| 05/20/2013 |
ISSA Kentuckiana Web Pen-Testing Workshop
Below are the videos form the Kentuckiana
ISSA's Web Pen-Testing Workshop. It
was put on in part to raise funds for
Hackers For Charity.
A few of theses are still uploading, but should be available shortly.
Part 1: Intro to Mutillidae, Burp Suite & Injection Jeremy
Druin
Part 2: SQL Injection Conrad Reynolds
Part 3:
Uploading a web shell via SQLi Jeremy Druin
Part 4:
Authentication Bypass via SQLi & Cookie Tampering Jeremy Druin
Part 5:
Intro to Kentuckiana ISSA Jeremy Druin
Part 6:
Remote File Inclusion (RFI) & Local File Inclusion (LFI) Jeremy Druin
Part 7:
Webshells Demo Adrian Crenshaw
Part 8:
Intros to Speakers
Part 9:
HTML & Javasript Injection XSS Jeremy Druin
Part 10:
XSS & BeEF Conrad Reynolds
Part 11:
What we have of CSRF
(Camera ran out of space, slides kept going) Jeremy Druin
Part 12:
JSON injection Jeremy Druin |
| 04/21/2013 |
AIDE 2013:The
rest of the videos
At this point I had to leave for Notacon to record their talk and was not there
to run the slide capture rig for AIDE. I shanghaied some volunteers into
recording, and while they did not get the slide rig working, we have the
presenter and slides on camera. Thanks for filling in.
Boring eForensic Science Items - Brian Martin
Hackers in Unganda: A Documentary (Kickstarter Project) - Jeremy Zerechak
Small Businesses Deserve Security Too - Frank Hackett
Help from the helpdesk - Mick Douglas (@bettersafetynet)
Malware Analysis Triage for n00bs - Grecs (@Grecs)
CCDC and Industry - James L. Siegel Jr. (WolfFlight)
Building an Engaging and Effective Information Security Awareness and Training
Program - Bill Gardner |
| 04/21/2013 |
Notacon
10 Videos
These are the videos from
the 10th Notacon conference held April
18th-21st, 2013. Not all of them are security related, but I hope my
viewers will enjoy them anyway. Thanks to Froggy and Tyger for having me up, and to the video
team: SatNights, Widget, Securi-D, Purge, Bunsen, Fry Steve and myself (at least
that is who it was last year, if you got he names for 2013 let me know).Track 1
Model Integrated Computing (Code Generation) and how it loves you
and deserves love back - Michael Walker
Guns & Privacy - Deviant Ollam
Domestic Preparedness (the zombie Apocalypse is nigh upon us) -
Illustrious Niteshad & megalos
DIY Neuroscience, EMGs, EEGs, and other recordings - meecie
Hacking Your Ability to Communicate - kadiera
Lasers for Fun! Lasers for Science. Lasers for Security! - Ethan Dicks
Video Everywhere! aka The Personal Distributed HD Video Network - Woz
Esolangs - Daniel Temkin
How We Learned Security from Steve - ghostnomad, ghostnomadjr, knuckles
& micronomad
Are we getting better? – Hacking Todays Technology - David Kennedy
Critical Making - Garnet Hertz
DC to Daylight: A whirlwind tour of the radio spectrum, and why it
matters. - Stormgren
Skeleton Key: Transforming Medical Discussions Through 3D Printing - KK
Pandya
Youthful Exploits of an early ISP - Dop & KevN
Whose Slide Is It Anyway? - nicolle @rogueclown neulist Track 2
I Forked the Law and We
All Won - Fork The Law
Make me Babyproof! - Gina “the kat” Hoang
The Maru Architecture Design: A proposed BYOD architecture for an
evolving threat landscape - Michael Smith
You Keep A-Knockin’ But You Can’t Come In - grap3_ap3
Encryption for Everyone - Dru Streicher (_node)
How I Became an iOS Developer for Fun and Debt - Mark Stanilav
AR_GRAF.OBJ: a darknet for the nuEra ?? - kevin carey, shawne
michaelain holloway & brian peterson
Creating professional glitch art with PoxParty - Jon Satrom & Ben
Syverson
Let’s Go CSRF’n Now! - grap3_ap3
Bad Games Arcade - Jake Eliott
The Winamp Imperative - Yoz
(sorry, audio died at 6:09) |
| 04/18/2013 |
AIDE 2013
I got to record and put up a few videos from AIDE.
I had to head to Notacon before I could
record them all, but I left some gear so hopefully I'll have more to come. Recorded at AIDE 2013. Big thanks to Bill
Gardner (@oncee) for having me out to
record.
Network King Of The Hill (NetKotH): A hacker wargame for organizers who are lazy
- Adrian Crenshaw (Irongeek)
Can You Hear Me Now? Leveraging Mobile Devices on Pentests - Georgia Weidman
RAWR
(Rapid Assessment of Web Resources) - @al14s and @c0ncealed |
| 04/11/2013 |
Hacker Swap Meet: Don't Let That Old
Junk Go To Waste!
Many of us are tech pack rats, we have old gear laying around we don't use but
don't want to just throw away. Got something you want to trade with other
hacker/maker types? Too expensive to ship but you can drive it to a con you will
be at anyway? Set up the trade at the new forums I put up. One man's treasure is
another man's hazmat. If you don't see a con/meet spot listed here, let me know
and I can add it.
http://www.hackerswapmeet.org/
I should have some old gear at Notacon I
want to get rid of. |
| 04/08/2013 |
Outerz0ne 9 (2013) Videos
These are most of the videos from the
Outerz0ne 9 conference. I have a few
more I have to get clearances on before I post them. Big thanks to
Joey and Evan on the video crew.
SkyDog Kicks Off Year NINE! (Number Nine)
Gursev Kalra - Impersonating CAPTCHA Providers
Tuttle/Brimstone - State of the BitCoin Address; Pizza, Pirates, and Profiteers.
Halfjack - Living to the Singularity: Geeks Guide to a Healthy Lifestyle
Chad Ramey - Hacking the Atom
Jeremy Schmeichel & Brian Wilson - IPv6? Ain't Nobody Got Time For That!
