Article Stack based buffer overflow tutorial, part 1 - Introduction This tutorial, in three parts, will cover the process of writing a simple stack based buffer overflow exploit based on a known vulnerability in the…
Article Stack Based Buffer Overflow Tutorial, part 2 - Exploiting the stack overflow This is the second article in a series of three on stack based buffer overflow. Before you read further, you will want to read the first article. In…
Article Stack Based Buffer Overflow Tutorial, part 3 - Adding shellcode This is the third article in a series of three on stack based buffer overflow. Before you read further, you will want to read the first and second…
Article Standards for Penetration Testing The cost and quality of penetration tests vary wildly between different vendors. As a response to those differences, a group of security…
Article OWASP top 10 tools and tactics A tool for each of the OWASP Top 10 to aid in discovering and remediating each of the Top Ten If you've spent any time defending web applications as…
Article How to Learn the IT Skills of a Security Professional InfoSec Institute's Recommended Course Path for Beginners: A+ Class Network+ class Security+ MCITP track for Server Admin CCNA CCNP Ethical Hacking…
Article Malware Analysis: Classifying with ClamAV and YARA On a daily basis,we are encountering thousands of new types of malware with unknown content. This malware can come from honeypots, infected websites…
Article Computer Forensics: Snort Logs Analysis Sometimes the best evidence of a network intrusion resides in network or traffic logs. Snort is a well known open-source traffic analysis and…
Article OWASP Top 10 Deeper Dive – A5: Cross-Site Request Forgery (CSRF) Description: Parsing the OWASP Top Ten with a closer look at Cross-Site Request Forgery (CSRF). No freely available or open source tools…
Article Grep Essentials grep The grep utility, which allows files to be searched for strings of words, uses a syntax similar to the regular expression syntax of the vi, ex,…
Article SQL Injection – Another hacking how-to We wanted to get up a brief demo of the ubiquitous SQL Injection. We use it here to get control of the OS. We'll have a lot more angles on SQL…
Article Microsoft Virtual Server Security: 10 Tips and Settings Virtualization brings significant value to business managers and engineers attempting to keep pace with business pressure for additional servers. It…
Article IT auditing and controls - An introduction Auditing is an evaluation of a person, organization, system, process, enterprise, project or product, performed to ascertain the validity and…
Article The Case of the Great Router Robbery NEWSFLASH: AnyTown Local News reports this Monday morning that the recent spate of office break-ins has continued with a weekend raid on the…
Article Creepy, the geolocation information aggregator What is creepy? So what is Creepy actually and how does it come into the “Geolocation” picture ? Creepy is a geolocation information aggregation…
Article Web application testing with Arachni What is Arachni? In very simple terms, Arachni is a tool that allows you to assess the security of web applications. [pkadzone zone="main_top"] [pka
Article IT auditing and controls - IT governance and controls “IT Governance and Controls” or “IT Monitoring and Assurance Practices for Board and Senior Management” Take your choice of titles of this article,…
Article OWASP Top 10 Deeper Dive - A8: Failure to Restrict URL Access [highlight color="blue"]Interested in formal OWASP Top 10 Training? Check out our OWASP Top 10 Training course OWASP Top 10 Training. [/highlight]…
Article Cracking WPA2 Tutorial In this video we will demonstrate how to crack WPA2 using the Airmon-ng suite. We will do it by: Identifying an access point Capturing traffic from…
Article Are your backup systems secure? All seemed well with backup operations at my company, until I got a visit from an operations center engineer. The lock already hanging open, he was…
Article Attacking web services Pt 1 - SOAP I often receive testing related questions from AppSec folks new to web services about the techniques used to discover and attack them. Often, web…
Article Attacking web services Pt 2 - SOAP In the previous article, we discussed forming a SOAP request based off the operations listed in a WSDL file and automating this task with Buby and…
Article Understanding the Public Key Infrastructure behind SSL secured websites Synopsis: Public Key Infrastructure (PKI) has recently been the focus of several important discussions within the information security community due…
Article HTTP response splitting attack In this paper we will discuss HTTP Response Splitting and how the attack can actually be carried out. When we're clear about how it works, because…
