SOAP In the previous article, we discussed forming a SOAP request based off the operations listed in a WSDL file and automating this task with Buby and…
Article Understanding the Public Key Infrastructure behind SSL secured websites Synopsis: Public Key Infrastructure (PKI) has recently been the focus of several important discussions within the information security community due…
Article HTTP response splitting attack In this paper we will discuss HTTP Response Splitting and how the attack can actually be carried out. When we're clear about how it works, because…
Article Android malware analysis The advance in technology brought us mobile phones with almost the same power and features as our personal computers. Something that criminal minds…
Article SQL Injection: The Equal Opportunity Vulnerability Introduction In the first installment of this series, we discussed application security within the Software Development Process by demystifying the…
Article A history of anonymous Anonymous is the most famous 'hacktivist' group in the world. The informal nature of the group makes its mechanics difficult to define.…
Article Goodbye DIACAP, Hello DIARMF When C&A becomes A&A, will you be ready? Every few months, an elite group of DoD security experts, IT managers, and senior leadership gather to char
Article UEFI and the TPM: Building a foundation for platform trust Table of Contents Trusted Computing Boot Path Security Challenges Boot Path Attack Surface The Trusted Memory Module (TPM) TPM Architectur
Article VLAN hacking In Virtual LAN or VLAN is a group of hosts communicate with each other, even thoughthey are in different physical location. Virtual LAN provides…
