Clik here to view.
Hot patching WinINET to access HTTPOnly cookies via InternetGetCookie
Preface: by removing these checks for HTTPOnly you are making cookie management less secure within the process. This is for testing/tools only and I DO NOT recommend doing this unless you’re absolutely...
View ArticleSQL Post-exploitation: Protections and Mitigations
Several questions have come up since giving my presentation in October at ToorCon; a lot of people want to know what they can do to protect themselves from the attacks I’ve outlined and what sort of...
View ArticleClik here to view.
Follow-up: Setting Up the SQL Development Environment
Since my talk at ToorCon in October, a few questions have come in asking how to compile the xsproc sources I released earlier. Just to make things easier on everyone (mostly me), I’ve decided to post a...
View ArticleClik here to view.
Everyone sucks at SSL (Part 1)
MSRC 271804 (Woops) In light of MSRC 2718704, released by Microsoft in mid-June, brings to light a glaring, obvious and known problem with current SSL certificate validation and its overarching...
View ArticleCanSecWest 2013 and more MS-SQL Shenanigans
Once again I’ll be taking the SQL-show on the road, this time up to Vancouver, BC for CanSecWest 2013. My talk will focus on the methods and mayhem that can be had in a MS-SQL post-exploitation...
View ArticleClik here to view.
New Watcher rule for custom-defined pattern matching
The passive Web-application vulnerability scanner Watcher has been updated with a new check that allows you to define a custom pattern in the form of a regular expression. Each incoming HTML,...
View ArticleWipe cookies with a custom Fiddler rule (and menu item)
Sometimes there’s a need to simply wipe all the cookies from an HTTP request. Maybe you want to re-issue a request without cookies, or maybe you want to browse a list of URLs to test that...
View ArticleQuick HTTP data extraction with Fiddler
FiddlerScript provides a good mechanism for quick n dirty tasks. Sometimes you just need to grep a pattern from a Web application and log it while you’re moving through the site. There are a number...
View ArticleToor’n to San Diego for some MS-SQL post-exploitation
A little over a year ago I presented at SOURCE Seattle about SQL post-exploitation; discussing things that are still possible in the MS-SQL environment, as well as those techniques that people seem to...
View ArticlePorting Watcher checks to ModSecurity rules!
Earlier this year, Ryan Barnett at TrustWave’s Spiderlabs started porting some of Watcher’s checks to ModSecurity. After we chatted about this, I decided to get involved. We always liked the idea of...
View ArticleMicrosoft “Roslyn” based REPL injection.
Microsoft recently released their new Compiler API codename “Roslyn”. If you haven’t checked it out yet you should. Here’s the link: http://msdn.microsoft.com/en-us/roslyn/. I wanted to get my hands a...
View ArticleXML Hell presentation at Blue Hat v11
At Microsoft BlueHat v11 I’ll be delivering an internal-only briefing along with Matt Swann. While I can’t go into the confidential details of the talk, there are some things I want to mention that...
View ArticleX5S V2.0…. its coming!
So, It’s been awhile since we’ve done any public updates to X5S. Over the last year, I’ve improved the algorithm and process significantly. Be on the look out, it should be released within the next...
View ArticleList of characters for testing Unicode transformations and best-fit mapping...
I’m attaching two CSV files for use in test cases and tools. The uni2asc.csv contains all of the Unicode characters that map to something ASCII < 0×80. The bestfit.csv contains all of the known...
View ArticleWe’re Hiring: Application Security Consultant and Researcher
Want to put your security research skills to the test in Seattle? We’re looking for junior and senior appsec consultants and vulnerability researchers to join Casaba – good work/life balance, salary...
View ArticleWatcher 1.4.0 released
A new update to the Watcher passive Web-vulnerability scanner has been released. Based on user feedback we’ve built out the Wiki documentation on Codeplex with more details about the issues identified...
View ArticleWatcher 1.3.0 released
A new update to the Watcher passive vulnerability detection and security testing tool has been released. Watcher is an open source addon to the Fiddler Web proxy that aids developers, auditors, and...
View ArticleMicrosoft CCI Framework for Deobfuscating .Net binaries. (Part 2)
So yesterday I talked a about using CCI to remove attributes from .Net binaries. Specifically the SupressIldasm attribute. I promised I’d put up some more code highlighting the framework’s benefits. So...
View ArticleUnibomber tool for specialized XSS testing
John Hernandez has been working hard at Casaba to build a specialized testing tool that automates some of the unique techniques we use to find cross-sites scripting bugs (XSS). At Black Hat I'm...
View ArticleWatcher v1.1.0 released
We've made some significant improvements to the Watcher web security and compliance auditing tool in version 1.1.0. Some new checks have been added, bug fixes, and performance improvements. I wanted to...
View Article
