protocol fuzzing past, present, future
|
|
|
- Mariah Glenn
- 9 years ago
- Views:
Transcription
1 protocol fuzzing past, present, future luiz eduardo senior systems & security engineer leduardo (at) musecurity.com Hack in the Box 07 - Kuala Lumpur Mu Security, Inc. All Rights Reserved Copyright 2007
2 agenda history of fuzzing protocol fuzzing fuzzable or not? non-sense fuzzing session-based fuzzing / stateful-based fuzzing tools techniques challenges getting creative packet fun predictions resources 2 hack in the box 07 - kuala lumpur
3 fuzzing history university of madison in 1989 by professor barton miller and his crew why? buzz word in the past few years sorta hope to find 0 days not just a http thing file format fuzzing application fuzzing and 3 hack in the box 07 - kuala lumpur
4 (possible definition)/ terms/ keywords/ etc malformed / semi-malformed/ invalid input random target exception-handling mutations instrumentation art / creativity agents negative-testing changed the mentality of: but.. that packet doesn t follow the rfc spec or hmmmmm but people are not supposed to send these packets 4 hack in the box 07 - kuala lumpur
5 (con)fuzzable or not? 5 hack in the box 07 - kuala lumpur
6 mainstreaming fuzzing numerous bugs found in the past few years some of them make the news others probably not growth in the number of specific tools 6 hack in the box 07 - kuala lumpur
7 corporate fuzzing again, nothing new. but if you don t fuzz, someone else will fuzzing became a common practice (regardless if it s done correctly or not) delivering products / services with basic testing is no longer acceptable 7 hack in the box 07 - kuala lumpur
8 so protocol fuzzing protocol abuse test robustness of the target from instability to crashes (or to remote code execution) if it s already hard for one to follow the rfc spec, how about the anything but? 8 hack in the box 07 - kuala lumpur
9 ohhh fuzzers are not va scanners! 9 hack in the box 07 - kuala lumpur
10 what to break in a protocol? structure state semantics Buffer Overflow Integer Overflow Invalid Message Format String Fragmented Field Invalid Header Null Character Wrong Encoding Invalid Index Invalid String Recursion Truncated Underflow Missing Field Mixed Case Out of Order Self-Reference Too Many Fields Invalid Offset 10 hack in the box 07 - kuala lumpur
11 what protocols to fuzz? all of them, of course but what s the buzz? what s new? what s not mature? sip scada ipv6 wireless bluetooth videogames 11 hack in the box 07 - kuala lumpur
12 non-sense fuzzing 12 hack in the box 07 - kuala lumpur
13 session-based fuzzing first you establish a channel with the target and then start fuzzing at that level 13 hack in the box 07 - kuala lumpur
14 stateful-based fuzzing one step above establishing a session on-the-fly fuzzing (possible) better fault isolation 14 hack in the box 07 - kuala lumpur
15 techniques random database (mix?) 15 hack in the box 07 - kuala lumpur
16 some of the challenges fault isolation the bug behind the bug slow protocol implementations monitor the target (memory leaks/ cpu spikes/ some type of redundancy) 16 hack in the box 07 - kuala lumpur
17 tools human spike / written in c/ block-based approach protos / java / different fuzzers peach / python / written while drinking beer at ph-neutral antiparser / python/ fuzzer and fault injection tool dfuz / c sulley/ parallel fuzzing capabilities /legos 17 hack in the box 07 - kuala lumpur
