Article Ideal skill set for the penetration testing Based on questions I've gotten over the years and specifically in class, I've decided that we need to address some basic skills that every…
Article Tracing the Crimeware Origins by Reversing Injected Code Part 1: Introduction and De-Obfuscating and Reversing the User-Mode Agent Dropper Part 2: Reverse Engineering the Kernel-Mode Device Driver Stealth…
Article Security Incident Response Testing To Meet Audit Requirements Description: Practical guidance and tools to ensure maximum readiness for incident response teams including drill tactics. PCI-DSS audits often…
Article An introduction to fuzzing: using fuzzers (SPIKE) to find vulnerabilities This article discusses the process of fuzzing an application to find exploitable bugs. Vulnserver, a TCP server application deliberately written by…
Article Stack based buffer overflow tutorial, part 1 - Introduction This tutorial, in three parts, will cover the process of writing a simple stack based buffer overflow exploit based on a known vulnerability in the…
Article Stack Based Buffer Overflow Tutorial, part 2 - Exploiting the stack overflow This is the second article in a series of three on stack based buffer overflow. Before you read further, you will want to read the first article. In…
Article Stack Based Buffer Overflow Tutorial, part 3 - Adding shellcode This is the third article in a series of three on stack based buffer overflow. Before you read further, you will want to read the first and second…
Article Standards for Penetration Testing The cost and quality of penetration tests vary wildly between different vendors. As a response to those differences, a group of security…
Article OWASP top 10 tools and tactics A tool for each of the OWASP Top 10 to aid in discovering and remediating each of the Top Ten If you've spent any time defending web applications as…
Article How to Learn the IT Skills of a Security Professional InfoSec Institute's Recommended Course Path for Beginners: A+ Class Network+ class Security+ MCITP track for Server Admin CCNA CCNP Ethical Hacking…
Article Malware Analysis: Classifying with ClamAV and YARA On a daily basis,we are encountering thousands of new types of malware with unknown content. This malware can come from honeypots, infected websites…
Article Computer Forensics: Snort Logs Analysis Sometimes the best evidence of a network intrusion resides in network or traffic logs. Snort is a well known open-source traffic analysis and…
Article OWASP Top 10 Deeper Dive – A5: Cross-Site Request Forgery (CSRF) Description: Parsing the OWASP Top Ten with a closer look at Cross-Site Request Forgery (CSRF). No freely available or open source tools…
Article Grep Essentials grep The grep utility, which allows files to be searched for strings of words, uses a syntax similar to the regular expression syntax of the vi, ex,…
Article SQL Injection – Another hacking how-to We wanted to get up a brief demo of the ubiquitous SQL Injection. We use it here to get control of the OS. We'll have a lot more angles on SQL…
Article Microsoft Virtual Server Security: 10 Tips and Settings Virtualization brings significant value to business managers and engineers attempting to keep pace with business pressure for additional servers. It…
Article IT auditing and controls - An introduction Auditing is an evaluation of a person, organization, system, process, enterprise, project or product, performed to ascertain the validity and…
Article The Case of the Great Router Robbery NEWSFLASH: AnyTown Local News reports this Monday morning that the recent spate of office break-ins has continued with a weekend raid on the…
Article Creepy, the geolocation information aggregator What is creepy? So what is Creepy actually and how does it come into the “Geolocation” picture ? Creepy is a geolocation information aggregation…
Article Web application testing with Arachni What is Arachni? In very simple terms, Arachni is a tool that allows you to assess the security of web applications. [pkadzone zone="main_top"] [pka
Article IT auditing and controls - IT governance and controls “IT Governance and Controls” or “IT Monitoring and Assurance Practices for Board and Senior Management” Take your choice of titles of this article,…
Article OWASP Top 10 Deeper Dive - A8: Failure to Restrict URL Access [highlight color="blue"]Interested in formal OWASP Top 10 Training? Check out our OWASP Top 10 Training course OWASP Top 10 Training. [/highlight]…
Article Cracking WPA2 Tutorial In this video we will demonstrate how to crack WPA2 using the Airmon-ng suite. We will do it by: Identifying an access point Capturing traffic from…
