<?xml version="1.0" encoding="UTF-8"?><!-- generator="WordPress/2.9.2" -->
<rss version="0.92">
<channel>
	<title>usefulfor.com/security</title>
	<link>http://usefulfor.com/security</link>
	<description>security dojo</description>
	<lastBuildDate>Wed, 16 Jun 2010 15:47:19 +0000</lastBuildDate>
	<docs>http://backend.userland.com/rss092</docs>
	<language>en</language>
	
	<item>
		<title>Dear Scammed Victim</title>
		<description><![CDATA[Just got this on my inbox:

Compensation From The Government.
The Chairman
DEBT MANAGEMENT OFFICE
Committee On Government Compensation,
Wuse Zone II, FCT, ABUJA.:
Our Ref : FGN /SNT/STB
Dear Beneficiary,
Re:  Government Compensation on Scams Victims, Lotto, Unpaid/Unclaimed
Contract/Donation.
The Federal Government of Nigeria through the President Dr.Goodluck Jonathan GCFR CON, has mandated the Debt management office in colaboration with Nigeria Financial Intelligence [...]]]></description>
		<link>http://usefulfor.com/security/2010/06/16/dear-scammed-victim/</link>
			</item>
	<item>
		<title>Java Bytecode Injection</title>
		<description><![CDATA[When assessing the security posture of a Java thick application we can usually process the code through a decompiler (such as Jad) and have a proper look at the code. It may be the case that we need to bypass the SSL checks but that is usually it.
However, every now and then, we stumble upon [...]]]></description>
		<link>http://usefulfor.com/security/2009/10/26/java-bytecode-injection/</link>
			</item>
	<item>
		<title>Beware of JBoss&#8217; &#8220;SecureIdentityLoginModule&#8221;</title>
		<description><![CDATA[From JBoss' Community Wiki EncryptingDataSourcePasswords page:

The org.jboss.resource.security.SecureIdentityLoginModule from jboss-jca.jar can be used to encrypt database passwords rather than using clear text passwords in the DataSource configuration. [...]

Which in principle, is a great thing. The problem being that usually database credentials end up being placed in the web application configuration file in clear text. However:
[...] It [...]]]></description>
		<link>http://usefulfor.com/security/2009/09/24/beware-of-jboss-secureidentityloginmodule/</link>
			</item>
	<item>
		<title>DEFCON 17: a late write up</title>
		<description><![CDATA[This year's DEFCON was quite amazing, apparently 10k people showed up in the Riviera for it. This is a late write up because everybody knows already about the fake ATM and the RFID reader near the Wall of Sheep, on the other hand, not everybody knows about other things that also took place. By the [...]]]></description>
		<link>http://usefulfor.com/security/2009/08/19/defcon-17-a-late-write-up/</link>
			</item>
	<item>
		<title>Bypassing Java thick client SSL checks</title>
		<description><![CDATA[x509 certificate generation
Generate the certificate using OpenSSL:-

$ openssl genrsa 1024 &#62; foo.key
$ openssl req -new -x509 -nodes -sha1 -days 7300 -key foo.key &#62; foo.crt
$ openssl pkcs12 -export -out foo.p12 -in foo.crt -inkey foo.key -name &#34;your name&#34;

You will need the .p12 file (contains key and certificate) to configure Burp. And the .crt file to add it [...]]]></description>
		<link>http://usefulfor.com/security/2009/06/23/bypassing-java-thick-client-ssl-checks/</link>
			</item>
	<item>
		<title>dradis v2.0 &#8211; flexibility unleashed</title>
		<description><![CDATA[It has been a long time since the last formal release of dradis (remember the dradis v1.2 one-click installer?). But that does not mean we have been doing nothing in the mean time  
We have been working as hard as one can work: over 487 commits since then (check the stats), we went to [...]]]></description>
		<link>http://usefulfor.com/security/2009/01/30/dradis-v2/</link>
			</item>
	<item>
		<title>DeepSec 2008</title>
		<description><![CDATA[DeepSec 2008 took place in Vienna in November. For a period of two days attendees enjoyed a good set of talks, a good atmosphere and had the chance to talk to different people from different security backgrounds.
I was invited to present my 'Behind Enemy lines' research, which mainly focused on different attack techniques that are [...]]]></description>
		<link>http://usefulfor.com/security/2008/12/18/deepsec-2008/</link>
			</item>
	<item>
		<title>lucent firewall ruleset parser</title>
		<description><![CDATA[Recently I had to go through the ruleset of a Lucent firewall, and the truth is that the export format of the rules is everything but easy to read.
The information is split into three files:

rules file: Contains the rules, each one takes about 72 lines (rules have many properties, each property is written in a [...]]]></description>
		<link>http://usefulfor.com/security/2008/12/01/lucent-firewall-ruleset-parser/</link>
			</item>
	<item>
		<title>DEFCON 16 &#8211; Las Vegas 2008</title>
		<description><![CDATA[hack-fu by Matt Hillman
Last week I attended DEFCON 16 in Las Vegas. I went last year as well, so I knew to expect the huge throngs of people, the strange mix of young, old, and crazy-haired and all the usual antics that happens when you gather around 7 thousand hackers in one place.
There's a lot [...]]]></description>
		<link>http://usefulfor.com/security/2008/08/21/defcon-16-las-vegas-2008/</link>
			</item>
	<item>
		<title>SSID Script Injection</title>
		<description><![CDATA[The administrative web interfaces for many wireless access points (APs) provide users with ‘Neighbourhood Wireless Scan’ functionality. This functionality scans for all accessible APs and displays the details of any APs which are identified. However, examination of these administrative interfaces revealed that a large number of them do not properly sanitise the parameters that are [...]]]></description>
		<link>http://usefulfor.com/security/2008/08/04/ssid-script-injection/</link>
			</item>
</channel>
</rss>
