Site uses cookies to provide basic functionality.
Javascript rendering is set to off by default when visiting the site via .onion and .i2p domains. It can be enabled back again in user's settings section. Javascript rendering set to off means, that you can disable javascript in your browser now and the site will remain functional.
There is also IRC server now available via native IRC clients or non javascript web based one.
Fonts can be adjusted in user's settings section as well.
Check FAQ for more.

OK

Networks
Languages
1 2 3 5 8 11 17 25 37 54 79 116 171 250 366 535 536 786 899 1149 1150 1319 1435 1514 1569 1606 1624 1625 1626 1627 1628 1631 1648 1660 1668 1674 1677 1680 1682 1683 1684 1685 ▲ ▼
This presentation describes how attackers could take advantage of SQL Injection vulnerabilities using time-based blind SQL injection. The goal is to stress the importance of establishing secure development best practices for Web applications and not only to entrust the site security to the perimeter defenses. This article shows exploitation examples for some versions of Microsoft SQL Server, Oracle DB Engine,MySQL and Microsoft Access datab....
This presentation describes how attackers could take advantage of SQL Injection vulnerabilities using time-based blind SQL injection. The goal is to stress the importance of establishing secure development best practices for Web applications and not only to entrust the site security to the perimeter defenses. This article shows exploitation examples for some versions of Microsoft SQL Server, Oracle DB Engine,MySQL and Microsoft Access datab....
The market share for Apple devices has grown considerably over the past few years, but most reverse engineering topics still focus on Microsoft platforms. This talk will outline what is necessary to begin reversing software on OS X. This will include a rundown of the tools available to an apple based researcher, how Objective-C works and what it looks like in a binary, the basics of the Mach-O file format including the undocumented _OBJC se..
The market share for Apple devices has grown considerably over the past few years, but most reverse engineering topics still focus on Microsoft platforms. This talk will outline what is necessary to begin reversing software on OS X. This will include a rundown of the tools available to an apple based researcher, how Objective-C works and what it looks like in a binary, the basics of the Mach-O file format including the undocumented _OBJC se..
Over the last several years, we've seen a decrease in effectiveness of "classical" security tools. The nature of the present day attacks is very different from what the security community has been used to in the past. Rather than wide-spread worms and viruses that cause general havoc, attackers are directly targeting their victims in order to achieve monetary or military gain. These attacks are blowing right past firewalls and anti-virus an....
Over the last several years, we've seen a decrease in effectiveness of "classical" security tools. The nature of the present day attacks is very different from what the security community has been used to in the past. Rather than wide-spread worms and viruses that cause general havoc, attackers are directly targeting their victims in order to achieve monetary or military gain. These attacks are blowing right past firewalls and anti-virus an....
Much literature has addressed the issue of the relative sizes of shadow economies in different countries. What is largely missing from this discussion is a more structured discussion on how to incorporate estimates of shadow economic activity into the national income accounting framework and a discussion of how the shadow components of specific industries can be analyzed in either an input-output or macroeconomic framework. After a brief di....
Much literature has addressed the issue of the relative sizes of shadow economies in different countries. What is largely missing from this discussion is a more structured discussion on how to incorporate estimates of shadow economic activity into the national income accounting framework and a discussion of how the shadow components of specific industries can be analyzed in either an input-output or macroeconomic framework. After a brief di....
This talk was given by Brenno de Winter in place of the much talked about canceled talk : The Anatomy of a Subway Hack:Breaking Crypto RFID's and Magstripes of Ticketing Systems by the original authors: Zack Anderson Student, MIT RJ Ryan Student, MIT Alessandro Chiesa Student, MIT In this talk we go over weaknesses in common subway fare collection systems. We focus on the Boston T subway, and show how we reverse en....
This talk was given by Brenno de Winter in place of the much talked about canceled talk : The Anatomy of a Subway Hack:Breaking Crypto RFID's and Magstripes of Ticketing Systems by the original authors: Zack Anderson Student, MIT RJ Ryan Student, MIT Alessandro Chiesa Student, MIT In this talk we go over weaknesses in common subway fare collection systems. We focus on the Boston T subway, and show how we reverse en....
