The Curious Engineer

LevelBlue SpiderLabs Blog

2011–2012

259 posts

2013–2026 →

2012 237

December 2012

  1. Owning Windows Networks with Responder 1.7 January 24, 2013 A lot has been happening with Responder lately! Read More
  2. SpiderLabs Crypto Contest - Winner! January 21, 2013 We have a winner! @TimoHirvonen Read More
  3. SpiderLabs Radio January 18, 2013 w/ Space Rogue January 18, 2013 This week's episode of SpiderLabs Radio hosted by Space Rogue covers Aaron ... Read More
  4. Defeating AES without a PhD January 17, 2013 | Dan Crowley "Cryptography is typically bypassed, not penetrated." – Adi Shamir FAITH IN THE ... Read More
  5. QA w/ SpiderLabs Research: Java 0day CVE-2013-0422 January 16, 2013 | Arseny Levin Q: What's going on? People are talking about some Java 0daywhich threatens the ... Read More
  6. SpiderLabs Radio January 25, 2013 w/ Space Rogue January 25, 2013 This weeks episode of SpiderLabs Radio hosted by Space Rogue covers the ... Read More
  7. [Honeypot Alert] Active Probes for Ruby on Rails XML Vulns January 25, 2013 | Ryan Barnett In a previous blog post, I outlined some ModSecurity defenses to help protect ... Read More
  8. Microsoft Patch Tuesday, November 2012 – Lions and Tigers and RCE, Oh My! November 13, 2012 | Space Rogue I feel some compassion for those system administrators alongthe East Coast of ... Read More
  9. Detecting Successful XSS Testing with JS Overrides November 29, 2012 | Ryan Barnett Do you know when an attacker or security researcher successfully finds a ... Read More
  10. [Honeypot Alert] User-Agent Field XSS Attacks November 29, 2012 | Ryan Barnett Our web honeypots picked up some more XSS attacks today: Read More
  11. An Analysis of a Fake Vodafone Bill PDF File November 29, 2012 We haven't come across many malicious PDF files recently in our spam traps, so ... Read More
  12. The Return of SpiderLabs Radio: Now with Space Rogue November 30, 2012 The SpiderLabs podcast known as SpiderLabs Radio has gone through many ... Read More
  13. Proxmark 3, now with more Android December 03, 2012 It's no secret; I'm a fan of the Proxmark 3 RFID testing board. It's a device ... Read More
  14. [Honeypot Alert] SQL Injection Scanning Targeting Joomla Plugins December 03, 2012 | Ryan Barnett The following SQL Injection attack payloads targeting Joomla components were ... Read More
  15. Blackberry OS 10 BlackLists Batman and PoohBear December 06, 2012 | Space Rogue A Blackberry oriented website in the UK was the first to notice an interesting ... Read More
  16. CCCDC Blue Teams vs Corporate Blue Team Comparision December 06, 2012 | Ryan Linn This weekend was the Community College Cyber Defense competition at Iowa State ... Read More
  17. [Honeypot Alert] SQL Injection Scanning Detected in WordPress Error Logs December 07, 2012 | Ryan Barnett Normally for these Web Honeypot alert blog posts, I show snippets of the Apache ... Read More
  18. SpiderLabs Radio December 7, 2012 w/ Space Rogue December 07, 2012 We are back with a third (new) episode of SpiderLabs Radio hosted by Space ... Read More
  19. Microsoft Advance Notification for December 2012 December 06, 2012 | Space Rogue Next week is Patch Tuesday, so this week we get the advance notification for ... Read More
  20. Class 101 - Automating the process of fingerprinting Web Applications and Identifying Vulnerabilities. December 08, 2012 | Wendel Guglielmetti Henrique First of all, this blog post is not for Web Application experts, instead I will ... Read More
  21. Microsoft Patch Tuesday, December 2012 – 99 Bottles of Beer on the Wall December 11, 2012 | Space Rogue The head of Trustwave SpiderLabs Nicholas Percoco has had an unusual goal this ... Read More
  22. How to Hack and Not Get Caught December 11, 2012 | Tim Maletic The following thoughts on internal network penetration strategies are drawn ... Read More
  23. [Honeypot Alert] Turning Local File Inclusion into Reflected Code Execution December 12, 2012 | Ryan Barnett Which web application attack type is more severe: Local File Inclusion (LFI) or ... Read More
  24. Abusing SAP Servers December 13, 2012 | Joaquim Espinhara da Silva Neto During some recent penetration tests I have noticed that large companies have ... Read More
  25. The Dexter Malware: Getting Your Hands Dirty December 13, 2012 | Josh Grunzweig A very interesting piece of malware that targets Point of Sale systems has ... Read More
  26. Abusing the Android Debug Bridge December 14, 2012 The android debug bridge (or ADB for short) is a valuable tool, it is what ... Read More
  27. SpiderLabs Radio December 14, 2012 w/ Space Rogue December 14, 2012 We are back with another episode of SpiderLabs Radio hosted by Space Rogue. ... Read More
  28. My 5 Top Ways to Escalate Privileges December 13, 2012 | Bruno Oliveira During a penetration test, rarely will the tester get access to a system with ... Read More
  29. You down with LNK? December 15, 2012 | Nathan Drier Oftentimes on an Internal pen test, I find myself with a limited-privilege ... Read More
  30. PCAP Files Are Great Arn't They?? December 15, 2012 | David Kirkpatrick One of the most important skills in anyone's armory responsible for looking ... Read More

