Nytro

Da, de-asta am incercat si eu sa vad daca extrag toate tabelele, daca e limitat.

Ha? Si pe aia cu FinFisher de ce nu ii aresteaza? Sa le dau la muie.

user() == sqli2@localhost ? Nota: Iti pot extrage tabelele.

More Mac OS X and iPhone sandbox escapes and kernel bugs Posted by Ian Beer A couple of weeks ago Apple released OS X 10.9.5 and iOS 8 which fixed a number of sandbox escapes and privilege escalation bugs found by Project Zero. All-bar-one of these bugs were found via manual source code auditing where there was source and binary analysis where there wasn’t. As always, click through the bugs for proof-of-concept code and further details: CVE-2014-4403* [ https://code.google.com/p/google-security-research/issues/detail?id=23 ] was as issue allowing a kernel ASLR bypass on OS X due to insufficient randomization of very early kernel heap allocations, the addresses of which could be leaked using the unprivileged SGDT instruction. This bug could be exploited from within any sandbox on OS X and allowed an attacker to determine the load address of the kernel. CVE-2014-4394* [ https://code.google.com/p/google-security-research/issues/detail?id=28 ] CVE-2014-4395* [ https://code.google.com/p/google-security-research/issues/detail?id=29 ] CVE-2014-4401* [ https://code.google.com/p/google-security-research/issues/detail?id=30 ] CVE-2014-4396* [ https://code.google.com/p/google-security-research/issues/detail?id=30 ] CVE-2014-4397* [ https://code.google.com/p/google-security-research/issues/detail?id=30 ] CVE-2014-4400* [ https://code.google.com/p/google-security-research/issues/detail?id=30 ] CVE-2014-4399* [ https://code.google.com/p/google-security-research/issues/detail?id=30 ] CVE-2014-4398* [ https://code.google.com/p/google-security-research/issues/detail?id=32 ] CVE-2014-4416* [ https://code.google.com/p/google-security-research/issues/detail?id=34 ] were all bounds-checking bugs in the driver for the Intel integrated HD GPU present on all current-generation Macs. Eight of these bugs allowed controlled kernel memory corruption from with most sandboxes on OS X (those with access to the GPU such as the Safari renderer process or the Chrome GPU process.) CVE-2014-4402* [ https://code.google.com/p/google-security-research/issues/detail?id=33 ] was another case of missing bounds checks, this time in another part of the graphics acceleration pipeline. CVE-2014-4376* [ https://code.google.com/p/google-security-research/issues/detail?id=31 ] was a kernel NULL-pointer dereference when setting up IOKit shared memory. This was exploitable from within some sandboxed 32-bit processes on OS X (for example the Chrome GPU process.) As is true with all these bugs this bug also allows any unsandboxed processes to execute code in the kernel. CVE-2014-4418 [ https://code.google.com/p/google-security-research/issues/detail?id=36 ] No CVE* [ https://code.google.com/p/google-security-research/issues/detail?id=35 ] were bugs affecting OS X and iOS in the implementation of the IOKit IODataQueue class where the kernel trusted index and size fields in shared memory which was mapped into userspace and writable. Looking at the release notes for iOS 8 these bugs seem to be very similar to one used in the recent Pangu Team jailbreak which was released a few days after these bugs were reported to Apple. CVE-2014-4389 [ https://code.google.com/p/google-security-research/issues/detail?id=39 ] were integer overflows in the bounds checking code of IODataQueue allowing kernel memory corruption on iOS and OS X. CVE-2014-4390 [ https://code.google.com/p/google-security-research/issues/detail?id=37 ] was another shared memory queuing bug, this time in the bluetooth stack. CVE-2014-4404+ [ https://code.google.com/p/google-security-research/issues/detail?id=40 ] was an interesting kernel heap overflow when parsing a binary keyboard map which affected iOS and OS X and was reachable by setting an IOKit registry value. See the linked bug for more details along with a PoC demonstrating kernel instruction pointer control. CVE-2014-4379 [ https://code.google.com/p/google-security-research/issues/detail?id=42 ] was another bug in the keyboard mapping code affecting iOS and OS X allowing userspace to read arbitrary kernel memory. CVE-2014-4405+ [ https://code.google.com/p/google-security-research/issues/detail?id=41 ] was a kernel NULL pointer dereference due to incorrect error handling in the key map parsing code, again see the linked bug for a PoC demonstrating kernel instruction pointer control on OS X. Finding and eliminating sandbox escapes is an important focus for Project Zero. The attack surface to break out of a sandbox is often smaller than the attack surface available to remote attackers to gain an initial foothold inside a sandbox. Therefore, strengthening sandboxes represents a solid return on investment of time. Our research seems to indicate that sandbox break-outs on OS X and iOS are an under-researched topic. We’d encourage others to join us in bringing these sandboxes up to strength. You can keep up-to-date with the latest Project Zero research by subscribing to labels in our bug tracker: https://code.google.com/p/google-security-research/issues/subscriptions These bugs exceeded Project Zero’s standard 90-day disclosure deadline. (+) These bugs were only fixed on iOS and remain unpatched on OS X. Sursa: Project Zero: More Mac OS X and iPhone sandbox escapes and kernel bugs

