<?xml version="1.0" encoding="UTF-8"?><!-- generator="WordPress/2.9" -->
<rss version="0.92">
<channel>
	<title>Hackyourself.net Information Security Blog</title>
	<link>http://hackyourself.net/blog1</link>
	<description>Hack Yourself...before someone else does!</description>
	<lastBuildDate>Thu, 08 Oct 2009 03:32:11 +0000</lastBuildDate>
	<docs>http://backend.userland.com/rss092</docs>
	<language>en</language>
	
	<item>
		<title>Where are the DBAs?</title>
		<description><![CDATA[What I really want to know is this: Where are the Database Admins (DBAs) these days?
I cant tell you how many times in the past 18 months that I&#8217;ve found real enterprises running vulnerable databases with default passwords, weak passwords and no real permissions management. 
It&#8217;s bad enough that the stats right now are this [...]]]></description>
		<link>http://hackyourself.net/blog1/2009/10/07/where-are-the-dbas/</link>
			</item>
	<item>
		<title>Some Free Web App Security Testing Tools &amp; Resources</title>
		<description><![CDATA[We went over some of these tools at the latest North Carolina OWASP Meeting, so I thought I&#8217;d make this list available here. Enjoy!

Proxy Servers:
WebScarab: http://www.owasp.org/index.php/Category:OWASP_WebScarab_Project#Download
Burp: http://www.portswigger.net/suite/download.html
Paros: http://www.parosproxy.org/download.shtml
Firefox Plugins:
Tamper Data: https://addons.mozilla.org/en-US/firefox/addon/966
NoScript: http://noscript.net/getit
ShowIP: https://addons.mozilla.org/en-US/firefox/addon/590
SwitchProxy: https://addons.mozilla.org/en-US/firefox/addon/125
SQL Inject Me: https://addons.mozilla.org/en-US/firefox/addon/7597
XSS Me: https://addons.mozilla.org/en-US/firefox/addon/7598
ViewStatePeeker: https://addons.mozilla.org/en-US/firefox/addon/7167
Many of these are included in a single plugin distribution here: https://addons.mozilla.org/en-US/firefox/collection/webappsec
Some SQL Injection Tools we [...]]]></description>
		<link>http://hackyourself.net/blog1/2009/06/11/some-free-web-app-security-testing-tools-resources/</link>
			</item>
	<item>
		<title>CWE Top 25 Breakdown &#8211; Part 3 of 4</title>
		<description><![CDATA[Last week we discussed the first 9 (top 9) in the CWE Top 25 Most
Dangerous Programming Errors. This week, we&#8217;ll discuss the second 8
on the list, which have been grouped into a category called &#8220;Risky
Resource Management&#8221;. 

&#160;


&#160;
&#160;
Risky Resource
Management

The weaknesses in this category are
related to ways in which software does not properly manage the
creation, usage, transfer, [...]]]></description>
		<link>http://hackyourself.net/blog1/2009/06/07/cwe-top-25-breakdown-part-3-of-4/</link>
			</item>
	<item>
		<title>CWE Top 25 Breakdown &#8211; Part 2 of 4</title>
		<description><![CDATA[Last week we introduced the CWE Top 25 Most Dangerous Programming Errors in Part 1 of a 4 part series. This week we will discuss the first nine, which have been categorized in a group called “Insecure Interaction Between Components”. Being the first nine, they are also the top 9, or the top most prevalent [...]]]></description>
		<link>http://hackyourself.net/blog1/2009/06/07/cwe-top-25-breakdown-part-2-of-4/</link>
			</item>
	<item>
		<title>CWE Top 25 Breakdown &#8211; Part 1 of 4</title>
		<description><![CDATA[This week, we&#8217;ll take a look at the recently published CWE Top 25 Most Dangerous Programming Errors. Since the Top 25 are broken into three main categories, it makes sense to address the list in three separate segments. But first, let&#8217;s review what the CWE Top 25 is and its importance.
Introduction
The CWE Top 25 Most [...]]]></description>
		<link>http://hackyourself.net/blog1/2009/03/19/cwe-top-25-breakdown-part-1-of-4/</link>
			</item>
	<item>
		<title>Should I be worried about my web applications?</title>
		<description><![CDATA[An interesting article published earlier this week on Information Week&#8217;s website here called &#8220;Web Applications: Achilles&#8217; Heel Of Corporate Security&#8221; discusses the tremendous rise in web-application breaches and attacks this past year.