November 2012

  1. Setting HoneyTraps with ModSecurity: Unused Web Ports December 17, 2012 | Ryan Barnett This blog post will show an easy configuration update that you can make to your ... Read More
  2. Fraud, Passwords, and Pwnage on the Interwebz December 19, 2012 | Therese Mendoza This past weekend I was lucky enough to attend Microsoft's BlueHat Conference ... Read More
  3. Setting HoneyTraps with ModSecurity: Project Honeypot Integration December 18, 2012 Following up my previous blog post which outlined how to activate additional ... Read More
  4. Finding Zero Days Reading Your Mind in the Year 2052 December 18, 2012 | Trustwave SpiderLabs A number of months ago, I was approach by the organizers of TEDxNaperville to ... Read More
  5. Simple Ciphers, and a little SpiderLabs Crypto Contest December 20, 2012 Millions have died and millions have been saved because of cryptography. There ... Read More
  6. The First Few Months of Penetration Testing: What they don't teach you in School September 24, 2012 | Alex Fernandez-Gatti I entered into school with the hope and dream of someday entering into the ... Read More
  7. CVSS for Penetration Test Results (Part II: Attack Sequences) September 24, 2012 | Tim Maletic CVSS needs to be extended to accommodate combinations of vulnerabilities. The ... Read More
  8. Wherever you come from, you can meet BeEF September 24, 2012 This year I've been very busy in terms of conferences, and ... Read More

October 2012

  1. Did I do that? (PenTest Faux Pas) September 25, 2012 Many times, in the course of explaining what I do to others that are unfamiliar ... Read More
  2. JSON Hijacking Demystified September 24, 2012 | Rohini Sulatycki JavaScript Object Notation (JSON) is a language and platform independent format ... Read More
  3. Hey, I just met you, and this is crazy, but here's my hashes, so hack me maybe? September 25, 2012 Those familiar with password cracking know that KoreLogic's rule set for John ... Read More
  4. Guidance for firms using the NetAccess N-1000 September 26, 2012 | Jonathan Werrett SpiderLabs' Incident Response team has recently seen credit card fraud ... Read More
  5. Getting in with the Proxmark 3 and ProxBrute September 26, 2012 As a member of the Physical Security team here at SpiderLabs, some of my job ... Read More
  6. Oops, I pwned your router - Part Two September 26, 2012 In the last blog post, "Opps I pwned your router Part One", I talked about some ... Read More
  7. FinSpy Mobile - Configuration and Insight September 27, 2012 | Josh Grunzweig A couple of weeks ago, Citizen Lab announced the discovery of the mobile ... Read More
  8. Adding Anti-CSRF Support to Burp Suite Intruder September 28, 2012 | Ulisses Alburquerque In the web application penetration testing industry, Burp Suite is considered a ... Read More

September 2012

  1. James Bond's Dry Erase Marker: The Hotel PenTest Pen October 01, 2012 You may have seen the talk and demonstration by Cody Brocious that allows him ... Read More
  2. Announcing the availability of ModSecurity extension for Nginx September 28, 2012 | Ryan Barnett ModSecurity for Nginx ModSecurity for Nginx is a web server plug-in for the ... Read More
  3. Using Mobile Applications for attacking Web Applications September 28, 2012 | Joaquim Espinhara da Silva Neto This simple blog post was motivated by my desire to look at some mobile ... Read More
  4. Smart Phone + Mail Server = Location Tracking September 28, 2012 My last two posts have touched on the privacy perspective in relation tomobile ... Read More
  5. Good things happen when Forensics and Malware Analysis work together. September 28, 2012 | Grayson Lenik The SpiderLabs Incident Response team worked a case earlier this year where ... Read More
  6. Trustwave SpiderLabs in Africa September 28, 2012 Africa. The land of origin; the original unknown. Read More
  7. Update from Trustwave SpiderLabs EMEA September 28, 2012 Europe, Middle East and Africa consists of around 120 countries depending on ... Read More
  8. The Grey Line Between Feature and Vulnerability, iOS edition October 02, 2012 | Mike Park I do a lot of Mobile Application Penetration testing for some of our largest ... Read More
  9. mDNS - Telling the world about you (and your device) October 10, 2012 Luiz Eduardo ( @effffn) and Rodrigo Montoro ( @spookerlabs ) have presented ... Read More
  10. Microsoft Patch Tuesday, October 2012 – Legend of Zelda Edition October 09, 2012 Hope you enjoyed last months light patch Tuesday with only two bulletins as ... Read More
  11. Microsoft Advanced Notification for October 2012 – Lync, SQL, Headache October 05, 2012 Microsoft has released its Advanced Notification for October 2012. After last ... Read More
  12. Introducing Responder-1.0 October 24, 2012 Responder is a multi threaded tool that answers to IPv4 LLMNR (Link-local ... Read More
  13. Worm Propagates Through Skype Messages October 12, 2012 | Rodel Mendrez For the past week, we've received a lot of reports of a worm that propagates ... Read More
  14. CVE-2012-4969 and the Unnamed Admin Panel November 13, 2012 | Moshe Basanchig While CVE-2012-4969 isn't new, we are still curious about the various ways this ... Read More
  15. Microsoft Advanced Notification for November 2012 - RCE, Yikes! November 08, 2012 | Space Rogue Microsoft has released its advance notification for next weeks Patch Tuesday ... Read More
  16. CWE the Vote November 06, 2012 It's a nice, sunny day in Cleveland, my friends. Tonight, after the votes are ... Read More
  17. TWSL2012-016: Multiple Vulnerabilities in Bitweaver October 24, 2012 | Robert Foggia The LevelBlue SpiderLabs team has published a new advisory for multiple ... Read More
  18. Microsoft Patch Tuesday August 2012 – Staying Alive In Gale Crater August 14, 2012 | Space Rogue As you install the nine updates that came out of Microsoft this month, five of ... Read More
  19. PTJ Undermines Your Blinky Light Box August 27, 2012 So, you just bought that fancy new box with the blinky lights that's supposed ... Read More
  20. All Your Password Hints Are Belong to Us August 22, 2012 | Jonathan Claudius This past weekend I ended up coming into the SpiderLabs office and "nerded out" ... Read More
  21. DEF CON 20: French Fry, Pizza, or Rotten Apples? August 21, 2012 If you currently do a search online for a female's perspective about DEF CON, ... Read More
  22. It's a sunny (zero) day for Java August 27, 2012 | SpiderLabs Researcher Java exploits have been used for distributing malware for a while. See for ... Read More
  23. How Antivirus Saved the Day…Sort of. August 28, 2012 | Josh Grunzweig Recently, I found myself in a common situation—helping a comrade in our ... Read More
  24. How to Get the Most Out of a PenTest August 29, 2012 | Nathan Drier Being a PenTester for Trustwave Spiderlabs, I work with a huge amount of ... Read More
  25. WAF Normalization and I18N August 29, 2012 | Ryan Barnett Submitted By Breno Silva Pinto and Ryan Barnett Read More
  26. Stripe-CTF Walkthrough August 29, 2012 | Ryan Linn I had the opportunity to do the Stripe-CTF (Capture The Flag) contest this past ... Read More
  27. Backward Compatibility Plays to Malware’s Hands August 29, 2012 | Moshe Basanchig Maintaining backward compatibility in software products is hard. Technology ... Read More
  28. TWSL2012-019: Cross-Site Scripting Vulnerability in Support Incident Tracker August 29, 2012 | Robert Foggia Trustwave SpiderLabs has published a new advisory today for a Cross-Site ... Read More
  29. Client-side Payload - The Brazilian Way. August 29, 2012 | Wendel Guglielmetti Henrique My name is Wendel Guglielmetti Henrique, and I'm a senior security consultant ... Read More
  30. Phishing Evolves: Rogue IVRs August 30, 2012 As someone who's worked in the financial industry for years, I'm fascinated by ... Read More
  31. The Patsy Proxy: Getting others to do your dirty work August 30, 2012 | Dan Crowley Patsy (slang) - A person easily taken advantage of, cheated, blamed, or ... Read More