Chris Silvers - Weapons of Miniature Destruction
Hacker Movie Challenge
Inside the Hacker's Studio - Billy Hoffman and IronGeek
Contest Prize Giveaway, Awards, Closing Ceremonies
Lightning Talks and such:
Andy Green - The Southeast Collegiate Cyber Defense Competition Lightning Talk
Lilyjade-v2.com - Why You Are Not Safe Lightning Talk
Presentation Karaoke |
| 03/26/2013 |
Updated: Links for Doxing, Personal OSInt, Profiling, Footprinting,
Cyberstalking
I have to give presentation on online privacy shortly, and figured it would be a
good time to update the page above with a few new links. See the change log at
the bottom. If you have more good links to add, please contact me. I'll also be
speaking at TakeDownCon St. Louis
on webshells so I've updated my
Webshell
Collection Page to keep a log of not only live webshells, but also keep a
history of dead ones. |
| 03/13/2013 |
Outerz0ne 9 Dates Announced: April 5-6th,
2013
I know it's a little short notice, but dates and the CFP have been announced for
Outerz0ne 2013: April 5-6th, 2013 in Atlanta Georgia. I'll of course be there
helping out the video crew. It's a donation based con, so give what you can. To
see videos from past years, check out:
Outerz0ne 8 (2012) Videos
Outerz0ne 2011 Hacker Con
Outerz0ne 2010 Videos
and a bunch of others spread out over the
Hacking
Illustrated page.
In other news, Jessica Miller from No Starch Press wanted me to announce
this:
"We've just released the free PDF of bunnie's "Hacking the Xbox" in Aaron
Swartz's honor, with links to support the causes Aaron believed in. I thought
you might be interested in seeing bunnie's note and helping to spread the word -
http://nostarch.com/xboxfree "
I did not know Aaron, but as a person who has be screwed by an uncaring
cover-ass bureaucracy before, I can sympathize. |
| 03/03/2013 |
Introduction to HTML Injection (HTMLi) and Cross Site Scripting (XSS) Using
Mutillidae
New Video From Jeremy Druin:
This video covers the basics of injecting HTML into sites with vulnerabilities
in which injected code is placed inline with intended code and executes in the
users browser. The injected HTML in this video is a fake login box that posts
the user username and password to a capture data page (in the NOWASP Mutillidae
application).
Later the same vulnerability is used to inject cross site scripting attack that
hooks the users browser with a Beef Framework script (hook.js) given an attacker
control of the users browser. |
| 03/03/2013 |
Introduction to Pen Testing Simple Network Management Protocol (SNMP)
New Video From Jeremy Druin:
The Simple Network Management Protocol (SNMP) is used on networked devices to
read, write, and update device configuration remotely. Windows desktop systems
typically do not run SNMP services by default but these can be enabled for
testing. Server operating systems often run snmp services by default as do
network devices such as routers, printers, special purpose equipment, switches,
and firewalls.
In this video, a Windows XP box has SNMP enabled to act as a test target. A
Backtrack 5 R3 host is used to perform assessment. The video progresses through
host discovery, port identification, service verification, finding community
strings, dumping device configuration, and altering device configuration. |
| 02/24/2013 |
Bro IDS/Network Programming Language Video Page
Liam Randall, a developer on the Bro
team, and the guy that supplies cherry flavored refreshment at many cons, asked
me to post his Shmoocon 2013 video. Since he said there would be more videos to
come, I decided to make a page for them. Go check out the project at:
http://www.bro-ids.org/ |
| 02/23/2013 |
Intro
To The Louisville OWASP Chapter
Quick intro to the Louisville OWASP chapter by Curtis Koenig. Sorry that the
video is cut a little short. I've also updated the
Shmoocon FireTalks 2013 page to have a downloads link at the bottom. |
| 02/18/2013 |
Shmoocon FireTalks 2013
The Shmocon FireTalks are now up:
“Thin Slicing a Black Swan: A Search for the Unknowns” by Michele “@mrsyiswhy”
Chubirka & Ronald Reck
“When Did the Smartphone Pentest Framework Get Awesome?” by by Georgia “@georgiaweidman”
Weidman
“ShellSquid: Distributed Shells With Node” by Tom Steele
“If You Can Open The Terminal, You Can Capture The Flag: CTF for Everyone” by
Nicolle “@rogueclown” Neulist
“Becoming a Time Lord – Implications of Attacking Time Sources” Joe “@joeklein”
Klein
“Swinging Security Style: An Immodest Proposal” by Wendy “@451wendy” Nather
“Drones: Augmenting your cyber attack tool bag with aerial weapon systems” by
Zac “@ph3n0” Hinkel
“Managed Service Providers: Pwn One and Done” Damian “@integrisec” Profancik
“No Tools? No Problem! Building a PowerShell Botnet” Christopher “@obscuresec”
Campbell
“Extending the 20 Critical Security Controls to Gap Assessments and Security
Maturity Modelling” John “@pinfosec” Willis
“Protecting Big Data From Cyber APT in the Cloud” Bill “@oncee” Gardner
“Writing a Thumbdrive for Active Disk Antiforensics” Travis “@travisgoodspeed”
Goodspeed
On the non-info-sec related front, you know I like to use my backlinks to get
things in search results as sort of a bully pulpit. It's my understanding that
IU Southeast Chancellor Sandra R. Patterson-Randles is searching for a new
job because of some IU policy about mandatory retirement. Ask around the
faculty/staff at
IUS
about her (off the record of course) before you make a hiring decision.
Personally, I'd want someone who cares more about the espoused values of the
organization, and less about appearances only. Then again, maybe she has the
skill set you are looking for, but a parrot with good grammar would seem to be a
much cheaper solution in that case. |
| 02/11/2013 |
Basics of using sqlmap - ISSA Kentuckiana workshop 8 - Jeremy Druin
This is the 8th in a line of classes Jeremy Druin will be giving on pen-testing
and web app security featuring Mutillidae (or other tools) for the Kentuckiana
ISSA. This one covers SQLMap. |
| 02/01/2013 |
ASAReaper: Grab Configs From Multiple Cisco Devices Over SSH (Demos PExpect and
AES Encrypted INI Files in Python)
Simple script I wrote for backing up Cisco ASAs. Does it all over SSH, and may
serve as example code for other projects. |
| 01/05/2013 |
SQL Server Hacking from ISSA Kentuckiana workshop 7 - Jeremy Druin
This is the 7th in a line of classes Jeremy Druin will be giving on pen-testing
and web app security featuring Mutillidae (or other tools) for the Kentuckiana
ISSA. This one covers SQL Server Hacking. |
| 01/03/2012 |
Information Security in University Campus and Open Environments 2013
This is an update of an article I did almost 8 years ago. Lots of things have
changed in that time, do I figured the update was in order. It almost acts as a
meta-page to other parts of my site, but I hope you enjoy it.