October 01, 2014 Bash bug: the other two RCEs, or how we chipped away at the original fix (CVE-2014-6277 and '78) The patch that implements a prefix-based way to mitigate vulnerabilities in bash function exports has been out since last week and has been already picked up by most Linux vendors (plus by Apple). So, here's a quick overview of the key developments along the way, including two really interesting things: proof-of-concept test cases for two serious, previously non-public RCE bugs tracked as CVE-2014-6277 and CVE-2014-6278. NOTE: If you or your distro maintainers have already deployed Florian's patch, there is no reason for alarm - you are almost certainly not vulnerable to attacks. If you do not have this patch, and instead relied only on the original CVE-2014-6271 fix, you probably need to act now. See this entry for a convenient test case and other tips. Still here? Good. If you need a refresher, the basic principles of the underlying function export functionality, and the impact of the original bash bug (CVE-2014-6271), are discussed in this blog post. If you have read the earlier post, the original attack disclosed by Stephane Chazelas should be very easy to understand: HTTP_COOKIE='() { 0; }; echo hi mom;' bash -c : In essence, the internal parser invoked by bash to process the specially encoded function definitions passed around in environmental variables had a small problem: it continued parsing the code past the end of the function definition itself - and at that point, flat out executing whatever instructions it came across, just as it would do in a normal bash script. Given that the value of certain environmental variables can be controlled by remote attackers in quite a few common settings, this opened up a good chunk of the Internet to attacks. The original vulnerability was reported privately and kept under embargo for roughly two weeks to develop a fairly conservative fix that modified the parser to bail out in a timely manner and do not parse any trailing commands. As soon as the embargo was lifted, we all found out about the bug and scrambled to deploy fixes. At the same time, a good chunk of the security community reacted with surprise and disbelief that bash is keen to dispatch the contents of environmental variables to a fairly complex syntax parser - so we started poking around. Tavis was the quickest: he found that you can convince the parser to keep looking for a file name for output redirection past the boundary between the untrusted string accepted from the environment and the actual body of the program that bash is being asked to execute (CVE-2014-7169). His original test case can be simplified at: HTTP_COOKIE='() { function a a>\' bash -c echo This example would create an empty file named "echo", instead of executing the requested command. Tavis' finding meant that you would be at risk of remote code execution in situations where attacker-controlled environmental variables are mixed with sanitized, attacker-controlled command-line parameters passed to calls such as system() or popen(). For example, you'd be in trouble if you were doing this in a web app: system("echo '"+ sanitized_string_without_quotes + "' | /some/trusted/program"); ...because the attacker could convince bash to skip over the "echo" command and execute the command given in the second parameter, which happens to be a sanitized string (albeit probably with no ability to specify parameters). On the flip side, this is a fairly specific if not entirely exotic coding pattern - and contrary to some of the initial reports, the bug probably wasn't exploitable in a much more general way. Chet, the maintainer of bash, started working on a fix to close this specific parsing issue, and released it soon thereafter. On the same day, Todd Sabin and Florian Weimer have independently bumped into an off-by-one issue in the parser (CVE-2014-7186). The bug manifested in what seemed to be a non-exploitable crash, but was enough to cast even more doubt on the robustness of the underlying code. The test for this problem was pretty simple - you just needed a sequence of here-documents that overflowed a static array, say: HTTP_COOKIE='() { 0 <<a <<b <<c <<d <<e <<f <<g <<h <<i <<j <<k <<l <<m; }' bash -c : Florian also bumped into a similar issue with loop parsing (CVE-2014-7187); the proof-of-concept function definition for this is a trivial for loop nested 129 levels deep, but the effect can be only observed under memory access diagnostics tools. In any case, the practical impact of this finding wasn't particularly clear. Nevertheless, all these revelations prompted him to start working on an unofficial but far more comprehensive patch that would largely shield the parser from untrusted strings in normally encountered variables present in the environment. In parallel to Tavis' and Florian's work, I set up a very straightforward fuzzing job with american fuzzy lop. I seeded it with a rudimentary function definition: () { foo() { foo; }; >bar; } ...and simply let it run with a minimalistic wrapper that took the test case generated by the fuzzer, put it in a variable, and then called execve() to invoke bash. Although the fuzzer had no clue about the syntax of shell programs, it had the benefit of being able to identify and isolate interesting syntax based on coverage signals, deriving around 1,000 