August 2012

  1. Hackers and Media Hype: Big Hacks that Never Really Happened September 05, 2012 | Space Rogue If you combine the dictionary definitions for 'media' and 'hype' you come up ... Read More
  2. CryptOMG Walkthrough - Challenge 1 September 05, 2012 It has been about 3 months since CryptOMG was released and I will start going ... Read More
  3. No, the Internet Does Not ‘Just Work’ September 12, 2012 | Space Rogue The recent GoDaddy DNS outage illustrates that the Internet does not just work ... Read More
  4. Microsoft Patch Tuesday September 2012 – Update those Certs! September 11, 2012 As we mentioned last week there are only two patches this month! Not to mention ... Read More
  5. Vulnerability Spidey Sense - Demystifying PenTesting Intuition September 10, 2012 | Chris Vinecombe In Louisville, Kentucky next month at Derbycon, Daniel Crowley and I will be ... Read More
  6. PenTesting: From Low Risk Issues to Sensitive Data Compromising September 07, 2012 | Bruno Oliveira Yes, I imagine you are probably tired to see blog posts about "real-world" ... Read More
  7. Getting a Start in the Security Industry September 06, 2012 | Nate Sanders This has been a fairly common topic over the last year and I've seen plenty of ... Read More
  8. Microsoft Advanced Notification for September 2012 - Bad News, Good News September 06, 2012 | Space Rogue Microsoft has released its Advanced Notification for September 2012. The bad ... Read More
  9. Chat server fuzzing, Part 1. The Beginning September 14, 2012 | Art Dahnert This article (along with subsequent articles) will cover the journey I've taken ... Read More
  10. Web Application Defense: Bayesian Attack Analysis September 20, 2012 Regular Expressions for Input Validation If your web application defensive ... Read More
  11. Exploiting Users By Non-technical Means; or, “S Users Do” September 18, 2012 | Barry O’Connell Numerous technical articles emerge each day about the latest vulnerabilities, ... Read More
  12. The New Zero-Day in Internet Exploder (Oops… Explorer) September 20, 2012 | Rami Kogan The ride on the rollercoaster called the web security world never stops and ... Read More
  13. Oracle DBMS_Scheduler Fun on Windows! September 20, 2012 So, last time I showed how to get a Unix reverse shell up and running just by ... Read More
  14. Analysing X-Cart Compromises September 24, 2012 | Marc Bown Recently I've found myself performing a lot of forensic examinations of X-Cart ... Read More
  15. Five E-Commerce Security Myths (Part 1) June 23, 2012 | Marc Bown Compromises of e-commerce websites are increasingly common. In our 2012 Global ... Read More
  16. Security Capture the Flag Competitions June 24, 2012 | John Hoopes Many people look at capture the flag competitions with varying reactions. Some ... Read More
  17. I Forgot Your Password June 24, 2012 | Chris Vinecombe I'm now going into my second year in application security, and as I learn more ... Read More

