A collection of security books and tutorials.

Fugitif · 21 Jul 2008

Software Distribution Malware Infection Vector

Software Distribution Malware Infection Vector

This paper presents an efficient mechanism as well as the corresponding reference implementation for on-the-fly infecting of executable code with malicious software. Their algorithm deploys virus infection routines and network redirection attacks, without requiring the modification of the application itself. This allows infection of executables with an embedded signature when the signature is not automatically verified before execution. They briefly discuss countermeasures such as secure channels, code authentication as well as trusted virtualization that enables the isolation of untrusted downloads from other applications running in trusted domains or compartments.
Click to expand...

Paper:

http://packetstormsecurity.org/papers/general/Software.Distribution.Malware.Infection.Vector.pdf

Fugitif · 20 Aug 2008

Reverse Engineering: Anti-Cracking Techniques.

Reverse Engineering: Anti-Cracking Techniques

Many antivirus and antispyware solutions identify malicious programs by looking for known unique signatures contained inside them. Those signatures are stored inside a database which is constantly updated. This tutorial guides you through a number of steps to encrypt the executable file code section in order to render antivirus signature checking techniques ineffective against identifying the malicious code.

Download:

http://packetstormsecurity.org/papers/general/Reverse_Engineering_Smashing_the_Signature.pdf

Fugitif · 28 Aug 2008

The Most Wanted Hacking Book 2008

Download:

1

http://rapidshare.com/files/101501973/44.Hacking.Books.vol-1.rar

2

http://rapidshare.com/files/101502026/44.Hacking.Books.vol-2.rar

44 hacking books

Fugitif · 3 Sep 2008

ASLR bypassing method on 2.6.17/20 Linux Kernel

ASLR bypassing method on 2.6.17/20 Linux Kernel
No-executable stack space bypassing method on Linux

Paper:

http://packetstormsecurity.org/papers/bypass/aslr-bypass.txt

Fugitif · 7 Sep 2008

XSS and More

Download:

http://www.disenchant.ch/blog/wp-content/uploads/2008/05/xss_presentation.pdf

Fugitif · 10 Sep 2008

SQL Smuggling Attack

SQL Smuggling

This paper will present a new class of attack, called SQL Smuggling. SQL Smuggling is a sub-class of SQL Injection attacks that rely on differences between contextual interpretation performed by the application platform and the database server. While numerous instances of SQL Smuggling are commonly known, it has yet to be examined as a discrete class of attacks, with a common root cause. The root cause in fact has not yet been thoroughly investigated; this research is a result of a new smuggling technique, presented in this paper. It is fair to assume that further study of this commonality will likely lead to additional findings in this area.
Click to expand...

Download:
http://packetstormsecurity.org/papers/database/SQL_Smuggling.pdf

Fugitif · 17 Sep 2008

Web 2.0 Attacks Revealed

Web 2.0 Attacks Revealed

Cert/CC Statistics shows that 7120 Software Vulnerabilities were
Reported in 2006
· 194 SQL Injection Vulnerabilities were found on BugTraq
between 2005-jan and 2005-June
· Symantec highlights in its most recent Internet Security Threat
Report that Web vulnerabilities constituted 69 percent of 2,249
new vulnerabilities identified for the first half of 2006, with 78
percent of "easily exploitable" vulnerabilities residing within Web
applications.
· Directory Traversal is the 2nd most common attack on the
internet as of the 2nd half of 2005
· Roughly 63% of the Web application vulnerabilities can be
accounted for by 4 vulnerability classes: file inclusion, SQL
injection, cross-site scripting, and directory traversal
Click to expand...

http://www.infosecwriters.com/text_resources/pdf/KMaraju_Web20-Attacks-Revealed.pdf

Fugitif · 5 Oct 2008

Assault on Oracle PL/SQL - Injection

Assault on Oracle PL/SQL - Injection

by Aelphaeis Mangarae from blackhat-forums

Table of Contents
Introduction 1
A Glance at Oracle APEX 4
-What is Oracle APEX?
-Architecture of Oracle APEX
-mod_plsql / XML DB HTTP
Oracle Database Permissions 7
-Invoker vs. Definer Rights
What Is SQL Injection? 8
-Introduction
-What Programming Languages are Vulnerable?
-Example: SQL Injection Exploitation
-SQL Injection Oracle vs. Other DBMS
PL/SQL Overview 12
-Introduction
-PL/SQL Data Types
-Procedures, Functions & Packages
-Executing Database Commands
-PL/SQL Triggers
-PL/SQL Cursors
PL/SQL Injection 21
-What is PL/SQL Injection?
-Injecting into a SELECT Query
-Injecting into DML
-Database Privilege Escalation
-Technique: Autonomous Transaction.
Click to expand...

