[Pauldotcom] WMI help to query for HTTP methods

Hi, I'm looking for some help with WMI. I haven't used WMI, but I had a coworker reach out to me about it. Can WMI be used to query IIS in order to get back the list of supported HTTP Methods? Thanks ___ Pauldotcom mailing list Pauldotcom@mail.pauldotc

Re: [Pauldotcom] ISMS Framework - the big picture

Hi, Hi is so 27001 is a standard published by the BSI organization. It is a list of controls and clauses you must implement in order to pass the BSI's audit to get certified with bsi for 27001. Jim Sent from my iPhone On Sep 5, 2013, at 6:05 PM, "marck e." wrote: > Our new CIO has asked us

Re: [Pauldotcom] Which security technique or programming is good?

Being a subject matter expert in a specific area is great! But becoming well rounded will also go a long way. As others mentioned too, learning to code on your own will be very helpful as you won't have to rely on te work of others. You can extend something already built or even write somethin

Re: [Pauldotcom] Looking for recommendation on Win Phone to get for testing

Thanks for all the info guys! Sent from my iPhone On Mar 15, 2013, at 6:57 PM, Blibbet wrote: > > Are the Nokia 900 and Samsung Focus 2 rootable/jailbreakable? > > Sorry, not sure. > > >> I just asked a WP ISV friend, and he says currently the Nokia > >> 900 and Samsung Focus 2 are the frontr

Re: [Pauldotcom] Looking for recommendation on Win Phone to get for testing

531 > > I think several of the roms come unlocked/rooted/etc. > > > On Tue, Mar 12, 2013 at 2:13 PM, Dimitrios Kapsalis > wrote: > >> :) Sorry, I meant the Lumia 900. The Nokia n900 is as I already own that >> device. >> >> >> On Tue, Mar 12, 2013 a

Re: [Pauldotcom] Looking for recommendation on Win Phone to get for testing

:) Sorry, I meant the Lumia 900. The Nokia n900 is as I already own that device. On Tue, Mar 12, 2013 at 1:33 PM, Bobby Stoskopf wrote: > i imagine the nokia is.. it's what pwnieexpress uses > > http://pwnieexpress.com/products/pwnphone > > > On Tue, Mar 12, 201

Re: [Pauldotcom] Looking for recommendation on Win Phone to get for testing

Are the Nokia 900 and Samsung Focus 2 rootable/jailbreakable? On Tue, Mar 12, 2013 at 12:43 PM, Blibbet wrote: > I'm looking for a recommendation on which WinPhone 7.x is the best to get >> in >> order to perform mobile assessments on. I don't get many assessments on >> these devices, and last I

[Pauldotcom] Looking for recommendation on Win Phone to get for testing

Hi All, I'm looking for a recommendation on which WinPhone 7.x is the best to get in order to perform mobile assessments on. I don't get many assessments on these devices, and last I had checked there wasn't much in this area for rooting the devices and getting access to the file system. Addition

Re: [Pauldotcom] Request: Cloud multi-tenancy environment assessment resources

are running on untrustworthy hardware. > Because they are. Control your own crypto, manage your own keys, > instrument and monitor, firewall like mad, etc. > > > Jack > > On Mon, Mar 4, 2013 at 12:00 PM, Dimitrios Kapsalis > wrote: >> Hi All, >> >&

[Pauldotcom] Request: Cloud multi-tenancy environment assessment resources

Hi All, I'm looking for any resources you may be able to provide regarding assessing cloud multi-tenancy environments. I understand that many of the controls tested when assessing a data center, network, or application would still apply, however is there anything to keep in mind? Regards. ___

Re: [Pauldotcom] How to perform ip forwarding similar to iptables in ubuntu

e for credentials which got annoying. I did not allow for any review of the traffic. On Thu, Feb 21, 2013 at 2:28 PM, Chris Campbell wrote: > Not replaced by, in addition to. > > Sent from my iPhone > > On 21 Feb 2013, at 20:16, Matt wrote: > > > > > On 21. feb.

[Pauldotcom] How to perform ip forwarding similar to iptables in ubuntu

Hi, I'm looking to do some testing on a thick client application installed on 10.8. The application does not have any capability to enter proxy information, I'm looking to understand if OSX has the ability to do ip forwarding as can be done with iptables on Ubuntu. Regards, Jim __

[Pauldotcom] Was FRAK presented at Blackhat/Defcon ever released?

