[Kvasir] Tools for effective data management during a Penetration Test

Welcome to Kvasir! Herein these directories lay the groundwork tools for effective data management during a Penetration Test. Penetration tests can be data management nightmares because of the large amounts of information that is generally obtained. Vulnerability scanners return lots of actual an...

[BeEF] Fake Browser Update Exploitation

How to use BeEF Framework for fake browser update exploitation. Fake Browser Update : - In BeEF Framework there is a new feature available in social-engineering called Clippy using this feature we are sending the fake Update notification and if user click on that so obviously he is going to insta...

multiple critical vulnerabilities in sophos products

List, I've completed the second paper in my series analyzing Sophos Antivirus internals, titled "Practical Attacks against Sophos Antivirus". As the name suggests, this paper describes realistic attacks against networks using Sophos products. The paper includes a working pre-authentication remote...

Sophos Products - Multiple Vulnerabilities

Sophos Products - Multiple Vulnerabilities List, I've completed the second paper in my series analyzing Sophos Antivirus internals, titled "Practical Attacks against Sophos Antivirus". As the name suggests, this paper describes realistic attacks against networks using Sophos products. The paper...

[BeEF 0.4.3.8] Browser Exploitation Framework

The Browser Exploitation Framework BeEF is a powerful professional security tool. It is a penetration testing tool that focuses on the web browser. BeEF is pioneering techniques that provide the experienced penetration tester with practical client side attack vectors. Unlike other security...

New Mandiant Offering: Response Readiness Assessment

Today, I am pleased to announce the release of Mandiant's newest Strategic Solutions offering: Response Readiness Assessment. In this post, I'll explain what the service provides, why our customer's requested such a service, and who can benefit from the Response Readiness Assessment offering...

NeXpose 5.0 vulnerability management solution Released by Rapid7

NeXpose 5.0 vulnerability management solution Released by Rapid7 Nexpose proactively supports the entire vulnerability management lifecycle, including discovery, detection, verification, risk classification, impact analysis, reporting and mitigation. This gives organizations immediate insight int...

Incident Response and Recovery May Be the Best Defense

By B.K. DeLong The ever increasing list of breaches appearing on the Open Security Foundation’s DataLossDB Web site as well as companies being targeted by the AntiSec movement made up of groups including recently-raided Anonymous, AnonOps, TeaMp0isoN, and now-dormant LulzSec continues to show tha...

Financial Services Industry Report Urges Rethink on Malware

BITS, a financial services industry trade group has published a guide to malicious software and cyber crime that finds many industry attempts to fight the problem haven’t worked. The report calls on financial services firms to cooperate more in fighting malware. The Malware Risks and Mitigation...

The iPad: As Insecure As The iPhone

Forbes reporter Andy Greenberg polled a group of security researchers about the security posture of Apple’s new iPad device and comes away with a simple conclusion: The iPad is just as insecure as the iPhone. Some quotes from the story: Aaron Portnoy, security researcher, Tipping Point: “It’s...

Audit Finds Gaping Holes in NASA Security

The U.S. Government Accountability Office GAO has painted a bleak picture of the NASA’s IT security posture. An audit of the space agency’s computer systems found weaknesses in several critical areas, especially in the way NASA implemented access controls like user accounts, passwords and the...

Hathaway Resigns as Federal Cybersecurity Adviser

Melissa Hathaway has left her post as the country’s top cybersecurity adviser, casting even more doubt on who will take the open job of cybersecurity coordinator created by President Obama in May. Hathaway said she is resigning for personal reasons and has no interest in the coordinator job,...

CVE-2007-3184

Cisco Trust Agent CTA before 2.1.104.0, when running on MacOS X, allows attackers with physical access to bypass authentication and modify System Preferences, including passwords, by invoking the Apple Menu when the Access Control Server ACS produces a user notification message after posture...

Authentication flaw

Cisco Trust Agent CTA before 2.1.104.0, when running on MacOS X, allows attackers with physical access to bypass authentication and modify System Preferences, including passwords, by invoking the Apple Menu when the Access Control Server ACS produces a user notification message after posture...

Authentication flaw

Cisco Secure ACS does not require authentication when Cisco Trust Agent CTA transmits posture information, which might allow remote attackers to gain network access via a spoofed Network Endpoint Assessment posture, aka "NACATTACK." NOTE: this attack might be limited to authenticated users and...

CVE-2007-1800

Cisco Secure ACS does not require authentication when Cisco Trust Agent CTA transmits posture information, which might allow remote attackers to gain network access via a spoofed Network Endpoint Assessment posture, aka "NACATTACK." NOTE: this attack might be limited to authenticated users and...

CVE-2007-1800

Cisco Secure ACS does not require authentication when Cisco Trust Agent CTA transmits posture information, which might allow remote attackers to gain network access via a spoofed Network Endpoint Assessment posture, aka "NACATTACK." NOTE: this attack might be limited to authenticated users and...