Category Archives: InfoSec

Eurotrash Security and Exotic Liability Podcast Mash Up

Leave a reply

Merry Christmas everyone. Check out the Eurotrash Security and Exotic Liability Christmas podcast special.


The Crimbo edition !

A very special Xmas episode recorded together with the Exotic Liability crew. Chris, Craig, Dale and Wim are joined by Chris and Ryan to discuss what moved the infosec community on both sides of the big pond in 2009 and are looking forward to 2010. One certainty being you will receive more and better Exotic Trash / EuroLiability.

Have a very merry Christmas and may your information not be compromized in 2010.

If you like it, subscribe in iTunes.

WPA Cracking in the cloud

1 Reply

Once again I have been having trouble finding the time to make blog posts, but I thought I should make the effort for a quick one so to speak.

Unless your living under a rock you will be familiar with all the buzz around cloud computing. There is alot of discussion about the benefits, risks etc, but I think no one can deny the possible power that can be leveraged.

A perfect example of this is the new WPA Cracker offering.

WPA Cracker is a cloud cracking service for penetration testers and network auditors who need to check the security of WPA-PSK protected wireless networks.

WPA-PSK networks are vulnerable to dictionary attacks, but running a respectable-sized dictionary over a WPA network handshake can take days or weeks. WPA Cracker gives you access to a 400CPU cluster that will run your network capture against a 135 million word dictionary created specifically for WPA passwords. While this job would take over 5 days on a contemporary dual-core PC, on our cluster it takes an average of 20 minutes, for only $17.

I have not had the opportunity to try this out myself yet, but I think the costs sound reasonable, and the time reduction would be very handy on a pentest.

WPACracker

Shodan… Helping you find network devices on the Internet

Leave a reply

So Shodan, I am sure most people have heard about this now, I have just struggled with work to find the time for any blogging, but I kept meaning to do a quick blog about this.

We all know search engines spider anything that’s visible on the Internet, Shodan helps you identify network devices and the versions they are running. As with all tools they can be used for good and evil. Obviously Shodan makes finding things a little easier, so this could make compromise a little easier, but you could also take the stance organisations should utilise this tool to see what is available online and re-mediate.

I think its a good tool so check it out, there is some speculation about how long the site will be allowed to remain due to typical political correctness. So check it out whilst its still hot.

Shodan

Free CISSP Certified Training School… Thanks Search Security

Leave a reply

SearchSecurity.co.uk are looking to help out the Security Pro in these hard economic times. I assume this offer is open to anyone who has a SearchSecurity Account, or who signs up. So I guess its worth a punt.

Heres the info:

That’s why the editors of SearchSecurity.co.UK are offering this exclusive opportunity to participate in our complimentary CISSP Certification Training school. Simply activate your complimentary membership today and gain immediate access to these unique lessons,

including:

— CISSP Essentials Training: Domain 1, Security Management Practices

— CISSP Essentials Training: Domain 2, Access Control

— CISSP Essentials Training: Domain 3, Cryptography

— CISSP Essentials training: Domain 4, Security Models and Architecture

— CISSP Essentials Training: Domain 5, Telecommunications and networking

— CISSP Essentials Training: Domain 6, Application and System Development

— CISSP Essentials Training: Domain 7, Business Continuity

— CISSP Essentials Training: Domain 8, Law, Investigations and Ethics

— CISSP Essentials Training: Domain 9, Physical Security

— CISSP Essentials Training: Domain 10, Operations Security

Take advantage of this exclusive opportunity to participate in our complimentary CISSP Certification Training school, featuring security guru and president of Logical Security, Shon Harris. This is the perfect, free opportunity to increase your security intelligence and prepare for the CISSP exam. Don’t delay. Sign up for SearchSecurity.co.UK for complete access to these expert videos online now, while you have this email open!

http://go.techtarget.com/r/10068111/8974973

SearchSecurityCISSP

Metasplot Framework 3.3 Released

Leave a reply

HD has posted on the Metasploit Blog that MSF3.3 has been released.
From the release note its looks like the guys have been hard at work, and I assume some of this is also due to the Rapid7 support.
I have updated this on my BT4 box and look forward to checking it out later in the week.

Get yourself updated now.

Tuesday, November 17, 2009

Metasploit Framework 3.3 Released!

We are excited to announce the immediate availability of version 3.3 of the Metasploit Framework. This release includes 446 exploits, 216 auxiliary modules, and hundreds of payloads, including an in-memory VNC service and the Meterpreter. In addition, the Windows payloads now support NX, DEP, IPv6, and the Windows 7 platform. More than 180 bugs were fixed since last year’s release of version 3.2, making this one of the more well-tested releases yet.

Metasploit runs on all modern operating systems, including Linux, Windows, Mac OS X, and most flavors of BSD. Metasploit has been used on a wide range of hardware platforms, from massive Unix mainframes to the Apple® iPhone™. Installers are available for the Windows and Linux platforms, bundling all dependencies into a single package for ease of installation. The latest version of the Metasploit Framework, as well as images, video demonstrations, documentation and installation instructions for many platforms, can be found online at http://www.metasploit.com/framework/.

This release of the Metasploit Framework was driven by numerous key contributors, including James Lee, Yoann Guillot, Steve Tornio, MC, Chris Gates, Alexander Kornbrust, Ramon Carvalle, Stephen Fewer, Ryan Linn, Lurene Grenier, Mike Kershaw, Patrick Webster, Max Moser, Efrain Torres, Alexander Sotirov, Ty Bodell, Joshua Drake, JR, Carlos Perez, Kris Katterjohn and many others.

The startup speed up the Metasploit Console and all utilities has been greatly improved due to performance patches by Yoann Guillot and a string processing overhaul by James Lee. Metasploit now fully supports the 1.9.1 version of the Ruby interpreter, clearing the way for support under a variety of alternate Ruby VMs in the future.

The Windows installation now includes a fully-functional console interface, using Cygwin and RXVT as a front-end to the framework. The Windows installer now runs on all supported versions of Windows, from Windows 2000 to Windows 7. The Windows version of Metasploit is now portable and can be silently installed via the /S /D=Dest parameters.

The Linux installers now include everything needed to run the Metasploit Framework on most versions of Linux released over the last five years. The official Linux installers are recommended for anyone using a Linux distribution other than Ubuntu (8.04+). These installers include Ruby 1.9.1, Subversion 1.6.6, and all dependencies, along with convenient scripts for keeping the framework updated.

MSF3-3

Offensive Security Exploit Archive Goes live

2 Replies

As previously blogged the Offensive Security Team were planning on taking up where milw0rm left off and its now up and running.
I have not had chance yet to have a good look around, but it certainly looks like they have mirrored / migrated most things across and already starting adding new stuff. One thing I have seen, that I never actually used myself was the online cracker. I am not sure if they guys are planning to take this on also, but I have high hopes for these guys keeping everything up and running.

So go check it out, and get your exploits.

The ultimate archive of exploits and vulnerable software and a great resource for vulnerability researchers and security addicts alike. Our aim is to collect exploits from submittals and various mailing lists and concentrate them in one, easy to navigate database. When possible, we’ve added the vulnerable software for download. We are still in the process of organizing the database. You can Download the relevant exploit by clicking the “D” and when available, download the Vulnerable Application using the “A” link.”.

ExploitDB