Climbing Mount WebAppSec – ZAP Directory Traversal

Whilst reading OWASP Testing Guide v4 I came across the section on testing for directory travseral and noted the “tools” at the bottom. Wfuzz and Dirbuster (the latter now incorporated into ZAP) I know about and will be dealing with in an upcoming “Discovering directories/files”. This left DotDotPwn and ZAP (Zed Attack Proxy) itself. Interestingly, DotDotPwn is incorporated into TrustedSec’s Penetrations Testers Toolkit (blogged about here) under “vulnerability-analysis“. So, quick and easy for me to fire up the tool and unleash it – however – I immediately hit a brick wall with URL’s not responding? It transpires this tool cannot easily handle HTTPS without a fair Read More

RUAG Breach – A lesson in cyber espionage tradecraft tools & techniques

Following a successful data breach of Swiss defense contractor RUAG – specialising in aerospace technology – the Swiss Governmental Computer Emergency Response Team (GovCERT) took the unusual step of publishing a comprehensive data breach report. The reasons given for publishing the report: …to give organizations the chance to check their networks for similar infections, and to show the modus operandi of the attacker group. You can download the summary technical report here (PDF) – 2 pages And the full espionage report here (PDF) – 34 Pages If the full report is a little TL;DR for your time or taste – or even Read More

UK Cyber Security Breaches Survey 2016 – Some Quick Stats

The UK government has just published the Cyber Security Breaches Survey 2016 (PDF here). Commissioned by the Department for Culture, Media and Sport, as part of the National Cyber Security Programme. It was carried out by Ipsos MORI, in partnership with the Institute for Criminal Justice Studies at the University of Portsmouth, and comprised: ▪ a representative telephone survey of 1,008 UK businesses from 30 November 2015 to 5 February 2016 ▪ a total of 30 in-depth interviews undertaken in January and February 2016 to follow up businesses that Here’s some pertinent stats lifted from the report: (69%) say cyber security is either Read More

Information Security Basics ARE Sexy

It all begins with a headline such as: “Hackers hack [insert new thing hacked]” Obviously, you change “insert new thing hacked” with whatever has just been demonstrated at the latest hacking convention, be that an ATM, fridge, sniper rifle, car, baby monitor, etc. Following this news, two camps will emerge. The first is the FUD (fear, uncertainty and doubt) group characterised by doomsaying. The second is the junk-hacking group, which is characterised by being unimpressed with what they call ‘junk hacking’ (junk I found around my house and scared you by hacking it). Both groups probably have their merits. One thing Read More