IBM&#8217;s 2008 X-Force Trend and Risk report which was released Monday states: 
&#8220;Certain types of corporate applications, namely custom-built software like Web applications, remain [...]]]></description>
		<link>http://hackyourself.net/blog1/2009/02/06/should-i-be-worried-about-my-web-applications/</link>
			</item>
	<item>
		<title>Does PCI Compliance Work?</title>
		<description><![CDATA[Given the presence of yet another very high-profile data breach from a supposedly PCI-compliant organization, many have begun to question the purpose and usefulness of PCI DSS and other similar regulations. There is a valid argument here, but let&#8217;s consider the purpose for these regulations. 
PCI and all others are meant to be a baseline [...]]]></description>
		<link>http://hackyourself.net/blog1/2009/01/28/does-pci-compliance-work/</link>
			</item>
	<item>
		<title>Top 10 Issues Observed During Pen Tests in 2008</title>
		<description><![CDATA[There has been a lot of press, effort and money focused on Web Application Security over the past year&#8211;and rightly so. The attack footprint for many publicly-facing web applications has been growing as new web and browser-based vulnerabilities are being discovered at a scary pace. The PCI DSS push has helped primarily with the escalation [...]]]></description>
		<link>http://hackyourself.net/blog1/2009/01/23/top-10-issues-observed-during-pen-tests-in-2008/</link>
			</item>
	<item>
		<title>A PHP Framework Worth Looking Into</title>
		<description><![CDATA[As a PHP coder myself, I know that it can be difficult for new programmers to build secure code. Aside from the Apache server config and the PHP config directives, writing secure code in PHP often is an afterthought &#8212; and it&#8217;s really easy to write insecure code with PHP. 
Where many of the difficulties [...]]]></description>
		<link>http://hackyourself.net/blog1/2009/01/15/a-php-framework-worth-looking-into/</link>
			</item>
	<item>
		<title>OSI is Dead</title>
		<description><![CDATA[Note: this post is a rambling with no solutions at all&#8211;I&#8217;m just bitching/rambling, whatever you want to call it&#8211;hell, it&#8217;s my blog, I&#8217;ll write what I please :)
There&#8217;s an interesting trend in the formerly &#8220;Gospel&#8221; OSI virtual model for the way computers talk&#8230;
It used to be that the application layer was sacred and didn&#8217;t violate [...]]]></description>
		<link>http://hackyourself.net/blog1/2008/11/13/osi-is-dead/</link>
			</item>
	<item>
		<title>Largest Attack Vector Still Poor Configuration&#8230;</title>
		<description><![CDATA[So after 12 years of analyzing security risks (and with a specialty on web app security) I&#8217;m surprised to find that a large percentage of webappsec risks we find still revolve around the configuration of the web server itself. 
What I&#8217;m finding
1. Verbose, default vendor-supplied error messages &#8211; this is really prevalent with IIS/ASP implementations&#8230;what [...]]]></description>
		<link>http://hackyourself.net/blog1/2008/11/07/largest-attack-vector-still-poor-configuration/</link>
			</item>
	<item>
		<title>Lunker Spear Phishing Toolkit</title>
		<description><![CDATA[Josh Perrymon, myself and a few others are working on a spear phishing toolkit to be released at OWASP NYC later this week. Lunker will be available through OWASP and is a collaboration between the Raleigh NC and Alabama OWASP Chapters. 
This Spear Phishing toolkit allows a pen tester (or an organization) to actively target [...]]]></description>
		<link>http://hackyourself.net/blog1/2008/09/22/lunker-spear-phishing-toolkit/</link>
			</item>
	<item>
		<title>&#8220;Perfect&#8221; security</title>
		<description><![CDATA[There&#8217;s been an interesting theme of late on many of the infosec mailing lists (including WASC) which carry a tune that mimics my own experience in this field &#8212; that of &#8220;perfect&#8221; security vs. acceptable risk mitigation or &#8220;operational&#8221; security. 
It drives an interesting point, since &#8220;perfect&#8221; security is simply not possible unless you want [...]]]></description>
		<link>http://hackyourself.net/blog1/2008/08/23/perfect-security/</link>
			</item>
	<item>
		<title>P0aned</title>
		<description><![CDATA[This post is a tribute to how fast Google works. I posted this and was immediately the first hit for the word P0aned in less than 5 minutes.