|
| 12/29/2012 |
Webshell
Collection Page Updated
I have a script I run against my web logs periodically to see if anyone is
trying to use a Remote File Include Webshell against my site. I wrote this
awhile back, but the list was getting long and there were a lot of 404s,
duplicates, and other problems. I've filtered out many of those. If you want to
take a look at some Webshell that are in active use on the Internet you may like
this page. |
| 12/27/2012 |
IU Southeast School of Business / MBA Write-up Updated
I've made many small changes over the months to my IUS MBA Review site (change
log). I
realize that this
page is not very security related, but I can tie it to infosec in a few ways
(regular readers, please ignore the noise in the signal). Lots
of infosec folks I know seem to go for an MBA if they want to get into
management, so I figured it might help some of the infosec folks in the
Louisville Metro area (Kentuckiana Metroversity) know what to avoid. It's also
an opportune time since some students are about to finish their bachelors in the
spring, and will start looking for grad schools now. I can tie it in as an
experiment in how some spiders index sites. I've done a bit of
forensic metadata work on a file
I received via an open records request that might be interesting as well, but
it's not in-depth. It may also help people who have to deal with bureaucracies
that have people like
Jay White, Jon Bingham, Linda Christiansen and Gil Atnip in them know that
they are not alone. Hopefully I'll be able to work with the
IU Southeast SGA to get a real grievance policy put in place over the spring
semester so students are treated with more respect. |
| 12/26/2012 |
MadMACs: MAC Address Spoofing and Host Name Randomizing App for Windows 7
(Should work in Windows Vista and Windows 8 too) Updated
I wrote MadMACs awhile back, as a simple script to randomize my MAC address (and
host name) in Windows on every boot. I had not updated it in a long time so it
stopped working well in newer versions of Windows (Windows 7, Windows Vista and
Windows 8). When someone would try to get MadMACs to work on a newer version of
the OS, Windows would not always respect the registry setting for what MAC
address they were suppose to use. Seems that if it is a wireless interface, the
2nd nibble has to be a 2, 6, A or an E on Windows Vista and newer. I included
functionality in the new version of MadMACs to make sure this nibble is correct
if you tell it the NIC you are trying to change/randomize the MAC address on is
a WiFi card. I've also added a GUI for configuring your MAC addresses on your
network cards (the old version used prompts), made the config file more INI
like, and made it so that MadMACs itself can reset your adapter and start using
the new MAC address immediately (name changes will take a reboot). |
| 12/22/2012 |
Anti-Arp-Poisoning Switch Demo Using OpenFlow & POX
When I posted my OpenFlow/SDN Security paper, I spaced on including the source
code to the ARP Poisoning resistant POX controller I mentioned. It is now
included in the link above. Also, go check out
Steve Erdman's blog for a bunch of
security/networking articles. |
| 12/16/2012 |
Security and Software Defined Networking: Practical Possibilities and Potential
Pitfalls
This is a short paper I wrote for class involving SDN (OpenFlow specifically)
and it's potential ramifications in the infosec world. |
| 12/09/2012 |
Introduction to Installing, Configuring, and Using Burp-Suite Proxy
Another video from Jeremy Druin. |
| 11/24/2012 |
Introduction to buffer overflows from ISSA KY workshop 6 and two other videos
from Jeremy Druin
Mutillidae: Using ettercap and sslstrip to capture login
This video by webpwnized (@webpwnized) reviews how to intercept web
communications using ettercap and intercept web traffic that is supposed to be
protected with SSL using SSLStrip.
Mutillidae SQL Injection via AJAX request with JSON response
This video by webpwnized (@webpwnized) covers pen-testing an SQL Injection
vulnerability that occurs in an AJAX request made in the background. The
response from the server is JSON. Since AJAX requests and regular request work
the same way (since they both follow the rules of the HTTP protocol), the AJAX
request can be pen-tested using the same tools and tecniques used with the more
traditional requests. The SQL Injection flaw is first discovered then used to
pull a list of the tables in the database along with the columns for the target
table. Once the target is identified, the defect is used to pull a list of the
username and password fields.
Introduction to buffer overflows from ISSA KY workshop 6
This recording is from the Kentucky ISSA Workshop #6 from the November 2012
meeting. In part 5, using Metasploit was covered. In this workshop, buffer
overflow vulnerabilities were examined more closely to see how Metasploit
exploits might be written. A custom program is written with a known buffer
overflow and compiled without the stack canaries or non-executable stack. Also
ASLR is disabled on the Ubuntu 12.04 testing host. The program is fuzzed to
determine an overflow exists and decompiled with GDB to look at the program
logic more closely. Python scripts are used to generate exploits that get closer
to over-writing the return pointer with a user supplied value. Once the buffer
overflow is identified and the size of the buffer found, the exploit development
begins. A custom exploit is developed to inject shellcode into the buffer,
determine a reasonable memory address in which to jump, and a root shell gained. |
| 11/11/2012 |
PhreakNIC 16 Day Two Videos Posted
Here are the videos from day 2 of
PhreakNIC 16. Big thanks to Ben the Meek and the rest of the video crew.
I'll get the AVIs up on Archive.org soon.
Where We're Going We Don't Need Keys - sp0rus
The Effects of Online Gaming Addiction - Gregory C. Mabry
Android Best Practices and Side Projects - Michael Walker
Starting up a Crypto Party - Peace
Build Free Hardware in Geda - Matthew O'Gorman, Tim Heath
IP Law: Myths and Facts - Rick Sanders
The Safety Dance: Wardriving the 4.9GHz Public Safety Band - Robert Portvliet,
Brad Antoniewicz
The Power of Names: How We Define Technology, and How Technology Defines Us -
Aestetix
DNS Sec Today - Thomas Clements
Why I am pessimistic about the future - Tom Cross |
| 11/10/2012 |
PhreakNIC 16 Day One Videos Posted
Here are the videos from day 1 of
PhreakNIC 16. Big thanks to Ben the Meek and the rest of the video crew.