Over the last couple of years a range of privacy threats have been in occurring. Europe is starting to look like the playing field of what is to come to the US: Storage of all e-mail traffic, online presence, phone calls, actual traveling throughout nations and filtering of content. Fortunately a closer look at the measures shows that it is never smart to overestimate the abilities European governments have and digital self defense is possi....
Over the last couple of years a range of privacy threats have been in occurring. Europe is starting to look like the playing field of what is to come to the US: Storage of all e-mail traffic, online presence, phone calls, actual traveling throughout nations and filtering of content. Fortunately a closer look at the measures shows that it is never smart to overestimate the abilities European governments have and digital self defense is possi....
Using various modifications and techniques - it is possible to gain free and anonymous cable modem internet access. This talk will analyze and discuss the tools, techniques, and technology behind both hacking cable modems and attempting to catch the users who are hacking cable modems. Previously confidential information gained from a senior network technician at Time Warner will be disclosed in this speech. We will also talk about how these....
Using various modifications and techniques - it is possible to gain free and anonymous cable modem internet access. This talk will analyze and discuss the tools, techniques, and technology behind both hacking cable modems and attempting to catch the users who are hacking cable modems. Previously confidential information gained from a senior network technician at Time Warner will be disclosed in this speech. We will also talk about how these....
With webapp protection now mandated by the PCI standard, web-application firewalls (WAFs) have received newfound interest from both consumers of security technologies, as well as from security researchers and potential attackers. Now that WAFs are a PCI-approved substitute for code reviews, expect many vendors to opt for this potentially less costly route to compliance. Of course, security researchers and potential attacks will increasingly....
With webapp protection now mandated by the PCI standard, web-application firewalls (WAFs) have received newfound interest from both consumers of security technologies, as well as from security researchers and potential attackers. Now that WAFs are a PCI-approved substitute for code reviews, expect many vendors to opt for this potentially less costly route to compliance. Of course, security researchers and potential attacks will increasingly....
Countless hours are spent researching vulnerabilities in proprietary and open source software for each bug found. Many indicators of potential vulnerabilities are visible both in the disassembly and debugging, if you know what to look for. How much can be automated? VulnCatcher illustrates the power of programmatic debugging using the VTRACE libraries for cross-platform debugging. atlas a disciple of the illustrious Skodo, has a histor..
Countless hours are spent researching vulnerabilities in proprietary and open source software for each bug found. Many indicators of potential vulnerabilities are visible both in the disassembly and debugging, if you know what to look for. How much can be automated? VulnCatcher illustrates the power of programmatic debugging using the VTRACE libraries for cross-platform debugging. atlas a disciple of the illustrious Skodo, has a histor..
NetBSD is a portable operating system for just about every architecture available. There is a notable lack of tools available for the penetration tester. In this talk we will present Toasterkit, a generic NetBSD rootkit. It has been tested on i386, Mac PPC, and VAX systems. Anthony Martinez is a system administrator for the New Mexico Tech Computer Center, and an undergraduate Computer Science student at the university. Thomas B..
NetBSD is a portable operating system for just about every architecture available. There is a notable lack of tools available for the penetration tester. In this talk we will present Toasterkit, a generic NetBSD rootkit. It has been tested on i386, Mac PPC, and VAX systems. Anthony Martinez is a system administrator for the New Mexico Tech Computer Center, and an undergraduate Computer Science student at the university. Thomas B..
In this presentation we're going to show Defcon how broken the Internet is, how helpless its users are without provider intervention, and how much apathy there is towards routing security. With the method described in this talk, an attacker is able to gain full control and visibility of all IP packets heading towards an arbitrary destination prefix on the Internet. From the perspective of the victims network, every inbound packet they....