Was FRAK ever released after being presented at BH and Defcon? For those that are not aware of FRAK, please find the presentation deck below. http://www.slideshare.net/the_netlocksmith/defcon-2012-firmware-vulnerability-hunting-with-frak ___ Pauldotcom

[Pauldotcom] Dodoni - Kismet network parser project

Hi all, I've started a new project over the weekend after performing some war driving. I've created a tool, that provided a KML file of the identified networks, the tool will generate a unique wordlist which can be used as a password list. Additionally, the tool is structured in a way where anyon

[Pauldotcom] [Mobile Penetration Testing] - Building the iSecPartners iOS-SSL-Kill-Switch MobileSubstrate Tweak

Hi all, I thought it would be valuable to share with all how to build the iSecPartners iOS SSL Kill Switch MobileSubstrate tweak. The steps explain how to build the tweak from source. It does not provide the compiled .deb file or show how to install the tweak. If there is an interest in this I can

[Pauldotcom] Ettercap bridge mode help

Hi all, Trying to get ettercap to run in bridged more using a filter and it's not working. I don't have the error handy right now but can provide if required. Not sure if it's my options or not. Has anyone don't this before? Regards. Sent from my iPhone __

Re: [Pauldotcom] Replay HTTP Request across proxy list - Does a tool like this exist?

at file) > (Around line 530) > > /x > > (1) https://githut.com/xme/pastemon > -- > Can't sleep, hackers will eat me! > PGP Key: > http://pgp.mit.edu:11371/pks/lookup?op=get&search=0x42D006FD51AD7F2C > > On 20 Jul 2012, at 17:51, Dimitrios Kapsalis wrote: > >

[Pauldotcom] Replay HTTP Request across proxy list - Does a tool like this exist?

Hi, I'm looking to do some research/testing and am looking to see if a tool exists which will replay an HTTP request over and over, and each time use a different proxy. Regards. ___ Pauldotcom mailing list Pauldotcom@mail.pauldotcom.com http://mail.paul

Re: [Pauldotcom] Does a DirBuster SAP list exist?

e is a list I saved a while back for SAP...Unsure of its age, or where >> I got it from... >> >> >> >> ------ >> *From:* Dimitrios Kapsalis >> *To:* PaulDotCom Security Weekly Mailing List < >> pauldotcom@mail.pauldotcom.com&g

[Pauldotcom] Does a DirBuster SAP list exist?

Hi, I'm looking to see if anyone has created a wordlist specific for SAP Netweaver that can be used in DirBuster. Regards, Jim ___ Pauldotcom mailing list Pauldotcom@mail.pauldotcom.com http://mail.pauldotcom.com/cgi-bin/mailman/listinfo/pauldotcom Main

Re: [Pauldotcom] Capturing HTTPS traffic from iPhone/iPad

n Sat, Feb 4, 2012 at 8:01 AM, Joshua Wright wrote: > On 2/3/2012 11:00 AM, Dimitrios Kapsalis wrote: > >> Additionally, I tried another application, at first it did not work. >> After installing the burp cert I can capture its traffic. The original >> application still fa

Re: [Pauldotcom] Capturing HTTPS traffic from iPhone/iPad

another application, at first it did not work. After installing the burp cert I can capture its traffic. The original application still fails. Thanks, Jim On Fri, Feb 3, 2012 at 8:26 AM, Joshua Wright wrote: > On 2/2/2012 1:12 PM, Dimitrios Kapsalis wrote: > >> I have updated my iOS dev

[Pauldotcom] Capturing HTTPS traffic from iPhone/iPad

Hi, I have updated my iOS device to 5.0.1, in order to try to capture the HTTPS traffic from an application. The application returns an error that the the connection cannot be established. I've tried it with the WebScarab, Fiddler, and Burp. I've installed for each the certificate in my iOS devic

Re: [Pauldotcom] Security Assessment: Mobile Application on Windows Mobile 6

Yes I have VMWare tools installed. On Mon, Jan 16, 2012 at 11:01 AM, Dan King wrote: > Do you have VMWare tools installed? > > On Mon, Jan 16, 2012 at 11:54 AM, Dimitrios Kapsalis > wrote: > >> Hi Josh, >> >> I turned off my proxy, reset iptables, and disable