Download:

Paper

Fugitif · 28 Apr 2009

Best of Penetration Testing Tools

Best of Penetration Testing Tools

Larry, John, and Paul will explore the "Best Of" security tools. Part I will cover the best of network penetration testing tools. Six tools in total will be discussed, including a tip, trick, and/or use case for each one! Come learn about Nmap's IPv6 scanning, Cain & Abel's VoIP functionality, and much more!

1) Nmap - Worlds Best Port Scanner
2) Nessus - Vulnerability Scanner
3) Metasploit - Exploit framework
4) Pass-The-Hash - Who needs passwords?
5) Hydra - Brute force password guessing
6) Cain & Abel - The ultimate MITM utility
7) Spotlight - Core IMPACT.
Click to expand...

http://pauldotcom.com/TriplePlay-NetworkPenTestingTools.pdf

Fugitif · 18 Jun 2009

Automatic creation of SQL injection and cross-site scripting attacks

Automatic creation of SQL injection and cross-site scripting attacks

This paper presents an automatic technique for creating inputs that expose SQLI and XSS vulnerabilities. The technique generates sample inputs, symbolically tracks taints through execution (including through database accesses), and mutates the inputs to produce concrete exploits. Ours is the first analysis of which we are aware that precisely addresses second-order XSS attacks.

Our technique creates real attack vectors, has few false positives, incurs no runtime overhead for the deployed application, works without requiring modification of application code, and handles dynamic programming-language constructs. We implemented the technique for PHP, in a tool Ardilla. We evaluated Ardilla on five PHP applications and found 68 previously unknown vulnerabilities (23 SQLI, 33 first-order XSS, and 12 second-order XSS).
Click to expand...

Download PDF

http://www.cs.washington.edu/homes/mernst/pubs/create-attacks-tr054-abstract.html

Fugitif · 28 Jan 2010

Cross-Site History Manipulation (XSHM) attack

Cross-Site History Manipulation (XSHM) attack

Hackers used to concentrate on Server-Side attacks on Web applications like Injections, Parameter Manipulations, Path traversal etc. In recent years we have seen a steady rise in Client-Side attacks: XSS, CSRF, JSON hijacking. These vulnerabilities exploit the trust shared between a user and a website, facilitated by Web Browsers, by circumventing the Same Origin Policy (SOP).
Click to expand...

Download:PDF

Passenger · 13 Jan 2011

http://www.securitytube.net/sitemap.aspx

ALSO

http://www.hak5.org/

is not bad.

g4lyfe · 18 Jan 2012

nice concept thought to add , if there pliz del

en.wikibooks.org/wiki/Hacking/Tools/Network/Nmap
Click to expand...

Marcohawa · 18 Dec 2019

Jason they were and are great tutorials I had told several people to check them out. I sure love the Damascus you are now making. Frank

A collection of security books and tutorials.

Fugitif Elder - Старейшина

Fugitif Elder - Старейшина

Fugitif Elder - Старейшина

Fugitif Elder - Старейшина

Fugitif Elder - Старейшина

Fugitif Elder - Старейшина

Fugitif Elder - Старейшина

Fugitif Elder - Старейшина

Fugitif Elder - Старейшина

Fugitif Elder - Старейшина

Fugitif Elder - Старейшина

Passenger Member

g4lyfe New Member

Marcohawa New Member

Useful Searches

A collection of security books and tutorials.

Fugitif Elder - Старейшина

Fugitif Elder - Старейшина

Fugitif Elder - Старейшина

Fugitif Elder - Старейшина

Fugitif Elder - Старейшина

Fugitif Elder - Старейшина

Fugitif Elder - Старейшина

Fugitif Elder - Старейшина

Fugitif Elder - Старейшина

Fugitif Elder - Старейшина

Fugitif Elder - Старейшина

Passenger Member

g4lyfe New Member

Marcohawa New Member