Vulnerability Info http://www.securityfocus.com Security Focus http://www.osvdb.org OSVDB http://nvd.nist.gov Nist NVD http://cve.mitre.org Mitre http://ciac.llnl.gov CIAC http://www.cert.org CERT http://iase.disa.mil ISAE Exploit Info http://www.milw0rm.com Milw0rm http://www.packetstormsecurity.nl Packet Storm Active Research Groups http://www.shmoo.com The Shmoo Group http://www.thc.org THC http://www.phenoelit.de Phenoelit Commercial Groups http://www.ngssoftware.com NGS http://www.immunitysec.com Immunitysec http://www.secunia.com Secunia http://www.securiteam.com Securiteam http://xforce.iss.net Xforce http://www.idefense.com Idefense http://www.eeye.com Eeye http://www.2600.com 2600 Security Organizations http://www.owasp.org OWASP http://www.isc2.org ISC2 http://www.isecom.org ISECOM http://www.sans.org SANS http://www.infragard.com Infragard Methodologies http://www.osissg.org OISSG http://www.isecom.org/ ISECOM http://www.osstmm.org OSSTMM Free "Auditing" Tools http://www.nessus.org Nessus http://www.insecure.org Nmap http://www.cqure.net Cqure Tools http://www.sqlsecurity.com/DesktopDefault.aspx?tabid=26 MS SQL Utilities http://www.cirt.net Nikto http://www.sysinternals.com Sysinternals Tools http://www.bindview.com/services/razor/utilities/ Bindview Tools http://thc.org/releases.php THC Tools http://www.metasploit.org Metasploit http://www.parosproxy.org/ Paros Proxy http://www.portswigger.net/proxy/ Burp Proxy http://www.securityforest.com Exploit Tree http://www.tank.net Spork http://ettercap.sourceforge.net/ Ettercap http://www.cirt.net/code/nikto.shtml nikto http://www.sensepost.com/research/wikto/ wikto http://www.nstalker.com/eng/products/nstealth/ nStealth http://reedarvin.thearvins.com/tools/PWDumpX14.zip pwdumpx (Obtain MS Hashes) http://www.foofus.net/fizzgig/fgdump/ fgdump (Obtain MS Hashes) http://www.off-by-one.net/misc/cachedump.html Cachedump (Obtain MS Hashes) http://studenti.unina.it/~ncuomo/syskey/ samdump2 http://www.ethereal.com/ Ethereal http://www.immunitysec.com/resources-freesoftware.shtml Free Immunitysec Tools http://www.foundstone.com/resources/freetools.htm Free Foundstone Tools http://www.eeye.com/html/Research/Tools/index.html Free Eeye Tools http://sectools.org/ Sectools.org Free Virtualization Tools http://www.vmware.com/products/server/ VMWare Server http://bochs.sourceforge.net/ Bochs http://pearpc.sourceforge.net/ PearPC http://www.microsoft.com/windows/virtualpc/default.mspx MS Virtual PC Free Reverse Engineering/Debugging Tools http://directory.fsf.org/GNU/binutils.html binutils http://www.gnu.org/software/gdb/ GDB http://directory.fsf.org/GNU/GUSS.html Guss http://www.gnu.org/software/ddd/ DDD http://www.ollydbg.de/ Ollydbg http://labs.idefense.com/labs-software.php iDefense Labs Tools http://oss.coresecurity.com/projects/uhooker.htm CORE Tools Defaced Websites http://www.zone-h.org/component/option,com_attacks/Itemid,43/ Zone H Default Password Lists http://www.cirt.net/cgi-bin/passwd.pl Cirt's Passwords http://www.phenoelit.de/dpl/dpl.html Phenoelit's Passwords http://www.petefinnigan.com/default/default_password_list.htm Pete Finnigan's Default Oracle Passwords http://www.governmentsecurity.org/articles/DefaultLoginsandPasswordsforNetworkedDevices.php GovernmentSecurity.org http://defaultpassword.com/ defaultpassword.com http://www.cyxla.com/passwords/passwords.html Cyxla's Password Database http://www.e-tech.ca/017-Default_Passwords_ad.asp e-tech Default Passwords http://www.uktsupport.co.uk/reference/biosp.htm Bios Passwords Technical Conferences http://www.defcon.org DefCon http://www.blackhat.com Blackhat http://www.cansecwest.com CanSecWest http://toorcon.com Toorcon http://www.shmoocon.org/ ShmooCon http://www.hopenumbersix.net/ H.O.P.E. http://www.ccc.de/ Chaos Computer Club http://conference.hackinthebox.org/ Hack in the Box CD Distros http://www.remote-exploit.org/index.php/Auditor_main Auditor http://www.knoppix.org Knoppix http://www.whoppix.net/index.php/Tools Whoppix / Whax http://www.remote-exploit.org/index.php/Main_Page BackTrack Wireless Tools http://www.netstumbler.com Netstumbler http://prismstumbler.sourceforge.net Prismstubler http://www.kismetwireless.net Kismet http://kismac.de/ Kismac (For Macs) http://airsnort.shmoo.com Airsnort http://wepcrack.sourceforge.net WEPCrack http://www.aircrack-ng.org/doku.php Aircrack-ng http://csrc.nist.gov/publications/nistpubs/800-48/NIST_SP-48.pdf Wireless SP http://www.blackalchemy.to/project/fakeap/ FakeAP http://www.802.11mercenary.net/lorcon/ Lorcon http://theta44.org/karma/index.html Karma Checklists / Hardening Guides http://csrc.nist.gov NIST CSRC http://nvd.nist.gov/cvss.cfm?version=2 NIST NVD Common Vulnerability Scoring System (Risk Rating Standardization) http://checklists.nist.gov NIST Checklists http://www.cisecurity.org Center for Internet Security http://www.nsa.gov/snac/index.cfm?MenuID=scg10.3.1 NSA Security Configuration Guides http://otn.oracle.com/deploy/security/oracle9i/pdf/9i_checklist.pdf Oracle's 9i Checklist http://www.petefinnigan.com/orasec.htm PF's Checklists http://www.microsoft.com/technet/archive/security/chklist/default.mspx Microsoft Checklists http://www.openna.com/pdfs/Securing-Optimizing-Linux-The-Ultimate-Solution-v2.0.pdf Securing and Optimizing Linux OS and