
<?phpxml version="1.0" encoding="utf-8"?>
<rss version="2.0" 
xmlns:content="http://purl.org/rss/1.0/modules/content/"
xmlns:wfw="http://wellformedweb.org/CommentAPI/"
xmlns:dc="http://purl.org/dc/elements/1.1/"
>
<channel>
<title>Best of Security / Published News / tools</title>
<link>http://bestofsecurity.net</link>
<description>Best of Security Portal  votes</description>
<pubDate>Tue, 26 Aug 2008 07:00:43 PDT</pubDate>
<language>en</language>
<item>
<title><![CDATA[Improved WinDBG opcode searching]]></title>
<link>http://bestofsecurity.net/tools/Improved_WinDBG_opcode_searching-1/</link>
<comments>http://bestofsecurity.net/tools/Improved_WinDBG_opcode_searching-1/</comments>
<pubDate>Tue, 26 Aug 2008 07:00:43 PDT</pubDate>
<dc:creator>Staff</dc:creator>
<category>tools</category>
<guid>http://bestofsecurity.net/tools/Improved_WinDBG_opcode_searching-1/</guid>
<description><![CDATA[Goaded by some coworkers about the opcode searching functionality of windbg prompted me to add a new option to jutsu today: searchOpcodeYou can search for sets of instructions in conjunction, it will assemble them, providing you the machine code, then search for the instructions in executable memory. Instructions are delimited by pipes. I plan to add some limited wildcard functionality in the near future as well.0:000&gt; !jutsu searchOpcode  pop ecx | pop ecx | ret[J] Searching for:&gt;  pop ecx &gt;  pop ecx &gt;  r<br/><br/>76 Vote(s) ]]></description>
</item>

<item>
<title><![CDATA[Improved WinDBG opcode searching]]></title>
<link>http://bestofsecurity.net/tools/Improved_WinDBG_opcode_searching/</link>
<comments>http://bestofsecurity.net/tools/Improved_WinDBG_opcode_searching/</comments>
<pubDate>Tue, 26 Aug 2008 07:00:40 PDT</pubDate>
<dc:creator>Staff</dc:creator>
<category>tools</category>
<guid>http://bestofsecurity.net/tools/Improved_WinDBG_opcode_searching/</guid>
<description><![CDATA[Goaded by some coworkers about the opcode searching functionality of windbg prompted me to add a new option to jutsu today: searchOpcodeYou can search for sets of instructions in conjunction, it will assemble them, providing you the machine code, then search for the instructions in executable memory. Instructions are delimited by pipes. I plan to add some limited wildcard functionality in the near future as well.0:000&gt; !jutsu searchOpcode  pop ecx | pop ecx | ret[J] Searching for:&gt;  pop ecx &gt;  pop ecx &gt;  r<br/><br/>86 Vote(s) ]]></description>
</item>

<item>
<title><![CDATA[Byakugan WinDBG Plugin Released!]]></title>
<link>http://bestofsecurity.net/tools/Byakugan_WinDBG_Plugin_Released/</link>
<comments>http://bestofsecurity.net/tools/Byakugan_WinDBG_Plugin_Released/</comments>
<pubDate>Thu, 21 Aug 2008 07:01:11 PDT</pubDate>
<dc:creator>Staff</dc:creator>
<category>tools</category>
<guid>http://bestofsecurity.net/tools/Byakugan_WinDBG_Plugin_Released/</guid>
<description><![CDATA[Today, HD merged in an amalgamation of windbg tools and plugins with a funny name into the main metasploit tree.  We've been working on this collection for awhile now, and currently it represents (I think) a good step towards turning windbg from simply a good debugger into a powerful platform for exploit development.The work that's currently released includes: tenketsu - the vista heap emulator/visualizer which allows you to track how input to a program effects the heap in real time.jutsu - a set of tools <br/><br/>125 Vote(s) ]]></description>
</item>

<item>
<title><![CDATA[Karmetasploit Wireless Fun]]></title>
<link>http://bestofsecurity.net/tools/Karmetasploit_Wireless_Fun/</link>
<comments>http://bestofsecurity.net/tools/Karmetasploit_Wireless_Fun/</comments>
<pubDate>Fri, 08 Aug 2008 07:00:55 PDT</pubDate>
<dc:creator>Staff</dc:creator>
<category>tools</category>
<guid>http://bestofsecurity.net/tools/Karmetasploit_Wireless_Fun/</guid>
<description><![CDATA[I just posted the first public documentation on Karmetasploit. This project is a combination of Dino Dai Zovi and Shane Macaulay's KARMA and the Metasploit Framework. The result is an extremely effective way to absorb information and remote shells from the wireless-enabled machines around you. This first version is still a proof-of-concept, but it already has an impressive feature list: - Capture POP3 and IMAP4 passwords (clear-text and SSL) - Accept outbound email sent over SMTP - Parse out FTP and HTTP l<br/><br/>125 Vote(s) ]]></description>
</item>