18 commercial bestorm codenomicom hydra mu security thread-x 18 hack in the box 07 - kuala lumpur
19 getting creative use different fuzzing tools use the same fuzzing tool (parallel fuzzing) use a framework to integrate other stuff (traffic gen, nmap, exploitation tools, etc) to integrate agents for monitoring well use any tools available 19 hack in the box 07 - kuala lumpur
20 packets 20 hack in the box 07 - kuala lumpur
21 packets (cont) 21 hack in the box 07 - kuala lumpur
22 packets (again) 22 hack in the box 07 - kuala lumpur
23 packets (cont) 23 hack in the box 07 - kuala lumpur
24 packets (last one) 24 hack in the box 07 - kuala lumpur
25 (con)fuzzing state of the security community bad security in depth implementations (dos?) again. lots of security is based on known attacks critical infrastructure (?) roi fuzzing is just one of the tools, but certainly has helped changing the way people think 25 hack in the box 07 - kuala lumpur
26 predictions / crazy thoughts most people already got fuzzing more intelligence has to be incoporated to protocol fuzzing protocol/ application adaptation offline protocol fuzzing/ protocol correlation redundant system testing fuzzing through tunnels proxy-fuzzing (not a-la spike proxy) fuzz through/ on/ with non-standard media types (traffic shapers, etc) creativity is key : use the brain, for anything better integration with other tools anything is fuzzable 26 hack in the box 07 - kuala lumpur
27 resources fuzzing mailing list by gadi evron book: fuzzing: brute force vulnerability discovery: pedram et al f 27 hack in the box 07 - kuala lumpur
28 questions? leduardo (at) musecurity.com 28 hack in the box 07 - kuala lumpur
protocol fuzzing past, present, future
protocol fuzzing past, present, future luiz eduardo senior systems & security engineer leduardo (at) musecurity.com gts x - são paulo Mu Security, Inc. All Rights Reserved Copyright 2007 agenda history
Tools and Techniques to automate the discovery of Zero Day Vulnerabilities. A.K.A Fuzzing 101
Tools and Techniques to automate the discovery of Zero Day Vulnerabilities A.K.A Fuzzing 101 Agenda GEEKZONE Overview of fuzzing techniques Tutorials on specific open-source fuzzers Demonstrations DIY
Peach Fuzzer Platform
Fuzzing is a software testing technique that introduces invalid, malformed, or random data to parts of a computer system, such as files, network packets, environment variables, or memory. How the tested
*[Bug hunting ] Jose Miguel Esparza 7th November 2007 Pamplona. 2007 S21sec
![*[Bug hunting ] Jose Miguel Esparza 7th November 2007 Pamplona. 2007 S21sec](/thumbs/27/11918842.jpg "*[Bug hunting ] Jose Miguel Esparza 7th November 2007 Pamplona. 2007 S21sec")
*[Bug hunting ] Jose Miguel Esparza 7th November 2007 Pamplona 2007 S21sec AGENDA Finding holes Fuzzing What is this? How to obtain data? Phases Tools Pros and cons Malybuzz What is this? Protocol specifications
Testing for Security
Testing for Security Kenneth Ingham September 29, 2009 1 Course overview The threat that security breaches present to your products and ultimately your customer base can be significant. This course is
Penetration Testing with Kali Linux
Penetration Testing with Kali Linux PWK Copyright 2014 Offensive Security Ltd. All rights reserved. Page 1 of 11 All rights reserved to Offensive Security, 2014 No part of this publication, in whole or