Re: [Pauldotcom] Security Assessment: Mobile Application on Windows Mobile 6

That was the issue! Once I ran the same configuration on the physical machine, the packets popped right up in Burp. Thanks! On Mon, Jan 16, 2012 at 10:54 AM, Dimitrios Kapsalis wrote: > Hi Josh, > > I turned off my proxy, reset iptables, and disabled ip_forwarding. I did > this to

Re: [Pauldotcom] Security Assessment: Mobile Application on Windows Mobile 6

Hi Josh, I turned off my proxy, reset iptables, and disabled ip_forwarding. I did this to ensure that none of them would be possibly impacting my test of just ettercap. I ran ettercap with the command: ettercap -TqM arp:remote /192.168.1.134/ / 192.168.1.1/ When executing the chk_poison plugin,

Re: [Pauldotcom] Security Assessment: Mobile Application on Windows Mobile 6

Having some difficulty setting this up on BT5. Maybe someone can see what I am missing. My set up is as follows. Devices: * BT5 running in VMWare * WM6 device Both devices are in the same network segment. The steps I took to configure the set up are: 1. Enable IP Forwarding $ echo 1 > /pro

Re: [Pauldotcom] Security Assessment: Mobile Application on Windows Mobile 6

dwest. Thanks, Jim On Thu, Jan 12, 2012 at 2:13 PM, Joshua Wright wrote: > On 1/12/2012 2:55 PM, Dimitrios Kapsalis wrote: > >> I'm experimenting with different mobile devices and applications on each. >> For the WM6 I have an application whose traffic I'd like to captur

[Pauldotcom] Security Assessment: Mobile Application on Windows Mobile 6

Hi, I'm experimenting with different mobile devices and applications on each. For the WM6 I have an application whose traffic I'd like to capture using an HTTP Proxy. How can a proxy be configured for the connection? I saw one proxy setting in the connections menu but it does not seem to be workin

Re: [Pauldotcom] How can i Penetration a web site for security?

Install some of the vulnerable site packages that are available and practice. Sent from my iPhone On Dec 30, 2011, at 8:41 AM, Matt wrote: > > On 25 Dec 2011, at 12:40 PM, Mohsen Mostafa Jokar wrote: > >> I want test my web site for security hole and attack,can you show me some >> tools or g

[Pauldotcom] Android Emulator intercepting SSL Traffic

The android emulator appears to have strict SSL enforced and thus is limiting my ability to test traffic of my application through burp proxy and other proxies. Given my understanding, the android device and emulator have a trusted cacerts store on the device similar to that which is part of the J

[Pauldotcom] Looking for info on Windows Phone 7 Application Assessment

Hi, I'm preparing to perform an assessment for a windows phone7 application. This is my first time in this space and am interested to see if anyone has performed an assessment like this in the past or has any tips. I've done iPhone and Android assessments thus far leveraging both the emulators an

Re: [Pauldotcom] Any tips for assessing Flash Applications and Silverlight?

wrote: > Define "access them" > > > On Oct 6, 2011, at 4:14 PM, Dimitrios Kapsalis wrote: > > > Been asked to look into flash and silverlight applications and ways to > assess them. > > > > With flash there are some items I have in mind as I have pl

Re: [Pauldotcom] Any tips for assessing Flash Applications and Silverlight?

So far I was aware of HP's SWFScan. It does a static analysis of the code, suppose that is a good start. Got to find myself a vulnerable flash file to try some dynamic testing and see if it can be manipulated. Thanks for the direction! Appreciate it. __

[Pauldotcom] Any tips for assessing Flash Applications and Silverlight?

Been asked to look into flash and silverlight applications and ways to assess them. With flash there are some items I have in mind as I have played with it a bit, silverlight however is a new animal. Any recommendations for tips or resources to look into? _

Re: [Pauldotcom] Derbycon 2011, Day 2, Track 2 Talks Posted

Adrian - Thanks for making these available! Really appreciate it. On Thu, Oct 6, 2011 at 8:57 AM, Adrian Crenshaw wrote: > Derbycon 2011, Day 2, Track 2 Talks > Posted > In this wave are the videos from the 2nd day of the conference t

Re: [Pauldotcom] Anyone do an assessment on SAP Desktop?

