Defcon too far? Blackhat too expensive? No problem!
Have no fear SecurityTubeCon is here! (well… soon!)
SecurityTubeCon is the first hacker conference to be held completely in cyberspace.
SecurityTubeCon is aimed at democratizing hacker conferences by allowing any researcher, regardless of his physical location, to share his work with the community. Unlike other Cons we will not *accept / reject* speakers. If you have something interesting to share, you WILL be heard. The idea behind SecurityTubeCon is not to pass judgments on your work, instead, it aims at providing a platform for knowledge exchange.
Ive always wanted to attend a hacker conference however for a poor student like me its not easy. If you don’t live in a big city you have to get to the conference by plane or train (£100 to £500), buy a ticket to attend (£50 to £1000), pay for a hotel (£100 – £300) and then pay for food/beer (£50 – £150), not to mention the time off work. All in all it can be an expensive trip!
SecurityTubeCon will be held on the 6th, 7th and and 8th of November. Location: cyberspace
For more information on SecurityTubeCon or if your interested in giving a talk:
DVWA has a new home
Damn Vulnerable Web App (DVWA) now has a new website dedicated to the online community. The website is the new portal for all things DVWA, from it we plan to expand our online community and take DVWA that one step further.
For the latest news on DVWA, forums, blog posts, code submissions, feedback and everything else DVWA:
http://www.dvwa.co.uk
While your there why not sign up to the forums and say hello! :)
DVWA v1.0.5 coming soon…
DVWA v1.0.5 will be released in the near future sporting many changes including more vulnerabilities and features.
Since version 1.0.4 we have a bigger open source community which have pushed DVWA to a whole new level, with out them the project couldn’t be what it is today.
DVWA v1.0.5 change log:
Complete re-code.
Complete re-design.
CSRF vulnerability.
Stored XSS vulnerability.
Full Path Disclosure vulnerability.
Login page.
Sessions.
Many bug fixes.
PHPIDS implementation.
+ much more
[BONSAI] SQL Injection in CS-Cart <= 2.0.5
Here is one of the vulnerabilities which I found during my research for Bonsai Security a few weeks ago. The research consisted of vulnerability assessing commercial and open source ecommerce web applications over a 2 week period.
During the time of my research I learnt a great deal from Andres Riancho (w3af/bonsai-sec owner) and from the vulnerability assessments them selves. So what did I learn? I learnt that patience is definitely a virtue, javascript is a pain in the ass, ecommerce web application developers need to invest more time on security and a lot more as regards to perfecting my assessment techniques.
Here is the vulnerability report:
http://www.bonsai-sec.com/research/vulnerabilities/cs-cart_SQL-injection-0100.txt
Here is a great post by Andres on the difficulty on the actual exploitation:
http://www.bonsai-sec.com/blog/index.php/not-the-average-sql-injection/
A massive thanks to Andres for giving me the opportunity to work for him. I learnt more in the (just over) two week period working for him than I could have learnt in a whole 12 months.
Pentest Labs: Web Application Edition (securityaegis)
Ever wanted to set up a complete web application penetration testing lab with all the best tools available? Here is an awesome video by www.securityaegis.com to show you how to do it.
Web App Lab Setup from Laz3r (of Securityaegis.com) on Vimeo.
For a full write up on how to do this or for more information check out their original blog post:
http://www.securityaegis.com/?p=574
