The Penetration Testing Marketplace in 2010

Tuesday, December 1st, 2009

Vulnerability assessment vendor Rapid7 has announced the first of a series of steps to integrate its penetration testing and vulnerability assessment scanning products. The first step is a module that allows users of the Metasploit Framework, which Rapid7 acquired in October to natively import NeXpose scanner results and then take ...

Numerous vulnerabilities in VMware products

Tuesday, November 24th, 2009

VMware has advised of a total of 93 vulnerabilities in several of its products, including ESX Server, Server, VirtualCenter and vCenter. Most of the vulnerabilities are in Java, Tomcat and the kernel and have been known for some time. Some of them can be exploited to compromise a system, however, ...

Metasploit 3.3 released

Wednesday, November 18th, 2009

Nearly one year after the release of Metasploit 3.2, the Metasploit Project developers have announced the availability of version 3.3 of the Metasploit Framework. The comprehensive programming framework for developing exploits for vulnerabilities is used by security researchers, penetration testers and black hat crackers alike. The latest release includes a ...

New Flash Attack Has No Real ‘Fix’

Friday, November 13th, 2009

Researchers have discovered a new attack that exploits the way browsers operate with Adobe Flash -- and there's no simple patch for it. The attack can occur on Websites that accept user-generated content -- anything from Webmail to social networking sites. An attacker basically takes advantage of the fact that a ...

Exploit published for SMB2 vulnerability in Windows

Tuesday, September 29th, 2009

A fully functional exploit for the security vulnerability in the SMB2 protocol implementation has been published. It can be used to discover and attack vulnerable Windows machines remotely. By integrating the exploit into the Metasploit exploit toolkit, attackers have access to a wide range of attack options, ranging from issuing ...