Blog

Blog

Jun

ModSecurity SVM Bypass Charity Challenge

Written By Josh Zlatin

I am happy to announce the ModSecurity SVM Bypass Charity Challenge. This is a SQL Injection, XSS and Path Traversal Filter Evasion Challenge. Similar to the Trustwave ModSecurity SQLi Challenge, I setup ModSecurity to proxy to the following four commercial vulnerability scanner demo sites:

3 Comments

| 1,274 Hits

Tags: PureWAF ModSecurity Web Defense

May

Speeding Up Lua Script Execution in ModSecurity

Written By Josh Zlatin

Often when implementing customised ModSecurity solutions we need to extend the built-in functionality via Lua scripting. One of the disadvantages to this approach is the added latency penalty paid for not using the native rules language. When web site performance is critical for business continuity, every additional millesecond counts. The current trunk code fixes a long-standing limitation where ModSecurity needed to create a new VM for each request, which added latency every time a Lua script was executed.

0 Comments

| 3,723 Hits

Tags: Lua, ModSecurity, purewaf, security

May

Ethical Hacking Unveiled

Written By Richard Brown

The term ‘ethical hacker’ is often misrepresented as the keywords "ethical" and "hacking" are an oxymoron. A hacker is defined as an unlawful individual breaking into systems and obtaining private data without explicit authorisation. Society in general has a perception of a hacker as a person wearing a hoodie and hiding in a dark basement.

0 Comments

| 670 Hits

Tags: ethical, hacker, hackers, hacking

Apr

Fight PCI trolls by trolling them back

Written By Gordon Maddern

I recently had to go in to bat for a client who was told by their PCI auditor that they would fail PCI and as a result have to notify all their clients that they were not PCI compliant. The reason they failed was because the ASV scanner picked up an F5 internal IP address disclosure vulnerability that their scanning engine Nessus picked up.

0 Comments

| 612 Hits

Tags: CVSS score, PCI, PCI compliance, vulnerability scanning

Mar

Hacking in the Year 2030

Written By Ty Miller

If you are anything like me, when you hear "Hacking in the Year 2030" you immediately visualize hacking robot armies and UFOs to take them down with lazers and ultrasonic USB attachments via your PlayStation 10 using only changes in pupil dilation to read mental instructions of what hacking tools to launch.

Well this technology may very well be around in 2030, but unfortunately most of you are more likely to still be exploiting Cross Site Scripting (XSS) vulnerabilities in the web interface of the killer robots.

3 Comments

| 3,045 Hits