Chrome Users Are Still Tracked Despite Opt-Out
Written by Angelo Castigliola   
Mar 08, 2012 at 03:55 AM
Share

After opting-out of all statistical data/security features for Chrome, the browser will still send data to Google servers periodically as someone browses the internet.

I reported this Issue (117432) to Google’s Chromium security project group.  

Write Comment (0 comments)
Last Updated ( Mar 08, 2012 at 03:59 PM )

Angelo sent a Tweet to Chris Eng.
An Easy Way to Generate FOIA Requests
Written by Angelo Castigliola   
Feb 29, 2012 at 10:56 PM
Share

This is a nice service, which breaks down the complexity of filing Freedom of Information Act (FOIA) requests to federal agencies.  Filing FOIA requests are handy for journalists, genealogy, and just idle curiosity:

This web site helps you generate the letters you need to send to the FBI to get a copy of your own FBI file. We can help you get your files from other "three-letter agencies" (CIA, NSA, DIA, ...) too. It's quick, it's easy, and best of all, it's free!  

Write Comment (0 comments)
Last Updated ( Mar 01, 2012 at 11:11 AM )

Network Stress Testing and Denial-of-Service Attack Tools
Written by Angelo Castigliola   
Feb 27, 2012 at 11:21 PM
Share

Many network security professionals prefer writing their own tools for stress testing.  Worth noting are some other toolsets for performing Denial of Service (DoS) tests which consumes resources primarily through flooding network protocols.

T50 Experimental Packet Injector Tool

Low Orbit Ion Cannon (LOIC)

High Orbit Ion Cannon (HOIC) – This seems to be available by torrent only but is widely accepted to be more effective than LOIC.

There are also enterprise versions of these tools which are better at crafting very specific load conditions and provides out of the box reporting.

HP Loadrunner

Facilita

Spirent

Write Comment (0 comments)
Last Updated ( Feb 28, 2012 at 11:25 AM )

Angelo sent a Tweet to Kevin Mitnick and Nick Farr.
Estimating Password Hash and Session Token Randomness
Written by Angelo Castigliola   
Feb 22, 2012 at 03:10 AM
Share

This is great research by Ryan O'Horo, from IOActive, on analyzing password hashes and session tokens. The purpose is to identify how much computing power it would take to generate a correct value:

I find myself analyzing password and token entropy quite frequently and I’ve come to rely upon Wolfram Alpha and Burp Suite Pro to get my estimates for these values. It’s understandable why we’d want to check a password’s entropy. It gives us an indication of how long it would take an attacker to brute force it, whether in a login form or a stolen database of hashes. However, an overlooked concern is the entropy contained in tokens for session and object identifiers. These values can also be brute forced to steal active sessions and gain access to objects to which we do not have permission. Not only are these tokens sometimes too short, they sometimes also contain much less entropy than appears.

Write Comment (0 comments)
Last Updated ( Feb 23, 2012 at 05:53 AM )

DNS Response Forging Tool for Code Analysis/Reverse Engineering
Written by Angelo Castigliola   
Feb 21, 2012 at 07:13 AM
Share

This seems like a handy tool to have. I do not have a use for it just yet:

DNSChef is a cross-platform DNS proxy capable of forging responses based on inclusive and exclusive domain lists, matching domains with wildcards, proxying true responses for nonmatching domains, using external configuration files and other features useful for pentesters and malware analysts. DNSChef was developed to help with a test of an application which did not support HTTP proxy parameters.

There are many ways to intercept network traffic; however, you may find this tool handy when everything else fails.

DNSChef source and documentation:

http://thesprawl.org/projects/dnschef/

Write Comment (0 comments)
Last Updated ( Feb 21, 2012 at 11:17 AM )

<< Start < Previous 1 2 3 4 5 6 7 8 9 10 Next > End >>

Angelo Castigliola     View Photos of Angelo (8)
    Send Angelo a Message
Sec and Sec-Tech Newsletter
Email:





Upcoming Events