Service Hardening Tools http://www.sun.com/software/security/jass/ Solaris - JASS http://www.sun.com/service/serviceplans/software/patchmanagement/patchmanager.html Solaris - Patch Manager http://www.bastille-unix.org/ Bastille Unix http://www.microsoft.com/technet/security/tools/default.mspx#EZE Microsoft Security Tools Defunct Research Groups ? http://www.attrition.org Attrition http://www.w00w00.org w00w00 http://adm.freelsd.net/ADM/ ADM http://en.wikipedia.org/wiki/TESO TESO http://en.wikipedia.org/wiki/Gobbles Gobbles Professional Security Programs https://www.pcisecuritystandards.org/ Payment Card Industry http://www.isc2.org ISC2 http://www.eccouncil.org/ EC Council Password Crackers/Auditors http://www.insecure.org/stf/lc5-setup.exe LC5 http://www.insecure.org/stf/lc5-crack.zip LC5 Keygen http://www.oxid.it/cain.html Cain and Abel http://www.openwall.com/john/ John the Ripper http://www.banquise.net/misc/patch-john.html John Bigpatch (For more hash types) http://en.wikipedia.org/wiki/RainbowCrack RainbowCrack http://rainbowtables.shmoo.com/ Rainbow Tables Open Source Intelligence http://johnny.ihackstuff.com/ Google Hacking http://news.netcraft.com/ NetCraft http://www.archive.org/ Way Back Machine http://www.domaintools.com DomainTools http://whois.webhosting.info Web Hosting dot info Compliance Resources http://www.hhs.gov/ocr/hipaa/ HIPAA http://www.aicpa.org/info/sarbanes_oxley_summary.htm SOX http://banking.senate.gov/conf/ FMA (GLBA) http://csrc.nist.gov/sec-cert/ FISMA http://www.iso.org/iso/en/prods-services/popstds/informationsecurity.html ISO 17799 http://csrc.nist.gov/fasp/ NIST FASP Resources http://usa.visa.com/business/accepting_visa/ops_risk_management/cisp.html Visa PCI http://www.sans.org/resources/policies/ SANS Security Policies Email Lists http://www.securityfocus.com/archive Security Focus E-mail Lists http://lists.grok.org.uk/mailman/listinfo/full-disclosure Full Disclosure (Unmoderated) http://www.immunitysec.com/mailman/listinfo/dailydave Daily Dave http://www.seclists.org Security List Archives Defense / IDS http://www.snort.org Snort http://www.bleedingsnort.com "Bleeding Edge" Snort http://acidlab.sourceforge.net/ ACID Snort Interface Load Testing / Denial of Service Info http://staff.washington.edu/dittrich/misc/ddos/ DDOS Info IDS Testing/Tuning Tools ftp://ftp.st.ryuAkoku.ac.jp/pub/security/tool/snot/ Snot http://securityfocus.com/data/tools/stick.tgz Stick Firewall Ruleset Testing Tools http://www.packetfactory.net/projects/firewalk/ Firewalk http://dev.inversepath.com/trac/ftester FTester Welcome to the ThreatPerspective Security Information Center. This is a portal site created by ThreatPerspective to enable our clients and other interested parties to learn more about Information Security. http://seclists.org/#bugtraq The premier general security mailing list. Vulnerabilities are often announced here first, so check frequently! http://seclists.org/bugtraq/2010/Jul/264 <p>Posted by Florian Weimer on Jul 29</p>------------------------------------------------------------------------<br> Problem type : remote...<br> http://seclists.org/bugtraq/2010/Jul/263 <p>Posted by Hafez Kamal on Jul 29</p>This is a reminder that the Call for Papers for Asia's largest network<br> Venue: Crowne Plaza Mutiara Kuala Lumpur...<br> http://seclists.org/bugtraq/2010/Jul/262 <p>Posted by Jose Nicolas Castellano on Jul 29</p>*************************************************<br> ** What is No cON Name...<br> http://seclists.org/bugtraq/2010/Jul/261 <p>Posted by security on Jul 29</p> _______________________________________________________________________<br> Enterprise Server 5.0...<br> http://seclists.org/bugtraq/2010/Jul/260 <p>Posted by Salvatore Fresta aka Drosophila on Jul 29</p>PBBooking 1.0.4_3 Joomla Component Multiple Blind SQL Injection<br> IV....<br> http://seclists.org/bugtraq/2010/Jul/259 <p>Posted by security-alert on Jul 29</p>SUPPORT COMMUNICATION - SECURITY BULLETIN<br> Source: Hewlett-Packard Company, HP Software Security Response Team...<br> http://seclists.org/bugtraq/2010/Jul/258 <p>Posted by MustLive on Jul 28</p>Hello Bugtraq!<br> 31.10.2009 - informed developers about...<br> http://seclists.org/bugtraq/2010/Jul/257 <p>Posted by MustLive on Jul 28</p>Hello Bugtraq!<br> 01.03.2009 -...<br> http://seclists.org/bugtraq/2010/Jul/256 <p>Posted by Salvatore Fresta aka Drosophila on Jul 28</p>PhotoMap Gallery 1.6.0 Joomla Component Multiple Blind SQL Injection<br> IV....<br> http://seclists.org/bugtraq/2010/Jul/255 <p>Posted by security-alert on Jul 28</p>SUPPORT COMMUNICATION - SECURITY BULLETIN<br> Source: Hewlett-Packard Company, HP...<br> http://seclists.org/bugtraq/2010/Jul/254 <p>Posted by advisories on Jul 28</p> Jira - Multiple Low Risk Vulnerabilities<br> Jira is prone to Cross...<br> http://seclists.org/bugtraq/2010/Jul/253 <p>Posted by Secunia Research on Jul 28</p>====================================================================== <br> Vendor's Description of...<br> http://seclists.org/bugtraq/2010/Jul/252 <p>Posted by Secunia Research on Jul 28</p>====================================================================== <br> Vendor's Description of...<br> http://seclists.org/bugtraq/2010/Jul/251 <p>Posted by Secunia Research on Jul 28</p>====================================================================== <br> Vendor's Description of...