The Advantages of Block-Based Protocol Analysis for Security Testing
The Advantages of Block-Based Protocol Analysis for Security Testing Dave Aitel Immunity,Inc. 111 E. 7 th St. Suite 64, NY NY 10009, USA [email protected] February, 4 2002 Abstract. This paper describes
DISCOVERY OF WEB-APPLICATION VULNERABILITIES USING FUZZING TECHNIQUES
DISCOVERY OF WEB-APPLICATION VULNERABILITIES USING FUZZING TECHNIQUES By Michael Crouse Dr. Errin W. Fulp, Ph.D., Advisor Abstract The increasingly high volume of users on the web and their use of web
A Link Layer Discovery Protocol Fuzzer
The University of Texas at Austin, Department of Computer Sciences, Technical Report TR-07-24 A Link Layer Discovery Protocol Fuzzer Jeremy Hollander Department of Computer Sciences The University of Texas
PREVENTING ZERO-DAY ATTACKS IN MOBILE DEVICES
PREVENTING ZERO-DAY ATTACKS IN MOBILE DEVICES Ira Winkler Codenomicon Session ID: MBS-W05 Session Classification: Intermediate Zero Day Attacks Zero day attacks are rising in prominence They tend to be
Vulnerability Assessment and Penetration Testing
Vulnerability Assessment and Penetration Testing Module 1: Vulnerability Assessment & Penetration Testing: Introduction 1.1 Brief Introduction of Linux 1.2 About Vulnerability Assessment and Penetration
ensuring security the way how we do it
ensuring security the way how we do it HUSTEF, 2015.11.18 Attila Tóth 1 Nokia Solutions and Networks 2014 Disclaimer The ideas, processes, tools are presented from a practitioner s point of view working
Sergey Bratus Trust Lab, Dartmouth College
Adventures in SCADA Sergey Bratus Trust Lab, Dartmouth College Edmond Rogers ( bigezy ) a Fortune 500 utility company -> University of Illinois Information Trust Institute What this talk is not No 0days
Attack and Defense Techniques
Network Security Attack and Defense Techniques Anna Sperotto, Ramin Sadre Design and Analysis of Communication Networks (DACS) University of Twente The Netherlands Attack Taxonomy Many different kind of
Will Dormann: Sure. Fuzz testing is a way of testing an application in a way that you want to actually break the program.
The Power of Fuzz Testing to Reduce Security Vulnerabilities Transcript Part 1: Why Fuzz Testing? Julia Allen: Welcome to CERT's podcast series: Security for Business Leaders. The CERT program is part
SECURITY B-SIDES: ATLANTA STRATEGIC PENETRATION TESTING. Presented by: Dave Kennedy Eric Smith
SECURITY B-SIDES: ATLANTA STRATEGIC PENETRATION TESTING Presented by: Dave Kennedy Eric Smith AGENDA Penetration Testing by the masses Review of current state by most service providers Deficiencies in
Learn Ethical Hacking, Become a Pentester
Learn Ethical Hacking, Become a Pentester Course Syllabus & Certification Program DOCUMENT CLASSIFICATION: PUBLIC Copyrighted Material No part of this publication, in whole or in part, may be reproduced,
ACHILLES CERTIFICATION. SIS Module SLS 1508
ACHILLES CERTIFICATION PUBLIC REPORT Final DeltaV Report SIS Module SLS 1508 Disclaimer Wurldtech Security Inc. retains the right to change information in this report without notice. Wurldtech Security
June 2014 WMLUG Meeting Kali Linux
June 2014 WMLUG Meeting Kali Linux "the quieter you become, the more you are able to hear" Patrick TenHoopen Kali Linux Kali Linux is a free and open source penetration testing Linux distribution designed
Application Denial of Service Is it Really That Easy?