other distinctive test cases from the starting one while "instinctively" knowing not to mess with the essential "() {" prefix. For the first few hours, it kept hitting only the redirect issue originally reported by Todd and the file-creation issue discovered by Tavis - but soon thereafter, it spewed out a new crash illustrated by this snippet of code (CVE-2014-6277): HTTP_COOKIE='() { ) { _; }; ) { _; } <<a; }' bash -c : This proved to be a very straightforward use of uninitialized memory: it hit a code path in make_redirect() where one field in a newly-allocated REDIR struct - here_doc_eof - would not be set to any specific value, yet would be treated as a valid pointer later on (somewhere in copy_redirect()). Now, if bash is compiled with both --enable-bash-malloc and --enable-mem-scramble, the memory returned to make_redirect() by xmalloc() will be set to 0xdf, making the pointer always resolve to 0xdfdfdfdf, and thus rendering the bug harder to exploit (essentially depending on whether the stack or any other memory region can be grown by the attacker to overlap with this address). That said, on a good majority of Linux distros, these flags are disabled, and you can trivially get bash to dereference a pointer that is entirely within attacker's control: HTTP_COOKIE="() { ) { _; }; ) { _; } <<`perl -e '{print "A"x1000}'`; }" bash -c : bash[25662]: segfault at 41414141 ip 00190d96 sp bfbe6354 error 4 in libc-2.12.so[110000+191000] The actual fault happens because of an attempt to copy here_doc_eof to a newly-allocated buffer using a C macro that expands to the following code: strcpy(xmalloc(1 + strlen(redirect->here_doc_eof)), (redirect->here_doc_eof)) This appears to be exploitable in at least one way: if here_doc_eof is chosen by the attacker to point in the vicinity of the current stack pointer, the apparent contents of the string - and therefore its length - may change between stack-based calls to xmalloc() and strcpy() as a natural consequence of an attempt to pass parameters and create local variables. Such a mid-macro switch will result in an out-of-bounds write to the newly-allocated memory. A simple conceptual illustration of this attack vector would be: char* result; int len_alloced; main(int argc, char** argv) { /* The offset will be system- and compiler-specific */; char* ptr = &ptr - 9; result = strcpy (malloc(100 + (len_alloced = strlen(ptr))), ptr); printf("requested memory = %d\n" "copied text = %d\n", len_alloced + 1, strlen(result) + 1); } When compiled with the -O2 flag used for bash, on one test system, this produces: requested memory = 2 copied text = 28 Of course, the result will vary from system to system, but the general consequences of this should be fairly evident. The issue is also made worse by the fact that only relatively few distributions were building bash as a position-independent executable that could be fully protected by ASLR. (In addition to this vector, there is also a location in dispose_cmd.c that calls free() on the pointer under some circumstances, but I haven't really really spent a lot of time trying to develop a functioning exploit for the '77 bug for reasons that should be evident in the text that follows... well, just about now.) It has to be said that there is a bit less glamour to such a low-level issue that still requires you to go through some mental gymnastics to be exploited in a portable way. Luckily, the fuzzer kept going, and few hours later, isolated a test case that, after minimization, yielded this gem (CVE-2014-6278): HTTP_COOKIE='() { _; } >_[$($())] { echo hi mom; id; }' bash -c : I am... actually not entirely sure what happens here. A sequence of nested $... statements within a redirect appears to cause the parser to bail out without properly resetting its state, and puts it in the mood for executing whatever comes next. The test case works as-is with bash 4.2 and 4.3, but not with more ancient releases; this is probably related to changes introduced few years ago in bash 4.2 patch level 12 (xparse_dolparen()), but I have not investigated if earlier versions are patently not vulnerable or simply require different syntax. The CVE-2014-6278 payload allows straightforward "put-your-commands-here" remote code execution on systems that are protected only with the original patch - something that we were worried about for a while, and what prompted us to ask people to update again over the past few days. Well, that's it. I kept the technical details of the last two findings embargoed for a while to give people some time to incorporate Florian's patch and avoid the panic associated with the original bug - but at this point, given the scrutiny that the code is under, the ease of discovering the problems with off-the-shelf open-source tools, and the availability of adequate mitigations, the secrecy seems to have outlived its purpose. Any closing thoughts? Well, I'm not sure there's a particular lesson to be learnt from the entire story. There's perhaps one thing - it would probably have been helpful if the questionable nature of the original patch was spotted by any of the notified vendors during the two-week embargo period. That said, I wasn't privy to these conversations - and hindsight is always 20/20. Sursa: lcamtuf's blog: Bash bug: the other two RCEs, or how we chipped away at the original fix (CVE-2014-6277 and '78)