<br> http://seclists.org/bugtraq/2010/Jul/250 <p>Posted by Secunia Research on Jul 28</p>====================================================================== <br> Vendor's Description...<br> http://seclists.org/#dailydave This technical discussion list covers vulnerability research, exploit development, and security events/gossip. It was started by <a href="http://www.immunitysec.com/">ImmunitySec</a> founder Dave Aitel and many security luminaries participate. Many posts simply advertise Immunity products, but you can't really fault Dave for being self-promotional on a list named DailyDave. http://seclists.org/dailydave/2010/q3/16 <p>Posted by Alexander Sotirov on Jul 25</p>NGINX got a pwnie nomination by proxy, Dr. Raid's song 'Pwned' mentions the<br> Those pics of you and your sis, they base64 encoded that shit and...<br> http://seclists.org/dailydave/2010/q3/15 <p>Posted by Rodrigo Rubira Branco (BSDaemon) on Jul 25</p> CALL FOR PAPERS - Hackers 2 Hackers Conference 7th edition<br> from 27 to 28 November 2010, and aims to get together industry,...<br> http://seclists.org/dailydave/2010/q3/14 <p>Posted by Jon Oberheide on Jul 22</p>This brings up an interesting question I had related to cross-vendor<br> disclosure (via an innocent-sounding...<br> http://seclists.org/dailydave/2010/q3/13 <p>Posted by Michal Zalewski on Jul 22</p>...so FYI:<br> /mz<br> http://seclists.org/dailydave/2010/q3/12 <p>Posted by dave on Jul 22</p>So it's been a while since I've posted about wireless penetration testing. And<br> to implement....<br> http://seclists.org/dailydave/2010/q3/11 <p>Posted by Florian Weimer on Jul 19</p>Only if the key is virtually unused. If it is not, revocation is<br> which cannot leak the key material,...<br> http://seclists.org/dailydave/2010/q3/10 <p>Posted by Ben Nagy on Jul 19</p>Hi all,<br> and decided that one of the things...<br> http://seclists.org/dailydave/2010/q3/9 <p>Posted by Kiwicon on Jul 15</p> ----[ TRULY THE FUTURE IS NOW, FOR IT IS THE YEAR<br> |::.. . ||::.. . | |::.||::.. . ||::.|:. ||::.. . /...<br> http://seclists.org/dailydave/2010/q3/8 <p>Posted by Shane on Jul 15</p>The good thing about their signing key is that it's static (does not<br> I've almost never seen a verified FF addon...<br> http://seclists.org/dailydave/2010/q3/7 <p>Posted by dave on Jul 15</p>Here are some trojans signed by a key from realtek, supposably. How cool is that! You<br> And, as pointed out:...<br> http://seclists.org/dailydave/2010/q3/6 <p>Posted by The Dark Tangent on Jul 15</p>Call for Papers - Black Hat Abu Dhabi 2010<br> East's first edition of the Las...<br> http://seclists.org/dailydave/2010/q3/5 <p>Posted by Alexander Sotirov on Jul 14</p>The Pwnie Awards ceremony will return for the fourth consecutive year to the<br> * Best...<br> http://seclists.org/dailydave/2010/q3/4 <p>Posted by dave on Jul 14</p>Lcamtuf says<br> right...<br> http://seclists.org/dailydave/2010/q3/3 <p>Posted by dave on Jul 12</p>In just a few days Immunity has a training called &quot;Finding 0days&quot; here in Miami<br> 0days tends to shift a bit depending on who the instructor is. Which generally brings...<br> http://seclists.org/dailydave/2010/q3/2 <p>Posted by Andre Gironda on Jul 07</p>Rich,<br> Dave says that...<br> http://seclists.org/#firewall-wizards Tips and tricks for firewall administrators http://seclists.org/firewall-wizards/2010/Jul/0 <p>Posted by Melissa Stockman on Jul 29</p>Hi,<br> Melissa Stockman<br> http://seclists.org/firewall-wizards/2010/Jun/13 <p>Posted by vern on Jun 21</p>You might want to check out Bro in this regard, which IMHO excels at this<br> Vern<br> http://seclists.org/firewall-wizards/2010/Jun/12 <p>Posted by Bernie on Jun 21</p>Personally I'd use wireshark Daniel. The ability to create file sets<br> Wireshark by Laura Chappell is a great resource.<br> http://seclists.org/firewall-wizards/2010/Jun/11 <p>Posted by Marcus J. Ranum on Jun 21</p>Yack, Daniel wrote:<br> That said, an IDS can be turned into one heck of a nice...<br> http://seclists.org/firewall-wizards/2010/Jun/10 <p>Posted by Farrukh Haroon on Jun 21</p>Instead of capturing each packet, you would be better off going via the<br> On Fri, Jun 18, 2010 at 4:58 PM,...<br> http://seclists.org/firewall-wizards/2010/Jun/9 <p>Posted by Yack, Daniel on Jun 21</p>There are probably one thousand ways to do this, but I wanted to toss<br> template that says...<br> http://seclists.org/firewall-wizards/2010/Jun/8 <p>Posted by paddy joesoap on Jun 17</p>Hi Kevin and all,<br> handle security on...<br> http://seclists.org/firewall-wizards/2010/Jun/7 <p>Posted by K K on Jun 17</p>In my experience, yes -- XMPP servers are generally deployed in the<br> clients connect to an edge device using the legacy...<br> http://seclists.org/firewall-wizards/2010/Jun/6 <p>Posted by paddy joesoap on Jun 16</p>Hi all,<br> firewall helps...<br> http://seclists.org/firewall-wizards/2010/Jun/5 <p>Posted by Paul Melson on Jun 08</p>IPSec, but when <br> airport, etc.) If the ports...<br> http://seclists.org/firewall-wizards/2010/Jun/4 <p>Posted by Kurt Buff on Jun 08</p>Layer 4 traceroute (<a rel="nofollow" href="http://pwhois.org/lft/">http://pwhois.org/lft/</a>) comes to mind, or nmap,<br> Kurt<br> http://seclists.org/firewall-wizards/2010/Jun/3 <p>Posted by Craig Van Tassle on Jun 08</p>Your best bet is to check with your ISP.