This post has little bearing on anything. Just a little fun with those l33t sp3@k3rz out there that like to carry the torch&#8230;plus a little jab at one [...]]]></description>
		<link>http://hackyourself.net/blog1/2008/08/02/p0aned-by-kemo/</link>
			</item>
	<item>
		<title>Microsoft Addresses Mass SQL Injection Attacks</title>
		<description><![CDATA[In response to the *not so* recent Mass SQL Injection Attacks from earlier this year, which targeted mainly pre-ASP.NET 2.0 code, Microsoft has released an advisory revealing 2 new Microsoft products (URLScan 3.0 and Microsoft Source Code Analyzer for SQL Injection) and a partnership with HP for their new free ASP-only SQL Injection scanner named [...]]]></description>
		<link>http://hackyourself.net/blog1/2008/06/27/microsoft-addresses-mass-sql-injection-attacks/</link>
			</item>
	<item>
		<title>HTTP Cache Poisoning and Host Header Injection</title>
		<description><![CDATA[A recent post came through the WASC mailing list today from Carlos Bueno regarding this topic. The basic gist is in the impact of utilizing the browser-supplied Host headers as a means for link consistency in programming your web code. 
For example, assume the page &#8216;urltest.php&#8217; contained the following
$host = $_SERVER['HTTP_HOST'];
$filename = $_SERVER["REQUEST_URI"];
echo 'http://'.$host.$filename;

Although a [...]]]></description>
		<link>http://hackyourself.net/blog1/2008/06/12/http-cache-poisoning-via-host-header-injection/</link>
			</item>
	<item>
		<title>Hackyourself Merchandise</title>
		<description><![CDATA[Shameless and sweet, I have designed a maternity line based on this:

To order one of these for your favorite pregger, check out my Cafe Press Site
Thanks for your support!
]]></description>
		<link>http://hackyourself.net/blog1/2008/06/05/hackyourself-merchandise/</link>
			</item>
	<item>
		<title>Hacking Citrix (this again?)</title>
		<description><![CDATA[It never ceases to amaze me to find legacy Citrix implementations out there, but it happens (often). 
A common mis-conception in years past was that Citrix was a secure remote access solution. Although more current versions of the architecture may indeed be more secure, it is certainly no replacement for a true secure remote access [...]]]></description>
		<link>http://hackyourself.net/blog1/2008/06/05/hacking-citrix-this-again/</link>
			</item>
	<item>
		<title>Top 5 SQL Injection Tools</title>
		<description><![CDATA[This is a list of the Top 5 FREE SQL Injection tools currently available. Although there is already a list of the Top 15 Free SQL Injection Scanners, not all of them deserve the honors of the best general-purpose tools. 
Not all of the Top 5 tools here work on all target databases, nor are [...]]]></description>
		<link>http://hackyourself.net/blog1/2008/06/04/top-5-sql-injection-tools/</link>
			</item>
	<item>
		<title>About the Author</title>
		<description><![CDATA[Donwalrus (a.k.a. Michael Menefee) is the President and Co-founder of WireHead Security, an Internet Security Consulting firm focused on education and training.
Michael&#8217;s career has spanned over 14 years in the Information Security arena. Spending most of his time tearing apart other people&#8217;s networks and helping them to better secure them, Michael is also a the [...]]]></description>
		<link>http://hackyourself.net/blog1/2008/06/04/about/</link>
			</item>
</channel>
</rss>

<!-- Dynamic Page Served (once) in 0.673 seconds -->
