• Subscribe to the low volume list for updates.

Blog

Google builds lessons for Web Application Security

Google has put some web application security testing training lessons around a vulnerable application that you are allowed to (within the boundries) attack and test for the purpose of learning about application security threats, testing and how to develop more secure applications. This codelab is built around Gruyere /?ru??j??r/ - a small, cheesy web application […]
Read More

TechCrunch Europe hacked

Drive by downloads, adobe exploits and a zeus variant trojan that is only detected by 2 of 43 Anti-virus products. This is a good example of current threats that website operators as well as end users should all be aware of, a high profile site gets hacked and poses a signifcant threat to the end […]
Read More

Metasploit Express Review

Metasploit Express with Ubuntu The purchase of Metasploit by Rapid7 last year and the recent release of Metasploit Express has been big news in the security community. I have finally gotten around to giving it a spin. So what is Metasploit Express? It is a web based front end for Metasploit that provides not only […]
Read More

Metasploit vs Snort as Snorby

Recently I stumbled acorss Snorby, an excellent easy to use implementation of Snort. It is a new web interface for Snort that is very pretty, but also simple. An excellent introduction to Intrusion Detection Systems, that is not going to scare anyone away. Now how to I get hold of this I hear you cry.... […]
Read More

Metasploit 3.4.0 on Ubuntu 10.04 a quick introduction

Perhaps you have heard of metasploit. It is a very powerful exploitation framework developed by HD Moore. Solid growth has seen an early version that was a few exploits in a perl based wrapper turn into a ruby coded framework that is competing with Core Impact and Canvas in the pen-testing community. Here is a […]
Read More

SET Social Engineering Toolkit

This tool and guide to using the tool is an example of how easy client based exploitation has become. When it comes down to it, attacking the client is fast becoming the easiest method to perform a targeted attack against an organisation or company. For our readers who are not familiar with Metasploit this maybe […]
Read More

CMS Explorer

When it comes to security vulnerability assessments against content management systems, it becomes necessary to discover which plugins are being used within the system. For the most popular open source systems (wordpress, drupal, joomla) there are literally thousands of plugins available and many have lets admit it not the best record when it comes to […]
Read More

New Web Application Security Tool from Google. Skipfish.

Having done some initial testing this new tool is powerful and comprehensive. It blends a number of other tool features into a neat little package. I did some testing on my local LAN and the web server was getting pounded with thousands of requests per second. Your access and error.log is really going to fill […]
Read More

Sqlmap 0.8 Released and Rolled out to HackerTarget.com servers

After discovering the new release of the excellent SQL Injection tool sqlmap I have done some testing and rolled it out to the HackerTarget.com scanning servers. If you are not familiar with the power of sqlmap head over to the sourceforge site for demo videos and some top notch documentation. Our scanning tools are configured […]
Read More

When Neo Hacked the Latvian SRS Database

Movie plots cross into real life in Latvia where a significant security breach has occurred in the hacking of the Latvian SRS Databse. A group of hackers has stirred the nation after hacking into the countries taxation web site and revealing details of the powerful political elites wages and bonuses. One of the hackers used […]
Read More