Application Denial of Service Is it Really That Easy? Shay Chen Agenda Introduction to Denial of Service Attacks Application Level DoS Techniques Case Study Denial of Service Testing Mitigation Summary
How To Understand A Network Attack
Network Security Attack and Defense Techniques Anna Sperotto (with material from Ramin Sadre) Design and Analysis of Communication Networks (DACS) University of Twente The Netherlands Attacks! Many different
Application Intrusion Detection
Application Intrusion Detection Drew Miller Black Hat Consulting Application Intrusion Detection Introduction Mitigating Exposures Monitoring Exposures Response Times Proactive Risk Analysis Summary Introduction
The Sulley Framework: Basics By loneferret www.kioptrix.com
The Sulley Framework: Basics By loneferret www.kioptrix.com Entirely coded using Python, The Sulley Framework was developed by Tipping-Point s Pedram Amini and Aaron Portmoy. Sulley is a fuzzer packed
Secure Web Application Coding Team Introductory Meeting December 1, 2005 1:00 2:00PM Bits & Pieces Room, Sansom West Room 306 Agenda
Secure Web Application Coding Team Introductory Meeting December 1, 2005 1:00 2:00PM Bits & Pieces Room, Sansom West Room 306 Agenda 1. Introductions for new members (5 minutes) 2. Name of group 3. Current
FIREWALLS & NETWORK SECURITY with Intrusion Detection and VPNs, 2 nd ed. Chapter 4 Finding Network Vulnerabilities
FIREWALLS & NETWORK SECURITY with Intrusion Detection and VPNs, 2 nd ed. Chapter 4 Finding Network Vulnerabilities Learning Objectives Name the common categories of vulnerabilities Discuss common system
How I Learned to Stop Fuzzing and Find More Bugs
How I Learned to Stop Fuzzing and Find More Bugs Jacob West Fortify Software August 3-5, 2007 Las Vegas Agenda Introduction to fuzzing What is fuzzing? Challenges with fuzzing Introduction to static analysis
Bug hunting. Vulnerability finding methods in Windows 32 environments compared. FX of Phenoelit
Bug hunting Vulnerability finding methods in Windows 32 environments compared FX of Phenoelit The goal: 0day What we are looking for: Handles network side input Runs on a remote system Is complex enough
Stateful Firewalls. Hank and Foo
Stateful Firewalls Hank and Foo 1 Types of firewalls Packet filter (stateless) Proxy firewalls Stateful inspection Deep packet inspection 2 Packet filter (Access Control Lists) Treats each packet in isolation
WEB APPLICATION HACKING. Part 2: Tools of the Trade (and how to use them)
WEB APPLICATION HACKING Part 2: Tools of the Trade (and how to use them) Jonathan Eddy September 27, 2013 Last Updated September 27, 2013 MAPPING THE APPLICATION 4 2 ENUMERATING CONTENT AND FUNCTIONALITY
CS5008: Internet Computing
CS5008: Internet Computing Lecture 22: Internet Security A. O Riordan, 2009, latest revision 2015 Internet Security When a computer connects to the Internet and begins communicating with others, it is
Automotive Ethernet Security Testing. Alon Regev and Abhijit Lahiri
Automotive Ethernet Security Testing Alon Regev and Abhijit Lahiri 1 Automotive Network Security Cars are evolving Number of ECUs, sensors, and interconnects is growing Moving to Ethernet networks utilizing
Debugging With Netalyzr
Debugging With Netalyzr Christian Kreibich (ICSI), Nicholas Weaver (ICSI), Boris Nechaev (HIIT/TKK), and Vern Paxson (ICSI & UC Berkeley) 1 What Is Netalyzr?! Netalyzr is a comprehensive network measurement
Firewalls. Firewalls. Idea: separate local network from the Internet 2/24/15. Intranet DMZ. Trusted hosts and networks. Firewall.
Firewalls 1 Firewalls Idea: separate local network from the Internet Trusted hosts and networks Firewall Intranet Router DMZ Demilitarized Zone: publicly accessible servers and networks 2 1 Castle and
How to make free phone calls and influence people by the grugq
