Basics The Test Site Methodology Results Analysis Summary In this series I’m going to be taking a look at how various web scanners perform at finding web application security issues. This installment compares Burpsuite Pro with Netsparker. Settings I am going to be using default settings for the most part with the following caveats: Netsparker is an automated…
Archives for 2015
Why Hipsters All Look Alike, or How to Do Science
But the beauty of Touboul’s model, which he sketches out in a meager four pages, lies in its succinctness. He doesn’t aim to explain everything. His goal is to express a single idea about how nonconformists might synchronize, and he does so in the most concise way possible. Touboul belongs to a breed of theoreticians who see themselves…
When Interviewing, Make it Clear That You’re Vetting Them As Well
But how do you figure out the culture of a company you’ve never worked for? As Nicole tried to evaluate company cultures, she kept asking the Passover question: “How is this organization different from all other organizations?” And, as with Passover, I told Nicole, the answer should come in the form of a story. Ask people to tell…
Models + Data = Prediction
Even obscure variables such as how frequently a user recharges the phone’s battery, how many incoming text messages they receive, how many miles they travel in a given day or how they enter contacts into their phone — the decision to add last name correlates with creditworthiness — can bear on a decision to extend credit. Source: You…
Failing at the Basics in Intelligence and InfoSec
The current operational environment in Europe is so lax that it seems there is literally no security error ISIS terrorists can make that will derail their plans. – Interviewed in Dabiq #7Escapes arrest after rest of cell killed in a raid – Make plans over mobile phone callsDiscuss plans using game consoles (PS4) – Video driving a truck…
Never Send Sensitive Information in the URL, Even Over HTTPS
There is some confusion about how secure it is to send sensitive information in the URL (or query string) when the connection is over HTTPS. Here are some basic things to note on this: It’s true that everything in the HTTP request is encrypted, including the URL (query string) The fact that the URL is encrypted in transit…
Everyone is Multiple People
I subscribe to a model of human understanding that sees each person as a combination of multiple people. When you’re dealing with someone, you have to know which person you’re actually talking to. It’s not always so extreme, of course, but it often is. Here are some people (traits) that my friends are/have: Self-confident elitist Will give shirt…
Why Trump is Winning
I just watched my first Republican debate (as opposed to just hearing about what was said from the media) and I now understand what’s going on with Trump. It’s quite simple. He’s a billionaire with the biggest ego and the clearest language that expresses three things repeatedly: Strength (belief that he can get it done) Nostalgia (a vision…
How to Install VMware Tools in Kali Linux 2.x
It’s harder than it should be, but easier than it looks: Mount the VMware Tools virtual CD from the guest’s VMware menu Copy the VMware Tools tar.gz file to the Kali Desktop Extract the directory using tar xf nameoffile.tar.gz Run the installer with Perl, e.g. perl vmware-install.pl –d Follow the short wizard. The defaults are decent. Reboot That’s…
T1SP: Episode 21
[ Subscribe to the Podcast: iTunes | Android ] Topics for this episode: News [ ] Stringing Shodan to exploitation [ ] Why you need to check HaveIBeenPwned [ ] Another DELL root cert hacked [ ] ISIS OPSEC advice (data privacy, tor, crytocat, telegram, proton mail, gps features on mobile devices, etc.) They also mention not to…
My Pre-fight Analysis of Aldo-McGregor
I’ve been waiting for this fight for a long time, and I want to give my thoughts before it happens later tonight. — I think Aldo has the highest chance to win (by decision), but I want McGregor to win McGregor’s greatest strength is speed, relaxation, and mobility. This can easily be removed by two of Aldo’s greatest…
The Amazon Hipster Knife
[ Gerber EAB Lite Pocket Knife ] I like knives. Always have. Back in high school I was all about some Spyderco. Then I had a Benchmade phase. Then I got into William Henry. And now I’ve gone hipster, and this post explains why. The hipster knife advantage The knife shown above I call my Hipster Amazon knife.…
Take 1 Security Podcast: Episode 20
Topics for this episode: News and analysis [ ] Ads using high frequency sound to communicate across devices. The ultrasonic pitches are embedded into TV commercials or are played when a user encounters an ad displayed in a computer browser. While the sound can’t be heard by the human ear, nearby tablets and smartphones can detect it. When…
