ProxyStrike – Background SQL Injection and XSS analysis

Wednesday, April 9th, 2008

The folks over at Darknet do a great job of pointing out interesting tools for use in penetration testing and web app security testing among other things. I won’t be duplicating their feed here, but when I see something that I want to test for myself, I will be posting ...

Wfuzz v1.4 Released for Download – Bruteforcing & Fuzzing Web Applications

Wednesday, April 9th, 2008

A new version of Wfuzz is available, many improvements and fixes since first release which was in the middle of 2007. Fuzzing is definitely in, an article was posted recently about how everyone should keep on fuzzing! Will post it up soon.Wfuzz is a tool designed for bruteforcing Web Applications, ...

MySQL SQL Injection Cheat Sheet

Sunday, April 6th, 2008

Some useful syntax reminders for SQL Injection into MySQL databases...This post is part of a series of SQL Injection Cheat Sheets.  In this series, I've endevoured to tabulate the data to make it easier to read and to use the same table for for each database backend.  This helps to ...

You’ve been iframed

Wednesday, April 2nd, 2008

Injected iframes into legitimate sites are becoming more and more common these days.  One of the latest targets is a Chinese government site at www.zhangzhu.gov.cn:Please note that while the site adminstrators have been notified, the injected iframe is still present in the site at the time of this posting.The iframe ...

SQL query injection for dummies

Friday, March 28th, 2008

The purpose of this article is to help people without advanced computer knowledge to start white hacking and learn how to write more secure login web pages. When I started to learn about security, even though I searched really hard, I did not manage to find articles that would tell ...