<item>
<title><![CDATA[Best of Open Source Software Awards (2008)]]></title>
<link>http://bestofsecurity.net/tools/Best_of_Open_Source_Software_Awards_2008-1/</link>
<comments>http://bestofsecurity.net/tools/Best_of_Open_Source_Software_Awards_2008-1/</comments>
<pubDate>Tue, 05 Aug 2008 07:02:04 PDT</pubDate>
<dc:creator>Staff</dc:creator>
<category>tools</category>
<guid>http://bestofsecurity.net/tools/Best_of_Open_Source_Software_Awards_2008-1/</guid>
<description><![CDATA[InfoWorld has just released the Best of Open Source Software Awards. The Metasploit Framework received an award in the category of Best of open source in security:&quot;When we first saw Metasploit back in 2004 at the DefCon hacker conference, we knew it would become a staple for security professionals the world over. And sure enough, Metasploit has become the de facto standard attack and penetration toolkit. Extremely extensible, and constantly updated to home in on the latest server and host vulnerabilities, <br/><br/>224 Vote(s) ]]></description>
</item>

<item>
<title><![CDATA[DNS Multiple Race Exploiter]]></title>
<link>http://bestofsecurity.net/tools/DNS_Multiple_Race_Exploiter/</link>
<comments>http://bestofsecurity.net/tools/DNS_Multiple_Race_Exploiter/</comments>
<pubDate>Sat, 02 Aug 2008 07:00:20 PDT</pubDate>
<dc:creator>Staff</dc:creator>
<category>tools</category>
<guid>http://bestofsecurity.net/tools/DNS_Multiple_Race_Exploiter/</guid>
<description><![CDATA[AR of Securebits released a new DNS poisoning tool today. The DNS Multiple Race Exploiter is unique in that it can overwrite any A record by using a CNAME response. This differs from any of the existing public tools (including those in Metasploit, which only poison uncached &quot;A&quot; records and &quot;NS&quot; records). Note for lazy IPS/IDS developers, this tool uses a static TTL of 0x7BEDABED in all spoofed replies.<br/><br/>74 Vote(s) ]]></description>
</item>

<item>
<title><![CDATA[Checking for Cache Poisoning]]></title>
<link>http://bestofsecurity.net/tools/Checking_for_Cache_Poisoning/</link>
<comments>http://bestofsecurity.net/tools/Checking_for_Cache_Poisoning/</comments>
<pubDate>Wed, 30 Jul 2008 07:01:32 PDT</pubDate>
<dc:creator>Staff</dc:creator>
<category>tools</category>
<guid>http://bestofsecurity.net/tools/Checking_for_Cache_Poisoning/</guid>
<description><![CDATA[After seeing the SBC/ATT server for Austin get poisoned, serve up advertisements, and eventually get taken offline, I decided to add a module to compare DNS results between two servers. In the following example, the &quot;.gov&quot; TLD has been poisoned with the bailiwicked_domain Metasploit module:msf &amp;gt; use auxiliary/spoof/dns/compare_resultsmsf auxiliary(compare_results) &amp;gt; set BASEDNS 4.2.2.3BASEDNS =&amp;gt; 4.2.2.3msf auxiliary(compare_results) &amp;gt; set TARGDNS poisoned.serverTARDNS =&amp;gt; poisoned.servermsf a<br/><br/>84 Vote(s) ]]></description>
</item>

<item>
<title><![CDATA[DNS Attacks in the Wild]]></title>
<link>http://bestofsecurity.net/tools/DNS_Attacks_in_the_Wild/</link>
<comments>http://bestofsecurity.net/tools/DNS_Attacks_in_the_Wild/</comments>
<pubDate>Wed, 30 Jul 2008 07:01:28 PDT</pubDate>
<dc:creator>Staff</dc:creator>
<category>tools</category>
<guid>http://bestofsecurity.net/tools/DNS_Attacks_in_the_Wild/</guid>
<description><![CDATA[In a recent conversation with Robert McMillan (IDG), I described a in-the-wild attack against one of AT&amp;T's DNS cache servers, specifically one that was configured as an upstream forwarder for an internal DNS machine at BreakingPoint Systems. The attackers had replaced the cache entry for www.google.com with a web page that loaded advertisements hidden inside an iframe. This attack affected anyone in the Austin, Texas region using that AT&amp;T Internet Services (previously SBC) DNS server. The attack itself w<br/><br/>236 Vote(s) ]]></description>
</item>

<item>
<title><![CDATA[Evilgrade Will Destroy Us All]]></title>
<link>http://bestofsecurity.net/tools/Evilgrade_Will_Destroy_Us_All/</link>
<comments>http://bestofsecurity.net/tools/Evilgrade_Will_Destroy_Us_All/</comments>
<pubDate>Tue, 29 Jul 2008 07:00:18 PDT</pubDate>
<dc:creator>Staff</dc:creator>
<category>tools</category>
<guid>http://bestofsecurity.net/tools/Evilgrade_Will_Destroy_Us_All/</guid>
<description><![CDATA[Francisco Amato of Infobyte Security Research just announced ISR-evilgrade v1.0.0, a toolkit for exploiting products which perform online updates in an insecure fashion. This tool works in conjunction with man-in-the-middle techniques (DNS, ARP, DHCP, etc) to exploit a wide variety applications. The demonstration video uses the CAU/Metasploit DNS exploit in conjunction with the Sun Java update mechanism to execute code on a fully patched Windows machine. For more information, see the README and slide deck.<br/><br/>216 Vote(s) ]]></description>
</item>

