alla's blog

Since July 2010 Ubuntu has disabled support for SSLv2 in OpenSSL library. If you are testing remote hosts for SSLv2 using a client that does not support it, you are getting false negatives.

Here is how you can check if you system supports SSLv2:

alla@notsoshiny:~$ socat OPENSSL-LISTEN:1080,method=SSLv2,cert=cert.pem,verify=0 READLINE


cert.pem has to be a valid certificate file that includes a private key. Generate one with OpenSSL if you don't have it.

We are looking for a penetration tester. Most of the work is in or around Brussels. Some of the work will have to be done remotely. Employee or subcontractor.

You'll get a lot of opportunities to hack stuff. Actually, you'll be trying to break stuff most of your working time. Except when you are writing reports. Or trying to make stuff work, before you can start breaking it. Most of the work are web application tests, but other stuff as well, from hardware hacking to custom client-server applications.

MagicTree 1.1 is released and available for download. This release includes:

1. Rapid 7 NeXpose XML import (both simple XML and full XML formats are supported)
2. Arachni XML import (as of 0.4.0.2. Thanks to Herman Stevens of Astyran for contribution)
3. OWASP Zed Attack Proxy XML import (development snapshot as of 6-Feb-2012)
4. New matrix query interface
5. Bug fix (#224) Remove orphan projects does not work anymore
6. Bug fix (#226) NPE in dumpData()
   

Herman Stevens has developed an XSLT for importing Arachni data into MagicTree.

To test his XSLT I went to install the latest development version of Arachni on my Ubuntu 11.04 (natty). Having fought with it for a while and finally managing to install it, I thought that the description of the process might help somebody else. So here it goes.

First I downloaded the sources:

As promised here I am working on XSLT for Rapid7 NeXpose XML reports.

There is one great big problem though. "NeXpose Simple XML" format (which is the only XML format available, at least in community edition) contains almost no vulnerability information.

I have created a forum for MagicTree. You can ask and answer questions, discuss features, post tips and tricks, or complain.

We are happy to announce that MagicTree version 1.0 is released and available for download.

We would like to thank everybody who submitted bug reports, feature requests or just wrote to tell us that they love MagicTree. You helped a lot!

Version 1.0 includes a lot of bug fixes and a number of new features, such as:

* Support for Acunetix data import
* Support for W3AF data import

I've just uploaded MagicTree build 1559, which includes fixes for bugs we have found while working on the PenTest Magazine article.

We are working hard on the next release of MagicTree. We hope to have it out before the end of September.

Update 2011/09/17: MagicTree build 1559 mentioned in the article is available for download.

PenTest Magazine has published our article Taming Vulnerability Data in its September extra issue along with a MagicTree review by Aby Rao.

Belgian IT magazine Data News has published the interview with Filip Waeytens and me (Alla) today. It is about penetration testing, hacking and IT security in general. Here is the PDF in Dutch. The whole issue can be viewed here.