CERT Secure Coding Standards

From www.cert.org/secure-coding,
As part of the CERT Secure Coding Initiative, the Computer Emergency Response Team (CERT) has deployed a new collaborative web site, SecureCoding, dedicated to developing secure coding standards for various programming languages. CERT's initial efforts are focused on the development of secure coding practices for the C and C++ programming languages. Rules and recommendations for secure coding practices in the C and C++ programming languages are now available in the website. The purpose of this project is that the practices can be used by software developers for professional development and as the basis for organizational coding standards supporting the quality of their products. Software producers can use this information as they develop strategies to avoid vulnerabilities when they code new software.

The development of secure coding practices is a necessary step to stem the ever-increasing threat from software vulnerabilities. CERT's goal is that the enumeration of secure code practices will allow for a common set of criteria that can be used to measure and evaluate software development efforts.
read more ...

CWE - Common Weakness Enumeration

From cwe.mitre.org
CWE is a community-developed dictionary of common software weaknesses targeted to developers and security practitioners.
"...
CWE is a community-developed formal list of common software weaknesses. It serves as a common language for describing software security weaknesses, a standard measuring stick for software security tools targeting these vulnerabilities, and as a baseline standard for weakness identification, mitigation, and prevention efforts.

Leveraging the diverse thinking on this topic from academia, the commercial sector, and government, CWE unites the most valuable breadth and depth of content and structure to serve as a unified standard. Our objective is to help shape and mature the code security assessment industry and also dramatically accelerate the use and utility of software assurance capabilities for organizations in reviewing the software systems they acquire or develop.
..."
The CWE project provides a Classification Tree of the full list of software vulnerabilities along with a Full CWE Dictionary.

'Vulnerability Type Distributions in CVE', published as part of the CWE project provides research results on publicly reported vulnerabilities. This technical white paper discusses the high-level types of vulnerabilities that have been publicly reported over the past five years, such as buffer overflows, cross-site scripting (XSS), SQL injection, and PHP file inclusion.

The paper identifies and explains trends such as the rapid rise of web application vulnerabilities, covers the distribution of vulnerability types in operating system vendor advisories, and compares the issues being reported in open and closed source advisories.

read more ...

Build Security In - BSI

From, buildsecurityin.us-cert.gov
Build Security In (BSI) is a project of the Strategic Initiatives Branch of the National Cyber Security Division (NCSD) of the Department of Homeland Security (DHS). The Software Engineering Institute (SEI) was engaged by the NCSD to provide support in the Process and Technology focus areas of this initiative. The SEI team and other contributors develop and collect software assurance and software security information that helps software developers, architects, and security practitioners to create secure systems.

BSI content is based on the principle that software security is fundamentally a software engineering problem and must be addressed in a systematic way throughout the software development life cycle. BSI contains and links to a broad range of best practices, tools, guidelines, rules, principles, and other knowledge that can be used to build security into software in every phase of its development.
read more ...

An Illustrated Guide to IPsec

From, Steve Friedl's Unixwiz.net Tech Tips, unixwiz.net
"...
IPsec is a suite of protocols for securing network connections, but the details and many variations quickly become overwhelming. This is particularly the case when trying to interoperate between disparate systems, causing more than one engineer to just mindlessly turn the knobs when attempting to bring up a new connection.

This Tech Tip means to give bottom-up coverage of the low-level protocols used in an IPv4 context (we provide no coverage of IPv6). This is not a deployment guide or best-practices document — we're looking at it strictly at the protocol level on up, rather than from the big picture on down.
..."
read more ...

Netdude - a Framework for Packet Trace Manipulation

Netdude is a framework for inspection, visualization, and modification of tcpdump packet trace files. Its modular design allows users to interact with the framework at different abstraction levels: a low-level trace navigation wrapper for libpcap called libpcapnav, a high-level API with convenient types for performing common packet manipulation tasks in libnetdude, and a GUI application that allows both small- and large-scale editing previously impossible without writing code. The framework is readily extensible at the libnetdude and GUI levels through its plugin architecture, making it a workbench for the creation of new packet trace tools.
read more ...