<item>
<title><![CDATA[BailiWicked Automatic Tuning]]></title>
<link>http://bestofsecurity.net/tools/BailiWicked_Automatic_Tuning/</link>
<comments>http://bestofsecurity.net/tools/BailiWicked_Automatic_Tuning/</comments>
<pubDate>Sat, 26 Jul 2008 07:00:23 PDT</pubDate>
<dc:creator>Staff</dc:creator>
<category>tools</category>
<guid>http://bestofsecurity.net/tools/BailiWicked_Automatic_Tuning/</guid>
<description><![CDATA[The bailiwicked modules (host and domain) were updated today to include the ability to predict the time window between the outgoing request from the target nameserver and the response from the real nameserver(s). This measurement is used to tune the number of spoofed replies sent by the exploit. The result is a big increase in exploit reliability, especially when the target domain has a ton of nameservers (Yahoo has eight) or changes its responsiveness during the test (BIND tends to slow down when it has a<br/><br/>60 Vote(s) ]]></description>
</item>

<item>
<title><![CDATA[BailiWicked]]></title>
<link>http://bestofsecurity.net/tools/BailiWicked/</link>
<comments>http://bestofsecurity.net/tools/BailiWicked/</comments>
<pubDate>Fri, 25 Jul 2008 07:00:17 PDT</pubDate>
<dc:creator>Staff</dc:creator>
<category>tools</category>
<guid>http://bestofsecurity.net/tools/BailiWicked/</guid>
<description><![CDATA[If you haven't already noticed by now, we've recently published two modules which exploit Kaminsky's DNS cache poisoning flaw.  I'll get to those in a second, but first a word about disclosure.In the short time that these modules have been available, I've received personal responses from a LOT of people, spanning the spectrum from &quot;OMG how could you do this to the Internet users???&quot; to &quot;Great work, now I know what I'm up against...  We need more open researchers like you guys.&quot;  In all honesty, I was conte<br/><br/>61 Vote(s) ]]></description>
</item>

<item>
<title><![CDATA[April Fools 2008 (recap)]]></title>
<link>http://bestofsecurity.net/tools/April_Fools_2008_recap/</link>
<comments>http://bestofsecurity.net/tools/April_Fools_2008_recap/</comments>
<pubDate>Sun, 06 Apr 2008 10:00:04 PDT</pubDate>
<dc:creator>Staff</dc:creator>
<category>tools</category>
<guid>http://bestofsecurity.net/tools/April_Fools_2008_recap/</guid>
<description><![CDATA[For April Fools Day this year, Adam Cecchetti put together a real-time strategy game that uses the Metasploit Framework to drive the game logic. Matt Miller and myself worked on a press release and web site that announced the game along with some interesting changes to the Metasploit Project. A description of the game, including screen shots, can be found at the PwnCraft Online page. The home page of metasploit.com on April 1st has been archived online for your viewing pleasure. A big thanks to Adam for th<br/><br/>164 Vote(s) ]]></description>
</item>

<item>
<title><![CDATA[RISE Security vs ASUS Eee PC]]></title>
<link>http://bestofsecurity.net/tools/RISE_Security_vs_ASUS_Eee_PC/</link>
<comments>http://bestofsecurity.net/tools/RISE_Security_vs_ASUS_Eee_PC/</comments>
<pubDate>Fri, 08 Feb 2008 10:42:46 PST</pubDate>
<dc:creator>Staff</dc:creator>
<category>tools</category>
<guid>http://bestofsecurity.net/tools/RISE_Security_vs_ASUS_Eee_PC/</guid>
<description><![CDATA[The fine folks at RISE Security have purchased a Linux-based ASUS Eee PC and literally rooted it out of the box (using Metasploit, of course). Considering how much criticism other PC vendors have received for out-of-the-box security, its a wonder that a similar outcry has not been heard for Linux-based products. The last line of the RISE article really sums it up: &quot;Easy to learn, Easy to work, Easy to root.&quot;<br/><br/>150 Vote(s) ]]></description>
</item>

<item>
<title><![CDATA[RASMANS, DHCP, Registry]]></title>
<link>http://bestofsecurity.net/tools/RASMANS_DHCP_Registry/</link>
<comments>http://bestofsecurity.net/tools/RASMANS_DHCP_Registry/</comments>
<pubDate>Tue, 05 Feb 2008 10:58:26 PST</pubDate>
<dc:creator>Staff</dc:creator>
<category>tools</category>
<guid>http://bestofsecurity.net/tools/RASMANS_DHCP_Registry/</guid>
<description><![CDATA[Last month, while working on the RASMANS &quot;registry corruption&quot; bug with HD, I noticed something odd.  The way the bug works is that every time you call the function, the current registry key is deleted and a new one is created with your custom information.  You control what is put into the registry key, and the value can be unlimited. The actual deletion and creation is done with windows api calls, and the RPC function is just a remote interface to the modification of those specific keys. Seems pretty safe<br/><br/>206 Vote(s) ]]></description>
</item>