Welcome to PhreakNIC - Warren Eckstein
Magnets, How Do They Work? - Michael Snyder
Own the Network – Own the Data - Paul Coggin
Something about middleware - Douglas Schmidt
Homebrew Roundtable - Scott Milliken, Erin Shelton
Repurposing Technology - Kim Smith & Kim Lilley
Hiring the Unhireable: Solving the Cyber Security Hiring Crisis From DHS to Wall
Street - Winn Schwartau
Network King Of The Hill (NetKotH): A hacker wargame for organizers who are lazy
bastards - Adrian Crenshaw |
| 11/06/2012 |
Derbycon 2012 Stable Talks
We did not officially record the Stable Talks this year but
Damian Profancik stepped up and
volunteered to do it. Big thanks for the recording and editing!
Valerie Thomas: Appearance Hacking 101 - The Art of Everyday Camouflage
Tim Tomes "LanMaSteR53": Next Generation Web Reconnaissance
Thomas Hoffecker: Hack Your Way into a DoD Security Clearance
John Seely CounterSploit MSF as a defense platform
Chris Murrey "f8lerror" & Jake Garlie "jagar": Easy Passwords = Easy
Break-Ins
Tyler Wrightson: The Art and Science of Hacking Any Target
Thomas Richards: Android in the Healthcare Workplace
Spencer McIntyre: How I Learned to Stop Worrying and Love the Smart Meter
Shawn Merdinger: Medical Device Security
Rockie Brockway: Business Ramifications of Internet's Unclean Conflicts
Nathan Magniez: Alice in Exploit Redirection Land
Magen Hughes: Are you HIPAA to the Jive
Justin Brown & Frank Hackett: Breaking into Security
Josh Thomas: Off Grid Communications with Android
Jennifer "savagejen" Savage & Daniel "unicorn Furnance": The Patsy Proxy
Jason Pubal: SQL Injection 101
James Siegel: Nice to Meet You
Brett Cunningham: Beyond Strings - Memory Analysis During Incident Response
Gus Fritschie & Nazia Khan: Hacked Hollywood
Evan Anderson: Active Directory Reconnaissance - Attacks and
Post-Exploitation
David Young: ISO8583 or Pentesting with Abnormal Targets
David Cowen: Running a Successful Red Team
Damian Profancik: Managed Service Providers - Pwn One and Done
Ben Toews & Scott Behrens: Rapid Blind SQL Injection Exploitation with
BBQSQL
Andy Cooper: Why Integgroll Sucks at Python..And You Can Too
|
| 11/04/20122 |
The potential impact of Software Defined Networking on security - Brent
Salisbury
This is Brent Salisbury talk on SDN and security for the
Kentuckiana ISSA November
meeting. Sorry about the sound, I need to get a mic next time. Sorry I did not
get Jeremy Druin's talk, we had multiple levels of video fail.
|
| 10/29/2012 |
SkyDogCon 2012 Videos
Here are the videos from
SkyDogCon. Thanks to all of the SkyDogCon crew, especially SeeBlind and
others for
running the cameras.
Opening Remarks-Trevor Hearn-Skydog
Rious and Sachin - "Hack the Badge"
GCS8 and Ginsu - Physical Security; Make sure your building is "Butter
Knife Proof"...
Marcus Carey - Security Myths Exposed
SpikyGeek - Dealing with difficult co-workers: How I became the "Thanks
for the candy" guy
Peter Shaw - Pivot2Pcap: a new approach to optimzing cybersecurity
operations by tightly coupling the big-picture view provided by Netflow
with the in-depth resolving power of PCAP.
Carter Smith - Gangs and the use of Technology
G. Mark Hardy - Hacking as an Act of War
Jeff Brown - RE, CND and Geopolitics, Oh My!
Curtis Koenig - Insanely Great!
Lee Baird - Setting up BackTrack and automating various tasks with bash
scripts
Bob Weiss & Benjamin Gatti - Cryptanalysis of the Enigma
Dr. Noah Schiffman - Bioveillance: The Surreptitious Analysis of
Physiological and Behavioral Data
Martin Bos & Eric Milam - Advanced Phishing Tactics Beyond User
Awareness
Sonny Mounicou - Build a UAV!
Alex Kirk - Lifecycle and Detection of an Exploit Kit
Chris Silvers - Go With the Flow: Strategies for successful social
engineering
Scott Moulton - Hack your Credit Score; How the System is Flawed
David Wyde - User-Readable Data and Multiple Personality Disorder
Closing of Conference
|
| 10/27/2012 |
SkyDogCon 2 Videos
Most of the talks are up, full post coming soon. |
| 10/25/2012 |
Hack3rcon 3 Videos
I still have one video from Hack3rcon 3 left to edit, but I wanted to put all of
the talks out in the RSS before the
SkyDogCon talks come out. One more coming soon hopefully.
Keynote: Hacking Survival
Speakers: Larry Pesce
Next Generation Web Reconnaissance
Speakers: Tim Tomes
Intro to Network Traffic Analysis - Part 1
Speakers: Jon Schipp
Intro to Network Traffic Analysis - Part 2
Speakers: Jon Schipp
Automated Spear-twishing - It was only a matter of time
Speakers: Sean Palka
In case of ZOMBIES break glass
Speakers: Chris Payne
Building Dictionaries and Destroying Hashes Using Amazon EC2
Speaker: Steve Werby
Secrets of Running a Consulting Business
Speakers: Brian Martin
Bash Scripting 101 for Pen Testers
Speakers: Lee Baird
Keynote: Finding the MacGyver in You
Speakers: William A. Minear
EMP, yeah you know me..