VoIPhreaking How to make free phone calls and influence people by the grugq Agenda Introduction VoIP Overview Security Conclusion Voice over IP (VoIP) Good News Other News Cheap phone calls Explosive growth
The Hacker Strategy. Dave Aitel [email protected]. Security Research
1 The Hacker Strategy Dave Aitel [email protected] Security Research Who am I? CTO, Immunity Inc. History: NSA->@stake -> Immunity Responsible for new product development Vulnerability Sharing Club
Critical Infrastructure Security: The Emerging Smart Grid. Cyber Security Lecture 5: Assurance, Evaluation, and Compliance Carl Hauser & Adam Hahn
Critical Infrastructure Security: The Emerging Smart Grid Cyber Security Lecture 5: Assurance, Evaluation, and Compliance Carl Hauser & Adam Hahn Overview Assurance & Evaluation Security Testing Approaches
Performance Testing Web 2.0
Performance Testing Web 2.0 David Chadwick Rational Testing Evangelist [email protected] Dawn Peters Systems Engineer, IBM Rational [email protected] 2009 IBM Corporation WEB 2.0 What is it? 2 Web
Fuzzing in Microsoft and FuzzGuru framework
Fuzzing in Microsoft and FuzzGuru framework OWASP-IL May-2007 John Neystadt [email protected] Lead Program Manager Forefront Edge, Microsoft Agenda Overview Introduction to Fuzzing FuzzGuru Architecture
3. Broken Account and Session Management. 4. Cross-Site Scripting (XSS) Flaws. Web browsers execute code sent from websites. Account Management
What is an? s Ten Most Critical Web Application Security Vulnerabilities Anthony LAI, CISSP, CISA Chapter Leader (Hong Kong) [email protected] Open Web Application Security Project http://www.owasp.org
PTSv2 in pills: The Best First for Beginners who want to become Penetration Testers. Self-paced, online, flexible access
The Best First for Beginners who want to become Penetration Testers PTSv2 in pills: Self-paced, online, flexible access 900+ interactive slides and 3 hours of video material Interactive and guided learning
Attacking the Traveling Salesman Point-of-sale attacks on airline travelers DEFCON 2014
Attacking the Traveling Salesman Point-of-sale attacks on airline travelers DEFCON 2014 Alex Zacharis Nikos Tsagkarakis [email protected] Census S.A. http://census-labs.com/ Contents Why target travelers?
The VoIP Vulnerability Scanner
SiVuS (SiP Vulnerability Scanner) The VoIP Vulnerability Scanner User Guide v1.07 www.vopsecurity.org Contents 1 INTRODUCTION... 3 2 SIVUS FEATURES AND FUNCTIONALITY... 4 3 INSTALLATION... 5 4 OPERATION...
Fuzzing an ios Application
Tufts University Computer Science Introduction to Computer Security Fuzzing an ios Application Author: Aaron Wishnick Mentor: Ming Chow December 13, 2013 Abstract The question of ios and mobile security
IPv6 Security Best Practices. Eric Vyncke [email protected] Distinguished System Engineer
IPv6 Best Practices Eric Vyncke [email protected] Distinguished System Engineer security 2007 Cisco Systems, Inc. All rights reserved. Cisco CPub 1 Agenda Shared Issues by IPv4 and IPv6 Specific Issues
How I DOS ed My Bank. (DTMF Input Processing Easy DOS Attacks via Phone Lines)
How I DOS ed My Bank (DTMF Input Processing Easy DOS Attacks via Phone Lines) 60 Min, Genres: Action, Comedy, Sci- Fi, Thriller, Family Our paper would be on DTMF input processing algorithms [DSP], that
ASL IT SECURITY XTREME XPLOIT DEVELOPMENT
ASL IT SECURITY XTREME XPLOIT DEVELOPMENT V 2.0 A S L I T S e c u r i t y P v t L t d. Page 1 Overview: The most dangerous threat is the one which do not have a CVE. Until now developing reliable exploits
Sample Report. Security Test Plan. Prepared by Security Innovation
Sample Report Security Test Plan Prepared by Security Innovation Table of Contents 1.0 Executive Summary... 3 2.0 Introduction... 3 3.0 Strategy... 4 4.0 Deliverables... 4 5.0 Test Cases... 5 Automation...