In this presentation we're going to show Defcon how broken the Internet is, how helpless its users are without provider intervention, and how much apathy there is towards routing security. With the method described in this talk, an attacker is able to gain full control and visibility of all IP packets heading towards an arbitrary destination prefix on the Internet. From the perspective of the victims network, every inbound packet they....
This presentation will cover a variety of topics of interest to anyone on a cellphone network in the US. I'm going to cover how to use your own backends for MMS and WAP access, unlock Bluetooth tethering, and circumvent some of the more obnoxious carrier restrictions. Of course, the best part is baking your own firmware and running your own code. I'll provide an overview of the processes necessary to do so, a quick rundown of what you can....
This presentation will cover a variety of topics of interest to anyone on a cellphone network in the US. I'm going to cover how to use your own backends for MMS and WAP access, unlock Bluetooth tethering, and circumvent some of the more obnoxious carrier restrictions. Of course, the best part is baking your own firmware and running your own code. I'll provide an overview of the processes necessary to do so, a quick rundown of what you can....
Brute Force attacks are often marginalized as a user issue or discounted as a non-issue because of sufficient password complexity. Because rainbow tables have provided a re-invigoration of this type of attack, maintaining password security is simply not enough. In this session, I will be releasing a framework for easily creating a brute force attack tool that is both multithreaded and distributed across multiple machines. As computing power....
Brute Force attacks are often marginalized as a user issue or discounted as a non-issue because of sufficient password complexity. Because rainbow tables have provided a re-invigoration of this type of attack, maintaining password security is simply not enough. In this session, I will be releasing a framework for easily creating a brute force attack tool that is both multithreaded and distributed across multiple machines. As computing power....
The Dark Tangent welcomes the Defcon 16 attendees at the start of the conference. For the third year in a row, Kingpin has had the honor of designing the DEFCON Badge. No longer just a boring piece of passive material, the badge is now a full-featured, active electronic product. If you're up early enough and interested in details of the entire development process of the badge, from initial concept drawings to prototype electronics to c....
The Dark Tangent welcomes the Defcon 16 attendees at the start of the conference. For the third year in a row, Kingpin has had the honor of designing the DEFCON Badge. No longer just a boring piece of passive material, the badge is now a full-featured, active electronic product. If you're up early enough and interested in details of the entire development process of the badge, from initial concept drawings to prototype electronics to c....
There’s a recent thread in Oracle-L about deadlocks and a recommendation to dump various instance information when the deadlock happens. A deadlock trace dumps some useful things automatically, but sometimes you want more, especially in RAC environment. So is it possible to make Oracle dump additional things when the deadlock event happens? Yes it is and it’s doable with Oracle diagnostic event handling infrastructure. First I’ll take....
There’s a recent thread in Oracle-L about deadlocks and a recommendation to dump various instance information when the deadlock happens. A deadlock trace dumps some useful things automatically, but sometimes you want more, especially in RAC environment. So is it possible to make Oracle dump additional things when the deadlock event happens? Yes it is and it’s doable with Oracle diagnostic event handling infrastructure. First I’ll take....
Cool, just discovered: if you’re using the (UNIX command-line program) “less” to view a file, you can hit the “v” character to open the file in “vi”!
Metric - johnj.com - 17 years ago - eng
Being a geek, I’ve always liked the word 'metric.’ A metric is a number or other quantitative object (physicists like 'metric tensors’) which measures something. I have three paintings drying right now (i.e., too wet to work into without screwing up areas). A thought occurred to me as I was thinking about what to work on next, that the number of drying paintings could be a metric of how artistically busy you happen to be at the moment. C....
Metric - johnj.com - 17 years ago - eng
Being a geek, I’ve always liked the word 'metric.’ A metric is a number or other quantitative object (physicists like 'metric tensors’) which measures something. I have three paintings drying right now (i.e., too wet to work into without screwing up areas). A thought occurred to me as I was thinking about what to work on next, that the number of drying paintings could be a metric of how artistically busy you happen to be at the moment. C....