Inside The Atheros WiFi Chipset - Adrian Chadd The Qualcomm Atheros wireless chips have a variety of open source drivers available. Adrian will walk through the open Atheros HALs and ath9k-htc firmware, describing how things hold together and how to use them. Note - everything discussed will be based on what is the open source software and publicly available information. Bio: Adrian is the FreeBSD wireless maintainer and worked at Atheros for 18 months on chip bring-up and open source work. He worked with other Atheros developers to open source the USB firmware for the AR5513 and ath9k-htc hardware, as well as the AR9300 HAL. He also works on network parallelism and scaling in FreeBSD. His day job isn't anything to do with wifi. Via: Inside The Atheros WiFi Chipset - Adrian Chadd (Defcon Wireless Village 2014) (Hacking Illustrated Series InfoSec Tutorial Videos)

SDR Tricks with HackRF - Michael Ossmann HackRF and some other Software Defined Radio platforms can be used in creative ways. I'll show methods, including a dirty trick or two, for using HackRF outside the advertised frequency range. I'll also show how the HackRF design lends itself to use as an oscilloscope or function generator suitable for many hardware hacking tasks. Bio: Michael Ossmann is a wireless security researcher who makes hardware for hackers. He founded Great Scott Gadgets in an effort to put exciting, new tools into the hands of innovative people. Via: SDR Tricks with HackRF - Michael Ossmann (Defcon Wireless Village 2014) (Hacking Illustrated Series InfoSec Tutorial Videos)