> >> I recall it is a web based app. When I did testing a few years back I >> recall finding several XSS vulns. So, check input and out validation. >> >> On Jun 21, 2011, at 11:33 AM, Dimitrios Kapsalis >> wrote: >> >> > Hi All, >> > >

Re: [Pauldotcom] Anyone do an assessment on SAP Desktop?

en I did testing a few years back I > recall finding several XSS vulns. So, check input and out validation. > > On Jun 21, 2011, at 11:33 AM, Dimitrios Kapsalis > wrote: > > > Hi All, > > > > I'll be doing an assessment of SAP Desktop in the coming days. Anything

[Pauldotcom] Anyone do an assessment on SAP Desktop?

Hi All, I'll be doing an assessment of SAP Desktop in the coming days. Anything thing that is specific to SAP that I should keep an eye out for? Currently I've treated it as a web application and started preparing my assessment as a regular web application. Thanks, Jim ___

Re: [Pauldotcom] OWASP AppSec EU, slides, pictures and experience

Thanks guys! Helps us who could not make it! On Tue, Jun 21, 2011 at 1:55 AM, Xander Solis wrote: > Abraham, > > Thank you for the information. Awesome blog post btw. > > Regards, > > Xander > > On Sat, Jun 18, 2011 at 11:58 AM, Abraham Aranguren > wrote: > >> Hi folks, >> >> For those that cou

Re: [Pauldotcom] Metasploit Unleashed - PDF

Great thanks! On Thu, Jun 9, 2011 at 5:23 AM, gold flake wrote: > There were recent requests on this forum for a PDF version of the > Metasploit Unleashed course. I have made a PDF of the contents > available on the website and it is uploaded at > http://www.mediafire.com/?bt4902x3h6mu8s5. > >

Re: [Pauldotcom] Footprinting/OSInt/Recon/Cyberstalking class

Good work Adrian! I'll check them out. On Mon, May 23, 2011 at 8:46 AM, Adrian Crenshaw wrote: > Hi all, >For those that might care, I put up the videos for the > Footprinting/OSInt/Recon/Cyberstalking class I did up in Fort Wayne Indiana > for the Northeast Indiana Chapter of ISSA. > > > ht

[Pauldotcom] Planning to go to first BlackHat conference in Vegas. What do you recommend for course to take?

Hi all, Going to Blackhat in Vegas this year, I'm looking at the courses and SO many look appealing, but we can't attend all. Any courses you recommend or have heard good things about? Thanks, Jim ___ Pauldotcom mailing list Pauldotcom@mail.pauldotcom.c

Re: [Pauldotcom] Single Sign-On Compliancy

I've seen that single sign implemented using a tiered approach. Based on the level of security required, the log on page will either prompt for user credentials based on their active directory profile, or use RSA SecureID. In general I haven't seen to many drawbacks with using this approach or havi

Re: [Pauldotcom] Website Extractor

You can try this one. http://www.httrack.com/ On Mon, Feb 7, 2011 at 3:53 PM, Juan Cortes wrote: > Hope all is well guys! > > I know there's such tool but i can't find it. > Basically I want to extract a website of all its content. and save them as > a file per page. > > thanks in advance. > > Ju

Re: [Pauldotcom] Password Generator app for iOS

Thanks! Any feedback to improve it :) Sent from my iPhone On Jan 20, 2011, at 8:43 PM, Chris Blazek wrote: > I'm sorry, I couldn't resist. :) > > Nice little app! > > > > > On Thu, Jan 20, 2011 at 7:08 PM, Dimitrios Kapsalis > wrote: > Haha nope!

Re: [Pauldotcom] Password Generator app for iOS

Haha nope! Feel free to rip it apart. I don't send any passwords generated out. Sent from my iPhone On Jan 20, 2011, at 5:03 PM, Chris Blazek wrote: > so are you logging ips and passwords generated for later use? :) > > Chris > > On Thu, Jan 20, 2011 at 4:30 PM, Dimitrio

Re: [Pauldotcom] Password Generator app for iOS

Sorry :) kizmo On Thu, Jan 20, 2011 at 3:32 PM, xgermx wrote: > What's it called? > > On Thu, Jan 20, 2011 at 11:59 AM, Dimitrios Kapsalis > wrote: > >> Hey guys, >> >> Put together a password generator application set it on the AppStore. >> Its f

[Pauldotcom] Password Generator app for iOS

Hey guys, Put together a password generator application set it on the AppStore. Its free, so let me know if you have any feedback or how to improve. Thanks! ___ Pauldotcom mailing list Pauldotcom@mail.pauldotcom.com http://mail.pauldotcom.com/cgi-bin/ma

