Mad Irish

Articles in security

1. Mallory is More than a Proxy - Raj Umadas and Mike Zusman of Intrepidus Group gave an amazing talk on Mallory last night at the Philadelphia OWASP chapter meeting. At first glance Mallory seems like a simple tool, just a proxy application that sits on the wire. Closer inspection, how
2. Evaluating CMS Security - When evaluating content management systems (CMS) it is extremely important to include criteria covering security considerations. CMS'es are complex, and extremely powerful web applications, and as such present interesting security challenges. Although m
3. Using Drupal XML-RPC to Bypass Authentication Failure Detection - Drupal provides robust, and largely ignored, XML remote procedure call (RPC) functionality. This functionality is available through the xmlrpc.php file that is available at the Drupal root in any installation. Any module can provide a hook into the XMLR
4. Securing Drupal User Accounts - Securing a default Drupal installation takes some work and forethought. Drupal's native functionality creates a number of vulnerabilities that can only be mitigated through careful configuration.
5. Brute Forcing Drupal - Brute forcing account credentials for Drupal 5 and 6 sites including a sample script.
6. Monitoring Drupal for Insecure Settings - The Drupal content management system (CMS) is a wonderful for maintaining multiple, user driven and owned websites. From a security context, however, Drupal can present a challenge.
7. Drupal Workflow 6.x-1.1 and 5.x-2.3 XSS Vulnerability - The Workflow module versions 6.x-1.1 and 5.x-2.3 contain a cross site scripting vulnerability.
8. Exploiting PHP PCRE Functions - An examination of the /e flag in the PHP preg_replace function and how it can lead to vulnerabilities (and exploits).
9. PHP Null Byte Poisoning - Null byte poisoning can be an extremely dangerous problem in PHP applications. In order to fully understand the PHP null byte issue we have to examine how C handles strings.
10. Writing OSSEC Custom Rules and Decoders - By default OSSEC monitors many of the programs commonly installed on a machine, but it's real power comes from the ability of system administrators to customize OSSEC.
11. Security Researchers in the Open Source Ecosystem - Although it may be a hassle for developers to deal with researchers it is critical to the success of open source projects.
12. PHP Arbitrary File Include - File include vulnerabilities in PHP examined, including some defensive strategies.
13. Exploiting Drupal Node2Node XSS Vulnerability - Instructions on exploiting the recently unpublished Drupal Node2Node module.
14. Google Safe Browsing API - Google has put together a really cool API that allows developers to query their database of suspected malware and phishing sites.
15. Using the Google Safe Browsing API from PHP - Google's new Safe Browsing API is a neat service that allows you to poll the MD5 hashes of known malware and phishing sites.
16. Software Security and Testing - In fact, the field of security could learn quite a bit from software testing methods and philosophy.
17. Secure PHP Connections to MySQL with SSL - Using encryption you can protect the traffic between your web server and your database server.
18. User Insecurity and Open Source Projects - Who should be responsible for protecting users from themselves? Should the Drupal core code base prevent such situations from even being possible? It's arguable that they should.
19. LAMP Security Through Virtualization - Splitting up the various layers of the LAMP stack to provide more insulation and defense in depth.
20. Drupal Content Access Module XSS Fun - Asking me about computer security and privacy is probably a lot like asking a law enforcement agent about home security - you're going to get an answer colored by experience.
21. Using and Extending Kojoney SSH Honeypot - Kojoney (http://kojoney.sourceforge.net/) is a wonderful low interaction SSH honeypot written in Python.
22. Defending Web Applications with PHPIDS - PHPIDS is a very intriguing project that mimics the functionality of much more involved intrusion detection systems.
23. SEI Advanced Incident Handling - Day 5 - The Software Engineering Institute, part of Carnegie Mellon University, and the organization that comprises CERT, offers an Advanced Incident Handling (AIH) course that I am currently attending.
24. SEI Advanced Incident Handling - Day 4 - The Software Engineering Institute, part of Carnegie Mellon University, and the organization that comprises CERT, offers an Advanced Incident Handling (AIH) course that I am currently attending.
25. SEI Advanced Incident Handling - Day 3 - The Software Engineering Institute, part of Carnegie Mellon University, and the organization that comprises CERT, offers an Advanced Incident Handling (AIH) course that I am currently attending.
26. SEI Advanced Incident Handling - Day 2 - The Software Engineering Institute, part of Carnegie Mellon University, and the organization that comprises CERT, offers an Advanced Incident Handling (AIH) course that I am currently attending.
27. SEI Advanced Incident Handling - Day 1 - The Software Engineering Institute, part of Carnegie Mellon University, and the organization that comprises CERT, offers an Advanced Incident Handling (AIH) course that I am currently attending.
