Andrew Peterson, Signal Sciences – Enterprise Security Weekly #124

Andrew Peterson is the Founder & CEO of Signal Sciences, and an O’Reilly author of “Cracking Security Misconceptions”. He joins the show today to talk about prioritizing bugs, if certain bugs at lower levels are being exploited, how to connect with developers and prioritize bugs, and more! Full Show Notes Visit http://securityweekly.com/esw for all the […]
The post Andrew Peterson, Signal Sciences – Enterprise Security Weekly #124 appeared first on Security Weekly.

Link: http://feedproxy.google.com/~r/securityweekly/Lviv/~3/ZgOfGpqVpV8/

OpenBMC, Cisco Routers, & Abusing Exchange – Hack Naked News #205

    This week, a tool that finds vulnerable robots on the internet, a new exploit that threatens over 9,000 Cisco Routers, apple turns of group FaceTime after an eavesdropping bug, wordpress sites under attack via Zero-Day in abandoned plugin, and OpenBMC caught with ‘pantsdown’ over a new security flaw! Jason Wood from Paladin Security […]
The post OpenBMC, Cisco Routers, & Abusing Exchange – Hack Naked News #205 appeared first on Security Weekly.

Link: http://feedproxy.google.com/~r/securityweekly/Lviv/~3/IP6evPcfJG0/

ADAPT – Tool That Performs Automated Penetration Testing For WebApps

ADAPT is a tool that performs Automated Dynamic Application Penetration Testing for web applications. It is designed to increase accuracy, speed, and confidence in penetration testing efforts. ADAPT automatically tests for multiple industry standard OWASP Top 10 vulnerabilities, and outputs categorized findings based on these potential vulnerabilities. ADAPT also uses the functionality from OWASP ZAP to perform automated active and passive scans, and auto-spidering. Due to the flexible nature of the ADAPT tool, all of theses features and tests can be enabled or disabled from the configuration file. For more information on tests and configuration, please visit the ADAPT wiki.How it WorksADAPT uses Python to create an automated framework to use industry standard tools, such as OWASP ZAP and Nmap, to perform repeatable, well-designed procedures with anticipated results to create an easly understandable report listing vulnerabilities detected within the web application.Automated Tests:* OTG-IDENT-004 – Account Enumeration* OTG-AUTHN-001 – Testing for Credentials Transported over an Encrypted Channel* OTG-AUTHN-002 – Default Credentials* OTG-AUTHN-003 – Testing for Weak lock out mechanism* OTG-AUTHZ-001 – Directory Traversal* OTG-CONFIG-002 – Test Application Platform Configuration* OTG-CONFIG-006 – Test HTTP Methods* OTG-CRYPST-001 – Testing for Weak SSL/TLS Ciphers, Insufficient Transport Layer Protection* OTG-CRYPST-002 – Testing for Padding Oracle* OTG-ERR-001 – Testing for Error Code* OTG-ERR-002 – Testing for Stack Traces* OTG-INFO-002 – Fingerprinting the Webserver* OTG-INPVAL-001 – Testing for Reflected Cross site scripting* OTG-INPVAL-002 – Testing for Stored Cross site scripting* OTG-INPVAL-003 – HTTP Verb Tampering* OTG-SESS-001 – Testing for Session Management Schema* OTG-SESS-002 – Cookie AttributesInstalling the PluginDetailed install instructions.Download Adapt

Link: http://www.kitploit.com/2019/01/adapt-tool-that-performs-automated.html

Scanner-Cli – A Project Security/Vulnerability/Risk Scanning Tool

The Hawkeye scanner-cli is a project security, vulnerability and general risk highlighting tool. It is meant to be integrated into your pre-commit hooks and your pipelines.Running and configuring the scannerThe Hawkeye scanner-cli assumes that your directory structure is such that it keeps the toolchain’s files on top level. Roughly, this is what it boils down to:Node.js projects have a package.json on top levelRuby projects will have a Gemfile on top levelPython projects will have a requirements.txt on top levelPHP projects will have a composer.lock on top levelJava projects will have a build (gradle) or target (maven) folder, and include .java and .jar filesThis is not exhaustive as sometimes tools require further files to exist. To understand how the modules decide whether they can handle a project, please check the How it works section and the modules folder.Docker (recommended)The docker image is hands-down the easiest way to the scanner. Please note that your project root (e.g. $PWD) needs to be mounted to /target.docker run –rm -v $PWD:/target hawkeyesec/scanner-cliThe docker build is also the recommended way to run the scanner in your CI pipelines. This is an example of running Hawkeye against one of your projects in GoCD:

Link: http://feedproxy.google.com/~r/PentestTools/~3/JoL8_BBnrhQ/scanner-cli-project-securityvulnerabili.html