Security of IPv6 and DNSSEC for penetration testers
Security of IPv6 and DNSSEC for penetration testers Vesselin Hadjitodorov Master education System and Network Engineering June 30, 2011 Agenda Introduction DNSSEC security IPv6 security Conclusion Questions
Review and Exploit Neglected Attack Surface in ios 8. Tielei Wang, Hao Xu, Xiaobo Chen of TEAM PANGU
Review and Exploit Neglected Attack Surface in ios 8 Tielei Wang, Hao Xu, Xiaobo Chen of TEAM PANGU BlackHat 2015 Agenda ios Security Background Review of Attack Surfaces Fuzz More IOKit and MIG System
Defense in Depth: Protecting Against Zero-Day Attacks
Defense in Depth: Protecting Against Zero-Day Attacks Chris McNab FIRST 16, Budapest 2004 Agenda Exploits through the ages Discussion of stack and heap overflows Common attack behavior Defense in depth
Web Applications Security: SQL Injection Attack
Web Applications Security: SQL Injection Attack S. C. Kothari CPRE 556: Lecture 8, February 2, 2006 Electrical and Computer Engineering Dept. Iowa State University SQL Injection: What is it A technique
Research on the Essential Network Equipment Risk Assessment Methodology based on Vulnerability Scanning Technology Xiaoqin Song 1
International Conference on Informatization in Education, Management and Business (IEMB 2015) Research on the Essential Network Equipment Risk Assessment Methodology based on Vulnerability Scanning Technology
Attacking VoIP Networks
Attacking VoIP Networks Hendrik Scholz http://www.wormulon.net/ cansecwest/core06 Vancouver April 3 7 2006 Agenda VoIP overview specific Attacks Forking/Traffic Amplification End
Application Security Testing
Tstsec - Version: 1 09 July 2016 Application Security Testing Application Security Testing Tstsec - Version: 1 4 days Course Description: We are living in a world of data and communication, in which the
Nessus. A short review of the Nessus computer network vulnerability analysing tool. Authors: Henrik Andersson Johannes Gumbel Martin Andersson
Nessus A short review of the Nessus computer network vulnerability analysing tool Authors: Henrik Andersson Johannes Gumbel Martin Andersson Introduction What is a security scanner? A security scanner
A Dozen Years of Shellphish From DEFCON to the Cyber Grand Challenge
A Dozen Years of Shellphish From DEFCON to the Cyber Grand Challenge Antonio Bianchi [email protected] University of California, Santa Barbara HITCON Enterprise August 27th, 2015 Agenda Shellphish The
Port Scanning and Vulnerability Assessment. ECE4893 Internetwork Security Georgia Institute of Technology
Port Scanning and Vulnerability Assessment ECE4893 Internetwork Security Georgia Institute of Technology Agenda Reconnaissance Scanning Network Mapping OS detection Vulnerability assessment Reconnaissance
CSE331: Introduction to Networks and Security. Lecture 32 Fall 2004
CSE331: Introduction to Networks and Security Lecture 32 Fall 2004 Hackers / Intruders External attacks Typical hacker Exploits carried out remotely Does not have an account on the remote machine Insider
Evaluation of Penetration Testing Software. Research
Evaluation of Penetration Testing Software Research Penetration testing is an evaluation of system security by simulating a malicious attack, which, at the most fundamental level, consists of an intellectual
Evaluation of Security for a H.323-based VoIP Emulated Architecture
Evaluation of Security for a H.323-based VoIP Emulated Architecture Eng. MARIUS HERCULEA, Professor VIRGIL DOBROTA Ph.D. Abstract Evaluation tests were conducted on H.323 Cisco Gatekeeper, Gateways and
Improving Web Vulnerability Scanning. Daniel Zulla
Improving Web Vulnerability Scanning 1 Daniel Zulla Introduction Hey! 2 Hi there! I m Dan. This is my first year at DEFCON. I do programming and security start-ups. I do some penetration testing as well
Guideline for stresstest Page 1 of 6. Stress test
Guideline for stresstest Page 1 of 6 Stress test Objective: Show unacceptable problems with high parallel load. Crash, wrong processing, slow processing. Test Procedure: Run test cases with maximum number