Re: [Pauldotcom] Paper for Shmoocon

I can read it :) should be a fun read Sent from my iPhone On Dec 20, 2010, at 9:19 AM, Adrian Crenshaw wrote: > Hi all, > I'm working on finishing up my paper on Malicious USB devices for > Shmoocon. Anyone care to be a proofreader/commenter? > > Thanks, > Adrian > ___

Re: [Pauldotcom] Winxp event viewer

try using snare or lasso. If you > are looking to do some deep searching on the log data I would recommend > downloading splunk. You can have it pull the data off in several ways WMI, > nfs, or agent based. They give a 500mb/ day index license away for free. > > > > >

Re: [Pauldotcom] Winxp event viewer

It is. I was wondering if any tools exists to pull it from there. Sent from my iPad On Oct 31, 2010, at 7:37 PM, Vincent Lape wrote: > Should be in the security event log if you have failures turned on. > > > > On Oct 31, 2010, at 2:11 PM, Dimitrios Kapsalis wrote

[Pauldotcom] Winxp event viewer

Hey all, One of my xp home boxes is being bruteforce scanned on ssh port. Anyway to interface with event viewer to harvest source IP addresses and usernames attackers are using? Sent from my iPhone ___ Pauldotcom mailing list Pauldotcom@mail.pauldot

Re: [Pauldotcom] Misc Web Pen testing scripts

Thanks for sharing! On Tue, Sep 7, 2010 at 10:30 AM, Baggett, Mark wrote: > Not at all, but let me clean them up a bit first. I have a few small > errors to fix then I'll post them to the pdc blog. > > -Original Message- > From: pauldotcom-boun...@mail.pauldotcom.com [mailto: > pauldotco

Re: [Pauldotcom] dealing with nmap XML and NSE output

I suppose, one could through together an XSLT program which can pull the relevant information from the xml file and create an HTML report for example. Another option would be to use a streaming API such as SAX to parse the xml file and pull the relavant information your looking to use. On Tue, Ju

Re: [Pauldotcom] Missing a file...

He's referring to the config.h file from the ago bot code he is trying to build. On Mon, Mar 29, 2010 at 11:55 AM, Daniel Holiday wrote: > Usually the config.h file is generated when you run > > ./configure > > in a -nix environment. > > > On Sun, Mar 28, 2010 at 4:14 PM, NetEvil wrote: > >> Hi

Re: [Pauldotcom] Missing a file...

Hey, Let me know what version of the ago bot you tried to run. I have one version and got it all configured. I'd have to pull that vm up and see what the config file looks like. I can send it your way if you need it. Jim On Sun, Mar 28, 2010 at 5:14 PM, NetEvil wrote: > Hi guys > In my researc

Re: [Pauldotcom] HDD(corrupted) data recovery help?

Few times I used spinrite worked well for me Sent from my iPhone On Mar 14, 2010, at 18:40, Michael Salmon wrote: Would this be a good time for some SpinRite testimonials? On Mar 14, 2010 7:05 PM, "William Gibson" wrote: So I just started having bad sectors in my WD external 1TB hdd and

Re: [Pauldotcom] Ssh break in attempt

I have seen similar on my home pc as well. Running ssh on a windows box so the invalid login attempts are being saved in the Event log. Any way to harvest these user names? To see what is being used by the attackers, skimming through the event log it definitely looks to be dictionary based. On

Re: [Pauldotcom] Odd PHP file, trying to find out what it does

Google this tag: which is seen in the code above. This looks to be an older attack that came up around 3/24/09. On Mon, Mar 1, 2010 at 10:29 AM, Andrew Ellis wrote: > This is pretty heavily obscured (obviously), but the structure and > some of the things it's doing is reminiscent of PHP Shell,

Re: [Pauldotcom] Firetalks Videos

Thanks for posting these. Appreciate it. On Wed, Feb 10, 2010 at 7:35 AM, Adrian Crenshaw wrote: > Here you go, 2:20:29 of goodness from David “ReL1K” Kennedy, Michael > “theprez98″ Schearer, Marcus J. Carey, Adrian “IronGeek” Crenshaw, Nicholas > “aricon” Berthaume, Zero Chaos, Benny "security4a

Re: [Pauldotcom] Meterpreter scripts written for 3.2 will they work for 3.3?

