OWASP VI Spain Meeting -2010: And still bruteforcing

Hi all, the past 19 of June i presented at OWASP VI Spain Meeting, a review of Bruteforce attacks in web applications, this is an old technique that is still useful for the attackers, and i showed with examples that is present in many attacks that affect big companies like Facebook, Yahoo, AT&T, Tuenti, etc. Also i presented the latest version of Webslayer a tool to perform all kind of bruteforce attacks in web applications.

You can find the presentation here:

http://www.owasp.org/images/2/2a/Bruteforce2010.key.pdf

And also the video of the talk (spanish) here.

Here is a picture of the conference showing the Webslayer results interface:

Next version will add some requested features like multiple proxies support, delay between request, and many more.

Stay tuned and enjoy...

Christian

Top 25 Most dangerous coding errors

A joint effort between CWE (Common Weakness Enumeration) and SANS, and with the participation of experts in the field, produced the "Top 25 most dangerous coding errors"  a list of the most significant programming errors that can lead to serious software vulnerabilities, this document will impact in many areas like:

• Software buyers will be able to buy much safer software. ( with a certificate of code beign free of these 25 bugs)
  
• Programmers will have tools that consistently measure the security of the software they are writing.
• Colleges will be able to teach secure coding more confidently.
• Employers will be able to ensure they have programmers who can write more secure code. 

"The main goal of the Top 25 list is to stop vulnerabilities at the source by educating programmers on how to eliminate all-too-common mistakes before software is even shipped."

This is a good initiative to have a very brief list of programming errors, so the programmers could use as a guide, the language and examples used are very easy to understand and i guess this will facilitate the adoption by the programmers.

There is a lot of information about secure coding at OWASP, but i guess that this simple guide will be easier to use, than OWASP documentation.

Hope programmers start to use it :)

You can check the list here

-CMM

OWASP Testing Guide v3.0

The new testing guide was released the 18 of December, this is a great project, and very useful for penetration testers.  This version is very complete and is more clean than the previous versions.

You can download here:

http://www.owasp.org/index.php/OWASP_Testing_Project

-CMM