Site uses cookies to provide basic functionality.
Javascript rendering is set to off by default when visiting the site via .onion and .i2p domains. It can be enabled back again in user's settings section. Javascript rendering set to off means, that you can disable javascript in your browser now and the site will remain functional.
There is also IRC server now available via native IRC clients or non javascript web based one.
Fonts can be adjusted in user's settings section as well.
Check FAQ for more.

OK

Networks
Languages
1 2 3 5 7 11 16 23 34 50 73 106 154 225 327 456 475 690 769 984 1003 1132 1234 1305 1353 1386 1409 1420 1421 1422 1423 1424 1425 1436 1443 1448 1452 1454 1456 1457 1458 1459 ▲ ▼
Abstract: In 2006 thousands of people will create applications based on the free Oracle 10g Express Edition. Even if this version of Oracle (based on Oracle 10g Rel. 2) is the most secure database from Oracle out of the box so far, there is still room for improvements. This presentation shows different possibilities to attack Oracle 10g Express Edition (and Oracle 10g Rel. 1 and Rel. 2). With Oracle 10g Oracle introduced some new securit....
This topic will present a new web-app/DB pen-test tool. This tool supports both proxy (passive) mode as well as direct URL targeting. It is a mixed Web App SQL Injection systematic pen-test and WebApp/Database scanner/auditing-style tool and supports most popular databases used by web applications such as Oracle, SQL Server, Access and DB2. It has many unique features from web app backend Database automatic detection to the ability to brows....
Abstract: Zulu is a light weight 802.11 wireless frame generation tool to enable fast and easy debugging and probing of 802.11 networks. It has an intuitive command line interface and operates with the unmodified madwifi-ng and partially with prism based Linux network drivers. Individual fields in frames can be set or unset, generating frames that possibly violate the IEEE 802.11 protocol. It can generate all control, data, and management ....
Abstract: The known topics for this year include: 1. The Worldwide SSL Analysis?There's a major flaw in the way many, many SSL devices operate. I'll discuss how widespread this flaw is, as well as announce results from this worldwide SSL scan. 2. Syntax Highlighting...on Hexdumps. Reverse Engineering efforts often require looking at hex dumps?without much context for whats being looked at. I will discuss a "bridge" position between AI an..
Abstract: The Evolving Art of Fuzzing will be a technical talk detailing the current state of fuzzing and describing cutting edge techniques. Fuzzer types, metrics, and future research will be presented. Also, three of ASI's private fuzzer tools will be discussed. They will be released on the DEFCON CD. Bio: Jared DeMott Jared DeMott is a vulnerability researcher for Applied Security, Inc. (ASI). Jared earned a masters degree from Johns ..
Abstract: From the 1337 hax0rs that brought you Anonym.OS, kaos.theory/security.research presents SAMAEL (Secure, Anonymous, Megalomaniacal, Autonomous, Encrypting Linux), the natural evolution of our secure, automagicically anonymizing operating system, Anonym.OS into a kick-ass anonymizing server! When kaos.theory released the Anonym.OS at ShmooCon in January of this year, we received many requests for features we had already planned to....
Today, as more punch gets packed into 1u than ever, server resources can be further consolidated and abstracted to securely separate complex and sophisticated services in the same hardware server, by running secure virtual UNIX machines. Who wants jails? System Administrators who need to securely separate small yet important services. Software Developers who always need more dev machines to hack amok. Root-Kit Testing and Debugging. Ed....
Abstract: Reverse engineering continues to evolve, or rather REvolve. The reverse engineering toolset primarily consists of disconnected disassemblers and debuggers. Without symbol information or data acquired from disassembly, the use of a debugger can be blind and tedious. Reverse engineering has fueled the need to enable these tools to work together. When disassemblers and debuggers are used in conjunction, the resulting union is great....
Abstract: Why would you want to attack IBM Networking? Isn?t it old, unused and unimportant in today?s modern business environments? The answer is why not attack it, after all it is still deployed in lots of high value environments. IBM Networking usually means Mainframes and therefore the potential to get to some cool financial or intelligence data. But what was that I heard you say? You can only route IP across the Internet! Maybe so, b....