<item>
<title><![CDATA[Internet Drive-By Shootings]]></title>
<link>http://bestofsecurity.net/tools/Internet_Drive-By_Shootings/</link>
<comments>http://bestofsecurity.net/tools/Internet_Drive-By_Shootings/</comments>
<pubDate>Tue, 05 Feb 2008 10:58:16 PST</pubDate>
<dc:creator>Staff</dc:creator>
<category>tools</category>
<guid>http://bestofsecurity.net/tools/Internet_Drive-By_Shootings/</guid>
<description><![CDATA[Web browser flaws are nothing new, but the professional crooks are finding new ways to combine these flaws into a system for turning a quick profit. This post describes an example of how one web site is combining system fingerprinting, browser vulnerabilities, email spam, fake web forums, and buggy PHP applications into an automated malware installation system.If you would like to test your system to see if it is vulnerable to these attacks, please visit the Metasploit Browser Assessment web page.Every cou<br/><br/>170 Vote(s) ]]></description>
</item>

<item>
<title><![CDATA[Metasploit Framework 3.0 Beta 1]]></title>
<link>http://bestofsecurity.net/tools/Metasploit_Framework_3-0_Beta_1/</link>
<comments>http://bestofsecurity.net/tools/Metasploit_Framework_3-0_Beta_1/</comments>
<pubDate>Tue, 05 Feb 2008 10:58:04 PST</pubDate>
<dc:creator>Staff</dc:creator>
<category>tools</category>
<guid>http://bestofsecurity.net/tools/Metasploit_Framework_3-0_Beta_1/</guid>
<description><![CDATA[We are happy to announce that the first beta release of the 3.0 tree is now ready for download. This release contains numerous bug fixes and improvements to the previous alpha release. 3.0 Beta 1 is fully compatible with Linux, BSD, Mac OS X, and Windows using our custom Cygwin installer. If you would like to discuss the beta release with other users, please subscribe to the framework-beta mailing list by sending a blank email to framework-beta-subscribe[at]metasploit.com.If you are attending the Black Hat<br/><br/>182 Vote(s) ]]></description>
</item>

<item>
<title><![CDATA[Putting the fun in browser fun]]></title>
<link>http://bestofsecurity.net/tools/Putting_the_fun_in_browser_fun/</link>
<comments>http://bestofsecurity.net/tools/Putting_the_fun_in_browser_fun/</comments>
<pubDate>Tue, 05 Feb 2008 10:57:55 PST</pubDate>
<dc:creator>Staff</dc:creator>
<category>tools</category>
<guid>http://bestofsecurity.net/tools/Putting_the_fun_in_browser_fun/</guid>
<description><![CDATA[During the month of July, H D posted one browser bug each day on the browser fun blog.  The majority of these bugs centered around issues that are typically regarded as non-exploitable, such as NULL pointer dereferences and stack overflows (not to be confused with stack-based buffer overflows).  Though this may be the case, there is an interesting exploitation vector that can be applied to browsers that run on Windows, such as Internet Explorer, that can potentially leverage code execution from otherwise n<br/><br/>147 Vote(s) ]]></description>
</item>

<item>
<title><![CDATA[Metasploit 411 from The 451 Group]]></title>
<link>http://bestofsecurity.net/tools/Metasploit_411_from_The_451_Group/</link>
<comments>http://bestofsecurity.net/tools/Metasploit_411_from_The_451_Group/</comments>
<pubDate>Tue, 05 Feb 2008 10:57:52 PST</pubDate>
<dc:creator>Staff</dc:creator>
<category>tools</category>
<guid>http://bestofsecurity.net/tools/Metasploit_411_from_The_451_Group/</guid>
<description><![CDATA[A few weeks ago, Nick Selby of the 451 Group interviewed me for a market research report about the Metasploit Project. This report was immediately available to 451 subscribers, but not to the general public. Today, TechTarget republished this report in the form of an article for their security news column. This report looks at the history of the project, our &quot;competition&quot;, and the reasons behind the license change in version 3.0. I would like to thank Nick for giving us a fair review and  taking the time t<br/><br/>54 Vote(s) ]]></description>
</item>

<item>
<title><![CDATA[Metasploit Framework 3.0 Beta 2]]></title>
<link>http://bestofsecurity.net/tools/Metasploit_Framework_3-0_Beta_2/</link>
<comments>http://bestofsecurity.net/tools/Metasploit_Framework_3-0_Beta_2/</comments>
<pubDate>Tue, 05 Feb 2008 10:57:40 PST</pubDate>
<dc:creator>Staff</dc:creator>
<category>tools</category>
<guid>http://bestofsecurity.net/tools/Metasploit_Framework_3-0_Beta_2/</guid>
<description><![CDATA[We are happy to announce that the second beta release of the 3.0 tree is now ready for download. This release includes incremental improvements to the first beta as well as some new features and modules.  3.0 Beta 2 is fully compatible with Linux, BSD, Mac OS X, and Windows using our custom Cygwin installer. If you would like to discuss the beta release with other users, please subscribe to the framework-beta mailing list by sending a blank email to framework-beta-subscribe[at]metasploit.com.This release m<br/><br/>218 Vote(s) ]]></description>
</item>