July 2012

  1. eHarmony Password Dump Analysis June 26, 2012 | Mike Kelly Unless you've been hauled up in a bunker, eating MREs and watching Doomsday ... Read More
  2. Oops, I pwned your router- Part One June 30, 2012 | Videoman Embedded computing is very much about making a computer as small as possible, ... Read More
  3. Analyzing PDF Malware - Part 3B June 27, 2012 | Ryan Merritt Down that dusty trail… As the big blue letters above state, this is part 3B of ... Read More
  4. Stolen Laptop Recovery via OSX Trap Partition July 02, 2012 My Macbook Air has 2 partitions, one that is my normal everyday partition that ... Read More
  5. Wham Bam, the Cutwail/Blackhole Combo July 02, 2012 | Phil Hay Over the past few weeks we have seen a resurgence of malicious spam with links ... Read More
  6. Analyzing PDF Malware - Part 3C July 03, 2012 | Ryan Merritt Let me explain, no there is too much, let me sum up… This is part 3C in the ... Read More
  7. Apex Secure Coding Considerations July 02, 2012 | Rohini Sulatycki Apex is an on-demand language that extends the Force.com platform by providing ... Read More
  8. How much data? Apache, Ubuntu and the Lies of the Logs. July 03, 2012 | Ryan Jones Forensic investigators rely heavily on log file data in order to analyse ... Read More
  9. Conference tips from your friends at Trustwave SpiderLabs July 11, 2012 | SpiderLabs Anterior We are quickly approaching the largest security conference week on the planet. ... Read More
  10. Microsoft Patch Tuesday July 2012 – TLS and Office for Mac? July 10, 2012 We have nine bulletins to deal with this month three of which are rated ... Read More
  11. What did the Java applet say to the SWF? Don't leave me alone in this Blackholeee! July 16, 2012 | SpiderLabs Researcher Last week as we were analyzing the new version of Blackhole with the new Java ... Read More
  12. Spam Down: Where is Lethic? July 17, 2012 | Phil Hay At Trustwave SpiderLabs we keep a close eye on spam trends. We keep and publish ... Read More
  13. Hashcat Per Position Markov Chains July 18, 2012 | Daniel Turner I just wanted to let you guys know about some interesting work Atom has been ... Read More
  14. Pentesting like an Eastern European July 18, 2012 | Jonathan Werrett Through SpiderLabs' Incident Response and Penetration Testing services we get a ... Read More
  15. Spam Down II: Grum Down July 20, 2012 | Phil Hay So the media is abuzz with news of the takedown of the Grum botnet, which has ... Read More
  16. Analyzing PDF Malware - Part 3D July 19, 2012 | Ryan Merritt Read More
  17. Spiders are FUN! Party at DEF CON July 25, 2012 Hey folks! This week a fair amount of us (15k) are heading to Vegas for Black ... Read More
  18. Reducing web application attack surface July 24, 2012 | Breno Silva For as long as companies rely on web sites to do business with their customers ... Read More
  19. Beyond Apache: ModSecurity for IIS/Nginx is Coming July 20, 2012 | Ryan Barnett The Trustwave SpiderLabs Research Team is proud to announce that, through a ... Read More

June 2012

  1. Announcing the availability of ModSecurity extension for IIS July 26, 2012 | Ryan Barnett This blog post has also been posted on the Microsoft Security Research and ... Read More
  2. PenTest Manager 2.0 - Attack Sequences July 26, 2012 Trustwave recently launched PenTest Manager 2.0, a major enhancement of the ... Read More
  3. TWSL2012-014: Multiple Vulnerabilities in Scrutinizer NetFlow sFlow Analyzer July 27, 2012 | Robert Foggia The SpiderLabs team at Trustwave published a new advisory today, which details ... Read More
  4. Stamping Out Hash Corruption, Like a Boss August 07, 2012 | Jonathan Claudius Have you ever dumped LM and NTLM password hashes from a Windows system using ... Read More
  5. One Factor, Two Factor, Three Factor, More August 07, 2012 There has been a lot of talk online today about how Matt Honan, a reporter for ... Read More
  6. Poems from The Palms August 13, 2012 | Martin Murfitt SpiderLabs gathered for its annual meeting in Las Vegas recently. Though no ... Read More
  7. “Catch Me If You Can” Trojan Banker Zeus Strikes Again (Part 2 of 5) May 22, 2012 | SpiderLabs Researcher This is the second blog in this series of blogs. The previous blog provided a ... Read More
  8. Connecting the Dots w/ PenTest Manager May 24, 2012 We are evolving how the penetration testing industry reports vulnerabilities. ... Read More
  9. iOS Application Security: Top 50 Free iPad Apps - The View From The Top Isn’t Much Better [Part 1 of 2] May 25, 2012 Hello. I'm Tom Neaves. I recently joined SpiderLabs as a Senior Security ... Read More
  10. Reading between the lines: Harvesting Credit Cards from ISO8583-1987 Traffic May 25, 2012 | Solomon Bhala Having investigated cardholder data security breaches for a few years now, I ... Read More
  11. Sakura Exploit Kit 1.1 May 29, 2012 | Moshe Basanchig Even though it's sometimes easy to forget that there are exploit kits other ... Read More
  12. Putting Out the Flame May 30, 2012 | SpiderLabs Researcher There's a lot of buzz going around in the security field about a big piece of ... Read More
  13. [Honeypot Alert] Inside the Attacker's Toolbox: Botnet Credit Card Validation Scripts May 31, 2012 | Ryan Barnett In our previous blog post "Inside the Attacker's Toolbox: Botnet Web Attack ... Read More
  14. iOS Application Security: Review of Top 50 Free iPad Apps [Part 2 of 2] June 01, 2012 The View From The Top Isn't Much Better Read More
  15. Defeating Flame String Obfuscation with IDAPython June 01, 2012 | Josh Grunzweig Like many other security research firms, SpiderLabs Research has been actively ... Read More
  16. Oracle Databases, a Penetration Tester’s View of Unauthorized Access to Customer Records May 31, 2012 | David Kirkpatrick When penetration-testing you get to see lots of seemingly unbelievable security ... Read More
  17. Now IronSpider - Go hard or Go home, I'm an Ironman! June 04, 2012 | SpiderLabs Researcher Probably in the same period I started at Trustwave SpiderLabs I decided to ... Read More
  18. Rogue Certificates Set on Flame June 05, 2012 | Rami Kogan It was only a matter of time before we felt Flame's aftershock. Yesterday ... Read More
  19. Dynamic DAST/WAF Integration: Realtime Virtual Patching June 05, 2012 | Ryan Barnett At the recent OWASP AppSecDC conference, I presented on this topic. I received ... Read More
  20. Dynamic DAST/WAF Integration: Realtime Virtual Patching June 05, 2012 | Ryan Barnett At the recent OWASP AppSecDC conference, I presented on this topic. I received ... Read More
  21. Zap(ped) into Foca(s) June 08, 2012 | Theresa An external penetration test isn't just about the network addresses to pwn, but ... Read More
  22. Analyzing PDF Malware - Part 3A June 08, 2012 | Ryan Merritt When we last left our heroes… Read More
  23. Discussions on Targeted Attacks June 06, 2012 Even though targeted attacks performed by groups such as LulzSec and Anonymous ... Read More
  24. The Return of Zuc.A and and Ancient OSX Viruses? June 11, 2012 | Space Rogue A few weeks ago I caught a tweet from Chris Wysopal (@WeldPond) noticing how ... Read More
  25. Microsoft Patch Tuesday: RDP - Keep on Knockin' But You Can't Come In June 12, 2012 Another month, another Patch Tuesday. This one has seven bulletins three of ... Read More
  26. MySQL/MariaDB: Trade You a Banana for Root Access? June 12, 2012 | Jonathan Claudius Summary Read More