Hacking 802.11 Basics - textile Hacking 802.11 Basics - textile Bio: Some dude. Via: Hacking 802.11 Basics - textile (Defcon Wireless Village 2014) (Hacking Illustrated Series InfoSec Tutorial Videos)

802.11ac Evolution: Data rates and Beamforming - Eric Johnson This session will discuss what is new in 11ac Discuss how the new data rates are derived. Where does 1.3 Gbps come from? The latest 11ac standard introduced 11ac beamforming. What is beamforming at a basic level? The practicalities of how 11ac beamforming works. Why it is not about making pretty antenna patterns? How it is different than proprietary analog solutions that proceeded the standards solution? Bio: Eric Johnson is one of Aruba's radio subject matter experts. He holds a Bachelor's and Master's degree in Electrical Engineering (Electromagnetics) from Carleton University. He has contributed solely and with teams on a total of 7 patents. His career now spans 26 years of defining, designing, building, and selling high performance radio and antenna solutions. He has contributed to and driven solutions for; space and terrestrial based remote sensing solutions; antenna designs from 30 MHz to 60 GHz; and at Nortel as architect on cellular radios, basestations, and antennas. Eric joined the Aruba Networks team in 2011 as the Product Manager for outdoor radio solutions and most recently delivered the AP-270 outdoor 11ac Access Point solutions. Via: 802.11ac Evolution: Data rates and Beamforming - Eric Johnson (Defcon Wireless Village 2014) (Hacking Illustrated Series InfoSec Tutorial Videos)

Mobile Forensics and Its App Analysis - Dr. Charline Nixon This presentation will talk about different mobile forensic tools, its uses, pros and cons. I will also use attack tree and its forensic tools comparison. The discussion also include app analysis, vulnerabilities, and breaches of mobile phone analysis. Bio: Charline F. Nixon is currently an IT Faculty at Calhoun Community College where she is responsible for teaching computer forensics, cyber terrorism and ethical hacking courses. She is currently developing a new course focused on mobile device hacking and forensics. Her previous positions include, IT School Chair and IT Faculty Lead Instructor. She holds 2 PhD’s in Education and Management and 2 Masters in Business and Cyber Security and a Black Belt Six Sigma. Charline has previously spoken at BSides Memphis and is one of the co-organizers of BSides Huntsville. In addition she holds several IT certifications, including GCIA, CEH, CHFI, ECSA, MFE,MCT, MCP,CASP (+10 others). Via: Mobile Forensics and Its App Analysis - Dr. Charline Nixon (TakeDownCon Rocket City 2014) (Hacking Illustrated Series InfoSec Tutorial Videos)

IPv6 Attack tools - Scott Hogg Many international organizations already have IPv6 networks, some organizations are working on their transitions to IPv6 and others are contemplating what IPv6 means to them. However, many organizations already have IPv6 running on their networks and they don’t even realize it. Many computer OSs now default to running both IPv4 and IPv6 which could lead to security vulnerabilities if one is not prepared. IPv6 security vulnerabilities currently exist “in the wild” and as the popularity of the IPv6 protocol increases so will the number of threats. This session will cover the overview of IPv6 security threats and protection measures. This session will cover recently released IPv6 attack tools that target the Neighbor Discovery Protocol (NDP) and how Ethernet switch manufacturers have created protection measures. Bio: Scott Hogg is the CTO for Global Technology Resources, Inc. (GTRI), a founding member of the Rocky Mountain IPv6 Task Force, and a member of the Infoblox IPv6 Center of Excellence. Scott has a B.S. in Computer Science, a M.S. in Telecommunications, along with his CCIE (#5133), CISSP (#4610), among many other vendor and industry certifications. Scott has authored the Cisco Press book on IPv6 Security and writes a popular blog for NetworkWorld.com. Scott helps enterprises and service providers with their IPv6 planning, training and deployment activities. Via: IPv6 Attack tools - Scott Hogg (TakeDownCon Rocket City 2014) (Hacking Illustrated Series InfoSec Tutorial Videos)