<item>
<title><![CDATA[Metasploit 3.0 Automated Exploitation]]></title>
<link>http://bestofsecurity.net/tools/Metasploit_3-0_Automated_Exploitation/</link>
<comments>http://bestofsecurity.net/tools/Metasploit_3-0_Automated_Exploitation/</comments>
<pubDate>Tue, 05 Feb 2008 10:57:31 PST</pubDate>
<dc:creator>Staff</dc:creator>
<category>tools</category>
<guid>http://bestofsecurity.net/tools/Metasploit_3-0_Automated_Exploitation/</guid>
<description><![CDATA[A recurring theme in my presentations about Metasploit 3.0 is the need for exploit automation. As of tonight, we finally have enough code to give a quick demonstration :-)Metasploit 3 uses the ActiveRecord module (part of RoR) to provide an object-oriented interface to an arbitrary database service. Database support is enabled by installing RubyGems, ActiveRecord (&quot;gem install activerecord&quot;), and a database-specific driver (&quot;gem install [ postgresql | sqlite3 | mysql | etc ]&quot;). Once these components have b<br/><br/>163 Vote(s) ]]></description>
</item>

<item>
<title><![CDATA[Meterpreter scripts and MSRT]]></title>
<link>http://bestofsecurity.net/tools/Meterpreter_scripts_and_MSRT/</link>
<comments>http://bestofsecurity.net/tools/Meterpreter_scripts_and_MSRT/</comments>
<pubDate>Tue, 05 Feb 2008 10:57:28 PST</pubDate>
<dc:creator>Staff</dc:creator>
<category>tools</category>
<guid>http://bestofsecurity.net/tools/Meterpreter_scripts_and_MSRT/</guid>
<description><![CDATA[One of the steps involved in completely automating exploitation is post-exploitation automation.  This is where steps are taken to automate the tasks that are performed after successfully exploiting a target host.  The meterpreter implementation in Metasploit 3.0 defines a programmatic interface for the attacker that helps to faciliate this automation, such as by making it easy to interact with processes, networking, and the file system.  While all of this has been present for some time, we have only recen<br/><br/>58 Vote(s) ]]></description>
</item>

<item>
<title><![CDATA[Kernel-mode payloads in Metasploit 3.0]]></title>
<link>http://bestofsecurity.net/tools/Kernel-mode_payloads_in_Metasploit_3-0/</link>
<comments>http://bestofsecurity.net/tools/Kernel-mode_payloads_in_Metasploit_3-0/</comments>
<pubDate>Tue, 05 Feb 2008 10:57:20 PST</pubDate>
<dc:creator>Staff</dc:creator>
<category>tools</category>
<guid>http://bestofsecurity.net/tools/Kernel-mode_payloads_in_Metasploit_3-0/</guid>
<description><![CDATA[We recently decided to finally take a stab at integrating kernel-mode payloads into Metasploit 3.0.  This presented an interesting challenge for us in terms of architectural integration.  We wanted to make it so users could continue to use the existing set of user-mode payloads for both kernel and non-kernel exploits.  Strictly speaking, every payload in Metasploit to date is a user-mode payload, and as such they will not function properly with a kernel-mode exploit.  However, the goal of making it possibl<br/><br/>130 Vote(s) ]]></description>
</item>

<item>
<title><![CDATA[Update on the status of 3.0]]></title>
<link>http://bestofsecurity.net/tools/Update_on_the_status_of_3-0/</link>
<comments>http://bestofsecurity.net/tools/Update_on_the_status_of_3-0/</comments>
<pubDate>Tue, 05 Feb 2008 10:57:16 PST</pubDate>
<dc:creator>Staff</dc:creator>
<category>tools</category>
<guid>http://bestofsecurity.net/tools/Update_on_the_status_of_3-0/</guid>
<description><![CDATA[It's been a while since our last update, so here's how things have been proceeding.  We're nearing the point of being able to cut a stable release of 3.0.  The main things that we'd like to complete before we'll feel happy calling things done include the following:1. Finish up msfweb support, or at least get pretty close.  We've made some good progress in getting a fancy little AJAX console integrated that allows you to run the equivalent of msfconsole from a web-browser.  If you're interested, grab the la<br/><br/>62 Vote(s) ]]></description>
</item>

<item>
<title><![CDATA[Metasploit Framework 3.0 RELEASED!]]></title>
<link>http://bestofsecurity.net/tools/Metasploit_Framework_3-0_RELEASED/</link>
<comments>http://bestofsecurity.net/tools/Metasploit_Framework_3-0_RELEASED/</comments>
<pubDate>Tue, 05 Feb 2008 10:57:06 PST</pubDate>
<dc:creator>Staff</dc:creator>
<category>tools</category>
<guid>http://bestofsecurity.net/tools/Metasploit_Framework_3-0_RELEASED/</guid>
<description><![CDATA[Metasploit is pleased to announce the immediate free availability of the Metasploit Framework version 3.0 from http://framework.metasploit.com/.The Metasploit Framework (&quot;Metasploit&quot;) is a development platform for creating security tools and exploits. Version 3.0 contains 177 exploits 104 payloads 17 encoders and 3 nop modules. Additionally 30 auxiliary modules are included that perform a wide range of tasks including host discovery protocol fuzzing and denial of service testing.  Metasploit is used by net<br/><br/>196 Vote(s) ]]></description>
</item>