May 2012

  1. Using Nmap to Screenshot Web Services June 14, 2012 | Ryan Linn As part of Trustwave SpiderLabs network penetration testing team, I perform ... Read More
  2. Introducing CryptOMG June 12, 2012 | Andrew Jordan CryptOMG is CTF-style testbed for exploiting various flaws in cryptographic ... Read More
  3. ModSecurity and OWASP CRS Updates Available June 15, 2012 | Ryan Barnett Security Fix Release: ModSecurity v2.6.6 The ModSecurity Development Team has ... Read More
  4. [Honeypot Alert] PHP-CGI Vuln Targeted For Database Dumping June 19, 2012 | Ryan Barnett Thanks to my SpiderLabs Research colleague @claudijd for collaborating with ... Read More
  5. Internet Explorer Vulnerabilities Gone Wild June 20, 2012 | Anat (Fox) Davidi It's a busy time for Internet Explorer: Patch Tuesday addressed quite a few ... Read More
  6. Metasploit = tips, tricks, hashes and tokens June 20, 2012 Metasploit is one of the many tools that can be used during a penetration test, ... Read More
  7. CVSS for Penetration Test Results (Part I) June 22, 2012 | Tim Maletic Trustwave has been adding support for the Common Vulnerability Scoring System ... Read More
  8. Five E-Commerce Security Myths (Part 2) June 23, 2012 In part 1 of this series I gave an introduction into how most merchants accept ... Read More
  9. Smart Meter Attacks: Old Vectors Die Hard April 12, 2012 | Barry O’Connell Much has been made of the recent attacks against a Puerto Rican utility's smart ... Read More
  10. [Honeypot Alert] Joomla com_s5clanroster Local File Inclusion Attacks April 16, 2012 | Ryan Barnett Our web honeypots picked up some increased scanning for the following ... Read More
  11. Australian Apple Store Customers Targeted by Phishers April 13, 2012 | Rodel Mendrez Recently, we came across a phishing attack targeting Australian Apple Store ... Read More
  12. SC Magazine Innovation Award Finalist - Trustwave SpiderLabs PenTest Manager April 20, 2012 PenTest Manager, the cutting edge penetration test management and reporting ... Read More
  13. Come and Join Us at InfoSecurity April 23, 2012 | Ziv Mador This week we will be presenting and speaking at InfoSecurity, Europe's No.1 ... Read More
  14. TWSL2012-012: Cross-Site Scripting Vulnerability in Support Incident Tracker April 21, 2012 | Robert Foggia LevelBlue SpiderLabs has published a new advisory today for a reflective ... Read More
  15. Once Again Cutwail Spam Campaign Ends Up In Phoenix Exploit Kit April 23, 2012 | Daniel Chechik In the past few months, a certain cybercrime group operates a large stable ... Read More
  16. Update from Trustwave SpiderLabs EMEA, London April 29, 2012 It was a hectic week in London. In case you hadn't heard its was InfoSec Europe ... Read More
  17. Brazilian Banking Malware: Pay Your Bill Slacker! April 26, 2012 I recently got wind of an interesting little sample that I believe originated ... Read More
  18. WordPress 3.3.2 Addresses Setup XSS Vulnerabilities April 25, 2012 | Jonathan Claudius Back in January we released a security advisory for WordPress, which included ... Read More
  19. Pwning a Spammer's Keylogger April 25, 2012 | Rodel Mendrez Recently, while scrounging around our spam traps, I spotted this ordinary piece ... Read More
  20. Winning! PenTest Manager pwns SC Europe Innovation Award April 25, 2012 We Won! :-) Thanks to all the hard work of the Trustwave's Engineering teams, ... Read More
  21. RedKit Payload - Binary Fun May 01, 2012 | Josh Grunzweig Before I jump into this blog post, I'd like to point out some interesting ... Read More
  22. Recent Mass SQL Injection Payload Analysis May 01, 2012 | Ryan Barnett There have been a number of mass SQL Injection campaigns targeting ... Read More
  23. [Honeypot Alert] (UPDATE) Active Exploit Attempts for PHP-CGI Vuln May 07, 2012 | Ryan Barnett UPDATE - we have received more exploit attempt details from web hosting ... Read More
  24. A Wild Exploit Kit Appears... Meet RedKit May 02, 2012 | Arseny Levin During our research we have recently encountered a new private exploit kit. The ... Read More