Dropping Docs on Darknets: How People Got Caught Most of you have probably used Tor before, but I2P may be unfamiliar. Both are anonymization networks that allow people to obfuscate where their traffic is coming from, and also host services (web sites for example) without it being tied back to them. This talk will give an overview of both, but will focus on real world stories of how people were deanonymized. Example cases like Eldo Kim & the Harvard Bomb Threat, Hector Xavier Monsegur (Sabu)/Jeremy Hammond (sup_g) & LulzSec, Freedom Hosting & Eric Eoin Marques and finally Ross William Ulbricht/“Dread Pirate Roberts” of the SilkRoad, will be used to explain how people have been caught and how it could have been avoided Bio: Adrian Crenshaw has worked in the IT industry for the last fifteen years. He runs the information security website Irongeek.com, which specializes in videos and articles that illustrate how to use various pen-testing and security tools. He did the cert chase for awhile (MCSE NT 4, CNE, A+, Network+. i-Net+) but stopped once he had to start paying for the tests himself. He holds a Master of Science in Security Informatics and is also one of the co-founders of Derbycon. Via: Dropping Docs on Darknets: How People Got Caught (TakeDownCon Rocket City 2014) (Hacking Illustrated Series InfoSec Tutorial Videos)

Energy-efficient bcrypt cracking - Katja Malvoni Abstract:Bcrypt is not completely hardware resistant: certain low-power parallel platforms improve bcrypt cracking energy-efficiency by a factor of 20+ when compared to traditional CPU implementations. https://www.youtube.com/watch?list=PLdIqs92nsIzRFk0OCN_uQiOkgtPiNk2mv&feat ure=player_embedded&v=maq2IY1F3x8 Via: Energy-efficient bcrypt cracking - Katja Malvoni (Passwords Con 2014) (Hacking Illustrated Series InfoSec Tutorial Videos)

Net hashes: a review of many network protocols - Robert Graham https://www.youtube.com/watch?list=PLdIqs92nsIzRFk0OCN_uQiOkgtPiNk2mv&feat ure=player_embedded&v=dM3n1Vff2xs Via: Net hashes: a review of many network protocols - Robert Graham (Passwords Con 2014) (Hacking Illustrated Series InfoSec Tutorial Videos)

I have the #cat so I make the rules - Yiannis Chrysanthou Abstract:The presentation will be a demonstration of new techniques for wordlist and rule generation to help crack quality passwords with a success rate above 90%. Bio:Yiannis works at KPMG LLP (UK) as a pentester. He managed to convince the Academia that his password cracking obsession is a good subject for an MSc thesis . In his MSc thesis he listed practical attacks on passwords and applied them against hashes disclosed from recent leaks. Yiannis argued that usage of standards such as FIPS181 (pronounceable random passwords) actually weakens password strength. Yiannis is an active member of Team Hashcat and has attended CMIYC and Hashrunner competitions. He is well known for his rulesets and wordlists. He makes his own rules both in life and password cracking! He recently presented at various seminars such as OWASP Chapters and BSides London. He was interviewed on the subject of password cracking by BBC and ArsTechnica. https://www.youtube.com/watch?list=PLdIqs92nsIzRFk0OCN_uQiOkgtPiNk2mv&feat ure=player_embedded&v=4fMwhSlC9HM Via: I have the #cat so I make the rules - Yiannis Chrysanthou (Passwords Con 2014) (Hacking Illustrated Series InfoSec Tutorial Videos)