<br> a box that you can wipe after you do this test.<br> http://seclists.org/firewall-wizards/2010/Jun/2 <p>Posted by Andrea Mennini - Mobile on Jun 08</p>Try grc.com shields up. It should give you a basic idea.<br> Subject: [fw-wiz] Hidden ISP firewall/filtering<br> http://seclists.org/firewall-wizards/2010/Jun/1 <p>Posted by Jerrod Fuller on Jun 04</p> <br> way to find out if our ISP actually has a...<br> http://seclists.org/firewall-wizards/2010/Jun/0 <p>Posted by Dragos Ruiu on Jun 04</p>-- EUSecWest 2010 MiniCFP (PacSec CFP Follows)<br> at the Melkweg in Amsterdam.) Please forward submissions to...<br> http://seclists.org/#focus-ids Technical discussion about Intrusion Detection Systems. You can also read the archives of a <A HREF="http://seclists.org/ids/">previous IDS list</A> http://seclists.org/focus-ids/2010/Jun/2 <p>Posted by Mohror, Kathryn on Jun 18</p> Workshop on Managing Systems via Log Analysis and Machine <br> ********...<br> http://seclists.org/focus-ids/2010/Jun/1 <p>Posted by pcapr on Jun 08</p>Just a quick note to let you know that the lite version of xtractr can<br> If you are...<br> http://seclists.org/focus-ids/2010/Jun/0 <p>Posted by wittybugz on Jun 01</p>Hi All,<br> on your web...<br> http://seclists.org/#fulldisclosure An unmoderated high-traffic forum for disclosure of security information. Fresh vulnerabilities sometimes hit this list many hours before they pass through the Bugtraq moderation queue. The relaxed atmosphere of this quirky list provides some comic relief and certain industry gossip. Unfortunately 80% of the posts are worthless drivel, so finding the gems takes patience. http://seclists.org/fulldisclosure/2010/Jul/400 <p>Posted by Elazar Broad on Jul 29</p>ed or nano? :)<br> http://seclists.org/fulldisclosure/2010/Jul/399 <p>Posted by Valdis . Kletnieks on Jul 29</p>On Thu, 29 Jul 2010 17:18:28 PDT, Zach C said:<br> vi or emacs. Take your pick, I'm not starting an editor war. ;)<br> http://seclists.org/fulldisclosure/2010/Jul/398 <p>Posted by Zach C on Jul 29</p>So if Drupal and WordPress, etc. are so terrible, what would you all recommend?<br> -Zach<br> http://seclists.org/fulldisclosure/2010/Jul/397 <p>Posted by coderman on Jul 29</p>when the bar is wordpress, .. well, you get the picture.<br> (those modules though, most could use regular scrubbing)<br> http://seclists.org/fulldisclosure/2010/Jul/396 <p>Posted by Christian Sciberras on Jul 29</p>Drupal or other decent [0]<br> Please! Don't put &quot;Drupal&quot; and &quot;decent&quot; in the same sentence!<br> http://seclists.org/fulldisclosure/2010/Jul/395 <p>Posted by coderman on Jul 29</p>Hewlett Packard has a soul mate! anyone who cares uses Drupal or other<br> python gevent based publishing pipe...<br> http://seclists.org/fulldisclosure/2010/Jul/394 <p>Posted by MustLive on Jul 29</p>Hello Full-Disclosure!<br> switched to smaller and less time-consuming, but still very...<br> http://seclists.org/fulldisclosure/2010/Jul/393 <p>Posted by Florian Weimer on Jul 29</p>------------------------------------------------------------------------<br> Problem type : remote...<br> http://seclists.org/fulldisclosure/2010/Jul/392 <p>Posted by coderman on Jul 29</p>stuxnet is strategic, and misleading. ... red team off roading?<br> 0. &quot;Blowing the Whistle on the Snitch Racket&quot;...<br> http://seclists.org/fulldisclosure/2010/Jul/391 <p>Posted by Hafez Kamal on Jul 29</p>This is a reminder that the Call for Papers for Asia's largest network<br> Venue: Crowne Plaza Mutiara Kuala Lumpur...<br> http://seclists.org/fulldisclosure/2010/Jul/390 <p>Posted by M.B.Jr. on Jul 28</p>I'm sorry, Rohit.<br> Marcio Barbado, Jr.<br> http://seclists.org/fulldisclosure/2010/Jul/389 <p>Posted by security on Jul 28</p> _______________________________________________________________________<br> Enterprise Server 5.0...<br> http://seclists.org/fulldisclosure/2010/Jul/388 <p>Posted by M.B.Jr. on Jul 28</p>Hi Rohit,<br> So, if your company's employees write...<br> http://seclists.org/fulldisclosure/2010/Jul/387 <p>Posted by MustLive on Jul 28</p>Hello Full-Disclosure!<br> 31.10.2009 - informed developers...<br> http://seclists.org/fulldisclosure/2010/Jul/386 <p>Posted by MustLive on Jul 28</p>Hello Full-Disclosure!<br> Timeline:...<br> http://seclists.org/#honeypots Discussions about tracking attackers by setting up decoy honeypots or entire <A HREF="http://www.honeynet.org">honeynet</A> networks. http://seclists.org/honeypots/2010/q3/1 <p>Posted by Hafez Kamal on Jul 29</p>This is a reminder that the Call for Papers for Asia's largest network<br> Venue: Crowne Plaza Mutiara Kuala Lumpur...<br> http://seclists.org/honeypots/2010/q3/0 <p>Posted by Hafez Kamal on Jul 04</p>Our first ever HITBSecConf in Europe is over! A big big thank you to all<br> All conference materials from the event can be downloaded from...<br> http://seclists.org/honeypots/2010/q2/8 <p>Posted by Mohror, Kathryn on Jun 16</p> Workshop on Managing Systems via Log Analysis and Machine <br> ********...<br> http://seclists.org/honeypots/2010/q2/7 <p>Posted by Hafez Kamal on May 19</p>The Call for Papers for HITB Security Conference 2010 Malaysia is now open!