<item>
<title><![CDATA[Exploiting the ANI vulnerability on Vista]]></title>
<link>http://bestofsecurity.net/tools/Exploiting_the_ANI_vulnerability_on_Vista/</link>
<comments>http://bestofsecurity.net/tools/Exploiting_the_ANI_vulnerability_on_Vista/</comments>
<pubDate>Tue, 05 Feb 2008 10:56:57 PST</pubDate>
<dc:creator>Staff</dc:creator>
<category>tools</category>
<guid>http://bestofsecurity.net/tools/Exploiting_the_ANI_vulnerability_on_Vista/</guid>
<description><![CDATA[There's been some discussion going around about whether or not it's really possible to use the ANI vulnerability to execute arbitrary code on Vista.  If you aren't familiar with the ANI vulnerability, go check out another great bit of work from Determina's Alexander Sotirov.  HD Moore wrote the first Metasploit module for this on Friday night and we continued to improve the exploit (and add a second SMTP module) over the weekend. These modules include a default target that is able to hit both XP and Vista.<br/><br/>186 Vote(s) ]]></description>
</item>

<item>
<title><![CDATA[HeapLib support added to Metasploit 3]]></title>
<link>http://bestofsecurity.net/tools/HeapLib_support_added_to_Metasploit_3/</link>
<comments>http://bestofsecurity.net/tools/HeapLib_support_added_to_Metasploit_3/</comments>
<pubDate>Tue, 05 Feb 2008 10:56:54 PST</pubDate>
<dc:creator>Staff</dc:creator>
<category>tools</category>
<guid>http://bestofsecurity.net/tools/HeapLib_support_added_to_Metasploit_3/</guid>
<description><![CDATA[If you were able to attend Black Hat Europe this year, you had the opportunity to catch Alexander Sotirov's talk on Heap Feng Shui.  If not, I recommend you take a look at the materials found here . The focus of his talk was on describing ways to use javascript in browsers to control heap layout with surgical precision.  This has obvious benefits when it comes to exploiting heap related vulnerabilities in browsers.  At present, many browser-based exploits will blindly spray payloads and other structures ac<br/><br/>52 Vote(s) ]]></description>
</item>

<item>
<title><![CDATA[April Codings Bring May Pwnings]]></title>
<link>http://bestofsecurity.net/tools/April_Codings_Bring_May_Pwnings/</link>
<comments>http://bestofsecurity.net/tools/April_Codings_Bring_May_Pwnings/</comments>
<pubDate>Tue, 05 Feb 2008 10:56:39 PST</pubDate>
<dc:creator>Staff</dc:creator>
<category>tools</category>
<guid>http://bestofsecurity.net/tools/April_Codings_Bring_May_Pwnings/</guid>
<description><![CDATA[April has been a busy month in Metasploit-land. The Metasploit Community Book is on a roll, with tons of new content straight from the community. We are still looking for volunteers to help with this project by developing new content and editing the existing text. This is a strictly non-profit effort and we have no intention of partnering with a publisher for this project. Hard-copies will eventually be provided by print-on-demand publishing. If you would like to help, please drop us an email at msfdev[at]<br/><br/>207 Vote(s) ]]></description>
</item>

<item>
<title><![CDATA[The Pwnie Awards: Nominate your favorites today!]]></title>
<link>http://bestofsecurity.net/tools/The_Pwnie_Awards_Nominate_your_favorites_today/</link>
<comments>http://bestofsecurity.net/tools/The_Pwnie_Awards_Nominate_your_favorites_today/</comments>
<pubDate>Tue, 05 Feb 2008 10:56:32 PST</pubDate>
<dc:creator>Staff</dc:creator>
<category>tools</category>
<guid>http://bestofsecurity.net/tools/The_Pwnie_Awards_Nominate_your_favorites_today/</guid>
<description><![CDATA[The first annual Pwnie Awards are being held in Las Vegas, August 2nd, during the Black Hat USA 2007 security conference. The Pwnie nomination period closes on July 28th, so please head to the web site and nominate your favorites today. Pwnies will be awarded for each of the following categories:    * Best Server-Side Bug    * Best Client-Side Bug    * Mass 0wnage    * Most Innovative Research    * Lamest Vendor Response    * Most Overhyped Bug    * Best Song<br/><br/>123 Vote(s) ]]></description>
</item>

