Penetration Testing

I recently saw a good webcast presented by Core Security Technologies on “Penetration Testing Ninjitsu”. This was presented by Ed Skoudis who is a very good SANS instructor and is also the author of the book “Counter Hack Reloaded” (I highly recommend all penetration testers read this book). Some of you may have taken his […]

Last week I spoke at a local security professionals user group about Automated Penetration Testing with CORE IMPACT (from Core Security Technologies). There has been some great developments in the automated penetration testing area recently with commercial tools like CORE IMPACT and Immunity’s CANVAS. However, lets not forget about recent advancements with open source solutions

c 99shell from the ccteam was a great PHP script, unfortunately support is discontinued. The idea is to have an all-in-one file to administrate a server once that file is uploaded. When you look into the source of the c 99shell it is a bit chaotic and it even is detected by some anti-virus programs.

The fine folks who brought you the De-ICE Pentest LiveCD’s have put together a nice nine minute video tutorial on Netcat. I personally love Netcat. It is a must use pentest tool. You can check it out on the heorot.net web site.

HD Moore has released the latest version of the venerable Metasploit Framework over the weekend. Version 3.1 includes the following updates and improvements: “The latest version features a graphical user interface, full support for the Windows platform, and over 450 modules, including 265 remote exploits…” This is a significant improvement for the Windows version and

Looking to enhance your pen testing skills and take it to the next level? Thomas over at De-ICE.net has just released the first disk in the more advanced “Level 2” set of Live PenTest LiveCD scenarios.

Just saw this on Richard Bejtlich’s blog… “I (Richard) contacted several PR reps at TruTV and asked about Tiger Team’s future. One of them wrote back: Thank you for your email and interest in Tiger Team. Tiger Team was a special and likely won’t be returning. Please let me know if I can assist you

Some of you may have seen the new reality TV show on CourtTV over the holidays called “Tiger Team”. This show is about a team of penetration testers hired to break in to some high profile companies using some pretty cool techniques. While you won’t see anything technically earth shattering (as Grumpy Security Guy mentions),

Looks like Thomas over at de-ice.net (creator of the De-ICE Pentest LiveCD’s) has started online training for beginning pen testers. Looks pretty affordable at only $395. He also has a special for $100 for the first 100 that sign up. Here are some details on the training from Thomas’ web site: “PenTesting Fundamentals” The following

In doing a recent pen test…just a reminder to not forget about easy things that a DBA might over look like keeping around a dangerous stored procedure like xp_cmdshell. While most of us spend time trying to figure out complex and creative ways to get into systems…sometimes it’s the simple things that get over looked.