<br> Keynote 1: Chris Wysopal...<br> http://seclists.org/honeypots/2010/q2/6 <p>Posted by Younger Tyler on May 19</p>Any tips on how to selectively get infected with Zeus?<br> Interesting thoughts as I am just...<br> http://seclists.org/honeypots/2010/q2/5 <p>Posted by Gary Derania on May 19</p>------Original Message------<br> analysis. I...<br> http://seclists.org/honeypots/2010/q2/4 <p>Posted by Michele Zoerb on May 19</p>Interesting thoughts as I am just starting the same type of project. I want to get infected by Zeus and perform some <br> From: listbounce () securityfocus...<br> http://seclists.org/honeypots/2010/q2/3 <p>Posted by Mayank.2.Bhatnagar on May 19</p>Hi everyone,<br> What...<br> http://seclists.org/honeypots/2010/q2/2 <p>Posted by Hafez Kamal on Apr 23</p>The second quarterly HITB eZine (issue 002) has been released! Grab your<br> over 20K downloads just weeks after its...<br> http://seclists.org/honeypots/2010/q2/1 <p>Posted by Hafez Kamal on Apr 08</p>This is the FINAL CALL to submit your talk / presentation proposals for<br> To submit your presentation proposals and for further details...<br> http://seclists.org/honeypots/2010/q2/0 <p>Posted by Alexandre Dulaunoy on Apr 04</p>Call for Papers Hack.lu 2010<br> Grand-Duchy of Luxembourg in October 2010 (27-29.10.2010). The...<br> http://seclists.org/#incidents Lightly moderated list for dicussing actual security incidents (unexplained probes, breakins, etc). Topics include information about new rootkits, backdoors, trojans, virii, and worms. http://seclists.org/#microsoft Beware that MS often uses these security bulletins as marketing propaganda to downplay serious vulnerabilities in their products&mdash;note how most have a prominent and often-misleading "mitigating factors" section. http://seclists.org/microsoft/2010/q3/7 <p>Posted by Microsoft on Jul 21</p>********************************************************************<br> -...<br> http://seclists.org/microsoft/2010/q3/6 <p>Posted by Microsoft on Jul 20</p>********************************************************************<br> -...<br> http://seclists.org/microsoft/2010/q3/5 <p>Posted by Microsoft on Jul 19</p>********************************************************************<br> -...<br> http://seclists.org/microsoft/2010/q3/4 <p>Posted by Microsoft on Jul 16</p>********************************************************************<br> -...<br> http://seclists.org/microsoft/2010/q3/3 <p>Posted by Microsoft on Jul 14</p>********************************************************************<br> Bulletin Information:...<br> http://seclists.org/microsoft/2010/q3/2 <p>Posted by Microsoft on Jul 13</p>********************************************************************<br> *...<br> http://seclists.org/microsoft/2010/q3/1 <p>Posted by Microsoft on Jul 13</p>********************************************************************<br> -...<br> http://seclists.org/microsoft/2010/q3/0 <p>Posted by Microsoft on Jul 13</p>********************************************************************<br> With the...<br> http://seclists.org/microsoft/2010/q2/5 <p>Posted by Microsoft on Jun 08</p>********************************************************************<br> With the...<br> http://seclists.org/microsoft/2010/q2/4 <p>Posted by Microsoft on May 11</p>********************************************************************<br> With the...<br> http://seclists.org/microsoft/2010/q2/3 <p>Posted by Microsoft on May 03</p>********************************************************************<br> -...<br> http://seclists.org/microsoft/2010/q2/2 <p>Posted by Microsoft on Apr 27</p>********************************************************************<br> -...<br> http://seclists.org/microsoft/2010/q2/1 <p>Posted by Microsoft on Apr 21</p>********************************************************************<br> -...<br> http://seclists.org/microsoft/2010/q2/0 <p>Posted by Microsoft on Apr 13</p>********************************************************************<br> With...<br> http://seclists.org/#nmap-dev Unmoderated technical development forum for debating ideas, patches, and suggestions regarding proposed changes to <A HREF="http://nmap.org">Nmap</A> and related projects. http://seclists.org/nmap-dev/2010/q3/217 <p>Posted by Jon Svede on Jul 29</p>I had the same issue a while back. After I left that job I decided <br> If you a solution already though, there isn't any need to...<br> http://seclists.org/nmap-dev/2010/q3/216 <p>Posted by Tuan Nguyen on Jul 29</p>I want to be able to parse the Nmap XML output in Java and convert it to<br> Do you have another way to parse Nmap and convert it to Java object?<br> http://seclists.org/nmap-dev/2010/q3/215 <p>Posted by Jacky Jack on Jul 29</p>Hi<br> Thanks.<br> http://seclists.org/nmap-dev/2010/q3/214 <p>Posted by Jacky Jack on Jul 29</p>Hi<br> writing/converting Nessus plugins to NSEs....<br> http://seclists.org/nmap-dev/2010/q3/213 <p>Posted by Jon Svede on Jul 29</p>What do you want to do with the results? I.e., are you looking just<br> Jon<br> http://seclists.org/nmap-dev/2010/q3/212 <p>Posted by Sebastian Reitenbach on Jul 29</p>Hi,<br> I tried to remove above two patches and removed the patch above from...