CSS exploit allows detection of social site use

Thursday, May 29th, 2008

Web developer Aza Raskin knows we visit Digg, Del.icio.us, Reddit and Facebook without even having to ask. No, he isn't employing privacy violating hackery, but he is exploiting a "cute" information leak in CSS that traditionally displays visited links differently than those that have yet to be visited. By loading in ...

Less is more (secure)

Wednesday, May 28th, 2008

Complexity is the enemy of security. Simple systems are inherently more secure than complex solutions. We see this idea validated again and again in security. Unfortunately, our IT systems are getting more and more complex as we depend on technology to fuel business growth and innovation. But do we really need ...

fgdump 2.1.0 and pwdump 1.7.1 Released – Dump LanMan & NTLM Hashes

Wednesday, May 28th, 2008

The major change is both tools now support 64-bit targets! Good news for us. pwdump6 is a password hash dumper for Windows 2000 and later systems. It is capable of dumping LanMan and NTLM hashes as well as password hash histories. It is based on pwdump3e, and should be stable on ...

Five free pen-testing tools

Tuesday, May 27th, 2008

Security assessment and deep testing don't require a big budget. Some of most effective security tools are free, and are commonly used by professional consultants, private industry and government security practitioners. Here are a few to start with. For scanning in the first steps of a security assessment or pen test, ...

Five steps to successful and cost-effective penetration testing

Tuesday, May 27th, 2008

Whether you hire outside consultants or do the testing yourself, here are some tips for making sure your time and money are well spent. 1. Set goals. Make sure you know before you start your penetration testing what you want the results to encompass. Adding in too many systems can be ...