SQL Injection Walkthrough

From SecuriTeam.com
SQL Injection is a trick to inject SQL query/command as an input possibly via web pages. Many web pages take parameters from web user, and make SQL query to the database. Take for instance when a user login, web page that user name and password and make SQL query to the database to check if a user has valid name and password. With SQL Injection, it is possible for us to send crafted user name and/or password field that will change the SQL query and thus grant us something else.

The following article from SecuritTeam tries to help beginners with grasping the problems facing them while trying to utilize SQL Injection techniques, to successfully utilize them, and to protect themselves from such attacks.
read more ...

HTTP Request Smuggling attack

From Prashant Gawade, Palisade Magazine.
"...
HTTP Request Smuggling (HRS) attack is the result of a device failure to properly handle deformed inbound HTTP requests. HRS works by taking benefit of the discrepancies in HTTP request parsing when one or more HTTP devices are in the data flow between the user and the web server. HTTP Request smuggling leads to various attacks like web cache poisoning, session hijacking, cross-site scripting etc.
..."

read more ...

vTun - Virtual Tunnels

From vtun.sourceforge.net
VTun is the easiest way to create Virtual Tunnels over TCP/IP networks with traffic shaping, compression, and encryption. It supports IP, PPP, SLIP, Ethernet and other tunnel types. VTun is easily and highly configurable and can be used for various network tasks like VPN, Mobile IP, etc.

read more ...

Reading C type declarations

From, Steve Friedl's Unixwiz.net Tech Tips, unixwiz.net

" ...

Even relatively new C programmers have no trouble reading simple C declarations such as

int      foo[5];     // foo is an array of 5 ints
char    *foo;        // foo is a pointer to char
double   foo();      // foo is a function returning a double 

but as the declarations get a bit more involved, it's more difficult to know exactly what you're looking at.

char *(*(**foo[][8])())[]; // huh ????? 

It turns out that the rules for reading an arbitrarily-complex C variable declaration are easily learned by even beginning programmers (though how to actually use the variable so declared may be well out of reach).

This Tech Tip shows how to do it.

..."

read more ...

Your Field Guide To Designing Security Into Networking Protocols

From, Mark Pustilnik & Andrew Roths, MSDN Magazine.

Designing a secure protocol is a treacherous task. This article outlines some of the most common pitfalls that await you, but there are many others. Perhaps the best insurance against making mistakes is having your design reviewed by knowledgeable peers, documenting your security guarantees as well as your thought process, and making sure that no holes are introduced during the inevitably iterative software development process.

You cannot succeed at this task without understanding in great detail the security characteristics of your building blocks, including the fact that they, in turn, are not infallible. You can safely assume that security holes will be found eventually, and be prepared to version your design, including the "pluggable" aspects such as authentication and cryptographic primitives.

This article discusses - Designing for secure communication, Man-in-the-middle attacks, Undue trust relationships in secure transports and Versioning & updates.

read more ...

One-way Web Hacking

From Saumil Shah, net-square.com

One-way web hacking is a technique which relies purely on HTTP traffic to attack and penetrate web servers and application servers. This technique was formulated to demonstrate that having tight firewalls or SSL does not really matter when it comes to web application attacks. The premise of the one-way technique is that only valid HTTP requests are allowed in and only valid HTTP responses are allowed out of the firewall.

A tight firewall can make things difficult for an attacker, but not keep the attacker entirely away. One-way hacks demonstrate the fact that, with tools like the file uploader, the web based command prompt and the web based SQL command prompt, it is just as easy to attack a web application and the underlying network with a tight firewall in place.

SSL makes things even worse, from the point of view of securing the application. Many people think that SSL prevents such attacks. It does not. SSL is used only to encrypt the data between the web browser and the web server, to prevent eavesdropping. SSL provides no security to the web application, or the underlying network. All one-way hacks can be easily adapted to SSL, using libraries such as OpenSSL.

Source code and examples of this technique are available here.

read more ...

DHCPing - BOOTP/DHCP audit tool

From Gregory Duchemin, dhcping.openwall.net

DHCPing is a lightweight and featureful security tool written in PERL and designed to test the security of various flavors of DHCP implementations around. DHCPing also offers several exploits for the latest vulnerabilities in DHCP implemetation of various vendors along with a set of generic attacks.