Single Packet Authentication is becoming an increasingly important method for protecting arbitrary network services through the use of a kernel level filtering mechanism such as Netfilter in the Linux kernel. By sending SPA packets over the Tor network, SPA packets can be endowed with an additional layer of privacy and anonymity. It becomes cryptographically difficult to deduce the communication of the SPA packet from any particular source ....
Abstract: Metamorphism has been touted as a way to generate undetectable viruses and worms, and it has also been suggested as a potential security-enhancing technique. Today metamorphic virus construction kits are readily available on the Internet. A visit to the VX Heavens reveals more than 150 generators and engines to choose from in the category of "Worm/Virus Creation Tools". The purpose of a metamorphic generator is to create multiple....
Abstract: Mobile Ad-Hoc Networking (MANET) technology promises disaster-tolerant, interoperable, secure communications that work the way we users do. Features like automatic peer discovery and stable multi-transport TCP connections are so attractive that some may wonder if it isn't all too good to be true. After a brief but clear introduction to the more-or-less subtle differences between wireless routing technologies, we will delve direct....
The 802.11 link-layer wireless protocol is widely known for its design flaws. Unauthenticated management packets, a ridiculous attempt at providing link layer confidentiality and authentication (WEP), and general vendor stupidity have all contributed to 802.11 being the most sensationalized protocol ever mentioned in the media. All of the above topics have been beaten to death. Instead this talk explores new advances not in design problems....
Abstract: Reverse Engineering has come a long way?what used to be practiced behind closed doors is now a mainstream occupation practiced throughout the security industry. Compilers and languages are changing, and the reverse engineer has to adapt: Nowadays, understanding C and the target platform assembly language is not sufficient any more. Too many reverse engineers shy away from analyzing C++ code and run into trouble dealing with heavil....
Abstract: The Plausible Deniability Toolkit is a collection of processes and tools designed to protect its users from invasions of privacy and infringement of civil rights by oppresive organizations and governments. The foundation for this toolkit is the result of anti-forensics gap analysis and the need for fabrication of evidence. Certainly most of these techniques have been in use by child pornography rings and various governmental TLA'....
Abstract: Experience from domestic and foreign humanitarian assistance and disaster relief (HADR) operations shows that shared situational awareness and the information systems that support it are the critical enablers of all other functions in such situations. They are not merely technical adjuncts to the delivery of food, water and shelter. Federal Agencies can respond better to disasters (both domestic and international) by sharing uncl....
Abstract: The amount of new malware being developed has increased at a staggering rate over the last couple of years. At the same time, executable packing technology has grown to provide malware authors with a myriad of choices in how they pack their malware to evade detection and analysis. This presents a growing problem to analysts who lack the time to learn how each packer works and can be unpacked, but still need to be able to quickly ....
Abstract: Kiosks are being deployed in an increasing number of locations including supermarkets, banks and airports. Providing public computer access from machines connected to your internal network is one of the most challenging IT problems. Traditionally, an anonymous user with local access to a machine that can talk to the Internet and the internal network is an administrator?s nightmare. Therefore the techniques to secure these machines....
Abstract: Government organizations are required by the Office of Management and Budget to migrate their networks over to IPv6 by 2008. There is a belief that this opens inherit risk to the organization due to undiscovered flaws and security holes that may be opened up. One such breach is the use of covert channels to push data in or out of a network in the guise of standard traffic. Covert channels are not new, and have been exploited i....
Abstract: Although there has been a significant amount of attention paid to the topic of late, there are complexities that must be understood to accurately gauge the impact of "Bumping Locks" on physical security. This talk will explore the vulnerabilities and exposures of virtually all pin-tumbler locks, highlighting the legal issues surrounding the possession and use of bump-keys and bumping implements. Case examples and demonstrations de....
Abstract: This paper outlines a Distributed Denial of Service (DDoS) attack which abuses open recursive Domain Name System (DNS) name servers using spoofed UDP packets. Our study is based on packet captures and logs from attacks reported to have a volume of 2.8Gbps. We study this data in order to further understand the basics of the reported recursive name server amplification attacks which are also known as DNS amplification or DNS reflec....
