• Subscribe to the low volume list for updates.

Blog

Web Scanner Comparison

An interesting report has been released that takes a sample of web application security testing applications and puts them up against each other. The most notably thing is how much the results vary, and how many vulnerabilities most scanners miss. Clearly using more than one scanner is necessary to be able to compare the results, […]
Read More

BackTrack 4 Release

In case you missed it the worlds leading penetration testing Linux Distribution BackTrack has hit version 4.0. A new web site, great video tutorials for those wanting to learn and a complete guide to Metasploit are just a few of the new bits for you to check out. Based on Ubuntu and well tested this […]
Read More

Samurai, BackTrack and Kali – LiveCD’s for Pentesting

Linux has brought a wonderful concept to the world of computers and that is easy to use live cd's that allow you to boot up a fully operational operating system that does not require installation to the hard drive. Ubuntu, SuSe, Mandriva and Fedora all have boot-able Live CD options that allow you to test […]
Read More

Nmap Cheat Sheet

Nmap Target Selection Scan a single IP nmap 192.168.1.1 Scan a host nmap www.testhostname.com Scan a range of IPs nmap 192.168.1.1-20 Scan a subnet nmap 192.168.1.0/24 Scan targets from a text file nmap -iL list-of-ips.txt These are all default scans, which will scan 1000 TCP ports. Host discovery will take place. Nmap Port Selection Scan […]
Read More

Maltego – Open Source Intelligence Gathering

A powerful new tool is about to go into a new release. Maltego makes the collection of open source intelligence about a target organisation a simple matter. DNS queries, document collection, email addresses, whois, search engine interrogation and a wide range of other collection methods allows a Penetration Tester or vulnerability assessment to quickly gather […]
Read More

DirBuster – Brute force a web server for interesting things

You would be surprised at what people leave unprotected on a web server. DirBuster is a java application that will brute force web directories and filenames on a web server / virtual host. This can often reveal unprotected web applications, scripts, old configuration files and many other interesting things that should not be available to […]
Read More

Mozilla Service Week

An online volunteering initiative by the Mozilla foundation is a great initiative intending to bring online volunteering together with organisations and individuals requiring assistance. We believe the Internet should make life better. Join us the week of September 14-21, 2009, as we take action to make a difference in our communities, our world, our Web. […]
Read More

rkhunter – add another layer to your security

Rkhunter is an easy to use tool that keeps an eye on your systems files for rootkits and a few other oddities that may indicate an attacker has taken over your system. It can be also used if your system has been hacked and you wish to inspect the damage - keep in mind that […]
Read More

SQL Injection Demystified

Darkreading has a great article up on SQL Injection. This form of attack has been around for a long time, and happens because of poor dynamic website coding practices. A simple SQL injection vulnerability can often be exploited to gain full access to the database and / or full control of the database server. Now […]
Read More