A list of the vulnerabilities that DHCPing has contributed to find, is available here (http://c3rb3r.openwall.net/dhcping/matrix.html)

read more ...

THC Nokia Phone-Lock Reset

The Hacker's Choice has released a tool, thc-nokia-unlock, that exploits a design flaw in nokia mobile phones to remove the phone-lock.

The Phone Lock feature is designed to disable the key pad, bluetooth and the USB port. This makes it impossible to access the data stored on the device without knowing the correct code.

This unlock tool make use of some undocumented features of the Symbian OS which is used in most of the Nokia phones. One such feature is a 'recognizer' that can be used to execute a program when the phone boots. A recognizer is loaded and executed when a drive is mounted.

The problem with Phone Lock feature is that it does not disable the Memory Card (MMC). You can remove the Memory Card from a locked phone and install the 'thc-nokia-unlock' tool which infact is a recognizer that performs a hard reset (by software) on the phone.

The Memory Card is mounted when it is placed again into the mobile phone even when the phone is locked, thus executing the tool.

The same recognizer-autostart method can be used to quickly install a backdoor on a locked mobile phone or to propagate a virus.

read more ...

Nmap Scripting Engine

From, Buanzo's Consulting blog.
Nmap-dev mailing list is having an announcement about the final release of Nmap Scripting Engine. A a sample script written by Buanzo for detection of SMTP Open Relay is available here.
read more ...

PaiMei reverse engineering framework

From pedram.redhive.com
PaiMei, is a reverse engineering framework consisting of multiple extensible components. The framework can essentially be thought of as a reverse engineer's swiss army knife and has already been proven effective for a wide range of both static and dynamic tasks such as fuzzer assistance, code coverage tracking, data flow tracking and more.
read more ...

More tools from this site are available here.

Process Stalker

From pedram.redhive.com,
Process Stalking is a term coined to describe the combined process of run-time profiling, state mapping and tracing. Consisting of a series of tools and scripts the goal of a successful stalk is to provide the reverse engineer with a intuitive interface to run-time block-level trace data.

The Process Stalking suite is broken into three main components; an IDA Pro plug-in, a stand alone tracing tool and a series of Python scripts for instrumenting intermediary and GML graph files. The generated GML graph definitions were designed for usage with a freely available interactive graph visualization tool.

A complete usage and script development manual for Process Stalker is available here.

An article detailing a step-by-step application of Process Stalker vs. the MS05-030 Microsoft Security bulletin is available at OpenRCE.org.
read more ...

eEye Research Tools

A lot of previously unreleased research tools are now made available at eEye research website, research.eEye.com.
read more ...

AxMan ActiveX fuzzing engine

From metasploit.com
AxMan is a web-based ActiveX fuzzing engine. The goal of AxMan is to discover vulnerabilities in COM objects exposed through Internet Explorer. Since AxMan is web-based, any security changes in the browser will also affect the results of the fuzzing process. This allows for a much more realistic test than other COM-based assessment tools. AxMan is designed to be used with Internet Explorer 6 only.
read more ...

AttackAPI

From gnucitizen.org
AttackAPI provides simple and intuitive web programmable interface for composing attack vectors with JavaScript and other client (and server) related technologies. The current release supports several browser based attacking techniques and simple but powerful JavaScript console.

read more ...

Other interesting projetcs from gnucitizen.org,
i) JavaScript Shell
ii) JavaScript Authorization Forcer
iii) JavaScript Port Scanner
iv) Fex - enables Firefox Extension Scanner
v) XSSing the Lan

Demystifying Cross Site Scripting Attacks

From David Kierznowski
Awaking the Sleeping Giant v1.0
Demystifying Cross Site Scripting Attacks
Author: David Kierznowski

This paper attempts to demystify and categorise current XSS entry nodes, attack capabilities and trends.

XSS attacks are gaining popularity quickly. There are loads of vulnerabilities waiting to be found. It can be simple and difficult to prevent. It can propogate around the Internet in hours, exploit internal or private networks and offers the ability to manipulate web services for fun and profit without compromising a single system.

The whitepaper can be found here.