Hi Carlos, below is the code for my script. Thanks, Jim # # This is a Meterpreter script designed to be used by the Metasploit Framework # # Meterpreter script for pulling forensics data from registry for any USB device # connected to system # # Provided by Dimitrios Kapsalis # Verion: 0.1

Re: [Pauldotcom] packers....

It's good but again not perfect. Does help though. Sent from my iPhone On Feb 7, 2010, at 8:59, Robert Portvliet wrote: What about PE-Scrambler? Have not used it myself, but have heard good things, thoughts? On Fri, Feb 5, 2010 at 9:41 AM, Duncan Alderson > wrote: Hi David, Have yo

Re: [Pauldotcom] Meterpreter scripts written for 3.2 will they work for 3.3?

los Perez wrote: > it should work without any problem, can you provide more info like against > what OS this is being ran against, on XP it should work, but Vista and 7 if > UAC is enabled it might fail, can you share the script? > On Feb 5, 2010, at 7:34 PM, Dimitrios Kapsalis wrote:

[Pauldotcom] Meterpreter scripts written for 3.2 will they work for 3.3?

I wrote a script for 3.2 to dump the USB info from the registry and when trying to run the script that worked for 3.2 under 3.3 it failed. The location it failed at is: session.sys.registry.create_key(root_key, base_key).each_key() do |device| Anything need to be changed for 3.3 to get this to wo

Re: [Pauldotcom] USB monitoring software

i wrote a meterpreter script if needed to pull info from registry. On Wed, Jan 27, 2010 at 6:40 PM, Jason Wood wrote: > You might want to check out a nirsoft app named USBDeview. It has ability > to take list of host names and then dump the results of USB devices to > various text file types.

Re: [Pauldotcom] Files containing credential stores sorted by operating system.

Google hacking can help too. On Tue, Jan 26, 2010 at 11:23 AM, PJ McGarvey wrote: > The one for finding WPA keys is pretty neat, cracking WPA has never been > easier. > > Also try searching for files with 'pwd', 'pass', 'logins', etc. in the > filename, you'd be amazed how many people store work

Re: [Pauldotcom] rainbow tables at Shmoocon

What about for the password files since they are generally smaller than rainbow tables, can we use the new forum on the site? On Tue, Jan 26, 2010 at 10:40 AM, Dimitrios Kapsalis wrote: > :) woohoo. > > > > On Tue, Jan 26, 2010 at 10:37 AM, Robin Wood wrote: > >> I&#

Re: [Pauldotcom] rainbow tables at Shmoocon

:) woohoo. On Tue, Jan 26, 2010 at 10:37 AM, Robin Wood wrote: > I'm sure I can find time to nip to the radioshack or somewhere else > that sells drives if it gets that desperate! We can but hope. > > 2010/1/26 Nicholas B. : > > I'm gonna be running back to my house and back during the con wher

Re: [Pauldotcom] rainbow tables at Shmoocon

Hope it can be somehow available to us who can't be at schmoocon. ___ Pauldotcom mailing list Pauldotcom@mail.pauldotcom.com http://mail.pauldotcom.com/cgi-bin/mailman/listinfo/pauldotcom Main Web Site: http://pauldotcom.com

Re: [Pauldotcom] rainbow tables at Shmoocon

Boohoo I won't be making it to schmoocon :( hopefully i can still get them)... On Wed, Jan 6, 2010 at 9:55 AM, Robin Wood wrote: > 2010/1/6 Jim Halfpenny : > > I'm not sure I would trust the rainbow tables in such a collection. It > would > > be easy to drop poisoned tables where a pecentage of

Re: [Pauldotcom] rainbow tables at Shmoocon

y them at Shmoocon. I'll publish a list of what I > get access to at the time and if you've got anything that I haven't > let me know and we can sort something out. > > Robin > > 2010/1/4 Dimitrios Kapsalis : > > Hi Robin, > > > > Are you looking

Re: [Pauldotcom] rainbow tables at Shmoocon

I have about the same amount as well. Maybe we can set something up where we can provide Disks and Postage and have the tables shared amongst everyone? On Mon, Jan 4, 2010 at 12:09 PM, Robert Miller wrote: > Robin, > > I have a few totaling roughly 35GB, you are more than welcome to them if >

Re: [Pauldotcom] rainbow tables at Shmoocon

Hi Robin, Are you looking for anything in particular? I'm not going to shmoocon but maybe we can set it through mail. Jim. On Mon, Jan 4, 2010 at 11:42 AM, Robin Wood wrote: > Hi > Is there anyone going to Shmoocon with a collection of rainbow tables > they'd like to share? I'm after tables f

