Damn Vulnerable Web App (DVWA) has released an updated version (v1.04) of their PHP/mySQL web application that is intended to be attacked. It’s intended to be run on a local (closed) network as a learning tool for exploits and vulnerabilities. As it sits now, it pretty much contains a lot of the basics – brute force, command execution, file inclusion, SQL injection, and XSS.
Author: Tim Donaworth
With Windows holding 89.6% of the global market share, it is a very large target. This is one of the reasons Windows is targeted so much by malicious attacks. Not very hard when you’re such a big target. So, what if you could change that and make your Windows machine/server appear as something else, even to the most notable of sniffing tools (Nmap, P0f, Ettercap, etc.)? Well, you can.
As many have noticed, Apple has released their new lineup of laptops, software, OSes, and iPhones. As I watched live coverage of the keynotes on Monday (thanks Gizmodo) – a few things caught my attention when they were speaking about the new iPhone 3G S. The first thing that caught my eye was the mention of “hardware encryption.” Now, simply mentioning that a device supports hardware encryption can mean a lot of things, and Apple isn’t very clear about what they mean by this. Trying to do some further research didn’t help much either as I only ended up being further confused with all the different mentions of this “hardware encryption.” The official word from Apple is… iPhone 3G S[…]
Let’s face it. Virtualization is everywhere in businesses today. There probably isn’t an IT admin out there that doesn’t swear by it. The sheer number of benefits it adds to the IT departments with its reduced resources, better energy savings, easier administration, etc. It’s also nothing new really. It’s been around for quite some time now, but it has usually been limited to the IT departments, developers, system testers, or the other elite geeks. It hasn’t really been a product for mass consumption – until now very soon. Anyone who hasn’t been hiding under a rock for the past few weeks has probably heard about Microsoft’s new OS, Windows 7, and how it’s incorporated a built-in Windows XP virtualization. It[…]
“w3af” (Web Application Attack and Audit Framework) is a complete environment for auditing and attacking web applications. This environment provides a solid platform for auditing and penetration-testing. The framework will work on all platforms that support Python (Linux, WinXP, Vista, OpenBSD, etc )
Today’s tutorial is anything new, but just thought I’d share some recent experience with Microsoft’s PowerShell. I’ve been playing around with PowerShell (PS) for a little while now, but nothing too extravagant, I’m not an administrator so I don’t have hundreds of little tasks I have to do on a daily basis (unless I can write a script to help me wake up and get ready in the morning.. C:\>Set-TeethClean ? ) – Anyways, I was recently tasked with doing some rudimentary task of searching through the Windows Certificate store and finding all CAs that were signed with MD5. If MD5 rings a bell its most likely because of this.
I really didn’t want to go through the list one by one, double-clicking, then selecting the Details tab. So I decided there had to be an easy way to parse this information. My first idea was to fire up Visual Studio and write a quick c# app to do this as it has built in Certificate Store classes/functions. But this seemed too combersome but I still wanted to leverage the .NET framework for the same features. PowerShell it was then.