Hello everyone, Today we will be going over the answers to the test offered by Tenable / Nessus when you interview with them to be an appsec guy. I was told I was the first to ace all 3 tests, so I might as well be the first to spoil all 3 tests. What they […]
Wow, what a crazy month. I’ve been up to a lot of things. For starters, I applied to Nessus for a part time vuln research analyst position, beat the phone screen and beat the 3 app challenges they sent me, but didn’t get the job and they gave me no real answer, even when I […]
This week I encountered a password hash I hadnt seen in a while. Base64 with a twist. SmarterTools.com has a mail server called SmarterMail written in all .net. It stores its passwords in xml files in what looks to be base64, but not quite. Unlike most companies, I assume SmarterTools doesn’t know how to encrypt […]
I recently went to Defcon and had some time to think about the next thing to write. I had been toying with the idea for some time. A password snarfer for those password database programs like Norton Identity Manager, PassSafe off of sourceforge, LastPass, Kaspersky Password Manager, Roboform Desktop, Iron Key and the rest. I’m […]
I have 3 new 0days. A remote code exec in a web server, an admin bypass in a mail server, and a crappy XSS in some heldesk webapp. I’ve alerted the proper people a couple weeks back. They have another couple weeks left to patch before I go public and all the fun begins. Expect […]
I made some updates to my tool. For example, now you can control how many messages are generated for each click. I also added the ability to use the scroll wheel to click fire. Check it out: Once again, if you want the tool, get it here: Apb Mouse Macro I still gotta finish […]
A couple months back I posted a C++ program for reading / writing mp3 files given their tags. This was of course windows so its always necessary to over do everything because that’s how windows works. I did the whole process on Linux in like 1 line of bash. I installed the MP3::Tag lib from […]
Well, now that my fuzzer is done and my APB hack tool is done, all I to do now is finish my file duplicate finder. I’ve given some though to other fuzzer tools that still need to be created such as a Web Services fuzzer. I haven’t seen anything like that come my way […]
I’ve been playing this game, All Points Bulletin for some time now and lately I’ve been seeing a lot of people using mouse macros to take advantage of poor netcode that allows users to fire their weapons ad fast as they can click. So what i did was write my own little macro application that […]
-EDIT- IM DONE Long time no update. What have I been working on? Lots. For starters, I am coding my own HTTP fuzzer in my favorite web lang – php. Here, take a look: http://gironsec.com/code/fuzzy.html Want to see the back end code? Now that I’m done, here it is: http://gironsec.com/code/myfuz.php I’m calling it ‘Joe’s Hot […]