April 2012

  1. TWSL2012-004: Multiple Vulnerabilities in Zen Cart May 08, 2012 | Robert Foggia The SpiderLabs team at Trustwave published a new advisory yesterday, which ... Read More
  2. Microsoft Patch Tuesday: Help Is On The Way! May 08, 2012 This may sound a bit odd but "nosteve" who usually gives his take on the patch ... Read More
  3. THOTCON 0x3 - Hacker Brew Contest May 08, 2012 | Ryan Merritt This year's instantiation of the THOTCON hacking conference issued a unique ... Read More
  4. Bypass Vulnerabilities in Squid and McAfee Web Access Gateway May 08, 2012 | Jonathan Claudius About two weeks ago, a Brazilian security researcher by the name of Gabriel ... Read More
  5. PHP-CGI Exploitation by Example May 08, 2012 | Jonathan Claudius Late last week, a vulnerability in PHP-CGI was disclosed, which allows all ... Read More
  6. “Catch Me If You Can” Trojan Banker Zeus Strikes Again (Part 1 of 5) May 15, 2012 | SpiderLabs Researcher In the next series of blogs we will describe in detail an attack from one of ... Read More
  7. It Takes Two to Tango (myself, and your unprotected file share) May 11, 2012 | Nathan Drier BananaStand learned from last time (to see last time, go here ). Systems were ... Read More
  8. “Catch Me If You Can” Trojan Banker Zeus Strikes Again (Part 4 of 5) May 15, 2012 | SpiderLabs Researcher This is the fourth part in a series of blogs. The prior blogs describe the ... Read More
  9. Too XXE For My Shirt May 16, 2012 | Dan Crowley Until tonight, I'd never gotten a chance to try an xml external entity (XXE) ... Read More
  10. [Honeypot Alert] Inside the Attacker's Toolbox: Botnet Web Attack Scripts May 17, 2012 | Ryan Barnett Have you ever wondered what script/code/tool was behind the automated web ... Read More
  11. About me, myself and BeEF May 17, 2012 | Antisnatchor Hello followers of SpiderLabs Anterior. Read More
  12. HULK vs. THOR - Application DoS Smackdown May 18, 2012 SpiderLabs Research Team Contributions from: Read More
  13. #TWContest: And the winner of the @Trustwave @SpiderLabs 2012 Global Security Report contest is... February 21, 2012 | SpiderLabs Anterior Here is a summary of the questions and answers: Read More
  14. SpiderLabs Threat Intelligence Program February 23, 2012 So a lot of people have been asking me "What do you do at Trustwave?" and I ... Read More
  15. [Honeypot Alert] phpMyAdmin Code Injection Attacks for Botnet Recruitment February 21, 2012 | Ryan Barnett Our web honeypots picked up the following attacks today: Read More
  16. PIG - Finding Your Target Without Saying a Word February 27, 2012 | Ryan Linn You see blogs, talks, presentations, and tutorials on how to break into boxes ... Read More

March 2012

  1. Virtual Patch for Movable Types XSS (CVE 2012-1262) March 01, 2012 | Ryan Barnett My SpiderLabs Research colleague Jonathan Claudius recently identified an XSS ... Read More
  2. Detecting Brazilian Banking Trojans with Snort http_inspect March 08, 2012 If you take a look at malware samples down here in Brazil, probably in most of ... Read More
  3. OWASP Virtual Patching Survey Results March 09, 2012 | SpiderLabs Researcher In a previous blog post, we issued a call for assistance to help OWASP with a ... Read More
  4. [Honeypot Alert] Status Report for February 2012 March 12, 2012 | Ryan Barnett Monthly Web Honeypot Status Report We have received a tremendous amount of ... Read More
  5. [Honeypot Alert] Status Report for February 2012 March 12, 2012 | Ryan Barnett Monthly Web Honeypot Status Report We have received a tremendous amount of ... Read More
  6. [Honeypot Alert] More WordPress is_human Plugin Remote Command Injection Attack Detected March 12, 2012 | Ryan Barnett As we first noted in a previous Honeypot Alert Blog post, our web honeypots ... Read More
  7. SpiderLabs T-Shirt Designs 2006-2011 March 14, 2012 | SpiderLabs Anterior Read More
  8. Microsoft Patch Tuesday, March 2012: Beware the RDP's of March March 13, 2012 Read More
  9. [Honeypot Alert] Zen Cart 'admin/sqlpatch.php' SQL Injection Attacks March 14, 2012 | Ryan Barnett Read More
  10. LIKE, omg! March 15, 2012 | Dan Crowley If you read this blog, you might have seen my earlier post regarding my ... Read More
  11. The Race for MS12-020 March 15, 2012 | Space Rogue So if you missed our previous blog post on the MS Patch Tuesday earlier this ... Read More
  12. A New Neighbor in Town: The Nuclear Pack v2.0 Exploit Kit March 22, 2012 In the past few years, cybercriminals have been increasingly using exploit kits ... Read More
  13. Dirty RAT Eats Nate's Banana March 21, 2012 | Josh Grunzweig I've got a real treat for everyone today, as I received approval to blog about ... Read More
  14. [Honeypot Alert] Large Scale LFI Attack From Brazillian Domains March 22, 2012 | Ryan Barnett Our web sensors picked up a big uptick in Local File Inclusion (LFI) attacks ... Read More
  15. SpiderLabs Radio Podcast: March 2012 March 25, 2012 We have just released the SpiderLabs Radio March Edition. This show is packed ... Read More
  16. Upcoming SpiderLabs Speaking Events - March / April 2012 March 23, 2012 At LevelBlue SpiderLabs we encourage our team members to frequently perform ... Read More
  17. TWSL2012-005: Cross-Site Scripting Vulnerability in osCommerce Platform March 23, 2012 | Robert Foggia Trustwave SpiderLabs has published a new advisory today for a Cross-Site ... Read More
  18. ModSecurity Advanced Topic of the Week: Automated Virtual Patching using OWASP Zed Attack Proxy March 27, 2012 | Ryan Barnett Automated Virtual Patching using OWASP Zed Attack Proxy The SpiderLabs Research ... Read More
  19. Hack Your Own Code: Advanced training for Developers March 28, 2012 | nosteve Mike Park and Marc Bown recently locked themselves in a conference room, ... Read More
  20. PenTest Manager: Now with Secure File Transfer March 29, 2012 PenTest Manager, the cutting-edge reporting tool created by Trustwave ... Read More

