Security

From Ggl's wiki

Jump to: navigation, search

Contents

Hacker's Manifesto

The conscience of a hacker by The Mentor (excerpt from Phrack 0x07-03) :

Yes, I am a criminal. My crime is that of curiosity. My crime is that of judging people by what they say and think, not what they look like. My crime is that of outsmarting you, something that you will never forgive me for.

I am a hacker, and this is my manifesto. You may stop this individual, but you can't stop us all... after all, we're all alike.

In the news

2007-Q1

Crypto

Theory

Matasano has written very interesting articles about the RSA signature verifcation implementation:

Some resourses to learn more about crypto:

Crypto everyday use

Honeypots

Only some ressources on honeypots:

GNU/Linux

Linux Malware Analysis

Some analysis sessions of malwares on linux systems.

Source Code Reviewing

I'm looking for tools to do source code reviewing under linux. As I use vim for code editing, I've found vim-taglist, and independently from vim, Freescope, CFlow, Source-Navigator, Insight. Insight which I knew as a front-end to gdb is more a full-integrated debug suite.

There are some well known opensource tools: FlawFinder, RATS, ITS4 and commercial Fortify SCA. For memory debugging and auditing, Valgrind.

MS Windows

Local and Domain password cracking

Retrieve cached passwords with PWDumpX (or CacheDump). Crack it with Ophcrack, Rainbowcrack or John.

Source Code Reviewing

Live Source Browsing in C++ explains how to use Visual C++ to browse source code. I'm trying to find good code coverage and testing tools. Read The Art of Software Security Assessment ;).

Tools

Intrusion Detection

Network

  • netcat, cryptcat, socat
  • nmap, amap, hping
  • scapy !!

Wireless

{,Post }Exploitation

Encryption

Password crackers

Fuzzers

VoIP

Ideas and Musings

Security CoreWar

One system has some vulnerable processes (essentially memory management related vulns). Each player upload a warrior which aims to replicate and to :

  • Destroy the warrior of the other player
  • Destroy the services processes of the other user
  • Take as more memory as it can

The memory is the actual memory of a machine or a virtual machine.

Security Remote Capture the Flag

CTF is a competition where each team own some servers with active services on them and some files or vulns e.g. flags. Some services have vulnerabilities by design or in their configuration. No source code is provided for the services. The score depends on :

  • Uptime of the services
  • How many times the team takes flags

There are different strategies :

  • Defending the services (filtering, binary patching)
  • Finding as most as vulnerable services as the team can

The scoring system is very important in this game.

Links

Sites and e-zines

note: some e-zines are mirrored here

Conferences

Crews and hackers

Blogs

More => SecurityBlogs Feeds

“I think computer viruses should count as life. I think it says something about human nature that the only form of life we have created so far is purely destructive. We've created life in our own image.”, Stephen Hawking

Retrieved from "http://www.stacksegment.net/wiki/index.php/Security"
Personal tools