28. Dangers of Drupal Cron - The Drupal default installation and configuration presents several security challenges and potential vulnerabilities with scheduling cron.
29. Envisioning Perspective - In order to properly assess the security posture of any organization it is essential to first make sure you can accurately gauge the landscape.
30. Educause Security 2009 - It's interesting to see a security conference so heavily focused on privacy, but identity theft is the intersection of privacy and security.
31. Security Review of NanoCMS - A brief security evaluation of NanoCMS version 0.4 final revealed a number of notable security vulnerabilities.
32. Review of Chained Exploits by Whitaker, Evans and Voth - Academic fields are severely limited by the vocabulary available to discuss issues and the "chained exploit" is sure to become a mainstay in the discourse of information security.
33. Writing Safer Database Queries from PHP - Both PHP and MySQL include many features that developers can use to create safer web applications.
34. Security Evaluation of Frog CMS - Frog CMS is a lightweight content management system written in PHP that supports several back-end databases
35. Drupal Password Reset via XSS - The Drupal account page contains a flaw, which combined with a well crafted XSS attack, could be used to change a user's password to an arbitrary value.
36. OSSEC Version 2.0 Released - OSSEC is a wonderful open source host based intrusion detection tool that can greatly enhance your server security.
37. Drupal Security Team Ignores Multiple XSS Vulnerabilities - The Drupal security team's rather disappointing advice to rectify this situation was not to fix the vulnerabilities in the module code in question, but rather to limit the scope of users granted 'administer content types' privileges.
38. Post Compromise Shell Shoveling - Shoveling a shell is a process whereby an attacker can gain interactive access to a compromised host.
39. pPIM 1.01 Multiple Vulnerabilities - pPIM 1.01 contains multiple vulnerabilities, from version information leakage, to system credential disclosure.
40. Building an MD5 Rainbow Table - A short perl program that creates a MySQL database of MD5 values, or a rainbow table.
41. Defending PHP Web Applications from MySQL - MySQL provides a number of features that can be used to greatly increase the security of your PHP application.
42. Hardening PHP with Suhosin - Suhosin is an extremely valuable addition to any PHP installation, allowing robust security and easy configuration.
43. PHP-Calendar SQL Credential Disclosure - A vulnerarbility in PHP-Calender reveals the database host, username and password.
44. Interrogating DNS - DNS (Domain Name System) is an important component of any reconnaissance or discovery phase of an attack on internet systems.
45. Creating a Robots.txt Honeypot - Creating a robots.txt to detect and trap web site attackers.
46. Protecting Your LAMP Site with a Robots.txt Honeypot - Knowing that malicious attackers might look into your robots.txt file and explore the listings there allows you to employ a few defensive techniques.
47. Web Application Security - In the latest Silver Bullet podcast Gary McGraw makes mention of the fact that he feels that web application security is attracting too much attention these days
48. Developing Security with Metrics - It is a professional hazard in security to become stuck in a reactive stance, always running to put out the latest fire.
49. Pen Tests are Bullshit - Recently I've spotted an increasingly tractable argument against pen testing emerging in the computer security industry.
50. InfoSec Institute Ethical Hacking Day 4 & 5 - I've just finished InfoSec Institute's Ethical Hacking class (http://www.infosecinstitute.com/courses/ethical_hacking_training.html). The last two days were so hectic that I didn't even get a chance to blog about them as I would have liked.
51. InfoSec Institute Ethical Hacking Day 3 - Day three of ethical hacking didn't end until about 7 PM and with the CPT exam scheduled for the end of day four I didn't get a chance to blog.
52. InfoSec Institute Ethical Hacking Day 2 - I've just finished the second day of InfoSec Institute's Ethical Hacking class (http://www.infosecinstitute.com/courses/ethical_hacking_training.html)
53. InfoSec Institute Ethical Hacking Day 1 - I've just finished the first day of InfoSec Institute's Ethical Hacking class (http://www.infosecinstitute.com/courses/ethical_hacking_training.html).
54. Installing TrueCrypt on Mandriva - TrueCrypt is a great encryption utility that is available for several operating systems and uses.
55. The Economy and Information Security - The internet security blog Security Aegis has just published an article, distilled out of interviews with some industry professionals, concerning the state of information security and the economy.
56. Decrypting Zipped Base 64 Encoded PHP Malware - De-obfuscating base 64 encoded PHP malware.
57. Exploring JPEG Metadata -
58. Using Paros for Web Application Auditing and Debugging - Paros is a wonderful free Java based tool that is invaluable for web application auditing, testing, and debugging.
59. Undeniable Deniable Filesystems - In a new paper published on Bruce Schneier's website (http://www.schneier.com/paper-truecrypt-dfs.pdf), researchers examine deniable file systems (DFS).
