Defending Against Hacking’s Long Game: It Ain’t Over Till It’s Over
In the third quarter of Super Bowl LI, the New England Patriots trailed the Atlanta Falcons by a score of 28-3. History was against the Patriots’ chances of rallying for a comeback ...
Pythonect Has New Graphs, Documentation, Tutorial, and More!
About two weeks ago I have released a new version of Pythonect (0.6) with new features, documentation, tutorial, and an (small, but growing) example directory.I’d like to take this opportunity to discuss ...
Hackersh 0.1 Release Announcement
I am pleased to announce the Official 0.1 launch of Hackersh ("Hacker Shell") - a shell (command interpreter) written in Python with built-in security commands, and out of the box wrappers for ...
Password Policy: You Are Doing It Wrong (When 2^56 Becomes 2^42)
They say the road to hell is paved with good intentions. This is often the case with non-standard password policies. About a month ago I visited my "favorite airplane company" website, and ...
Scraping LinkedIn Public Profiles for Fun and Profit
Reconnaissance and Information Gathering is a part of almost every penetration testing engagement. Often, the tester will only perform network reconnaissance in an attempt to disclose and learn the company's network infrastructure ...
Fuzzing Like A Boss with Pythonect
In my previous post Automated Static Malware Analysis with Pythonect, I wrote about how to use Pythonect to automate static malware analysis. In this post I'll describe how to use Pythonect and ...
Automated Static Malware Analysis with Pythonect
About 5 months ago I have released the first version of Pythonect - a new, experimental, general-purpose high-level dataflow programming language based on Python, written in Python.It aims to combine the intuitive ...
Modulation and Data Loss Prevention (DLP) Solutions
Last year, my colleague Iftach (Ian) Amit and I gave a talk called 'Sounds Like Botnets' at DEFCON 19 and BSides Las Vegas conferences. Here is a link to the slides [PDF].In ...
Decoderless Shellcode Encoding
Today, it's almost impossible to send an unencoded exploit payload over the wire without triggering a Network Intrusion Prevention System (IPS) or Network Intrusion Detection System (NIDS) on the way.The obvious solution ...
Linux/x86 Execve Python Interpreter with a Python Program Passed in as String Shellcode
About a month ago, Phrack magazine #68 was released and a linux x86 shellcode (bindshell-tcp-fork.s) that I wrote a few years ago got mentioned in one of the articles.This made me feel ...