<item>
<title><![CDATA[Black Hat USA: Tactical Exploitation]]></title>
<link>http://bestofsecurity.net/tools/Black_Hat_USA_Tactical_Exploitation/</link>
<comments>http://bestofsecurity.net/tools/Black_Hat_USA_Tactical_Exploitation/</comments>
<pubDate>Tue, 05 Feb 2008 10:56:27 PST</pubDate>
<dc:creator>Staff</dc:creator>
<category>tools</category>
<guid>http://bestofsecurity.net/tools/Black_Hat_USA_Tactical_Exploitation/</guid>
<description><![CDATA[Valsmith and I took the stage at Black Hat yesterday to deliver a 150 minute presentation on what we call &quot;Tactical Exploitation&quot;. The talk was aimed at penetration testers who find themselves limited in what they can exploit due to artificial constraints placed on their scope. The first half of the talk focused on lesser-known discovery and fingerprinting tools. Third-party services, such as DomainTools.com and the web interface to Paterva's Evolution product were discussed. The first half ended up with s<br/><br/>78 Vote(s) ]]></description>
</item>

<item>
<title><![CDATA[The Pwnie Awards: Winners Announced!]]></title>
<link>http://bestofsecurity.net/tools/The_Pwnie_Awards_Winners_Announced/</link>
<comments>http://bestofsecurity.net/tools/The_Pwnie_Awards_Winners_Announced/</comments>
<pubDate>Tue, 05 Feb 2008 10:56:21 PST</pubDate>
<dc:creator>Staff</dc:creator>
<category>tools</category>
<guid>http://bestofsecurity.net/tools/The_Pwnie_Awards_Winners_Announced/</guid>
<description><![CDATA[The winners of the 2007 Pwnie Awards were announced during an award ceremony at the Black Hat USA security conference. Dennis Fisher of TechTarget posted a review of the awards ceremony and the winners. While the event wasn't a complete success (short notice of the ceremony location/time, US immigration blocking entrance for one of the judges, limited nominations in some categories, etc), everyone involved had a good time and we are much better prepared for next year ;-)<br/><br/>127 Vote(s) ]]></description>
</item>

<item>
<title><![CDATA[An easier way to create payload modules in 3.0]]></title>
<link>http://bestofsecurity.net/tools/An_easier_way_to_create_payload_modules_in_3-0/</link>
<comments>http://bestofsecurity.net/tools/An_easier_way_to_create_payload_modules_in_3-0/</comments>
<pubDate>Tue, 05 Feb 2008 10:56:11 PST</pubDate>
<dc:creator>Staff</dc:creator>
<category>tools</category>
<guid>http://bestofsecurity.net/tools/An_easier_way_to_create_payload_modules_in_3-0/</guid>
<description><![CDATA[Thanks to Yoann GUILLOT and Julien TINNES, Metasploit 3.0 (the trunk version) includes integrated support for metasm, a 100% ruby assembler, disassembler, and linker.  It currently supports x86 and MIPS, but support for many other architectures is in development.  Using metasm, we've taken some steps to improve the framework's payload module interface.  This improvement is designed to make it possible for payload modules to contain assembly rather than the typical large blob of pre-assembled machine code. <br/><br/>194 Vote(s) ]]></description>
</item>

<item>
<title><![CDATA[A root shell in my pocket (and maybe yours)]]></title>
<link>http://bestofsecurity.net/tools/A_root_shell_in_my_pocket_and_maybe_yours/</link>
<comments>http://bestofsecurity.net/tools/A_root_shell_in_my_pocket_and_maybe_yours/</comments>
<pubDate>Tue, 05 Feb 2008 10:55:56 PST</pubDate>
<dc:creator>Staff</dc:creator>
<category>tools</category>
<guid>http://bestofsecurity.net/tools/A_root_shell_in_my_pocket_and_maybe_yours/</guid>
<description><![CDATA[After the recent price drop and toolchain release, I bit the bullet and bought a shiny new iPhone. The first thing I did is bypass activation, run jailbreak, and install the AppTapp Installer. Using the installer, I added OpenSSH and a VT-100 Terminal to the phone. Once I had shell access, I made a few observations:1) The processor is actually decent. Compare the iPhone (400Mhz*) with the Nokia n770 (233mhz) or the Nokia n800 (320Mhz) and the choice of a handheld hacking device is a no-brainer. The (mostly<br/><br/>243 Vote(s) ]]></description>
</item>

<item>
<title><![CDATA[Cracking the iPhone (part 1)]]></title>
<link>http://bestofsecurity.net/tools/Cracking_the_iPhone_part_1/</link>
<comments>http://bestofsecurity.net/tools/Cracking_the_iPhone_part_1/</comments>
<pubDate>Tue, 05 Feb 2008 10:55:46 PST</pubDate>
<dc:creator>Staff</dc:creator>
<category>tools</category>
<guid>http://bestofsecurity.net/tools/Cracking_the_iPhone_part_1/</guid>
<description><![CDATA[In my last post, I described the Apple iPhone in terms of being a security tool and a security target. At the time, I had just finished a first pass on iPhone shellcode. What I didn't realize was that a stock iPhone does not include a /bin/sh executable, nor any of the standard Unix command line tools. My shellcode would only be useful against iPhones which had been updated with the BSD environment package.A few days later, Apple released the 1.1.1 update. This update removed any installed third-party pack<br/><br/>197 Vote(s) ]]></description>
</item>