60. Protecting Your Data During Computer Disposal - Instruction for security destroying your old hardware
61. Samurai Web Testing Framework - he Samurai Web Testing Framework is a bootable Linux CD that contains numerous tools specifically designed for web application penetration testing and vulnerability assessment.
62. Captcha Cracking - Network Security Research (http://network-security-research.blogspot.com/) has published a new paper that details some of the ways CAPTCHA can be defeated
63. Is Security Certification Worth it? - At some point in every security professionals career they look at certification and begin to weigh their value.
64. Writing Windows Buffer Overflows - Writing a buffer overflow attack against a Windows program present several challenges.
65. The IACRB and CEPT Certification -
66. Password Protection - Single factor authentication (passwords) is the most common authentication method in use for computer access.
67. Tips for Securing Drupal - Some tips for securing your Drupal installation.
68. Installing Nikto on Windows - Nikto is a fast, extensible, free open source web scanner written in Perl.
69. MrNeti Tries to Enter the House - Code for a remote file inclusion vulnerability I found on a third party site host.
70. CEPT Practical - The Certified Ethical Penetration Tester (CEPT) certification is sponsored by the IACRB (Information Assurance Certification Review Board).
71. Security Researcher Toolkit - When you start working in computer security, as with many computer related fields, you'll find that there are a lot of expensive tools out there to assist in your work.
72. The New School of Information Security - The New School of Information Security is one of the most timely and radical books on computer and information security that I've ever read.
73. Developing Drupal Module Exploits - While the Drupal security team does a great job of making sure the core modules distributed with Drupal are secure, there are a host of third party contributed modules that often contain security problems.
74. What is Fast Flux Hosting? - Fast flux hosting, commonly utilized amongst malware bot herds and spammers, is a method used to hide servers.
75. MediaDefender DDOS of Revision3 - There's a very interesting write up of the recent denial of service attack against Revision3 on the company's blog.
76. OSSEC Intrustion Detection System - OSSEC is an open source host based intrusion detection system (IDS). An IDS is one of the most important tools available to a security administrator.
77. Microsoft Office Encryption 2003 and 2007 - This article was designed to address some nagging questions about utilizing Microsoft Office encryption as well as compatibility issues between Office 2003 and Office 2007.
78. USB Malware - Remember the good old days when you traded C-64 games with your friends by carrying your floppy drive over to his or her house to copy disks? Back in those days very few people had the two drives you needed to copy a disk so the entire process was a bit
79. The New Threats in Computer Security - One of the trends that seemed to come up over and over again was the changing landscape of computer security. There seems to have been two major sea changes in information security over the last couple of years.
80. Introduction to Incident Response - The purpose of this tutorial is to provide a basic introduction to incident response.
81. Web Hacking Lesson 6 - Arbitrary Code Execution Vulnerabilities - Arbitrary code execution vulnerabilities are the most damaging sorts of vulnerabilities to find in web applications.
82. Web Hacking Lesson 5 - File Upload Vulnerabilities - File upload vulnerabilities (and local file disclosure vulnerabilities) are some of the most devastating vulnerabilities in PHP applications.
83. Web Hacking Lesson 4 - File Include Vulnerabilities - PHP file include vulnerabilities are some of the most destructive that an attacker can exploit.
84. Web Hacking Lesson 1 - This is the first in a series of training articles that goes hand in hand with a test site that should be downloaded and installed by the reader.
85. Web Hacking Lesson 3 - Brute Force - Brute forcing a web application is a method to bypass traditional authentication checks.
86. Social Engineering via Social Networking - y providing details to a networking site you could be making a social engineering attack much easier to pull off.
87. Is Oracle Data Encrypted on the Wire? - Determine if queries and responses to and from Oracle databases (which occur over TCP port 1512 by default) were encrypted.
88. Using Netcat to Transfer Files (and Other Mischief) - Netcat is an oft maligned program that can easily be used for many interesting and useful purposes.
89. SSHatter SSH Brute Forcer - SSHatter is a simple SSH brute forcer written in Perl.
90. On Multiple Single Factor Authentication - Two factor authentication is fast becoming an industry standard for high value applications. Unfortunately a lot of misunderstanding surrounds two factor authentication, and thus, the implementation is often less than ideal.
91. On Multiple Single Factor Authentication - Two factor authentication is fast becoming an industry standard for high value applications.
92. Investigating Rogue Ports - Discovering what processes are bound to open ports.
93. Using FreeNX on Mandriva - FreeNX is a remote desktop client/server program much like VNC. I've found that on Mandriva, remote connections using the TightVNC server that is usually installed, can be sluggish.
