Burp Suite allows you to easily write your own plugins, to perform complex and highly customized tasks within Burp. PortSwigger (the developer behind Burp Suite) created a series of blog posts wherein he explains what can be done with Burp Extensions. In his first blog post about the subject (see Writing your first …

Read More

This article presents the HTML5 LocalStorage (and SessionStorage) objects and discusses some security implcations and recommendations. Furthermore JavaScript examples are given on how HTML5 can be easily used. What is HTML5 Web Storage or LocalStorage? With HTML5, web pages can store data locally within the user’s …

Read More

This page lists different HTTP request templates. All templates contain the minimum number of required headers. HTTP POST
POST /login.cgi HTTP/1.0 Host: 192.168.200.1 Content-Type: application/x-www-form-urlencoded Content-Length: 51 submit=Login&username=admin&password=Adm1n15trat0r HTTP GET
GET /index.html HTTP/1.0 …

Read More

Stompy is a fairly advanced entropy verifier for session cookies, XSRF tokens, OTPs, and other random data. It goes well beyond FIPS-140-2, performing n-dimensional spectral testing as well. What’s so cool about stompy? Stompy aims to be a quick and mostly automated tool to provide a first line of assessment and …

Read More

This article show how you can obtain the UNIX epoch time (number of seconds since 1970-01-01 00:00:00 UTC) using the Linux bash “date” command. It also shows how you can convert a UNIX epoch time to a human readable time. Obtain UNIX epoch time using bash Obtaining the UNIX epoch time using bash is easy. Use the …

Read More

You can use the following commands to scan a netblock for the presence of systems with an SNMP service which still use the community strings “public” and/or “private”. nmap -P0 -v -sU -p 161 -oA snmp_scan 192.168.0.1/24 for i in *.gnmap do for j in $(grep ‘161/open/’ $i | awk ‘{ print $2 }’) do echo $j snmpwalk -v2c -c …

Read More

Some tips for doing things in vbscript. Convert a relative path to an absolute path strDirName = objFSO.GetAbsolutePathName(strDirName) Type-cast a String to an Integer intNumber = CInt(strNumber) Regular expressions in VBScript Set objIPAddressRegEx= new RegExp ‘Create a RegExp object objIPAddressRegEx.Pattern = …

Read More

How to enable the Windows Firewall, even though Domain Policies are prohibiting you from enabling it… Consider the following scenario: you have a Windows XP laptop which is connected to a Windows Domain. In order to avoid having connectivity issues, the Domain Admins decided that it would be best to fully disable the …

Read More

How to use SubInAcl.exe? SubInAcl version 5.2.3790.1180 USAGE —– Usage : SubInAcl [/option…] /object_type object_name [[/action[=parameter]…] /options : /outputlog=FileName /errorlog=FileName /noverbose /verbose (default) /notestmode (default) /testmode /alternatesamserver=SamServer /offlinesam=FileName …

Read More

This webpage contains a series of examples of how xcacls.vbs can be used. Overview Xcacls.vbs is an augmented version of the Extended Change Access Control List tool (Xcacls.exe) that ships in the Windows 2000 and Windows Server 2003 Support Tools. Xcacls.vbs is an unsupported utility that addresses specific …

Read More