Where have you been!?

I've been busy... :-(

But i do have some upcoming conference speaking engagements coming up.

So. If you are heading to BruCon

catch me and Joe McCray talk about Pentesting High Security Environments.

If you are heading to DerbyCon

Catch me and Rob Fuller talk about The Dirty Little Secrets They Didn’t Teach You In Pentesting Class


Lastly, if you'll be in Switzerland for Hashdays







You can catch me talk about From Low to Pwned.

I'll also be giving a talk at the Management workshop on Information Operations for Management (sorry the info isn't on the site yet but should be here https://www.hashdays.ch/management-session.html at some point).

I'm sure there will be more stuff in November/December its just not scheduled yet.

carnal0wnage and Attack Research join forces!

I'm happy to announce that carnal0wnage and Attack Research have joined blog forces!

the new home for the blog will be:

http://carnal0wnage.attackresearch.com/

please point your RSS readers to the new location and enjoy

With the new blog is the ability for a few more people to post. If you want to contribute please email c0arblog@attackresearch.com

-CG

2 Year Anniversary!

Happy Two Year Anniversary of carnal0wnage blog!

carnal0wnage on Exotic Liability Podcast

Chris Nickerson was kind enough to ask me to join him for his Exotic Liability podcast.

You can check it out here:
http://exoticliability.qb1.libsyn.com/index.php?post_id=453598

Main Exotic Liability Page:
http://www.exoticliability.com/

I had a blast! I'm really looking forward to hearing the rest of the interviews/podcasts. They had some really sharp people come on the show including Mike Murray, Val Smith, Delchi, and Max Caceres.

Next time we'll get Dean in on the call.

Notes from the podcast (or stuff I forgot to mention but should have)

Oracle Demo video from ShmooCon Firetalk
http://www.vimeo.com/3118559

Metasploit Oracle API and some code (still beta)
http://metasploit.com/users/mc/

**requires Oracle Instantclient and rubydbi and probably some other stuff

SOURCE Boston video of Vince and I's client-side talk
http://www.vimeo.com/3665163

Check out Michael Santarcangelo's book on Defending against Breaches, which has alot to do with educating users, user awareness programs, defending against SE, and handling data breaches....a must read!
http://www.intothebreach.com/

g0ne and I will be giving the client-side talk at NotaCon 6 in April and ChicagoCon in May

Maltego for Network Infrastructure Enumeration

New article on Using Maltego for Network Infrastructure Enumeration posted on EthicalHacker.net

Any organization that has an Internet presence needs to have some form of infrastructure to support their presence. During Infrastructure Enumeration you attempt to discover how much of it exists, what type of infrastructure is used, where it is located, what technology is used and how it is structured. This type of information is interesting for:

* Security assessments (as this is the first and most tedious phase of any external assessment).
* Getting an idea of the organization’s Internet and geographical presence.
* Gaining insight into the technology used by the organization.
* Making connections between seemingly unconnected organizations (as they might be sharing common infrastructure).
* Getting a list of brands or affiliations supported by the organization.

Read the article over on EthicalHacker.net
http://www.ethicalhacker.net/content/view/251/24/

Carnal0wnage Blog makes the top 5 Best Technical Security Blog

I am happy to announce that Carnal0wnage Blog made the top 5 Best Technical Security Blogs for the RSA Social Security Awards

https://365.rsaconference.com/blogs/blogger_meetup/2009/04/06/social-security-awards--the-finalists

Best Technical Security Blog

Carnal 0wnage
Zero Day
Schneier on Security
SANS
Rational Survivability

Thanks to everyone that voted or to whoever coded up that burp script :-)

Presentation on Client-Side Attacks at SOURCE Boston

Alright its time for SOURCE Boston!

I'm happy to announce that g0ne and I will be there presenting on:

Attacking Layer 8: Client-Side Penetration Testing

We'll be talking about why you should be allowing your penetration testers to use client-side attacks during their assessments , how to use the metasploit framework to deliver client-side attacks with demos (yes other tools do CS attacks but we're poor), and some remediations for client-side attacks.

It will be an extra special big day because we'll be presenting as Full Scope Security, our new security consultancy. More on that later.

If you're not going to make it to SOURCE, we will also be at Notacon 16-19 April 09
http://www.notacon.org and ChicagoCon 8-9 May 09 http://www.chicagocon.com

Top 10 Web Hacking Techniques

Jeremiah Grossman just posted (well...awhile ago) the official Top Ten Web Hacking Techniques.

I want to give a shout out to dean who did a great post on ActiveX repurposing or "0wning the client without an exploit" back in August. ActiveX repurposing is #9 in the Top 10, and #41 (blog post linked there) on the big list. Unfortunately He nor c0 was specifically mentioned in the top10 even though it was mentioned in the big list.

...maybe next year.

Oracle FTP Script Write/Binary Download/Execute via Oracle Packages Video

Metasploit Auxiliary module for Oracle FTP Script Write/Binary Download/Execute via Oracle Packages.

As DBA (yea for SQLI) we use UTL_FILE to write out our FTP download script, using DBMS_SCHEDULER we create a job to run the script to download our binary and create a 2nd job to execute our binary and get our meterpreter shell. Oracle...Unbreakable.

I got the "how to do it" from Red-Database-Security

check MC's video (requires java) on getting those DBA privs on an 11g box.
w00t-shell.net/demos/CVE-2008-3996.html

No code yet unless you email me and say you'll actually test it. Right now its in the "works for me" status but if you want to try it out on some other Oracle versions give me a shout. It wont work on 9 but should work on 10 & 11.


Metasploit Auxiliary module for Oracle FTP Script Write/Binary Download/Execute via Oracle Packages from carnal0wnage on Vimeo.

Attacking Oracle with Metasploit ShmooCon Firetalk Demo

Here is the video from my Attacking Oracle with the Metasploit Framework ShmooCon Firetalk.




Attacking Oracle with the Metasploit Framework Shmoocon Firetalk Demo Video from carnal0wnage on Vimeo.

carnal0wnage mention on ITSecurity.com

carnal blog got a shoutout over on IT Security.com

http://www.itsecurity.com/blog/20080310/why-life-is-tough-for-the-ethical-hackers/

First Post

New blog, I suck at updating blogs but we'll see how we do...