94. Getting TrueCrypt to Work with Mandriva 2007.1 - How to install and enable TrueCrypt on a Mandriva linux machien.
95. Securing User Input in Web Based Applications - Gathering input via a form doesn't guarantee that the only data passed to the form processing script will be passed by the form.
96. Exploiting Input Validation - Exploiting form input validation failures is one of the easiest ways to leverage control of a web server through an online application.
97. PHP Filesystem Security - A discussion of preventative measures PHP application developers can take when deploying their programs on a Linux filesystem.
98. Cross Site Request Forgery - A short discussion of cross site request forgery (XSRF) attacks and some simple preventative measures.
99. TCP/IP, Ports and Network Connections* - Understanding the TCP/IP handshake, including sequencing negotiation, how to view and discover available ports on local and remote machines and how to monitor local TCP/IP connections.
100. Linux Permissions - Understanding the nuances of file permissions in Linux is a daunting task.
101. Writing Buffer Overflows - A brief tutorial on buffer overflow vulnerabilities and developing exploits.
102. MySQL Database User Security - All too often, especially on small setups, database security is ignored.
103. Wireless Hacking with Kismet - The proliferation of wireless networks is sometimes scary when you consider how insecure most wireless configurations are.
104. Password Recovery on Windows XP - Resetting or decrypting Windows XP passwords is as fast as booting from a CD.
105. Open Source USB Key Encryption Techniques - A sort guide to using open source encryption technolgoy to secure removable media.
106. Hack by Numbers - An examination of the how-to steps taken by many system crackers.
107. Happy Hacking via Wireless - Abusing unsecured wireless connections for fun and profit, including advice for protecting your own wireless connections.
108. Using Secure Protocols - How to set up SSH and POP3s (or SSL wrapped POP) - Using secured protocols to defend against sniffing attacks on your Linux system.
109. Effective File Removal - Removing a file from your computer is not as simple as just moving it to the 'Recycle Bin', read up on why and how to actually delete material from your hard drive.
110. NT Security Tools - A few good security tools for Windows, reviews, and links to download them.
111. Connecting To a Remote MySQL Server Securely Using SSH Port Forwarding - Brief instructions on how to set up local port forwarding to allow for a secure MySQL connection.
112. Hardening Your Windows 2000 Server - A list of simple steps you can take to significantly increase the level of security on a default installation of Windows 2000.
113. Computer Security Class - Notes 2 - The notes from the second session of the 'Computer Security' class I taught
114. Computer Security Class - Notes 1 - The notes from the first session of the 'Computer Security' class I taught.
115. Suggested Material for Computer Security Class - These are my suggestions for reading for Computer Security class students.
116. Glossary of Computer Security Terminology - A list of computer security terminology to get you started.
117. NT Port Filtering - Instructions for using native NT/2000 features to implement a simple firewall.
118. Web Bugs in Hot Teen Action! - Graphic descriptions of web bugs in hot online action for your pleasure!
119. Holy Klez Batman! - A short advisory and examination of the Klez virus including links to cleaning tools and futher information.
120. Typical Computer Users Security Guide - Simple guide to security for home users. Covers easy steps you can take to protect your home system.
121. PGP on Windows Tutorial - How to get started using PGP - Pretty Good Privacy.
122. Cold Fusion Server Security - Cold Fusion server security. Includes a discussion of accessing the CFIDE administrator function on Cold Fusion servers and RDS security.
123. Target Ennumeration on a *nix - Finding open ports on a remote Unix or Linux machine.
124. Linux Security Tools - A list of some common and helpful Linux security tools, including brief reviews and links to the tool source.
125. Linux Security Tools - Links to some useful security tools for your Linux system.
126. Madirish Tutorial 01 - Getting started as a hacker, what system to choose and why.
127. Madirish Tutorial 02 - A quick look at TCP/IP, ports, and what goes on across the internet.
128. Madirish Tutorial 03 - Understanding your tools, a brief look at computer components and hardware, what they all do and why.
129. Madirish Tutorial 07 - Compiling raw C code (for exploits).
130. Proliferation of the Internet -
131. Madirish Tutorial 08 - Finding a target and seeing what is available on target systems (target enumeration).
132. Madirish Tutorial 09 - Finding and exploring Windows shares by hand.
133. Overview of Computer Security Part I - A rather long white paper on all sorts of aspects of computer security. Developed for a training program on computer security.
134. Overview of Computer Security Part II - Part two of a rather long overview of computer security.
135. IIS Unicode Directory Traversal Exploit Explained - The Code Red worm exploit demystified, includes screen shots and instructions.
136. Madirish Tutorial 11 (Brute Forcing) - Breaking in - using a brute forcer to find a username and password for the target system
137. Hacking Windows shares from Linux with Samba - Instructions on accessing unprotected Netbios shares on a Windows machine from Linux.