Re: [Pauldotcom] Manually embedding shellcode into executables

I haven't had much success with the msfpayload, seem that most virus scans pick up the payload. Even tried to use a couple types of encoding stacked on top of each other with out much luck. play with it and then test exe against virustotal.com On Tue, Dec 1, 2009 at 4:17 PM, Adrian Crenshaw wrote

Re: [Pauldotcom] Manually embedding shellcode into executables

I'd be interested in this topic as well. On Tue, Dec 1, 2009 at 10:13 AM, Matthew Raspberry wrote: > Hey all, > > I was listening to Pauldotcom episode 176 when Relic was talking about > manually embedding payloads into executables and I was wondering if someone > could point me to a book or web

Re: [Pauldotcom] Forget the laugh, no have a painful groan on me...

Guess they dont know the assumption, to assume that the hackers are teenagers with no girlfriends or work with all the time on their hands. Thus they would be able to keep up with the network changes. ___ Pauldotcom mailing list Pauldotcom@mail.pauldotcom

Re: [Pauldotcom] Have a laugh on me...

I'd take this guy for coffee to Starbucks. set up wireshark and show him what can happen. On Mon, Oct 12, 2009 at 2:42 PM, Vincent Lape wrote: > document your conversation with "top buy" create a report stating the > issue and remediation recommendations and just wait till it gets > pwned. Once

Re: [Pauldotcom] SNOW stego

I was able to. Posted it in the other thread. On Wed, Sep 30, 2009 at 10:04 AM, Adrian Crenshaw wrote: > Were yo able to successfully convert the message back? It should read > something like "Listen to pauldotcom" > > Adrian > > > > > On Wed, Sep 30, 2009 at 10:32 AM, Grymoire wrote: > >> >> >It

Re: [Pauldotcom] Whitespace Stego

Listen to pauldotcom. On Wed, Sep 30, 2009 at 9:38 AM, Vincent Lape wrote: > Too bad there was not an app available for iPhone / crackberry to > check for stego in attachments. > > On Sep 30, 2009, at 6:42 AM, Adrian Crenshaw > wrote: > > > I was interested in making a stego program that hid

[Pauldotcom] Ruby and Pcaplet library windows

Is it possible to set up ruby and pcaplet on a windows box? I just discovere this library and wanted to explore it a bit. If not anyone have any guide for setting it up on linux? I take it its straght forward from little ive read so far. thanks ___ Paul

Re: [Pauldotcom] Dial Home Docs

The only way I can think of this occuring in a word doc is to write a macro. The macro can just ping your box, this should be enough to get the IP. On Mon, Sep 21, 2009 at 2:56 AM, Andrew Ellis wrote: > You could add a tab to firefox's default tabs (the ones it loads on a > new session) that poi

[Pauldotcom] When virus scans are there certain directories they skip?

Was thinking this afternoon, when anti-virus scans run, are there certain directories that they always skip? ___ Pauldotcom mailing list Pauldotcom@mail.pauldotcom.com http://mail.pauldotcom.com/cgi-bin/mailman/listinfo/pauldotcom Main Web Site: http://pa

Re: [Pauldotcom] PEScrambler

I actually found the file a few weeks go when the site came up again. Played with it a bit with meterpreter and msfpayload. In some cases it did work and in some it did not. I didn't try to play with files of different sizes as is described above. >From what I understand, it disassembles the code

Re: [Pauldotcom] Forensically interesting spots in the Windows 7, Vista and XP file system and registry (prep work for my anti-forensics class)

ge << "\t\t- DeviceDesc : #{deviceDesc.data}\n" message << "\t\t - HardwareID : #{hardwareID.data}\n" Iterate thru each key, get the values and close the key before going to the next. I hope this helps On Fri, Aug 14, 2009 at 4:47 PM, Dimitrios Kapsalis > w

Re: [Pauldotcom] Forensically interesting spots in the Windows 7, Vista and XP file system and registry (prep work for my anti-forensics class)

script for pulling forensics data from registry for any USB device # connected to system # # Provided by Dimitrios Kapsalis # Verion: 0.1 require 'fileutils' # ===

Re: [Pauldotcom] How much do timestamps matter?