Tradeoff cryptanalysis of password hashing schemes - Dmitry Khovratovich, Alex Biryukov, Johann Großschädl Abstract:We explore time-memory tradeoffs for the most promising password hashing schemes in the context of brute-force password cracking on ASIC, FPGA, and GPU. Bio:Alex Biryukov is a professor at the University of Luxembourg and the head of Laboratory of Algorithms, Cryptology, and Security (LACS). Dmitry Khovratovich is a post-doctoral researcher at LACS. Alex and Dmitry are professional cryptanalysts, known for their works on the world standard cipher AES, hash function SHA-2, and tradeoff attacks on stream ciphers, which have been published at flagship crypto conferences. Johann Großschädl is a researcher at LACS with a focus on efficient implementation of cryptographic primitives in hardware and software. In the past 15 years, he has published about 80 papers in these areas, including 9 papers in the workshop series on Cryptographic Hardware and Embedded Systems (CHES). LdIqs92nsIzRFk0OCN_uQiOkgtPiNk2mvVia: Tradeoff cryptanalysis of password hashing schemes - Dmitry Khovratovich, Alex Biryukov, Johann Großschädl (Passwords Con 2014) (Hacking Illustrated Series InfoSec Tutorial Videos)

Using cryptanalysis to speed-up password cracking - Christian Rechberger Abstract:Cryptanalysts try to find collisions or preimages. Password crackers look for the most effective way to search through candidate passwords. So far there was no useful practical overlap: We change that! Bio:Assoc. Prof. at Technical University of Denmark. Co-designer of SHA-3 finalist Grostl, block cipher Prince, and co-inventor of various attack techniques for ciphers and hash functions like AES and SHA-1. https://www.youtube.com/watch?feature=player_embedded&list=PLdIqs92nsIzRFk 0OCN_uQiOkgtPiNk2mv&v=O7u8S2jxTns Via: Using cryptanalysis to speed-up password cracking - Christian Rechberger (Passwords Con 2014) (Hacking Illustrated Series InfoSec Tutorial Videos)

Hackers Are People Too Amanda Berlin (Infosystir) Derbycon 2014 The world and popular culture mostly see hackers as criminals. We should all make it our mission to not only educate each other when it comes to technology and practices, but also education the population on what we do and why we do it. Let’s spread the word on all of the amazing things that our community does and has to offer to shine a better light on the word “hackerâ€. I go through the responses of my local community and circles of family and friends as well as what I’ve learned in the process. Hopefully the word spreads and it empowers us to secure all the things!!! Via: Hackers Are People Too - Amanda Berlin (Infosystir) Derbycon 2014 (Hacking Illustrated Series InfoSec Tutorial Videos)

How to Secure and Sys Admin Windows like a Boss. Jim Kennedy Derbycon 2014 Last year we looked at some of the specifics of how to secure a windows network from 6000 hostile users with domain creds. Those users are still there- still hostile and still hell bent on breaking our stuff. I will recap the security measures we have in place and expand upon the specifics of the important ones. But there is also a holistic approach to building an Active Directory Domain from the bottom up so that security is built in- just like software design. As I have learned more about the attack vector I have realized that following best practices in design- that on first glance appear to have little security value- do in fact build the foundation of our ongoing success at beating back the attackers. You can’t build a house on quicksand. Via: How to Secure and Sys Admin Windows like a Boss. - Jim Kennedy Derbycon 2014 (Hacking Illustrated Series InfoSec Tutorial Videos)

Interceptor: A PowerShell SSL MITM Script Casey Smith Derbycon 2014 This talk will take you line by line through creating an SSL Man-In-The-Middle Powershell script. Modern malware often aims to steal web credentials and inject code into secure sessions. This script can be used to mimic that behavior, and expand your influence by collecting web credentials, or injecting “additional functionality” into a user’s web experience. In addition, you can mimic the behavior of applications such as Burp or Fiddler by extending or customizing this script. Topics covered include Dynamic CA and Signed Certificate Generation. PowerShell Sockets, Streams, Threads and SSL/TLS Interception and Tampering. Via: Interceptor: A PowerShell SSL MITM Script - Casey Smith Derbycon 2014 (Hacking Illustrated Series InfoSec Tutorial Videos)