<br> http://seclists.org/nmap-dev/2010/q3/211 <p>Posted by Sebastian Reitenbach on Jul 28</p>Hi,<br> Sebastian<br> http://seclists.org/nmap-dev/2010/q3/210 <p>Posted by Gutek on Jul 28</p>just a small typo in the &quot;Canon iR3570 printer ftpd&quot; fingerprint (reads<br> A.G.<br> http://seclists.org/nmap-dev/2010/q3/209 <p>Posted by kirubakaran S on Jul 28</p> Yes, The formatting of text in Description box is not done. It is just<br> <a rel="nofollow" href="http://kirubakaran-blessedblogger.blogspot.com/">http://kirubakaran-blessedblogger.blogspot.com/</a><br> http://seclists.org/nmap-dev/2010/q3/208 <p>Posted by David Fifield on Jul 28</p>Thanks for your interest! Please help us understand what you have in<br> As for code organization, --sh-exec and --exec are handled in the files...<br> http://seclists.org/nmap-dev/2010/q3/207 <p>Posted by David Fifield on Jul 28</p>Good catch on this. We had a test for --mtu in Nping, but I guess we<br> David Fifield<br> http://seclists.org/nmap-dev/2010/q3/206 <p>Posted by David Fifield on Jul 28</p>Thanks. I see that this patch is mostly about not mixing code and<br> gcc -c -I../../nbase...<br> http://seclists.org/nmap-dev/2010/q3/205 <p>Posted by David Fifield on Jul 28</p>I think this is fine to commit now.<br> David Fifield<br> http://seclists.org/nmap-dev/2010/q3/204 <p>Posted by David Fifield on Jul 28</p>Thank you for testing, Kris. I agree, we should collapse single newlines<br> David Fifield<br> http://seclists.org/nmap-dev/2010/q3/203 <p>Posted by Kris Katterjohn on Jul 28</p>I have one comment on the Description box: the text tends to look rather goofy<br> paragraph separation. This is just a...<br> http://seclists.org/#nmap-hackers Moderated list for the most important new releases and announcements regarding the <A HREF="http://nmap.org">Nmap Security Scanner</A> and related projects. We recommend that all Nmap users <a href="http://cgi.insecure.org/mailman/listinfo/nmap-hackers">subscribe</a>. http://seclists.org/nmap-hackers/2010/7 <p>Posted by Fyodor on Jul 16</p>Hi folks. It has been 3.5 months since the last Nmap release<br> Hat in a couple weeks (see...<br> http://seclists.org/nmap-hackers/2010/6 <p>Posted by Fyodor on Apr 30</p>Hi Folks. I have some Nmap news to share with you:<br> Drazen Popovic and Djalal Harouni will be working on...<br> http://seclists.org/nmap-hackers/2010/5 <p>Posted by Fyodor on Apr 14</p>Hi folks, I have a quick question for you:<br> post...<br> http://seclists.org/nmap-hackers/2010/4 <p>Posted by Fyodor on Apr 07</p>Hello everyone. I hope you're enjoying the 5.30BETA1 release. So far<br> summer! SoC previously brought us...<br> http://seclists.org/nmap-hackers/2010/3 <p>Posted by Fyodor on Mar 29</p>Hi folks! It has been two months since the 5.21 release and we've<br> ipidseq. Learn about them all at...<br> http://seclists.org/nmap-hackers/2010/2 <p>Posted by Fyodor on Jan 27</p>Hello everyone. I'm pleased to release Nmap 5.21, which contains zero<br> development projects. If you want to know...<br> http://seclists.org/nmap-hackers/2010/1 <p>Posted by Fyodor on Jan 22</p>Hi folks. I'm happy to report that the 5.20 release went well. But<br> If you're running from a build of the latest SVN checkout, you...<br> http://seclists.org/nmap-hackers/2010/0 <p>Posted by Fyodor on Jan 20</p>Happy new year, everyone. I'm happy to announce Nmap 5.20--our first<br> The...<br> http://seclists.org/nmap-hackers/2009/3 <p>Posted by Fyodor on Jul 16</p>Hello everyone. I'm delighted to announce the release of Nmap 5.00!<br> 1) The new Ncat tool aims to be your Swiss Army Knife...<br> http://seclists.org/nmap-hackers/2009/2 <p>Posted by Fyodor on Jun 26</p>Hi Folks. I'm pleased to announce some exciting Nmap news:<br> Please test it out, and let us know if you find any problems...<br> http://seclists.org/nmap-hackers/2009/1 <p>Posted by Fyodor on Apr 01</p>Hi Folks! In case you missed all the news reports yesterday, a couple<br> millions of infections, and this massive botnet...<br> http://seclists.org/nmap-hackers/2009/0 <p>Posted by Fyodor on Mar 27</p>Hello everyone. We've seen 848 messages on nmap-dev this year, but<br> 4.85BETA4 release,...<br> http://seclists.org/#pen-test While this list is intended for "professionals", participants frequenly disclose techniques and strategies that would be useful to anyone with a practical interest in security and network auditing. http://seclists.org/pen-test/2010/Jul/57 <p>Posted by Hafez Kamal on Jul 29</p>This is a reminder that the Call for Papers for Asia's largest network<br> Venue: Crowne Plaza Mutiara Kuala Lumpur...<br> http://seclists.org/pen-test/2010/Jul/56 <p>Posted by Alonso Jose da Silva II on Jul 28</p>Guys,<br> AlonsoII<br> http://seclists.org/pen-test/2010/Jul/55 <p>Posted by Pete Herzog on Jul 28</p>Jeff,<br> -pete.<br> http://seclists.org/pen-test/2010/Jul/54 <p>Posted by Saleh on Jul 28</p>Here is a demonstration for SSL Strip Attack:<br> <a rel="nofollow" href="http://securitytube.net/SSLstrip-Tutorial-video.aspx">http://securitytube.net/SSLstrip-Tutorial-video.aspx</a><br> http://seclists.org/pen-test/2010/Jul/53 <p>Posted by Robin Wood on Jul 28</p>A we've pointed out quite a few times, I was looking for attacks on<br> and CEPT certs require a full practical examination in order...