I think some of the info in the file system journal helps when people try to alter timestamps Sent from my iPhone On Aug 11, 2009, at 20:26, Grymoire wrote: > >> As the subject states, how much do file time stamp matter to a >> forensics >> case? If some one finds my collection of "Nazi alb

[Pauldotcom] Metasploit beginner

Hi All, I started to play with metasploit this weekend and actually sit down to learn how to work it. I set up a lab environment and was able to create an "evil" exe that would connect back to my generic handler. This took some time to really understand and get it to work, but now I got that piec

Re: [Pauldotcom] Blue Team Tactics

Thanks for starting a thread like this John. It can be very educational to see how others go about protecting their boxes coming from the Blue team! On Tue, Jul 28, 2009 at 7:54 AM, John Strand wrote: > Please! PSW land! Share your Blue Team tactics! > What tools, scripts, and techniques do you

Re: [Pauldotcom] Another Undocumented Feature

My XP is completely patched and it created a NULL folder. On Sun, Jul 19, 2009 at 11:34 AM, Robin Wood wrote: > 2009/7/19 Tom Brennan - Personal : > > right click the windows desktop and create a folder named: > > > > CON or PRN or NULL > > > > > > NULL works ok in a completely unpatched XP, th

Re: [Pauldotcom] Another Undocumented Feature

, 2009 at 1:01 PM, Dimitrios Kapsalis wrote: > NULL works :) > > The other two just go back to New Folder > > On Sun, Jul 19, 2009 at 8:56 AM, Tom Brennan - Personal < > jinxpu...@gmail.com> wrote: > >> right click the windows desktop and create a folde

Re: [Pauldotcom] Another Undocumented Feature

NULL works :) The other two just go back to New Folder On Sun, Jul 19, 2009 at 8:56 AM, Tom Brennan - Personal wrote: > right click the windows desktop and create a folder named: > > CON or PRN or NULL > > > > Brennan > www.proactiverisk.com > > ___

Re: [Pauldotcom] Anti-forensic tools

IE8 I believe has the same type of feature in it that allows for Private Browsing. On Thu, Jul 2, 2009 at 6:21 AM, Adrian Crenshaw wrote: > To Mad Marv: I've been using Eraser some, and I recently found that you can > cover files with another file when you do a wipe instead of just > random/zeros

Re: [Pauldotcom] Cracking good times (UNCLASSIFIED)

My experience with the online ones is that I haven't really seen any that implement salts. I haven't looked in some time thought so maybe now they exist. On Tue, Jun 30, 2009 at 1:33 PM, Robert Portvliet < robert.portvl...@gmail.com> wrote: > > Assuming the attacker retrieves the hashes ...at wh

Re: [Pauldotcom] Multiple Kismet Drones

Hi Micheal, Where can I find Larry's SANS paper you referenced? Thanks, Jim On Fri, May 22, 2009 at 7:21 AM, Michael Boyd wrote: > I'll be the WRT54GL for all drones. Actually, for this new rollout, I > was using Larry's SANS paper as a guide. I was planning on having two > drones per floor. L

Re: [Pauldotcom] Spoofing emails

Can someone send an example of how to do this using metasploit's mailer? Im new to metasploit so still learning! On Mon, May 11, 2009 at 3:18 PM, MV wrote: > fire it my way please > > > On Mon, May 11, 2009 at 9:23 AM, Robin Wood wrote: > >> I built an app recently that takes a html page and a

Re: [Pauldotcom] Openwrt & Cell Phone

Whats the issue your having? I've used DD-WRT with my wifi on my phone before with no issues. On Mon, May 11, 2009 at 7:11 AM, Cody Dumont wrote: > > Greetings All, > > Any one ever used openwrt to access the internet via a Cell phone or pda. > > Thanks... > > Cody >

Re: [Pauldotcom] Can Twitter be used to control a bot?

I dont see any reason why twitter couldnt be used as a C&C for a bot net. I think the main characteristics you would need for a C&C are: 1. Each to provide commands - need some protocol between bots and C&C 2. Availability of C&C center to be always up To make it more intersting, i think you coul

Re: [Pauldotcom] Hype on Conficter

The Ghost net article was actually a very good read. 2009/4/2 Tim Mugherini > Thanks for your replies thus far. > > Just read Paul's post on conficker from yesterday. > > To quote "We can speculate all day and night about why we made a big deal > about this, but in the end I have to wonder, wh