Abstract: When trying to analyze a complex system for its security properties, very little information is available in the beginning. If the complex system in question contains parts that the analyst cannot see or touch, proprietary hardware and software as well as large scale server software, the task doesn't get any easier. The talk will tell the story about how Phenoelit went about looking at RIM's BlackBerry messaging solution while fo....
Abstract: Despite many appearances in film and television, fairly little is widely known about how safes can be opened without the proper combination or key. This talk will attempt to address some of the questions commonly asked about the craft, such as -- is it really possible to have a safe open in a minute or two using just a stethoscope and some clever finger-work? (Yes, but it will take a bit more time than a few minutes.) Are the gadg....
Abstract: DNS operations today are no longer just a secure configuration and bandwidth, but rather a whole world of online abuse and criminal activities. In this presentation we will discuss how DNS has become this infrastructure for online crime and abuse. Spam, DDoS attacks, botnets and extremely reliable phishing servers all owe their existence to DNS games Further, we will discuss how DNS helps discover and combat malicious activities..
Abstract: The wrtp54g/rtp300 is a linksys VOIP Proxy router with one primary distinguishing characteristic that separates it from all other VOIP Routers on the market today: It's based on linux. This fact alone makes this router the key to learning the inner workings of VOIP and opens up a world of possibilities when it comes to its de-obfuscation. After all, 3rd party firmware on its parent router, of which it is a descendant of the wrt5....
Abstract: Hacking stuff is for the birds. I'm taking a new path in life. I've decided to become a technical consultant for Hollywood. (No, not really, but work with me here). In my new role, I've decided it's time to take up the torch for all my fellow consultants who have been abused by you people through the years. We're all just sick and tired of your snide little comments about hackers in the movies. So go ahead. Make fun of Hollywood.....
Abstract: Research in Motion's Blackberry technology has quickly become the defacto standard for executives and technical personnel alike to maintain unteathered remote access to critical data. Often regarded as inherently secure, most administrators deploy this solution without a full understanding of the technology or risks involved. This presentation will demonstrate how an attacker could utilize many typical corporate blackberry deploy....
Abstract: Binary disassembling and manual analysis to find exploitable vulnerabilities is a cool topic. What's cooler? Saving yourself hours of time and brain rot by letting a program do the hard parts for you! In this talk, we will dissect a well-known exploitable vulnerability as well as an open source tool for automatically detecting that vulnerability. By the end of the talk, you will understand the basics of static code analysis, expl....
Abstract: In 2006 the Help America Vote Act (HAVA) rid the country of lever voting machines and punchcard ballots, and gave the states enormous budgets for buying electronic voting machines. What's still unresolved is how these electronic voting machines are going to be audited. Trying to keep track of many different vendors, each of which has many different machines, is like getting lost in a funhouse hall of mirrors. Yet, there is good n....
Abstract: Detecting global abuse patterns with realtime black lists, spamtraps and honey pots. Understanding what your network is doing to the rest of the community is difficult, we discuss how to use our tools to understand how your network is abusing other networks and show graphs and stats of trends globably and within the us. Bio: Rick Wesson has worked in the IETF and ICANN on DNS, whois, and Registry and Registrar protocols; Served..
Abstract: Learn to Spy on Corporate Network Traffic. After attending this talk, you will learn how to perform targeted packet sniffing to capture web, e-mail, chat conversations, VoIP, and file transfer traffic. Many tools are covered, including Effetech, MSN Protocol Analyzer, Ethereal filters, URLSnarf, FileSnarf, ACE, Cain and Abel, and others. Bio: Andrew Whitaker is the Director of Enterprise Security for InfoSec Academy, a global ....
Abstract: We all want to be awesome hackers, but let's face it: inventing the sploitz can be hard work. What if there were a way to make interesting security discoveries using relatively simple tools, recycled concepts from research in other fields, and readily available data? For better or worse, this is the kind of question that we at foofus.net ask ourselves on a regular basis. And it's in that spirit that we present this fine talk. We....
Abstract: If you want to know how the National Security Agency and telecommunications companies are conspiring to invade your privacy, this is the panel for you. The Electronic Frontier Foundation (EFF) is currently suing AT&T for collaborating with the NSA in its massive and illegal program to wiretap and data-mine Americans' phone and internet communications. Come learn about the legal and technical issues surrounding the NSA surveillance....
