exploresecurity.com
tlslite | Explore Security
http://www.exploresecurity.com/tag/tlslite
IT security tools, techniques and commentary. Testing for POODLE TLS Manually. Testing for the original POODLE vulnerability was easy because it was an inherent problem with SSLv3, so if you find SSLv3 enabled then you’ve found POODLE (although other factors such as cipher suite preference have a role to play – see my previous post. Like Heartbleed, though, testing for POODLE. Is conceptually easy but it falls within a class of flaws that requires bespoke tools as an unpatched version of. March 13, 2015.
exploresecurity.com
Jerome | Explore Security
http://www.exploresecurity.com/author/Jerome
IT security tools, techniques and commentary. From CSV to CMD to qwerty. The ongoing breach stories of targeted email campaigns harbouring malicious attachments made me think of writing up a summary of a presentation I gave at the amazing NCC Con. This entry was posted in Passwords. April 19, 2016. A Thick Spread of Logjam. This entry was posted in Penetration Testing. July 20, 2015. Testing for Anti-Virus on File Upload. Continue reading →. This entry was posted in Penetration Testing. May 26, 2015.
exploresecurity.com
tool | Explore Security
http://www.exploresecurity.com/tag/tool
IT security tools, techniques and commentary. Testing for POODLE TLS Manually. Testing for the original POODLE vulnerability was easy because it was an inherent problem with SSLv3, so if you find SSLv3 enabled then you’ve found POODLE (although other factors such as cipher suite preference have a role to play – see my previous post. Like Heartbleed, though, testing for POODLE. Is conceptually easy but it falls within a class of flaws that requires bespoke tools as an unpatched version of. March 13, 2015.
exploresecurity.com
When HTML Encoding Helped XSS | Explore Security
http://www.exploresecurity.com/when-html-encoding-helped-xss
IT security tools, techniques and commentary. When HTML Encoding Helped XSS. Recently I was pentesting a web app that had an unauthenticated XSS vulnerability but there was some heavy filtering in place. Nonetheless I was able to achieve session fixation using a combination of a technique I previously explained. And some fun filter workarounds – including using the application’s own defensive HTML encoding to create a working XSS payload! Characters that were allowed included:. 1 Get a valid cookie.
exploresecurity.com
OpenSSL | Explore Security
http://www.exploresecurity.com/tag/openssl
IT security tools, techniques and commentary. A Thick Spread of Logjam. This article dissects the recent Logjam paper from a pentesting viewpoint to reveal a number of different factors that affect the impact of the vulnerability. One of those factors includes the use of common primes and I’ve included a small change to OpenSSL that you can use to look out for this. Continue reading →. This entry was posted in Penetration Testing. July 20, 2015. Thoughts on Testing for POODLE. November 1, 2014. If the se...
exploresecurity.com
TLS | Explore Security
http://www.exploresecurity.com/tag/tls
IT security tools, techniques and commentary. A Thick Spread of Logjam. This article dissects the recent Logjam paper from a pentesting viewpoint to reveal a number of different factors that affect the impact of the vulnerability. One of those factors includes the use of common primes and I’ve included a small change to OpenSSL that you can use to look out for this. Continue reading →. This entry was posted in Penetration Testing. July 20, 2015. Testing for POODLE TLS Manually. March 13, 2015. A how-to o...
exploresecurity.com
anti-virus | Explore Security
http://www.exploresecurity.com/tag/anti-virus
IT security tools, techniques and commentary. Testing for Anti-Virus on File Upload. One of the issues on a standard web app checklist is to test whether or not an application that supports file upload is scanning those files for malware. This article reviews the methodology and highlights the danger of corrupting an EICAR test file so that it no longer acts as a valid test. It is based on an internal presentation I gave, the slides for which are here. Continue reading →. May 26, 2015. Time ago 3 Days.
exploresecurity.com
POODLE | Explore Security
http://www.exploresecurity.com/tag/poodle
IT security tools, techniques and commentary. Testing for POODLE TLS Manually. Testing for the original POODLE vulnerability was easy because it was an inherent problem with SSLv3, so if you find SSLv3 enabled then you’ve found POODLE (although other factors such as cipher suite preference have a role to play – see my previous post. Like Heartbleed, though, testing for POODLE. Is conceptually easy but it falls within a class of flaws that requires bespoke tools as an unpatched version of. March 13, 2015.
exploresecurity.com
file upload | Explore Security
http://www.exploresecurity.com/tag/file-upload
IT security tools, techniques and commentary. Tag Archives: file upload. Testing for Anti-Virus on File Upload. One of the issues on a standard web app checklist is to test whether or not an application that supports file upload is scanning those files for malware. This article reviews the methodology and highlights the danger of corrupting an EICAR test file so that it no longer acts as a valid test. It is based on an internal presentation I gave, the slides for which are here. Continue reading →.
exploresecurity.com
EICAR | Explore Security
http://www.exploresecurity.com/tag/eicar
IT security tools, techniques and commentary. Testing for Anti-Virus on File Upload. One of the issues on a standard web app checklist is to test whether or not an application that supports file upload is scanning those files for malware. This article reviews the methodology and highlights the danger of corrupting an EICAR test file so that it no longer acts as a valid test. It is based on an internal presentation I gave, the slides for which are here. Continue reading →. May 26, 2015. Time ago 3 Days.
SOCIAL ENGAGEMENT