Most of todays tools for fingerprinting are focusing on server-side services. Well-known and widely-accepted implementations of such utilities are available for http web services, smtp mail server, ftp servers and even telnet daemons. Of course, many attack scenarios are focusing on server-side attacks.
Client-based attacks, especially targeting web clients, are becoming more and more popular. Browser-targeted attacks, drive-by pharming and web-based phishing provide a broad aspect of threats during surfing in the world wide web. Attacker might initialize and optimize their attacks by fingerprinting the target application to find the best possible way to compromise the client.
The browserrecon project is going to prove, that client-side fingerprinting is possible and useful too. In this particular implementation, currently available in php only, the given web browser is identified by the used http requests. Similar to the http fingerprinting provided within httprecon the header lines and values are analyzed and compared to a fingerprint database.
Read more on this article...
If you don’t know, BackTrack is a top rated linux live distribution focused on penetration testing. With no installation whatsoever, the analysis platform is started directly from the CD-Rom and is fully accessible within minutes.
Back in January we mentioned the BackTrack Live Hacking CD BETA 3 was released, at last the final version is ready for download!
Tools
As usual, updated, sharpened, SVN’ed and armed to the teeth. This release we have some special features such as spoonwep, fastrack and other cool additions.
Kernel
2.6.21.5. Yes, yes, stop whining….We had serious deliberations concerning the BT3 kernel. We decided not to upgrade to a newer kernel as wireless injection patches were not fully tested and verified. We did not want to jeopardize the awesome wireless capabilities of BT3 for the sake of sexiness or slightly increased hardware compatibilities. All relevant security patches have been applied.
Availability
For the first time we distribute three different version of Backtrack 3:
* CD version
* USB version
* VMWare version
FREE DOWNLOAD
BackTrack Final 3 Hacking
Read More
Read more on this article...
Pantera is actually using an improved version of SPIKE Proxy and is a project under the umbrella of OWASP.
It’s aiming to be a more automated method for testing Web Application Security.
Features:
* User-friendly custom web GUI. (CSS): Pantera itself is a web application that runs inside the browser and can be customized using CSS by the user. Some of the customizations are visual style, colors, fonts, views for easy information access, etc.
* 100% python: Python is cross-platform, easy to install and use. Making it the perfect language of choice to use.
* Multi-platform (Windows, Linux, etc.) and multi-browser (IE, Firefox, etc.): By using Python, Pantera is cross-platform. And we have made sure Pantera works fine with the most common browsers.
* Supports SSL, NTLM, HTTP Basic: All this is supported by Pantera, still most open source tools have problems with things like NTLM.
* Powerful analysis engine: Pantera has a powerful analysis engine, meaning that each web page that Pantera sees is analyzed for several things like comments, scripts, vulnerabilities, hidden tags and more. All this is done in background and transparent for the user while testing the website manual and of course all this info is stored in the database.
* XML data files for configuration and attacks: Pantera uses XML files for configuration but also all the attacks and tests are stored in XML files, so it’s easy to add content to these files.
* MySQL support: Most tools do not allow you to save the assessment. While performing an assessment with Pantera you can create a session, so all the info generated while the assessment is stored in the database. You can edit, delete and modify the content of the assessment at your will. You can continue the next day on the same point you stopped. Currently only MySQL is supported, more databases will be supported in the future.
* Project Management: Each assessment is a session. Pantera offers project management to create new, open and delete projects.
* Plug-in support: Pantera offers plug-in support so advanced users can add and extent its features.
* Report generation: As Pantera can save assessments it can generate reports with all the gather data and vulnerabilities found. Some reports formats are HTML, XML, PDF, etc. Reports can also be customized!!
Requirements:
* Python 2.4
* MySQL 5 (Due to the use of triggers)
* pyOpenSSL
* FormBuild (install script inside Pantera zip)
Read more on this article...
So the latest news with the Gary McKinnon case that was he was trying to fight against Extradition, he started off with Appeals against US Extradition, then he Won The Right to Lords Appeal Extradition Hearing and then he lost the Lords case then went for the European Court.
Sadly it seems he lost his appeal in the European Court of Human Rights and he is to face immediate extradition and trial in the US possibly still under charges of terrorism, which is ridiculous.
The British hacker facing extradition to the US for breaking into the computer systems of the Pentagon and NASA has lost his appeal with the European Court of Human Rights.
Gary McKinnon (42) was hoping to be tried in the UK where the alleged offences took place. The Glaswegian now faces immediate extradition for trial.
McKinnon lost an appeal in the House of Lords last month and applied to the European court for temporary relief on August 12. After yesterday’s verdict, that relief will no longer apply.
So the decision is out finally, after temporary relief until August 28th he was safe in the UK but now extradition has been granted he will be heading to the US.
I hope they don’t try and make an example of him because he doesn’t wish to comply with their wishes, apparently he has Asperger’s too (a form of autism).
He has previously declined a deal with the US authorities in which he would receive a shorter sentence in return for a guilty appeal. He now faces up to 60 years in prison although the sentence is likely to be much shorter.
McKinnon’s lawyers are now appealing to the home secretary to allow their client to be tried in the UK as he has recently been diagnosed with Asperger’s Syndrome.
McKinnon denies his activities were a threat to US security and claims he was then motivated by a belief that the computer systems contained information about UFOs that was being concealed from the public.
I really wonder what kind of sentence he will get, he surely won’t get the full 60 years terrorism sentence but still they could be harsh with him.
If I had to make a conservative guess I’d say 3-5 years in the clink, up to a maximum of about 7.
Source: Tech Radar
Read more on this article...
We respect your privacy. All of your personal information that you leave on this site is completely secure. We do not provide this information to any other third party notice without your prior permission. We fully comply with the privacy norms of Google. We have a very strong policy toward spam mails. We do not send our newsletters to you unless you subscribe with us for the same. In case, that you have earlier subscribed to our newsletter and now you want to stop receiving the same then just unsubscribe and you will never see them again in your mailbox.
We reserve the exclusive right to change any of our policies without any prior notice.
Read more on this article...
