Submitted by alla on 6 December, 2012 - 11:07
Once again, we are looking for a penetration tester. See this post for a descriptiong of skills we are interested in. Prior penetration testing experience is a plus, but not a must, provided that you have the necessary knowledge, both practical and theoretical. The job is in Brussels, Belgium, working remotely may be possible for some projects, but most of the time you'll have to be on site.
Contact us at info@gremwell.com if you are interested.
Submitted by alla on 20 October, 2012 - 17:15
We have recently been swampted by spam forum posts and comments. Some seem to be submitted by bots while other appear to be from humans. Untill now we've been using Image CAPTCHA module which doesn't seem to help much. We have now installed and configured Riddler. Let's see if it helps.
If you are trying to submit a post or comment and can't get through Riddler, please send us an email.
Submitted by alla on 26 September, 2012 - 17:15
MagicTree 1.2 is available for download. New features in this release:
- Metasploit XML import (issue #228)
- Support "critical" severity from Nessus 5 (issue #254)
- XSLT export. MagicTree data can now be exported as arbitrary XML. An XSLT for nmap-format export is provided. Use case: merge multiple nmap files, then export as one file to use in Nessus scan (issue #77)
- Importing exploitability data from Nessus
- Added "Save file as..." button to XML file view
Submitted by abb on 20 June, 2012 - 16:48
Submitted by abb on 12 June, 2012 - 16:12
Finally, a feature to make Linux bridge transparent to 802.1x EAP messages is in the official 3.2 kernel! No more manual kernel patching or messing with openswitch. This feature is mostly useful for pentesting 802.1x-protected networks.
To force a bridge forward 802.1x EAP messages all you needs to do is to set the 4th least-significant-bit in a special sysfs file, something like this:
echo 8 > /sys/class/net/brXXX/bridge/group_fwd_mask
I haven't tried myself yet, but can confirm the sysfs file is there on my Ubuntu 12.04.
Submitted by alla on 1 June, 2012 - 14:36
Update: Burp Suite Pro 1.4.10 supports JSON scanning out of the box, see http://releases.portswigger.net/2012/06/v1410.html
Update 2: The plugin is released under the terms of GNU GPL. In short it means that you can use it and change it as you like, publish the changes under GNU GPL if you like, but cannot include it as a part of any closed-source software. If you really want to use it as a part of closed-source software, contact me, we can figure something out.
Submitted by abb on 11 May, 2012 - 20:43
I would like to announce release of sslcaudit 1.0. This tool is designed to automate testing SSL/TLS clients for resistance against MITM attacks.
There is no proper installation procedure yet (Debian package and distutils-based Python installer are coming soon). For now just fetch the release from GIT repository:
~$ git clone -b release_1_0 https://github.com/grwl/sslcaudit.git
Cloning into sslcaudit...
Submitted by alla on 9 May, 2012 - 10:55
Since July 2010 Ubuntu has disabled support for SSLv2 in OpenSSL library. If you are testing remote hosts for SSLv2 using a client that does not support it, you are getting false negatives.
Here is how you can check if you system supports SSLv2:
alla@notsoshiny:~$ socat OPENSSL-LISTEN:1080,method=SSLv2,cert=cert.pem,verify=0 READLINE
cert.pem has to be a valid certificate file that includes a private key. Generate one with OpenSSL if you don't have it.
Submitted by abb on 1 May, 2012 - 23:12
UPDATE: Newer version of sslcaudit is available here.
Here is sslcaudit v1.0 RC1. The goal of the project is to develop a utility to automate testing SSL/TLS clients for resistance against MITM attacks. The project is GPL-licensed, source code hosted at github. PDF user guide is available at here.
INTRODUCTION
Submitted by abb on 13 April, 2012 - 14:34
I've written a custom TCP port scanner, to handle a broken target sporadically responding with SYN-ACKs even on filtered ports. Nmap detect such ports as open (in syn- and connect-scan modes).
$ sudo ./run.sh -s 172.16.33.1 -d 172.16.33.144 --p0 21 --p1 25 -i vmnet8
INFO:Scanner:res 172.16.33.144:24, res=closed)>
INFO:Scanner:res 172.16.33.144:22, res=open)>
INFO:Scanner:res 172.16.33.144:21, res=filtered)>
INFO:Scanner:res 172.16.33.144:23, res=fake-open)>
Pages