<br> http://seclists.org/pen-test/2010/Jul/52 <p>Posted by Pete Herzog on Jul 28</p>Hi Saleh,<br> prove...<br> http://seclists.org/pen-test/2010/Jul/51 <p>Posted by Tony Turner on Jul 28</p>You need to put the findings in context. It's not enough to say &quot;Fix the<br> have an...<br> http://seclists.org/pen-test/2010/Jul/50 <p>Posted by Jason Ross on Jul 25</p>In 2 of those 3 scenarios, this shouldn't be a question.<br> In the third example (you...<br> http://seclists.org/pen-test/2010/Jul/49 <p>Posted by Robert Portvliet on Jul 25</p>If they gave a you a good report you should have the vulnerabilities<br> severity of their...<br> http://seclists.org/pen-test/2010/Jul/48 <p>Posted by Todd Haverkos on Jul 25</p>a bv &lt;vbavbalist () gmail com&gt; writes:<br> In the report, hopefully there are CVE numbers as...<br> http://seclists.org/pen-test/2010/Jul/47 <p>Posted by Jacky Jack on Jul 24</p>Hi Demetris Papapetrou<br> Thanks....<br> http://seclists.org/pen-test/2010/Jul/46 <p>Posted by Pete Herzog on Jul 24</p>&quot;People are bad at trust....<br> A new article called Essential Trust Analysis is now available...<br> http://seclists.org/pen-test/2010/Jul/45 <p>Posted by Robert Portvliet on Jul 24</p>What is the behavior you are seeing? (Does it fail because it can't<br> Also, take into consideration that although they are blocking...<br> http://seclists.org/pen-test/2010/Jul/44 <p>Posted by a bv on Jul 24</p>Hi,<br> Prove to peers and potential employers without a doubt that you...<br> http://seclists.org/pen-test/2010/Jul/43 <p>Posted by Richard Miles on Jul 24</p>Hi chintan,<br> and CEPT certs require a...<br> http://seclists.org/#risks Peter G. Neumann moderates this regular digest of current events which demonstrate risks to the public in computers and related systems. Security risks are often discussed. http://seclists.org/risks/2010/q3/2 <p>Posted by RISKS List Owner on Jul 21</p>RISKS-LIST: Risks-Forum Digest Wednesday 21 July 2010 Volume 26 : Issue 11<br> The current issue can be...<br> http://seclists.org/risks/2010/q3/1 <p>Posted by RISKS List Owner on Jul 10</p>RISKS-LIST: Risks-Forum Digest Saturday 10 July 2010 Volume 26 : Issue 10<br> The current issue can be...<br> http://seclists.org/risks/2010/q3/0 <p>Posted by RISKS List Owner on Jul 03</p>RISKS-LIST: Risks-Forum Digest Saturday 3 July 2010 Volume 26 : Issue 09<br> The current issue can be...<br> http://seclists.org/risks/2010/q2/7 <p>Posted by RISKS List Owner on Jun 10</p>RISKS-LIST: Risks-Forum Digest Thursday 10 June 2010 Volume 26 : Issue 08<br> The current issue can be...<br> http://seclists.org/risks/2010/q2/6 <p>Posted by RISKS List Owner on May 29</p>RISKS-LIST: Risks-Forum Digest Saturday 29 May 2010 Volume 26 : Issue 07<br> The current issue can be...<br> http://seclists.org/risks/2010/q2/5 <p>Posted by RISKS List Owner on May 08</p>RISKS-LIST: Risks-Forum Digest Saturday 8 May 2010 Volume 26 : Issue 06<br> The current issue can be...<br> http://seclists.org/risks/2010/q2/4 <p>Posted by RISKS List Owner on May 04</p>RISKS-LIST: Risks-Forum Digest Tuesday 4 April 2010 Volume 26 : Issue 05<br> The current issue can be...<br> http://seclists.org/risks/2010/q2/3 <p>Posted by RISKS List Owner on Apr 28</p>RISKS-LIST: Risks-Forum Digest Wednesday 28 April 2010 Volume 26 : Issue 04<br> The current issue can be...<br> http://seclists.org/risks/2010/q2/2 <p>Posted by RISKS List Owner on Apr 25</p>ACM FORUM ON RISKS TO THE PUBLIC IN COMPUTERS AND RELATED SYSTEMS (comp.risks)<br> Contents:...<br> http://seclists.org/risks/2010/q2/1 <p>Posted by RISKS List Owner on Apr 18</p>RISKS-LIST: Risks-Forum Digest Sunday 18 April 2010 Volume 26 : Issue 02<br> The current issue can be...<br> http://seclists.org/risks/2010/q2/0 <p>Posted by RISKS List Owner on Apr 08</p>RISKS-LIST: Risks-Forum Digest Thursday 8 April 2010 Volume 26 : Issue 01<br> The current issue can be...<br> http://seclists.org/#basics A high-volume list which permits people to ask "stupid questions" without being derided as "n00bs". I recommend this list to network security newbies, but be sure to read Bugtraq and other lists as well. http://seclists.org/basics/2010/Jul/190 <p>Posted by Hafez Kamal on Jul 29</p>This is a reminder that the Call for Papers for Asia's largest network<br> Venue: Crowne Plaza Mutiara Kuala Lumpur...<br> http://seclists.org/basics/2010/Jul/189 <p>Posted by Curt Purdy on Jul 29</p>Sometimes when I am full of myself, like when I am the last man<br> When beyond-national corporations use clueless...<br> http://seclists.org/basics/2010/Jul/188 <p>Posted by Shawn Merdinger on Jul 29</p>Hi,<br> it benefits your company and how your customers can tell if a site is...<br> http://seclists.org/basics/2010/Jul/187 <p>Posted by Far McKon on Jul 29</p>Hey,<br> Philly (NYC is 2 hours away,...<br> http://seclists.org/basics/2010/Jul/186 <p>Posted by zero9zero on Jul 29</p>Well sql injection doesn't have to be in a lnput validation.. Usually they inject it through the url too...<br> powered by Sinyal...<br> http://seclists.org/basics/2010/Jul/185 <p>Posted by Jacky Jack on Jul 29</p>Hi<br> it benefits your company and how your customers can tell if a site is secure. You will...<br> http://seclists.org/basics/2010/Jul/184 <p>Posted by Chester Enright on Jul 29</p>n3td3v...yet another example of the creation of a phony organization<br> Please stop with...