Exploiting Browsers Like A Boss w/ WhiteLightning! Bryce Kunz Derbycon 2014 Have you ever performed a spear-phishing attack where you failed to gain access to your target even though you know your target was exploitable to an old browser exploit? Selecting the wrong browser exploit or the wrong callback port for your payload can make for a very sad panda. Well cry no more sad panda- because WhiteLightning solves your exploitation problems! WhiteLightning is a browser exploitation frame - work that stealthily detects accurate versioning information from an endpoint’s browser and intelligently selects the best browser exploits to gain access to the remote endpoint. WhiteLightning directly interfaces with Metasploit via MS - GRPC to accurately start exploits- payloads- and handlers in real-time. Ready for the best part? Using some slick trickery I will show you how to use WhiteLightning and Metasploit together to exploit endpoint browsers all over a single TCP port using valid HTTP requests! Say goodbye to blocked callbacks and unreliable browser exploitation because we’re about to 0wn some targets with WhiteLightning!!! Via: Exploiting Browsers Like A Boss w/ WhiteLightning! - Bryce Kunz Derbycon 2014 (Hacking Illustrated Series InfoSec Tutorial Videos)

Burp For All Languages Tom Steele Derbycon 2014 This talk will mark the an official release and demonstration a new tool which exposes the entire BurpSuite Extender API over a combination of HTTP and WebSockets. BurpSuite is a great tool for application security assessments and the Burp Extender API exposes an extraordinary amount of functionality for users to build their own plugins. However, these plugins must be written in Java, Python, or Ruby. Additionally, restrictions on these languages while running on the JVM can be frustrating. By executing via HTTP and WebSockets, plugins can be written in any language and can run entirely independent from BurpSuite, allowing for unlimited functionality. We will discuss the previous projects which inspired this, functionality of the API, and some client demonstrations written in various languages. Some practical and some that are just awesome for the sake of being awesome. Via: Burp For All Languages - Tom Steele Derbycon 2014 (Hacking Illustrated Series InfoSec Tutorial Videos)

How not to suck at pen testing John Strand Derbycon 2014 Godamitsomuch. How did printing a report from a vuln scan - ner qualify as a “pen test”? Why are your testers ignoring low and informational findings? In this presentation, John will cover some key components that many penetration tests lack, including why it is impor - tant to get caught, why it is important to learn from real attackers and how to gain access to organizations without sending a single exploit, and how to look for other attackers on the network. Additionally, John will show you how to bypass “all powerful” white listing applications that are often touted as an impenetrable defense. Via: How not to suck at pen testing - John Strand Derbycon 2014 (Hacking Illustrated Series InfoSec Tutorial Videos)

Making BadUSB Work For You Adam Caudill - Brandon Wilson Derbycon 2014 Your average USB thumb drive can be so much more than meets the eye. There’s been some fear spread recently about how they can be used as an attack vector- but little information about how you can take advantage of them. This talk dispels some of the fear- and introduces users to how they can leverage a low cost thumb drive to attack systems and hide data. During the talk- new tools- code- and documentation will be publicly released to allow anyone to take advantage of these techniques. Via: Making BadUSB Work For You - Adam Caudill - Brandon Wilson Derbycon 2014 (Hacking Illustrated Series InfoSec Tutorial Videos)

The Social Engineering Savants - The Psychopathic Profile Kevin Miller Derbycon 2014 Some people are good at convincing others. Some have a knack for it- but there is a class of people who truly excel. Is this because of the right circumstances in their upbringing? Is it their interests- or do they have a true advantage the rest of society can’t achieve? Psychopaths are experts at charm and deception. They have a true advantage most people cannot hope to gain- but their advantage is also their weakness. Although their behavior and calm demeanor gives them the upper hand in dealing with people- their desire for high risk situations also gives them away to what they really are. The question becomes who are they- and what makes them different. With those that are different- what differentiates them between being violent and high functioning. Almost everyone has met one- they question is who are they- and are they really your friend? Via: The Social Engineering Savants - The Psychopathic Profile - Kevin Miller Derbycon 2014 (Hacking Illustrated Series InfoSec Tutorial Videos)