Session 3: Security in a Software Project
Session 3: Security in a Software Project Part 1: Parts of a software project Until now, we have mainly discussed what goes wrong during low- level design and implementation. However, implementation in
Social-Engineering. Hacking a mature security program. Strategic Penetration Testing
Social-Engineering Hacking a mature security program Strategic Penetration Testing Dave Kennedy (ReL1K) http://www.secmaniac.com twitter: Dave_ReL1K A Mature Security Program. Companies have invested a
10 Key Things Your VoIP Firewall Should Do. When voice joins applications and data on your network
10 Key Things Your Firewall Should Do When voice joins applications and data on your network Table of Contents Making the Move to 3 10 Key Things 1 Security is More Than Physical 4 2 Priority Means Clarity
Attack and Penetration Testing 101
Attack and Penetration Testing 101 Presented by Paul Petefish [email protected] July 15, 2009 Copyright 2000-2009, Solutionary, Inc. All rights reserved. Version 2.2 Agenda Penetration Testing
Threat Modeling/ Security Testing. Tarun Banga, Adobe 1. Agenda
Threat Modeling/ Security Testing Presented by: Tarun Banga Sr. Manager Quality Engineering, Adobe Quality Leader (India) Adobe Systems India Pvt. Ltd. Agenda Security Principles Why Security Testing Security
IMPLEMENTATION OF INTELLIGENT FIREWALL TO CHECK INTERNET HACKERS THREAT
IMPLEMENTATION OF INTELLIGENT FIREWALL TO CHECK INTERNET HACKERS THREAT Roopa K. Panduranga Rao MV Dept of CS and Engg., Dept of IS and Engg., J.N.N College of Engineering, J.N.N College of Engineering,
Passive Vulnerability Detection
Page 1 of 5 Passive Vulnerability Detection "Techniques to passively find network security vulnerabilities" Ron Gula [email protected] September 9, 1999 Copyright 1999 Network Security Wizards
Security Testing Summary of Next-Generation Enterprise VoIP Solution: Unify Inc. OpenScape SBC V8
Security Testing Summary of Next-Generation Enterprise VoIP Solution: Unify Inc. OpenScape SBC V8 SR140531D 19 August 2014 Miercom www.miercom.com Overview Unify Inc. (formerly Siemens Enterprise Communications)
Topics in Network Security
Topics in Network Security Jem Berkes MASc. ECE, University of Waterloo B.Sc. ECE, University of Manitoba www.berkes.ca February, 2009 Ver. 2 In this presentation Wi-Fi security (802.11) Protecting insecure
Chapter 8 Security Pt 2
Chapter 8 Security Pt 2 IC322 Fall 2014 Computer Networking: A Top Down Approach 6 th edition Jim Kurose, Keith Ross Addison-Wesley March 2012 All material copyright 1996-2012 J.F Kurose and K.W. Ross,
CIT 380: Securing Computer Systems
CIT 380: Securing Computer Systems Scanning CIT 380: Securing Computer Systems Slide #1 Topics 1. Port Scanning 2. Stealth Scanning 3. Version Identification 4. OS Fingerprinting 5. Vulnerability Scanning
Evading Infrastructure Security Mohamed Bedewi Penetration Testing Consultant
Evading Infrastructure Security Mohamed Bedewi Penetration Testing Consultant What infrastructure security really means? Infrastructure Security is Making sure that your system services are always running
VoIP Phreaking Introduction to SIP Hacking. Hendrik Scholz [email protected] http://www.wormulon.net/ 22C3, 2005 12 27 Berlin, Germany
VoIP Phreaking Introduction to SIP Hacking Hendrik Scholz [email protected] http://www.wormulon.net/ 22C3, 2005 12 27 Berlin, Germany Agenda What is Voice Over IP? Infrastucture Protocols SIP attacks
INTRUSION DETECTION SYSTEM (IDS) D souza Adam Jerry Joseph 0925910 I MCA
INTRUSION DETECTION SYSTEM (IDS) D souza Adam Jerry Joseph 0925910 I MCA OVERVIEW Introduction Overview The IDS Puzzle Current State of IDS Threats I have a good firewall, why do I need an IDS? Expectations
Application Code Development Standards
Application Code Development Standards Overview This document is intended to provide guidance to campus system owners and software developers regarding secure software engineering practices. These standards