Speakers: Adrian Crenshaw
Intro to Linux exploit development - Part 1
Speakers: John deGruyter
Intro to Linux exploit development - Part 2
Speakers: John deGruyter
This video is combined with the one above, but I'm too lazy to redo my numbering system. :)
Advanced Phishing Tactics – Beyond User Awareness
Speakers: Eric Milam, Martin Bos
DNS Reconnaissance
Speakers: Carlos Perez
Sponsors: Tenable Network Security
*SILVER*
Social Engineering Applied: Exploit the Target
Speakers: Keith Pachulski
From Patch to Pwnd
Speakers: Deral Heiland
Building a pad that will survive the times
Speakers: Branden Miller
Wielding Katana: A Pentesters Portable Pal
Speakers: Ronin |
| 10/20/2012 |
Hack3rcon 3 Videos, A Little Early
Those at Hack3rcon know I'm posting
videos on the site while I'm at the con. I noticed someone at the con looking
for them on the front page, but I had not linked to them there yet (Just Tweeted
them from @irongeek_adc). The
link above will take you to the Hack3rcon 3 video page, and I will make a longer
post when I have them all out there (but keep watching that page over the
weekend if you like). |
| 10/06/2012 |
Louisville Infosec 2012 Videos
Below are the videos from Louisville
Infosec 2012 conference. Sorry about the noise, I had no line in from the
house audio. My talk is not in here because the slides rig failed. You can see a
previous version of it here:
Dingleberry Pi Building a Blackthrow: More inexpensive hardware to leave behind
on someone else's network - Adrian Crenshaw
Index:
Keynote Jack Daniel
InfoSec Stress & Community
Nathan Heald - No
Keys, No Worries Lock Picking
Jeremy Druin - NOWASP Mutillidae 2.2 A web pen-testing environment for secure
development
Curtis Koenig - Grey Hats
and Bug Bounties
Deral Heiland - From Printer to Pwnd Leveraging multifunction printers during
penetration testing
James
Jardine - Ninja Developers App Sec Testing and SDLC
Joshua Bartley -
Data Hiding In Your Application
Keynote Michael Peters The Security TrifectaT - Isolation vs. Collaboration |
| 10/03/2012 |
Derbycon
2012, Day 3 Tracks 2, 3 & 4 Videos Posted In this batch we have:
Matt Weeks: Ambush- Catching Intruders at Any Point
Joshua Marpet: separating security intelligence from
security FUD
Steve Werby: Building dictionaries and destroying hashes
w/amazon EC2
Raphael Mudge:
Dirty Red Team Tricks II
David Schuetz (Darth Null) – Slow down cowpoke – When
enthusiasm outpaces common sense
Nicolle Neulist: Write your own tools with
Python
David McGuire: Maturing the Pen Testing Professional
Matt Presson: Building a database security program
Chris Jenks: Intro to Linux system hardening
Eric Milam: Becoming Mallory
Patrick Tatro: Why isn't everyone pulling security- this
is combat
Jason Frisvold: Taming Skynet-using the cloud to automate
baseline scanning
JP Dunning & Chris Silvers: Wielding Katana- A live
security suite
Mick Douglas – Sprinkler: IR
Matthew Perry: Current trends in computer law
Leonard Isham: SE me – SE you
CLOSING CEREMONY
See you next year, or at Hack3rcon,
Skydogcon or
Phreaknic.
|
| 10/02/2012 |
Derbycon
2012, Day 2 Tracks 3 & 4, Plus Day 3 Track 1 Videos Posted In this batch we have:
Michael Schearer – Flex your right constituion and
political activism in the hacker community
Eric Smith – Penetration testing from a Hot Tub Time
Machine
Chris Nickerson (ind303) – Tactical Surveillance: Look
at me now!
Jamie Murdock – How to create a one man SOC
Branden Miller / Bill Gardner – Building an Awareness
and training program
Dan Crowley / Chris Vinecombe – Vulnerability Spidey
Sense
Nathaniel
Husted – Everything you always wanted to know about
Security Academia (But were too afraid too ask)
Bill Sempf – What locksport can teach us about security
JP Dunning (.ronin) - The Glitch: Hardware With Hacking Made
Easy
Christopher Domas – The future of RE: Dynamic Binary
Visulization
Tom Eston / Kevin Johnson – Social Zombies: Rise of the
Mobile Dead
KC. Yerrid / Matt Jezorek / Boris Sverdlik (JadedSecurity)-
It's not your perimenter. It's you
Deral Heiland -Format String Vulnerabilities 101
Jack Daniel – How Screwed Are We?
Kellep Charles: Security Vulnerablity Assessments. –
Process and best practices
John Woods – So you got yourself an infosec manager job.
Now what?
K.C.
Holland (DevAuto) - Personal Darknet or How to get pr0n @
work
Tony DeLaGrange / Jason Wood:SH5ARK ATTACK- taking a
byte out of HTML5!
Matthew Sullivan: Cookie Cadger – taking cookie
hijacking to a new level
Stephen Haywood (AverageSecurityGuy) -
Introduction to Metasploit Post Exploitation Modules
Noah Beddome: The devils in the Details-A look at bad SE
and how to do better
Jay James & Shane MacDougall: Usine McAfee
secure/trustguard as attack tools
Roamer and Deviant Ollam - Welcome to NinjaTel, press 2 to
activate your device now
Laszlo Toth & Ferenc Spala: Think differently about
database hacking
|
| 10/01/2012 |
Derbycon
2012, Day 2 Tracks 1 & 2 Videos Posted In this batch we have:
Skip Duckwall / Chris Campbell – Puff Puff Pass – Getting the most out of your hash
Jordan Harbinger – Social Engineering Defense Contractors on LinkedIn and Facebook: Who's plugged into your employees?
Paul Asadoorian / John Strand – Everything they told me about security was wrong.
Zack Fasel – Pwned in 60 Seconds -From Network Guest to Windows Domain Admin
Ryan Elkins – Simple Security Defense to thwart an Army of Cyber Ninja Warriors
atlas: RfCat-subghz or bust
Georgia Weidman – Introducing the Smartphone Pentest Framework
Gillis Jones – The Badmin Project
Kyle (kos) Osborn – Physical Drive-By Downloads
Johnny Long – The Evolution of HFC
Dual Core (int0x80) – Moar Anti-Forensics – Moar Louise
Bruce Potter – Security Epistemology: Beliefs – Truth – and Knowledge in the Infosec Community
Josh More – Pen Testing Security Vendors
Jason Gunnoe & Chris Centore -Building the next generation IDS with OSINT
Babak Javadi / Keith Howell: 4140 Ways your alarm system can fail
Benjamin Mauch – Creating a powerful user defense against attackers
Bart Hopper – Hunting Evil
Doug Burks – Security Onion – Network Security monitoring in minutes
Direct downloads from Archive.org will be uploaded when I have all of Day 2
ready.
|
| 09/30/2012 |
Derbycon
2.0: The Reunion, Day 1 Videos Posted
Hi all. Expect these to come out in phases.