February 2012

  1. RCE root in all current Samba versions April 10, 2012 | Space Rogue While perusing the change log for the release of SAMBA that was pushed out ... Read More
  2. [Honeypot Alert] Zeroboard now_connect() Remote Code Execution Attacks April 11, 2012 | Ryan Barnett Our web honeypots recently identified attacks for CVE-2009-4834 which is a ... Read More
  3. TWSL2012-008: Multiple Vulnerabilities in Scrutinizer NetFlow sFlow Analyzer April 12, 2012 Trustwave SpiderLabs has published a new advisory yesterday for multiple ... Read More
  4. Microsoft Patch Tuesday: IE, Common Control, and Digitized Chuck Yeager April 11, 2012 For those of you that remember Microsoft Works, today's update will be special ... Read More
  5. Microsoft Patch Tuesday (January 2012): Media Player and The BEAST January 10, 2012 The statisticians over at the Patch Tuesday Farmer's Almanac are saying that 7 ... Read More
  6. [Honeypot Alert] Extensive 'setup.php' Scanning Detected January 12, 2012 | Ryan Barnett The SpiderLabs Research Team has identified an extensive scanning campaign ... Read More
  7. [Honeypot Alert] Is-human Wordpress Plugin Remote Command Execution Attack Detected January 13, 2012 | Ryan Barnett Our web honeypot logs picked up an attack aimed at exploiting the Is-human ... Read More
  8. Android IRC Bot - This Ain't Your Granny's Android Malware (Or Maybe It Is) January 18, 2012 | Josh Grunzweig As I'm sure many of you know, the rise of mobile-based malware has been on the ... Read More
  9. [Honeypot Alert] phpMyAdmin Superglobal Session Manipulation Attack Detected January 17, 2012 | Ryan Barnett Our web honeypots have identified attempts to exploit CVE-2011-2505. OSVDB ... Read More
  10. Scripting Metasploit using MSGRPC January 13, 2012 | Ryan Linn While there are many aspects of network pen testers that sets the good testers ... Read More
  11. On Null Byte Poisoning and XPath Injection January 23, 2012 | Dan Crowley Recently I released a tool called XMLmao, a configurable testbed for learning ... Read More
  12. [Honeypot Alert] Simple Page Options Module for Joomla! Local File Inclusion Attack Detected January 19, 2012 | Ryan Barnett Our web honeypots generated the following ModSecurity alert today: Read More
  13. Cuckoo for Cuckoo Box January 26, 2012 | Ryan Merritt Cuckoo Sandbox is an automated, open source, malware analysis system that ... Read More
  14. TWSL2012-002: Multiple Vulnerabilities in WordPress January 24, 2012 | Robert Foggia Trustwave SpiderLabs has published a new advisory today for multiple ... Read More
  15. HOIC DDoS Analysis and Detection January 27, 2012 | Ryan Barnett In a previous blog post, we provided details of a DDoS attack tool called LOIC ... Read More
  16. Island Hopping the SpiderLabs Way February 02, 2012 | Nathan Drier More and more, I find myself having to fight with highly segmented networks and ... Read More
  17. Death to PDF! February 03, 2012 SpiderLabs customers are frustrated with PDF reports: Read More
  18. Clarifying The LevelBlue CA Policy Update February 04, 2012 We've seen a number of comments and questions on Twitter regarding a recent ... Read More
  19. [Honeypot Alert] Status Report for January 2012 February 06, 2012 | Ryan Barnett Monthly Web Honeypot Status Report We have received a tremendous amount of ... Read More
  20. WASC Distributed Web Honeypots Project Update February 08, 2012 As the WASC Distributed Web Honeypots Project Sponsor, we are excited to ... Read More
  21. #TWContest: 1 out of every ~800 devices on the Internet is vulnerable to… February 09, 2012 | SpiderLabs Anterior On Tuesday we posted our first question of the Trustwave 2012 Global Security ... Read More

January 2012

  1. #TWContest: The industry that ranked third is... February 10, 2012 | SpiderLabs Anterior On Thursday we posted our second question of the Trustwave 2012 Global Security ... Read More
  2. Common Attack Methodologies Identified in European Customers February 13, 2012 | Ryan Barnett As you may have heard, Trustwave SpiderLabs released our Global Security Report ... Read More
  3. #TWContest: The 7th most popular password is... February 13, 2012 On Friday we posted our third question of the Trustwave 2012 Global Security ... Read More
  4. #TWContest: The top 'origin' of attack is... February 14, 2012 | SpiderLabs Anterior The question was… "What was the top "origin" of attack as seen through ... Read More
  5. Top Ten Web Protection Techniques of 2011 February 14, 2012 | Ryan Barnett Top Ten Web Hacking Techniques of 2011 Every year the web security community ... Read More
  6. #TWContest: The correct data aggregation technique is... February 15, 2012 | SpiderLabs Anterior On Tuesday we posted our fifth question of the Trustwave 2012 Global Security ... Read More
  7. Patch Tuesday, Feb 2012: What I did this Valentine's Day February 15, 2012 | nosteve Read More
  8. #TWContest: The two main motivations for web-based attacks are... February 16, 2012 | SpiderLabs Anterior On Thursday we posted our sixth question of the Trustwave 2012 Global Security ... Read More
  9. Trustwave SpiderLabs: My First Nine Days February 15, 2012 | Space Rogue So as some of you may have heard I now work at Trustwave for their SpiderLabs ... Read More
  10. Call for Assistance: OWASP Virtual Patching Survey February 17, 2012 | Ryan Barnett Identification of web application vulnerabilities is only half the battle with ... Read More
  11. #TWContest: One in how many organizations use insecure remote access... February 20, 2012 | SpiderLabs Anterior The question was… "One in how many organizations use insecure remote access ... Read More
  12. TWSL2011-013: Multiple Vulnerabilities in IceWarp Mail Server September 23, 2011 The Spiderlabs team at Trustwave published a new advisory today which detail ... Read More
  13. Trustwave Releases New ModSecurity Rules and Support September 22, 2011 ModSecurity is the most popular open source web application firewall (WAF) ... Read More
  14. ModSecurity Advanced Topic of the Week: Commercial Rules Overview October 04, 2011 As you may have heard, Trustwave recently announced the availability of ... Read More
  15. Interesting Authentication Bypass Vulnerabilities September 30, 2011 Recently I've been writing a talk called "Authentication Bypass Zoo: Pwnage and ... Read More
  16. Google Android Focus Stealing Vulnerability Demo September 27, 2011 Way back in August 2011, myself and Sean Schulte gave a presentation at DEF CON ... Read More
  17. NickiSpy.C - Android Malware Analysis Demo October 26, 2011 | Josh Grunzweig Recently I got the chance to dig into a nice little piece of Android spyware, ... Read More

