VAPWN - Web application Visualization - Crawler

Some time ago, we were working on a web application analyzer tool focused on the structure of the web application. We have a alpha version with a crawler and a proxy working. This is a proof of concept of visualization techniques in the security field:



You can view a video with an example of a crawling, different colors means different kind of files (dinamic, javascript, directory, hmtl, etc):

http://www.edge-security.com/vapwn-edge.mov

Hope you like, we are going the release this alpha version asap.

Enjoy!

Windows Vista - Easy hack

Hi, this time the people from Offensive-Security.com, bring us an example on how Windows Vista could be hacked in a very easy way, forget exploits, ASLR, DEP, etc.

Just boot with a live CD, move utilman.exe to utilman.old, and copy cmd.exe to utilman.exe.

Then in the login window, just press CTRL-U, and a console with administrative rights will pop up.

It's the same as the old Windows XP Sticky-keys trick.

Video here

Enjoy

PCI Requirement 666, sorry 6.6

After all the discussion around the PCI DSS requirement 6.6, on what were the real requirements, we can conclude that from June 30 (2008) there are two options for the web applications requirement:

1- Application Code review, that is subdivided in the following alternatives:

• Manual review of application source code
  
• Proper use of automated source code analyzer (scanning) tools
  
• Manual web application security vulnerability assessments
  
• Proper use of automated web application security vulnerability assessment (scanning)  tools.

2- Web application Firewall

I think that we should have both options implemented, there are not exclusive and implementing just the Manual web application as Code Review would not assure the security of the application, because maybe between the discovery of the vulnerabilities and the patching/correcting/solving phase will pass some time that the application will be exposed, also new vulnerabilities introduced after the Manual Web Application Assessment, will put in jeopardy the security of the application.

Another interesting point is the alternative 4 of the option 1 "Proper use of automated web application security vulnerability assessment tool", what is considered "Proper" ?   I imagine a lot of "tool monkeys" launching automatic scanners, printing the tool report and justifying requirement 6.6 for two pennies, and then you will have to explain to your customer why your service is more expensive than the other.... 

It's always the same :(

More to come on this issue,

Metagoofil 1.4 - Metadata exposed

Hi this time i will post a brief entry about the new version of Metagoofil released some

 days ago.

In this version (1.4) i added a new feature that will extract the MAC address from 

the office documents, yes you read right :)  the MAC ADDRESS. 

We can find this information inside the documents in a string like this:

_PID_ GUID ... {F96EB3B9-C9F1-11D2-95EB-0060089BB2DA}

The last 12 hex digits are your MAC!

So here we have another piece of information that can be used to track an user, and most of them 

don't know it's existence :(

The next version of Metagoofil it will possibly  map the MAC address to the vendor 

name, so we can have more information about a target company.

Download here: MetaGooFil

PhishMe - Phishing awareness

Via Dancho's blog i read a post about a company called PhishMe.com where they offer a service for creating Phishing campaigns to test the awareness level in the different areas of your company by creating targeted emails and websites.

It's not a bad idea, with this you can have a sense of how your company employees deal with phishing scams. What is curious is that interface seems like a real professional Phisher interface, at least it will give ideas to the Phishers on how to organize and present the data of the attacks launched to get an idea of the success rate of the campaign.

Check Phishme.com
Dancho's post