Opening Ceremony
HD Moore – The Wild West
Dan Kaminsky – Black Ops
Mudge – Cyber Fast Track; from the trenches
Jayson E. Street – Securing the Internet: YOU’re doing it wrong (An INFOSEC Intervention)
Jason Scott – Rescuing The Prince of Persia from the sands of time
Dave Marcus – 2FA-Enabled Fraud: Dissecting Operation High Roller
Rafal Los – House of Cards
Rob Fuller / Chris Gates – Dirty Little Secrets Part 2
Chris Hadnagy – Nonverbal Human Hacking
Rick Farina: The Hacker Ethos meets the FOSS ethos
Brent Huston – Info overload..Future shock.. IBM & nature of modern crime
Ian Amit – SexyDefense – the red team tore you a new one. Now what?
egyp7 – Privilege Escalation with the Metasploit Framework
Larry Pesce / Darren Wigley – Hacking Survival: So. You want to compute post-apocalypse?
James Arlen – Doubt – Deceit -Deficiency and Decency – a Decade of Disillusionment
Carlos Perez – DNS Reconnaissance
Sam Gaudet: Pentesting for non-pentesters…through virtual machines
Ryan Linn – Collecting Underpants To Win Your Network
Jerry Gamblin: is it time for another firewall or a security awareness program?
|
| 09/19/2012 |
How To Upgrade To Latest Mutillidae On Samurai WTF 2
Jeremy Druin has a new video:
This video covers upgrading the default version of NOWASP (Mutillidae) which
comes with SamuraiWTF 2.0 with the latest available version. On this particular
version of SamuraiWTF 2.0, NOWASP (Mutillidae) 2.1.20 was installed in the ISO.
The latest version of NOWASP (Mutillidae) available at the time of this video
was 2.3.7. In the video, the hosts file responsible for activating the links to
the "target" web applications was modified so the default web applications would
work. Also, the "samurai" start up script is reviewed to show why the LiveCD
version of Samurai includes working web app targets but the installed version
requires the targets be "activated". The video then covers how to upgrade the
existing default installation of NOWASP (Mutillidae) with the latest available
version. Additionally, the video discusses how to run the default version and
latest version of NOWASP (Mutillidae) side-by-side or replace the existing
installation with the latest version.
|
| 09/16/2012 |
Installing Latest Mutillidae On Samurai WTF Version 2
Jeremy Druin has a new video:
Samurai WTF is an excellent platform for web pen testing. A very large number of
tools are already included. An older version of NOWASP Mutillidae comes
pre-installed. This video covers installing the latest version on Samurai WTF
2.0. Installation requires downloading the latest verion of NOWASP Mutillidae,
unzipping the Zip file which contains a single folder named "mutillidae", and
placing the "mutillidae" folder into /var/www directory. Configuration is done
by opening the /var/www/mutillidae/classes/MySQLHandler.php file and changing
the default MySQL password from blank empty string to "samurai". Starting the
project is done by browsing to http://localhost/mutillidae and clicking the
Reset-DB button on the menu bar. |
| 09/15/2012 |
Web Shells and
RFIs Collection
I wrote a little script to periodically look through my web logs for unique RFIs
and Web Shells, and then collect them on one page where I can go look at them or
download them to add to my Web Shell library. Many of these attacks are repeated
multiple time, so I ignore the time fields in judging if an RFI/Web Shell is
unique. I may have to weed this over time as I imagine many of the links to Web
Shells will be 404ing over time. I also use nofollow and a referrer hiding
service so it does not look like I'm attacking anyone with the web shells. This
page will also let you link off to firebwall.com where you can use their PHP
decoder to look at the obfuscated code. Enjoy my Web Shell zoo, it should update
itself every hour or so. If you see your domain on the list of websites hosting
Web Shells you are likely pwned and should clean up your server. |
| 09/09/2012 |
Into to Metasploit - Jeremy Druin
This is the 5th in a line of classes Jeremy Druin will
be giving on pen-testing and web app security featuring
Mutillidae for the Kentuckiana
ISSA. This one covers Metasploit. |
| 09/04/2012 |
Teensy 3.0
As many of my readers know I've done a lot of work with the Teensy 2.0 in
projects such as the
programmable HID USB keyboard and my own
hardware keylogger. Now Paul Stoffregen is coming out with a new version,
Teensy 3.0. You should still have the easy of development that comes with
the Arduino framework (or more raw C/C++ if you like) but there are two major new
features, of many, that I'm excited about: More powerful 32 bit ARM Cortex-M4
and USB host support. Go check out Paul's Kickstarter page for more details and
added features. |
| 08/29/2012 |
SSH Phone Home: Using the Raspberry Pi as a proxy/pivot (Shovel a Shell)
I added a new section to my Raspberry Pi recipes page that covers setting up a
Raspberry Pi to send you a Reverse Shell using SSH (AKA: Shovel a shell). This
is pretty good for blowing past NAT and some firewalls with weak egress
filtering. The idea is that you can use these as drop boxes to leave on someone
else's network, then have them remote back out to you. These instructions should
work pretty much the same on any *nix device or distro that uses OpenSSH. |
| 08/13/2012 |
Irongeek's Logwatch Script To Grep For RFI, Webshells, Password Grabs, Web
Scanners, Etc.
This is a simple script I put together for those using shared hosting providers.
It let's you grep through your logs for things like RFIs, likely webshells,
passwords grabs, web scanners, etc. The video below gives more details. This can
be a great tool for collecting webshells. |
| 08/07/2012 |
Jeremy Druin
has two new Mutillidae/Web Pen-testing videos
Setting User Agent String And Browser Information
Introduction to user-agent switching: This video uses the Firefox add-on
"User-Agent Switcher" to modify several settings in the browser that are
transmitted in the user agent string inside HTTP requests. Some web applications
will show different content depending on the user agent setting making
alteration of the settings useful in web pen testing.
Walkthrough Of CBC Bit Flipping Attack With Solution
This video shows a solution to the view-user-privilege-level in Mutillidae.
Before viewing, review how XOR works and more importantly that XOR is
communicative (If A xor B = C then it must be true that A xor C = B and also
true that B xor C = A). The attack in the video takes advantage that the
attacker knows the IV (initialization vector) and the plaintext (user ID). The
attack works by flipping each byte in the IV to see what effect is produced on
the plaintext (User ID). When the correct byte is located, the ciphertext for
that byte is recovered followed by a determination of the correct byte to
inject. The correct value is injected to cause the User ID to change.
