Securing Cross Site XMLHttpRequest

Monday, June 23rd, 2008

As I mentioned in my post on Cross Document Messaging, client side cross domain request is an important area of interest for AJAX developers looking for ways to avoid expensive server side proxying calls. While Cross Document Messaging is useful for allowing third party components or gadgets embedded in a ...

Cain & Abel v4.9.15 released

Saturday, June 21st, 2008

Cain & Abel is a password recovery tool for Microsoft Operating Systems. It allows easy recovery of various kind of passwords by sniffing the network, cracking encrypted passwords using Dictionary, Brute-Force and Cryptanalysis attacks, recording VoIP conversations, decoding scrambled passwords, recovering wireless network keys, revealing password boxes, uncovering cached passwords ...

Successful 802.1X Every Time

Friday, June 20th, 2008

It’s not rocket science, but any time we mingle and intertwine four or five different pieces of technology, there’s always the potential for a mess… or at least a misconfiguration or two along the way. Don’t know what 802.1X is? Check out the recent 802.1X technology primer.If you’re planning to, ...

SIPVicious v0.2.3 – VoIP/SIP Auditing Toolkit

Wednesday, June 11th, 2008

SIPVicious suite is a set of tools that can be used to audit SIP based VoIP systems. It currently consists of four tools:svmap - this is a sip scanner. Lists SIP devices found on an IP range svwar - identifies active extensions on a PBX svcrack - an online password cracker for ...

What you need to know about HTTP Verb Tampering

Wednesday, June 4th, 2008

Recently Arshan Dabirsiaghi, Director of Research of Aspect Security, published a white paper entitled “Bypassing URL Authentication and Authorization with HTTP Verb Tampering”. Initially there was a lot of confusion about what exactly was being explained or claimed. Including, is it real? Is it novel? Is it dangerous? What is ...