My friends at ProgramUtvikling just published the first PodCast in the series Oslo Developer Conversations. In this PodCast, yours truly interviews Uncle Bob about software craftsmanship. The podcast is still only available as video, but audio will come shortly. I had a great time doing this interview and I’m particularly happy that we managed to have a good combination of a technical discussion and an informal discussion. I’m looking forwa..
Snow Day March 2009 - solomon.io - 17 years ago - eng
It might strike you odd that I’m libertarian - that is, I want government as small and harmless as possible - and that my political view is rooted deeply in my faith. You see, I believe God gave us a gift, a gift so very precious that we have created a government to protect it. The government has often mishandled this gift, and so have we. We don’t really deserve this gift, but we have it.
ZFS is all about performance (many levels of caching, pre-fetch, …) and memory consumption :-) Here are my last links about ZFS [internals](http://src.opensolaris.org/source/xref/onnv/onnv- gate/usr/src/cmd/mdb/common/modules/zfs/zfs.c#333), it’s worth a read if you plan to use ZFS on large productions : The slides of Adam Leventhal’s talk for the OpenSolaris Storage Summit : ZFS, Cache, and Flash c0t0d0s0.org : a very good explanation of t..
I just noticed a bug 8277300 filed in Metalink with following description: ORA-7445[XTYQBCB] OCCURS DURING EXECUTING SQL THAT USES 60000 BIND VARIABLES . Wow! That’s about 100 times more bind variables in a single query than what I’ve seen in past. And I thought that query was bad!!! :) I suspect this is a massive IN list passed to a query. Maybe it’s time to use a temporary table or a collection for passing in the IN values instead?
I just noticed a bug 8277300 filed in Metalink with following description: ORA-7445[XTYQBCB] OCCURS DURING EXECUTING SQL THAT USES 60000 BIND VARIABLES . Wow! That’s about 100 times more bind variables in a single query than what I’ve seen in past. And I thought that query was bad!!! :) I suspect this is a massive IN list passed to a query. Maybe it’s time to use a temporary table or a collection for passing in the IN values instead?
The sky is falling. Everyone’s losing their job. The dollar isn’t worth what it used to be. Everything’s doom and gloom. Yet economists and politicians seem to insist that this is all part of a cycle, which includes recessions, booms, depressions, bull markets, bear markets, and other mumbo jumbo.
We all know that cigarettes and alcohol can be expensive because states will tax the hell out of time. Currently, California has virtually no money, and one politician has come up with a solution: tax recreational marijuana.
I’ve all but stopped using mock objects in my tests. The reason is that mocking have had a detrimental effect on the design of my systems. I’ve often ended up having the mocks trick me into adding a needless layer of indirection that does nothing except delegate to the next layer, just to satisfy the mocks. For a while, I was wondering whether I was the only one with this problem, but then I saw this tutorial on JBehave, which so perfectly ..
Or in other words, how to translate SQL_ID to a hash value :) I once wrote a script to demo this in my Advanced Oracle Troubleshooting class. Check this, I’ll run a query and then check what is its SQL_ID and HASH_VALUE from V$SQL: SQL> select * from dual ; D - X SQL> select sql_id, hash_value from v$sql 2 where sql_text = ' select * from dual '; SQL_ID HASH_VALUE ------------- ---------- a5ks9fhw2v9s1 942515969 So, V$SQL..
Or in other words, how to translate SQL_ID to a hash value :) I once wrote a script to demo this in my Advanced Oracle Troubleshooting class. Check this, I’ll run a query and then check what is its SQL_ID and HASH_VALUE from V$SQL: SQL> select * from dual ; D - X SQL> select sql_id, hash_value from v$sql 2 where sql_text = ' select * from dual '; SQL_ID HASH_VALUE ------------- ---------- a5ks9fhw2v9s1 942515969 So, V$SQL..
1 2 3 5 8 11 17 25 37 54 79 116 171 250 366 535 536 786 899 1149 1150 1319 1435 1514 1569 1606 1624 1625 1626 1627 1628 1631 1648 1660 1668 1674 1677 1680 1682 1683 1684 1685 ▲ ▼
117 visitors online