Malicious Network Traffic Analysis
Malicious Network Traffic Analysis Uncover system intrusions by identifying malicious network activity. There are a tremendous amount of network based attacks to be aware of on the internet today and the
Presented By: Holes in the Fence. Agenda. IPCCTV Attack. DDos Attack. Why Network Security is Important
Presented By: Holes in the Fence Dave Engebretson, Contributing Technology writer, SDM Magazine Industry Instructor in Fiber and Networking Prevention of Security System breaches of networked Edge Devices
CONTENTS. Foundations. Case Study: The Black Hat Hassle Acknowledgments Introduction
CONTENTS Foreword Case Study: The Black Hat Hassle Acknowledgments Introduction xvii xx xxiii xxv Foundations Case Study: ebay Surprise 2 1 Cisco Network Design Models and Security Overview 5 Cisco Network
Custom Penetration Testing
Custom Penetration Testing Compromising a Vulnerability through Discovery and Custom Exploitation Stephen Sims Advanced Penetration Testing - 2009 SANS 1 Objectives Penetration Testing Precompiled Tools
Attack Frameworks and Tools
Network Architectures and Services, Georg Carle Faculty of Informatics Technische Universität München, Germany Attack Frameworks and Tools Pranav Jagdish Betreuer: Nadine Herold Seminar Innovative Internet
Cconducted at the Cisco facility and Miercom lab. Specific areas examined
Lab Testing Summary Report July 2009 Report 090708 Product Category: Unified Communications Vendor Tested: Key findings and conclusions: Cisco Unified Communications solution uses multilayered security
How To Protect Your Network From Attack From Outside From Inside And Outside
IT 4823 Information Security Administration Firewalls and Intrusion Prevention October 7 Notice: This session is being recorded. Lecture slides prepared by Dr Lawrie Brown for Computer Security: Principles
Firewalls Netasq. Security Management by NETASQ
Firewalls Netasq Security Management by NETASQ 1. 0 M a n a g e m e n t o f t h e s e c u r i t y b y N E T A S Q 1 pyright NETASQ 2002 Security Management is handled by the ASQ, a Technology developed
Detecting and Exploiting XSS with Xenotix XSS Exploit Framework
Detecting and Exploiting XSS with Xenotix XSS Exploit Framework [email protected] keralacyberforce.in Introduction Cross Site Scripting or XSS vulnerabilities have been reported and exploited since 1990s.
Release Notes for Epilog for Windows Release Notes for Epilog for Windows v1.7/v1.8
Release Notes for Epilog for Windows v1.7/v1.8 InterSect Alliance International Pty Ltd Page 1 of 22 About this document This document provides release notes for Snare Enterprise Epilog for Windows release
Deployment of Snort IDS in SIP based VoIP environments
Deployment of Snort IDS in SIP based VoIP environments Jiří Markl, Jaroslav Dočkal [email protected] K-209 Univerzita obrany Kounicova 65, 612 00 Brno Czech Republic Abstract This paper describes
Linux Network Security
Linux Network Security Course ID SEC220 Course Description This extremely popular class focuses on network security, and makes an excellent companion class to the GL550: Host Security course. Protocols
Penetration Testing: Lessons from the Field
Penetration Testing: Lessons from the Field CORE SECURITY TECHNOLOGIES SCS SERVICES May 2009 1 Agenda: About me: Alberto Soliño Director of Security Consulting Services at Core Security One of first five
How to build a security assessment program. Dan Boucaut
How to build a security assessment program Dan Boucaut Agenda 1 Problem statement 2 Business case 3 How to avoid creating more problems Problem statement Security assessments are hard, costly and may take
Cutting Edge Practices for Secure Software Engineering
Cutting Edge Practices for Secure Software Engineering Kanchan Hans Amity Institute of Information Technology Amity University, Noida, 201301, India [email protected] Abstract Security has become a high