Blog
Rhodes MSc Information Security Weekend
An education isn’t how much you have committed to memory, or even how much you know. It’s being able to differentiate between what you know and what you don’t.
– Anatole France
Jobs within Information Security, and indeed Information Technology, are often more than a 9-5 affair for many who choose them as their career. There is a wealth of different technologies, frameworks, approaches and information that you need to understand to perform your job to a suitable level. In IT security specifically, with the pace of technology constantly growing, keeping abreast is often easier said than done.
Cadet Training
You’ve seen the movies. You’ve seen the cooler than life characters hacking systems using obscure keyboards and operating systems that seem to float through the network, so how about now really learning how it’s done?
Hacking by Numbers, Cadet Edition is being presented at Black Hat USA this year by two super star SensePost hackers. This entry-level course will delve into the following topics:
• Understanding the hacker mind-set.
• Method based approached of understanding the penetration testing life cycle.
ITWeb Security Summit
The ITWeb Security Summit is creeping up on us again and will be happening on the 10-11th of May. This year ITWeb went with something slightly different, and are asking for people to suggest who they’d like to see on day 2. These suggestions will then be voted on. So, if there’s someone you’re dying to see present or a topic you really want someone to spend some time researching, head over to their community portal and write it down.
To understand the battlefield, you need a broad view
It is always a little bemusing to hear that we only provide pentests. Since 2001, SensePost has offered a very comprehensible vulnerability management service that’s evolved through multiple generations of technologies and methodologies into a service we’re very proud of. The Managed Vulnerability Scanning (“MVS”) service makes use of our purpose-built BroadView scanning technology to scan a number of high profile South African and European clients. More information can be found here, but the purpose of this post is to introduce it with a basic overview of its deployment.
BlackHat Barcelona Training
Hola amigos,
We will be running our elite “Combat Training” at the BlackHat Briefings in Barcelona this March (talk lineup) and this course is the flagship of our established Hacking by Numbers series. From the first hour to the final minutes students are placed in different attacker scenarios as they race the clock to “capture the flag”. The trainers are highly skilled (as well as having the standard Southern African humour, looks, and charm) and the course is full of new hacks.
The Yeti is here
After several months of dedicated … uh dedication, our new network footprinting tool is being made available to the masses.
It’s called Yeti and it is a cross-platform, Java application. It’s predecessor, BidiBlah, was only available on Windows platforms and hopefully with Yeti we can now offer Internet intelligence gathering to everyone.
So what does Yeti do:
Top level domain expansion (tld expand) Forward lookups (mx,ns,a,cname and zone transfers) Reverse lookups (ptr records) Cert Extraction (getting the common name, and domain from ssl certificates) Bing IP/Site searches Report exports to xls format We invite you all to visit the Yeti community blog and to participate in either testing the tool or just to add comments. Usage instructions can be found on the spyeti blogspot.
Training – lots of stuff(c)
Hey. Charl here. Lots of stuff is happening on the training front right now (ed: right now!), and I wanted to make sure everyone is aware of it.
1. New schedule published
At the start of the year we always try publish a schedule of when and where our various training courses are happening. Of course it changes a bit as the year progresses, but its a pretty good overview of where you need to be if you want to participate in one of the courses. The current 2011 schedule can be found here.
Happy New Year gift: source code!
If you use the Gregorian Calendar, then Happy New Year! Down here in South Africa, we’ve also ushered in a new year and in celebration SensePost is releasing source code for our in-house web proxy, Suru, under a BSD-style license.
When released in 2006, Suru introduced a number of unique features to the world of inline proxies including trivial fuzzing, token correlation and background directory brute-forcing. Further improvements include timing analysis and indexable directory checks. These were not available in other commercial proxies at the time, hence our need to write our own. Since then, most of these features have been incorporated into more full-featured commercial proxies, negating the need for Suru.
Season’s Greetings
To all our customers, staff (past and present), business partners, friends and associates I’d like to wish a joyous and peaceful festive season. What started out as a depression is slowly becoming a success and I thank you for all your support during this past year. I look forward to seeing you all again soon and sharing with you an exciting and prosperous 2011!
Internal spotlight
As the year winds down, it’s time to mention a few internal victories that are fun to share:
Daniel Cuthbert and Rogan Dawes (both staunch OWASP proponents) have joined our assessment team, which is a big boost. Welcome guys! Glenn Wilkinson, a lead analyst, had his Masters thesis listed on Amazon Dominic White was interviewed in all his glory on .za teevee over Wikileaks