Mutillidae is available for download at
http://sourceforge.net/projects/mutillidae/. Updates about Mutillidae are
tweeted to @webpwnized along
with announcements about video releases. |
| 08/05/2012 |
Host Vulnerability Assessment with Nessus, NeXpose and Metasploitable 2
This is the 4th in a line of classes Jeremy Druin will be giving on pen-testing
and web app security featuring
Mutillidae for the Kentuckiana
ISSA. This one covers Nessus, NeXpose and Metasploitable 2. |
| 07/31/2012 |
BSides Las Vegas 2012 Videos
They have been up on Youtube since Friday, but now I have them indexed and
with links to where you can download AVIs from Archive.org. Enjoy. Thanks to
all of the BSides Crew for having me out to help record and render the videos.
@bsideslv,
@banasidhe,
@kickfroggy,
@quadling,
@jack_daniel
Breaking Ground
KEYNOTE, Jack Daniel: "The State of Security BSides"
Matt Weeks: "Ambush - Catching Intruders At Any Point"
Robert Rowley: "Max Level Web App Security"
Davi Ottenheimer: "Big Data's Fourth V: Or Why We'll Never Find the Loch Ness
Monster"
HD Moore: "Empirical Exploitation"
Christopher Lytle: "Puzzle Competitions and You"
Parth Patel: "Introducing 'Android Security Evaluation Framework' - ASEF"
Terry Gold: "RFID LOL"
Raphael Mudge: "Force Multipliers for Red Team Operations"
Andrew Hay & Matt Johansen: "Applications and Cloud and Hackers, Oh My!"
Brendan O'Connor: "Reticle: Dropping an Intelligent F-BOMB"
Josh Sokol/Dan Cornell:"The Magic of Symbiotic Security: Creating an Ecosystem
of Security Systems"
James Lester & Joseph Tartaro: "Burp Suite: Informing the 99% of what the 1%'ers
are knowingly taking advantage of."
dc949 - "Stiltwalker: Round 2"
Gillis Jones: "The Badmin project: (Na-na- nanana Na-na-nanana BADMIN)"
IPv6 Panel / Drinking Game
Proving Ground
Michael Fornal: "How I managed to break into the InfoSec World with only a tweet
and an email."
David Keene: "Breaking Microsoft Dynamics Great Plains - an insiders guide"
William Ghote: "Lotus Notes Password Hash Redux"
Spencer McIntyre: "How I Learned To Stop Worrying and Love the Smart Meter"
Christopher Campbell "Shot With Your OwnGun: How Appliances are Used Against
You."
Shawn Asmus, Kristov Widak: “Mirror Mirror – Reflected PDF Attacks using SQL
Injection”
Georgia Weidman: "Introducing the Smartphone Penetration Testing Framework"
Phil Young: "Mainframed - The Forgotten
Fortress"
Walt Williams: "Metrics that Suck Even Less"
Conrad Constantine: "The Leverage of Language: or : How I Realized Information
Theory could Save Information Security"
Jason Ding: "The Blooming Social Media Economics Built on "Fake" Identities
Lightning Talks
|
| 07/30/2012 |
Indiana University Southeast School of Business/MBA Review Updated: Emails
from Gil Atnip, Alan Jay White, Lawyer Cover Plate, Etc.
Hi all. Don't worry, I'll be back to infosec content soon (with a posting of
the BsidesLV videos). In the mean time, I just wanted to make an update post
about the situation I shared with you awhile back (see change log at the
bottom of the
IUS MBA
page). It seems many of the faulty/admins at IUS have been told to responded
to be with only an IU lawyer cover plate response that tells me to contact
IU Counsel. Unfortunately, the contacts I have at IU Counsel are not
responding to my requests either at this point. Another interesting tidbit,
seems someone has forwarded my MBA review site to the campus police (reverse
DNS lookup for the win), though I have little idea what allegations may have
been made (and they are not saying). I've posted the details on all this to
the page. At this point there is not much I can do but shut up and go away,
as is their intention, but I do ask for something from my readers. If you
know of an organization that cares about academic abuses/student rights to
due process, please forward them to the page. If you are a web admin, please
just link to the page so it's easier for perspective students to find if
they search for it. Thanks for your time. |
| 07/16/2012 |
OISF
2012 Videos Here are the talks from the OISF Anniversary Event 2012:
Conference Kickoff - Deral Heiland & Abyss of Cybersecurity - John Bumgarner
Size Does Matter: Password Tools and Data - Bob Weiss
Dingleberry Pi Building a Blackthrow: More inexpensive hardware to leave
behind on someone else's network - Adrian Crenshaw
Threat Model Express - Sahba Kazerooni |
| 07/16/2012 |
Bsides Cleveland 2012 Videos
Here are the talks from Bsides Cleveland 2012:
Secret Pentesting Technigues Shhh...Dave KennedyDave "ReL1K" Kennedy
Focusing on the Fool: Building an Awareness & Training Program - Branden
Miller & Bill Gardner
<? $People ?> Process Technology - Jeff @ghostnomad Kirsch
Dingleberry Pi Building a Blackthrow: More inexpensive hardware to leave
behind on someone else's network - Adrian "Irongeek" Crenshaw
Testing Enterprise DLP Systems // Advanced data exfiltration techniques -
Albert School
Automating Incident Response - Mick Douglas
Business Ramifications of the Internet's Unclean Conflicts - Rockie Brockway
Netflow for Incident Response - Jamison Budacki
Winter is Coming: Cloud Security in Dark Ages - Bill Mathews
What locksport can teach us about security - Bill Sempf <missing>
Pass the Hash like a Rockstar - Martin "PureHate" Bos
Naked Boulder Rolling - Applying Risk Management to Web Application Security
- J Wolfgang Goerlich
Anti-Forensics Filler - Irongeek
Outside the Echo Chamber - James Siegel (aka WolfFlight)
Pentesting ASP.NET - Bill Sempf |
| 07/15/2012 |
Basic Output via Raspberry Pi's GPIO and Serial/UART to an Arduinio or Teensy
Updated
While I was at Bsides Cleveland and OISF I found some problems with my
write-up and schematics, I've updated them now so you won't encounter blue
smoke. |
| 07/07/2012 |
More
Web Pen-Testing Videos From Jeremy Druin
Here are two more videos from Jeremy Druin (@webpwnized):
Using
Command Injection To Gain Remote Desktop On Windows
How To Exploit Metasploitable 2 With Nmap Nexpose Nessus Metasploit |
| 07/07/2012 |
Basic Output via Raspberry Pi's GPIO and Serial/UART to an Arduinio or Teensy
