Article Extending Burp Suite Introduction There are multiple intercepting proxy tools available and Burp Suite is one of the best tools available for interception. If you are…
Article Virtualization Security: Hacking VMware with VASTO With the advancement of the technology in the field of computers, requirement for hybrid setups has also escalated. Nowadays every company is using…
Article Attack Surface Reduction – Chapter 4 This is Chapter 4 in Tom Olzak‘s book, “Enterprise Security: A practitioner’s guide.” Chapter 3 is available here: Building the Foundation:…
Article pcAnywhere Leaked Source Code - An Anonymous Review [highlight color=yellow]DISCLAIMER: InfoSec Institute received an anonymous submission concerning the leaked pcAnywhere source code. The article is…
Article Information Gathering Using Maltego The first phase in security assessment is to focus on collecting as much information as possible about a target application. According to OWASP,…
Article CSRF and XSS: A Lethal Combination - Part I Introduction In the second installment of this series, we discussed one of the most prevalent attacks to applications: SQL Injection. The previous…
Article Circumventing NAT with UDP hole punching A lot of networks use NAT (Network Address Translation) these days. This allows the systems on the same network to have a single global IP address.…
Article How to Build a Secure RPC Interface for AJAX Apps With Google Web Toolkit Why use GWT? Most modern web applications utilize an AJAX functionality of some sort to make them highly interactive and to have a user interface…
Article Soft Skills: A Peek into the Mind of a Hiring Manager As a recruiter, I often have the question posed to me in a variety of ways, "Exactly what is it that hiring managers want?" What is it that they are…
Article InfoSec Book Excerpt: Security Metrics - Chapter 17 We like to read the latest and greatest security books, andsometimes the author and/or publisher is generous enough to share an extended with us -…
Article W3af walkthrough and tutorial w3af (Web Application audit and attack framework) is a framework for auditing and exploitation of web applications. In this series of articles we…
Article Pivoting from the age old ARP attack Translating layer 2 local addresses to layer 3 globally routable addresses is the sole responsibility of the Address Resolution Protocol. ARP…
Article Cookie-based SQL injection Did you say a "cookie" ? A cookie, also known as an HTTP cookie, web cookie, or browser cookie, is used for an origin website to send state…
Article Security Dangers of Web Management Interfaces Web based interfaces are convenient for managing networking equipment, but under no circumstances should these be open to the world and the…
Article DarkComet analysis – Understanding the Trojan used in Syrian uprising DarkComet used in Syrian conflict? On February 17th the CNN published an interesting article, where some Syrian's regime opponents claimed that the…
Article Mexican Drug Cartels and Cyberspace: Opportunity and Threat 1) Mexican Drug Gangs Kidnap Computer Hackers and Programmers Mexican drug trafficking organizations are increasingly demonstrating a desire to make…
Article SQL injection through HTTP headers During vulnerability assessment or penetration testing, identifying the input vectors of the target application is a primordial step. Sometimes,…
Article The Importance of Securing a Linux Web Server With the significant prevalence of Linux web servers globally, security is often touted as a strength of the platform for such a purpose. However, a…
Article Malware Analysis - Follow along reversing the German government's "Bundestrojaner" Introduction I'm reasonably sure that anyone reading this particular article has heard about viruses, worms, trojans and malware; as well as…
Article OSINT and pre-game show for a on-site WLAN Penetration Test Wireless Penetration Testing in my opinion is one of the most fun parts of Ethical Hacking. It incorporates application exploits once you are on the…
Article Iframe & the security risk Web application security is always an important topic to discuss because websites seem to be the first target of malicious hackers. Hackers use…
Article Passive Fingerprinting During penetration testing, the main objective of the auditor is to exploit and gain access. For that to happen, it is required to have some…
Article Hacking AutoUpdate by Injecting Fake Updates Works against Java, AppleUpdate, Google Analytics, Skype, Blackberry and more Introduction [pkadzone zone="main_top"] [pkadzone zone="main_top"] We…
Article AlienVault OSSIM Review - Open Source SIEM Introduction As logs never lie, it's very important to aggregate and analyze the internal and external network logs constantly so that companies can…