<item>
<title><![CDATA[Cracking the iPhone (part 2)]]></title>
<link>http://bestofsecurity.net/tools/Cracking_the_iPhone_part_2-1/</link>
<comments>http://bestofsecurity.net/tools/Cracking_the_iPhone_part_2-1/</comments>
<pubDate>Tue, 05 Feb 2008 10:55:37 PST</pubDate>
<dc:creator>Staff</dc:creator>
<category>tools</category>
<guid>http://bestofsecurity.net/tools/Cracking_the_iPhone_part_2-1/</guid>
<description><![CDATA[In part one of &quot;Cracking the iPhone&quot;, I described the libtiff vulnerability, its impact on iPhone users, and released the first version of my hacked up debugger. In this post, I will walk through the process of actually writing the exploit.First off, a new version of weasel (hdm-0.02) has been released. This version includes an entirely new disassembly backend, courtesy of libopcodes, and supports thumb-mode instructions. Thumb is a 16-bit instruction mode for ARM processors that is designed to save memory<br/><br/>160 Vote(s) ]]></description>
</item>

<item>
<title><![CDATA[Cracking the iPhone (part 2.1)]]></title>
<link>http://bestofsecurity.net/tools/Cracking_the_iPhone_part_2-1/</link>
<comments>http://bestofsecurity.net/tools/Cracking_the_iPhone_part_2-1/</comments>
<pubDate>Tue, 05 Feb 2008 10:55:30 PST</pubDate>
<dc:creator>Staff</dc:creator>
<category>tools</category>
<guid>http://bestofsecurity.net/tools/Cracking_the_iPhone_part_2-1/</guid>
<description><![CDATA[In part two of &quot;Cracking the iPhone&quot;, the final result was a working exploit for the libtiff vulnerability. This exploit depended on four key addresses to work properly. The first address was the stack pointer where our string was stored. The stack pointer is static across the same version of the application, but does change between major versions. Due to this address change, a different stack address had to be used for MobileMail versus MobileSafari, and version 1.02 had a different address than 1.1.1. Th<br/><br/>108 Vote(s) ]]></description>
</item>

<item>
<title><![CDATA[Cracking the iPhone (part 3)]]></title>
<link>http://bestofsecurity.net/tools/Cracking_the_iPhone_part_3/</link>
<comments>http://bestofsecurity.net/tools/Cracking_the_iPhone_part_3/</comments>
<pubDate>Tue, 05 Feb 2008 10:55:25 PST</pubDate>
<dc:creator>Staff</dc:creator>
<category>tools</category>
<guid>http://bestofsecurity.net/tools/Cracking_the_iPhone_part_3/</guid>
<description><![CDATA[In part one of &quot;Cracking the iPhone&quot;, I described the libtiff vulnerability.  In part two, I walked through the process of exploiting it. In part two point one, I covered a new exploit approach that resulted in reliable code execution. The one piece still missing is what to do once code execution is obtained. An unmodified iPhone does not include an interactive shell, nor any of the standard Unix tools. In order to make this exploit useful, the user needs a payload that can install arbitrary executables on<br/><br/>87 Vote(s) ]]></description>
</item>

<item>
<title><![CDATA[Reliable staging without a stager receive loop]]></title>
<link>http://bestofsecurity.net/tools/Reliable_staging_without_a_stager_receive_loop/</link>
<comments>http://bestofsecurity.net/tools/Reliable_staging_without_a_stager_receive_loop/</comments>
<pubDate>Tue, 05 Feb 2008 10:55:11 PST</pubDate>
<dc:creator>Staff</dc:creator>
<category>tools</category>
<guid>http://bestofsecurity.net/tools/Reliable_staging_without_a_stager_receive_loop/</guid>
<description><![CDATA[Staged payloads are used by Metasploit to help reduce the size of the initial payload blob that needs to be transmitted as part of an exploitation attempt.  These stagers typically connect to a Metasploit client and bootstrap (read in) a second stage payload blob which is subsequently executed.  There's a problem with this approach, however, and it has to do with partial reads.It just so happens that Metasploit has a stage (the DLL injection stage) that is nearly 3000 bytes in size.  On all modern operatin<br/><br/>195 Vote(s) ]]></description>
</item>

<item>
<title><![CDATA[METASPLOIT UNLEASHES VERSION 3.1]]></title>
<link>http://bestofsecurity.net/tools/METASPLOIT_UNLEASHES_VERSION_3-1/</link>
<comments>http://bestofsecurity.net/tools/METASPLOIT_UNLEASHES_VERSION_3-1/</comments>
<pubDate>Tue, 05 Feb 2008 10:55:02 PST</pubDate>
<dc:creator>Staff</dc:creator>
<category>tools</category>
<guid>http://bestofsecurity.net/tools/METASPLOIT_UNLEASHES_VERSION_3-1/</guid>
<description><![CDATA[Austin, Texas, January 28th, 2008 -- The Metasploit Project announced today the free, world-wide availability of version 3.1 of their exploit development and attack framework. The latest version features a graphical user interface, full support for the Windows platform, and over 450 modules, including 265 remote exploits.   &quot;Metasploit 3.1 consolidates a year of research and development, integrating ideas and code from some of the sharpest and most innovative folks in the security research community&quot; said <br/><br/>142 Vote(s) ]]></description>
</item>

</channel>
</rss>