2011 22

December 2011

  1. Trustwave Protections Deployed: Duqu November 06, 2011 | Robert Foggia Recent reports of the zero-day exploit found in the Win32k True Type Font ... Read More
  2. Trustwave Protections Deployed: MS11-083 November 15, 2011 | Robert Foggia Last week, it was Microsoft's Patch Tuesday! For November, Microsoft released ... Read More
  3. [Honeypot Alert] Mass Joomla Component LFI Attacks Identified November 17, 2011 | Ryan Barnett Joomla Component LFI Vulnerabilities Joomla has hundreds of Controller ... Read More
  4. [Honeypot Alert] WordPress/Joomla/Mambo SQL Injection Scanning Detected December 09, 2011 | Ryan Barnett Our web honeypot analysis today detected scanning looking for SQL Injection ... Read More
  5. [Honeypot Alert] WordPress/Joomla/Mambo SQL Injection Scanning Detected December 09, 2011 | Ryan Barnett Our web honeypot analysis today detected scanning looking for SQL Injection ... Read More
  6. [Honeypot Alert] Awstats Command Injection Scanning Detected December 13, 2011 | Ryan Barnett Issue Detected Our daily web honeypot analysis has detected an increase in ... Read More
  7. Microsoft Patch Tuesday, December 2011 December 13, 2011 This Patch Tuesday, there are 3 new Critical and 10 new Important Bulletins. ... Read More
  8. Mobile Device Location Tracking, and Why It Matters December 14, 2011 Throughout the past decade, there has been a substantial increase in mobile ... Read More
  9. BayThreat Follow-up: More About Mobile Devices and Privacy December 15, 2011 | Luiz Eduardo Dos Santos We just saw a recent post here on SpiderLabs Anterior about one of mostly used ... Read More
  10. [Honeypot Alert] phpAlbum PHP Code Execution Attacks December 19, 2011 | Ryan Barnett We have seen a number of scans probing for phpAlbum code execution vulns in our ... Read More
  11. Announcing Release of OWASP ModSecurity Core Rule Set v2.2.3 December 19, 2011 | Ryan Barnett The SpiderLabs Research Team is pleased to announce the ModSecurity OWASP Core ... Read More
  12. TWSL2011-018: Authentication Bypass Vulnerability in IBM TS3100/TS3200 Web User Interface December 21, 2011 | Robert Foggia The Spiderlabs team at Trustwave published a new advisory for a authentication ... Read More
  13. [Honeypot Alert] User Agent Field Arbitrary PHP Code Execution December 21, 2011 | Ryan Barnett While reviewing today's web honeypot logs, SpiderLabs Research identified two ... Read More

November 2011

  1. TWSL2011-019: Cross-Site Scripting Vulnerability in phpMyAdmin December 23, 2011 | Robert Foggia The Spiderlabs team at Trustwave published a new advisory for a ... Read More
  2. [Honeypot Alert] Plone and Zope Remote Command Execution Detected December 27, 2011 | Ryan Barnett We have identified active scanning for the recent Plone and Zope Remote Command ... Read More
  3. [Honeypot Alert] phpThumb() 'fltr[]' Parameter Command Injection Detected December 28, 2011 | Ryan Barnett The SpiderLabs Research Team has identified active scanning for the phpThumb() ... Read More

October 2011

  1. Virtual Patch for ASP.Net Forms Authentication Bypass Vulnerability (CVE-2011-3416) January 04, 2012 | Ryan Barnett Last Thursday, Microsoft released an out-of-band security patch (MS11-100) ... Read More
  2. Introducing SQLol January 06, 2012 | Dan Crowley At the most recent Austin Hackers Association meeting I unveiled a project I've ... Read More

September 2011

  1. ModSecurity Advanced Topic of the Week: Mitigation of 'Slow Read' Denial of Service Attack January 06, 2012 | Ryan Barnett Slow-Read DoS Attack Background Another tweak in the ongoing "Slow" DoS attacks ... Read More
  2. Analyzing PDF Malware - Part 2 January 06, 2012 Where were we? Read More
  3. [Honeypot Alert] Multiple Local File Inclusion Attacks January 09, 2012 | Ryan Barnett Our web server honeypot log analysis has picked up some targeted local file ... Read More
  4. ModSecurity Mitigations for ASP.NET HashTable DoS Vulnerability (CVE-2011-3414) January 09, 2012 | Ryan Barnett ThreatPost had a news story today about PoC code that was released to the full ... Read More

2013–2026 →