<br> http://seclists.org/basics/2010/Jul/183 <p>Posted by Florian Rommel on Jul 29</p>blah blah blah... yes i would rather sit back in the times when all we heard was the propaganda of the war machine and <br> worlds interest to know or &quot;leaking&quot; real information that is in direct contrast to lies published by the...<br> http://seclists.org/basics/2010/Jul/182 <p>Posted by pryorda pryor on Jul 29</p>I think we should have access to all the warlogs anyways.. We are<br> it benefits your company and how your customers can tell if a site is secure. You will find out how to...<br> http://seclists.org/basics/2010/Jul/181 <p>Posted by Jan G.B. on Jul 29</p>Let's see what you posted on twitter not so long ago..<br> In this guide we examine the importance of...<br> http://seclists.org/basics/2010/Jul/180 <p>Posted by Andre Pawlowski on Jul 29</p>I tested this for myself with Firefox 3.6.8 and Google Chrome<br> Andre Pawlowski...<br> http://seclists.org/basics/2010/Jul/179 <p>Posted by Murda on Jul 29</p>Sorry, Tamer, I think you may have misunderstood this phrase:<br> Incidentally(and coincidentally) my response would be the same...<br> http://seclists.org/basics/2010/Jul/178 <p>Posted by Murda on Jul 29</p>I will bring this up at the next security community meeting. I will also<br> going to...<br> http://seclists.org/basics/2010/Jul/177 <p>Posted by Chad Perrin on Jul 29</p>While Mr. Gillett (who also responded to you) made very good points, and<br> what...<br> http://seclists.org/basics/2010/Jul/176 <p>Posted by Murda on Jul 29</p>I wonder if he can hear us trip-trapping on 'his' list. Just wait 'til my<br> while there are a few trolls, andrew being...<br> http://seclists.org/#jobs A popular list for advertising or finding jobs in the security field. Employers post openings and job seekers post resumes (run by SecurityFocus). For privacy reasons, only the current year is archived. http://seclists.org/#vuln-dev A moderated list for discussing possible security issues and devising exploits for them. http://seclists.org/#vulnwatch A non-discussion, non-patch, all-vulnerability annoucement list supported and run by a community of volunteer moderators distributed around the world. http://seclists.org/#webappsec Provides insights on the unique challenges which make web applications notoriously hard to secure, as well as attack methods including SQL injection, cross-site scripting (XSS), cross-site request forgery, and more. http://seclists.org/webappsec/2010/q3/28 <p>Posted by Hafez Kamal on Jul 29</p>This is a reminder that the Call for Papers for Asia's largest network<br> Venue: Crowne Plaza Mutiara Kuala Lumpur...<br> http://seclists.org/webappsec/2010/q3/27 <p>Posted by Robert Hajime Lanning on Jul 28</p>You can hash the form data, then encrypt the hash with a shared transaction<br> SSL/TLS and second via the internal signing.<br> http://seclists.org/webappsec/2010/q3/26 <p>Posted by richardhigh on Jul 27</p>Saleh,<br> Request...<br> http://seclists.org/webappsec/2010/q3/25 <p>Posted by Saleh on Jul 26</p>---------- Forwarded message ----------<br> Using CRC, there is absolutely...<br> http://seclists.org/webappsec/2010/q3/24 <p>Posted by Peter M. Jansson on Jul 21</p>So section 3.7.5 if the DISA Application Security and Development STIG V3R1 seems to be the requirement in question, <br> (Actually, I worry a bit more about potential bugs in the...<br> http://seclists.org/webappsec/2010/q3/23 <p>Posted by Robert Hajime Lanning on Jul 21</p>Well, outside of an AES128-SHA1 SSL connection, there really isn't much that can<br> client platform?<br> http://seclists.org/webappsec/2010/q3/22 <p>Posted by Richard Moore on Jul 21</p>If the intention is to protect against malicious changes (as the<br> rich.<br> http://seclists.org/webappsec/2010/q3/21 <p>Posted by Martin Tartarelli on Jul 21</p>Hi Richard,<br> 2010/7/20 Nikhil Wagholikar &lt;visitnikhil () gmail com&gt;:<br> http://seclists.org/webappsec/2010/q3/20 <p>Posted by Jacqueline.Primrose on Jul 21</p>Have you checked out GlobalScape EFT?<br> Does anyone know of any tools out there that can be used to ensure the integrity of data while in transit from a web...<br> http://seclists.org/webappsec/2010/q3/19 <p>Posted by Saleh on Jul 21</p>According to one of my friends (voulnet () gmail com)<br> HTTPS will do good =D<br> http://seclists.org/webappsec/2010/q3/18 <p>Posted by Robin Wood on Jul 21</p>As I said, on my box I'm root, I've all the privs available and the<br> --------------------------------------<br> http://seclists.org/webappsec/2010/q3/17 <p>Posted by Nikhil Wagholikar on Jul 20</p>Hi Richard,<br> It's Finally Here - The Cenzic...<br> http://seclists.org/webappsec/2010/q3/16 <p>Posted by Camilo Uribe on Jul 20</p>Look for the file privilege:<br> <a rel="nofollow" href="http://www.cenzic.com/2009HClaunch_Securityfocus">http://www.cenzic.com/2009HClaunch_Securityfocus</a>...<br> http://seclists.org/webappsec/2010/q3/15 <p>Posted by Robert Hajime Lanning on Jul 20</p>https will between the browser and the webserver.<br> http://seclists.org/webappsec/2010/q3/14 <p>Posted by Robin Wood on Jul 20</p>Not sure on the vulnerable app I'm testing but in my lab I'm on as<br> --------------------------------------<br>