I added a "recipe" for using the Raspberry Pi's GPIO pins to interface
with a
Teensy (which means it is also no problem to talk to an Arduino). I've
included simple code, schematics/diagrams and videos to demonstrate. Right
now I'm just outputting from the Raspberry Pi to the Teensy, but input
should not be a problem either with the linked to resources. |
| 07/06/2012 |
Running an I2P Svartkast on the Raspberry Pi Updated
I updated the article a little to show how to set up a SSH tunnel through
the I2P darknet. Expect to see a few more Raspberry Pi posts as I prep up
for my talks at
Bsides Cleveland and
OISF. |
| 07/04/2012 |
Updates to About and
Irongeek in print pages
I noticed a few people at
Indiana
University Southeast looking at my
review
of the IUS MBA program, then looking at my "about"
page. Maybe they wanted to see if I was a crackpot. I decided to update
my about page to list
more of the talks I've done around the country since it was last updated. I
have also updated the Irongeek
in print page with more books my site or I have been referenced in. |
| 06/28/2012 |
Raspberry Pi Recipes
On this page I'll be posting little security ideas for the Raspberry
Pi. Current sections include:
I2P on the Raspberry Pi
Installing Metasploit on the Raspberry Pi
Making an “EtherLogger” to log Ethernet packets with the Raspberry Pi |
| 06/21/2012 |
Running an I2P Svartkast on the Raspberry Pi: Even more cheap hardware to
leave on someone else's network
This is sort of a sequel to a previous article I wrote titled "Running an
I2P Svartkast on the Raspberry Pi: Even more cheap hardware to leave on
someone else's network". In that article I answer the obvious question of
what the hell a Svartkast is, as well as show how to make one out of a
Raspberry Pi. |
| 06/16/2012 |
How To Install Metasploitable 2 With Mutillidae On Virtual Box
Here is another one from Jeremy Druin (@webpwnized):
This video covers installing Rapid7's Metasploitable 2.0 with Mutillidae on
a Virtual Box Host Only network. In addition to reviewing how to install
Metasploitable 2 on Virtual Box, the configuration of the virtual network
card is shown so that the Mutillidae web application running on
Metasploitable 2 can be accessed from a separate Backtrack 5 virtual machine
running on the same Host Only network. |
| 06/07/2012 |
Out of Character: Use of Punycode and Homoglyph Attacks to Obfuscate URLs for Phishing
This is the paper I was working on in last semester's class. Hope it is
helpful. |
| 06/07/2012 |
IUS MBA Program Continued: Amendment of records, FERPA and getting your side
put in the record
Again, not security related, but could be of interest to some. Next post I
swear will be security related. |
| 06/02/2012 |
Traceroute and Scapy Jeremy Druin @webpwnized
This is the 3rd in a line of classes Jeremy Druin will be giving on
pen-testing and web app security featuring
Mutillidae for the
Kentuckiana ISSA. This one covers Traceroute and Scapy. |
| 05/26/2012 |
AIDE
2012 Videos posted Recorded at AIDE
2012. Big thanks to Bill Gardner (@oncee)
for having me out to record.
Anti-Forensics: Occult Computing
Adrian Crenshaw
Out of Character: Use of Punycode and Homoglyph Attacks to Obfuscate URLs
for Phishing
Adrian Crenshaw
An Introduction to Traffic Analysis: A Pragmatic Approach
Jon Shipp
Pen Testing Web 2.0: The Client
Jeremy Druin
Breaking into Security
Frank J. Hackett and Justin Brown
Sabu the Hacker: The capture, the crimes, the damage done, the slip, the
apprehension, and the fallout.
Dr. Marcus Rogers
Jill McIntyre
Boris Sverdlik
Ronald Layton, U.S. Secret Service
BNAT Hijacking: Repairing Broken Communication Channels
Jonathan Claudius
Setting up BackTrack and automating various tasks with bash scripts
Lee Baird
Going on the Offensive - Proactive Measures in Securing YOUR Company
Dave Kennedy |
| 05/23/2012 |
BSidesCleveland
Here is another event I will be speaking at.
What:
BSidesCleveland
When: Friday, July 13, 2012
Where: Embassy Suites Cleveland - Rockside
Address: 5800 Rockside Woods Boulevard, Independence 44131
Cost: Free (as always!)
Register at:
http://www.securitybsides.com/w/page/27427415/BSidesCleveland
Submit to CFP at:
http://www.securitybsides.com/w/page/53552319/BSidesClevelandCFP
|
| 05/22/2012 |
Homoglyph
Attack Generator Updated: Obfuscating EXEs, scripts and documents using 'Right-To-Left Override' (U+202E)
Added option to use 'Right-To-Left Override' (U+202E) so you can do some stupied
EXE tricks, and added a linkless output so you can copy & paste your homography
without formatting |
| 05/21/2012 |
Gaining Administrative Shell Access Via Command Injection
Here is another one from Jeremy Druin (@webpwnized):
Using command injection against the Mutillidae web application, we gain a root
shell (Administrative Windows cmd shell). The server is fully patched with
anti-virus running and a firewall blocking port 23. Additionally the telnet
service is disabled. With the command injection vulnerability, this video
demonstrates how misconfiguring web services can have serious consequences for
security. Additionally we review how to remediate command injection
vulnerabilities and discuss some of the defects which expose the server to
compromise.
|
| 05/21/2012 |
Offensive-Security Ohio Chapter (OSOC) Version of OSInt/Footprinting Talk
This is the version of my OSInt/Footprinting talk as given at the
Offensive-Security Ohio Chapter (OSOC) class on May 18th. I did not have my
video gear with me, so @securid did
the recording. Videos can also be downloaded from
http://www.1dave1cup.com/ |
| 05/21/2012 |
Review of the IUS (Indiana University Southeast) MBA Program
(and a bit about
filing student grievances)
Most of my writings are on Information security, but this one delves into
something else. It may still be of interest to those with a security mindset. I
hope that it will serve two purposes: 1. To help other students that file
grievances against faculty learn from my experience, and 2. convince those
interested in pursuing an MBA in the Louisville area to go someplace other than
the IUS MBA program. |