Abstract: " During this presentation SensePost will discuss and demonstrate two pieces of new technology?the Suru WebProxy and the SP_LR Generic network proxy. The Suru web proxy is an inline web proxy (the likes of Paros, @stake webproxy and Webscarab) and offers the analyst unparalleled functionality. Are the days of the web proxy counted? Is there really room for another web proxy? Come to their presentation and see what happened when t....
Abstract: This talk looks at the technical and psychological backgrounds behind why phishing works, and how this can be exploited to make phishing attacks more effective. To date, apart from the occasional use of psychology grads by 419 scammers, no-one has really looked at the wetware mechanisms that make phishing successful. Security technology doesn't help here, with poorly-designed user interfaces playing right into the phishers hands.....
Abstract: An Anonymous identity is difficult but not impossible to obtain. With help of international laws and loopholes a new identity can be created. This talk will demonstrate how this can be done with never before published methods. There are many reasons why a person might choose to obscure their identity and become anonymous. Several of these reasons are legal and legitimate - someone, for example, who feels threatened by someone e....
Abstract: This presentation will focus on disabling many of the windows based network security solutions that are most widely used. New payloads will be presented that demonstrate how host based firewalls at this time are not adequate defense to safeguard one's network resources. The speech is highly technical and requires knowledge of reverse engineering and process injection. Bio: Lin0xx has been a code and security enthusiast for a nu..
Abstract: Reverse engineers often like to argue that a prime motivator for their activities is the desire to discover and patch vulnerabilities in closed-source binary software. Given the veritable plethora.. nay, Katrina-like flood of vulnerabilities being discovered on a near daily basis, one has to wonder where all these binary patches are hiding. Clearly this argument is a sham to make reverse engineers feel better about their DMCA vio....
Abstract: The Census Bureau is the Only Federal Agency that is acquiring detailed personal data on Every person in the United States. While the Census provides valuable information that is vital to our form of government, major privacy concerns exists. The potential for abuse of the data has historical roots, the most notorious being the rounding up and relocation of Japanese-Americans during World War II. Learn how the Social, Economic, ....
Abstract: The web of trust, as used in PGP, is a well-known system for establishing trust between people, even if the people have not previously met. Why does it work so well in crypto? The answer is simple: it's the same system that we all use on a daily basis when dealing with friends, family, relationships, andjust about everyone else we have to interact with. On the crypto side, however, there are a number of restrictions that limit the....
We describe requirements for a malware collection repository. The repository serves as a clearing house for malware samples, as well as analysis provided by members of the clearing house. We discuss how malware authors are aware of, and actively exploit inherent inefficiencies in the current generation of competitive, closed malware collections. We demonstrate how, by illuminating AV sensors, and by using frequent updates, malware authors ....
Abstract: This session will reveal to you how the FBI uses Neuro-Linguistic Programming (NLP) during interview and interrogation sessions. Gaining cooperation with special speech and word changes, Clues to help determine whether clients are lying or remembering and the traditional "Cop Stop technique" will all be revealed and practiced by attendees. Seldom taught outside the law or medical community, you'll be instructed in and actual prac....
Mosquito is a secure remote execution framework available via LGPL that combines high-grade cryptography and a small efficient virtual machine on both ends to ensure that intellectual property is protected. It also presents a dynamic environment on a target host that can be reprogrammed on the fly over a secure communications channel to fit the current situation.'-" The virtual machine was written from scratch for this purpose, with a buil....
Snort has become a standard component of many IT security environments. Snort is mature and widely deployed, and is no longer viewed as new or exciting by the industry. However, with such widespread deployment, enhancing Snort's capabilities offers the potential for a large and immediate impact. Instead of chasing the industry's new-hotness of the day, it frequently makes more sense to add new capabilities to an existing security control. ....
1 2 3 5 7 11 16 23 34 50 73 106 154 225 327 456 475 690 769 984 1003 1132 1234 1305 1353 1386 1409 1420 1421 1422 1423 1424 1425 1436 1443 1448 1452 1454 1456 1457 1458 1459 ▲ ▼
17 visitors online