This is an old paper I wrote about vulnerabilities in file upload implementations in PHP web applications. The web site it used to live on no longer exists, so I thought I repost it here to have it close at hand. It is relevant to other web application technologies (Java, .NET, etc.) but all the…

Great news - PortSwigger is working on PKCS#11 support (SSL client certificates stored on hardware tokens, such as smart cards) for Burp. I got to try the test build - it works perfectly with Belgian eID on Linux. I am really happy about it - no more awkward chaining of proxies and SSL tunnels to…

We have released MagicTree 1.3. It fixes several nasty bugs that may lead to data corruption. We recommend everybody who uses MagicTree to upgrade. New features include support for AppScan XML and better handling of Imperva Scuba XML Here is the full change log: Fix for #307 "Cannot create a…

Once again, we are looking for a penetration tester. See this post for a descriptiong of skills we are interested in. Prior penetration testing experience is a plus, but not a must, provided that you have the necessary knowledge, both practical and theoretical. The job is in Brussels, Belgium,…

We have recently been swampted by spam forum posts and comments. Some seem to be submitted by bots while other appear to be from humans. Untill now we've been using Image CAPTCHA module which doesn't seem to help much. We have now installed and configured Riddler. Let's see if it helps. If you are…

MagicTree 1.2 is available for download. New features in this release: Metasploit XML import (issue #228) Support "critical" severity from Nessus 5 (issue #254) XSLT export. MagicTree data can now be exported as arbitrary XML. An XSLT for nmap-format export is provided. Use case: merge multiple…

http://www.xkcd.org/730/

Finally, a feature to make Linux bridge transparent to 802.1x EAP messages is in the official 3.2 kernel! No more manual kernel patching or messing with openswitch. This feature is mostly useful for pentesting 802.1x-protected networks. To force a bridge forward 802.1x EAP messages all you needs to…

Update: Burp Suite Pro 1.4.10 supports JSON scanning out of the box, see http://releases.portswigger.net/2012/06/v1410.html Update 2: The plugin is released under the terms of GNU GPL. In short it means that you can use it and change it as you like, publish the changes under GNU GPL if you like,…

I would like to announce release of sslcaudit 1.0. This tool is designed to automate testing SSL/TLS clients for resistance against MITM attacks. There is no proper installation procedure yet (Debian package and distutils-based Python installer are coming soon). For now just fetch the release from…