How to Deploy Splunk AD Monitoring in 437 Easy Steps
I just had the privilege of getting Active Directory data into Splunk. It was pretty straightforward. Here are the steps. Consult two priests (preferably an old and a young one) Install 47 plugins on the Splunk indexer. Those won’t do anything. Just install them. Install 19 more plugins on your Domain Controller. Those also won’t do anything. Install…
Pacifism During Wartime
As an ex-Indian civil servant, it always makes me shout with laughter to hear, for instance, Gandhi named as an example of the success of non-violence. As long as twenty years ago it was cynically admitted in Anglo-Indian circles that Gandhi was very useful to the British government. So he will be to the Japanese if they get…
Expect Expanded Concealed Carry Laws in the United States
“There are multiple casualties and confirmed fatalities,” San Bernardino Police spokeswoman Sgt. Vicki Cervantes told reporters. Source: San Bernardino shooting: Multiple deaths reported – CNN.com Another week, another mass shooting. One thing that can be predicted to come out of all this is expanded concealed carry laws. Yes, expanded. Basically, the population is about to demand of its…
The Mind of a Compatibilist
Compatibilists are often quite confused. Most pivot between two different nonsensical ideas: I can break the laws of physics! Me being determined doesn’t mean I don’t have choice. You realize these are in conflict, right? Here’s a great example of someone suffering from the first problem. You’ve probably heard about causal chains. Well, all of the prior causes…
Adjusting Free Will Skepticism Based on Necessity
I wrote recently about Lupus Liberalism, an affliction where liberals turn their backs on what they’re supposed to be defending (humanism) by attacking other liberals who are attacking intolerant beliefs. It’s simpler than it sounds. Anyway, this got me thinking about applying that same concept to other beliefs, including beliefs that I have and that I care a…
The Relationship Between Relaxation, Fun, and Success
I went to my first basketball game the other day. It was a Golden State Warriors game, and there is talk that they could be one of the best teams of all time. They remain undefeated 18 games into the season, which is an NBA record. I don’t like basketball, but I like witnessing and studying greatness. I…
WordPress Attack Stats: November 2015
I monitor my site extensively, especially people doing weird stuff on it. I’ve a number of triggers and technologies set up, and I’m always swapping them in and out, with all logs going to Splunk. From there I write custom filters for the types of things I want to know about immediately, get daily logs for, weekly reports,…
Algorithmic Learning
I think people need to think more about how they learn. Too many treat the gathering of knowledge like an ancient spiritual experience; they do some hand-waving, mumble some incantations, and then they look to the heavens for a sign that something has changed. We can do better. Two kinds of learning I think there are two main…
The Psychology of Admiring Great People
This post is about fighting. I’m a humanist. I get how strange that is, so let’s move on. Jose Aldo is fighting Conor McGregor on December 12th, and I am more excited about this fight than I have been for any fight in years. Here’s why. Jose Aldo is a wrecking ball. He’s extremely dominant, and he’s been…
Marc Benioff on What Companies Should Be Focusing On
Where do your ideas come from?I like to be around creative people. That’s a way that I ideate. I like to be in locations that I kind of feel are very creative, that stimulate me in a creative process. I also get a lot of stimulation being around my customers. The next stage of my creative process is…
The Myth of Exceptionalism
There is a particular line coming from Lupus Liberals that I find troubling. It has to do with American Exceptionalism. The argument usually goes like this (between fellow liberals, mind you): It’s really bad that Islam has so many anti-humanist values and beliefs built into it, since confused or evil people can read those things and think they’re…
Lupus Liberalism and the Regressive Left
I wrote recently about the concept of Lupus Liberalism, and I wanted to take a moment to 1) explicitly define the term, and 2) show how it relates to Maajid Nawaz’s term Regressive Left. First, Lupus Liberalism. Lupus Liberalism Lupus Liberalism is a metaphorical reference to Lupus—a medical disorder that causes the body’s immune system to become hyperactive…
Terrorist Stereotypes
Someone just shot up a Planned Parenthood clinic in Colorado. We know what the terrorist looks like. It’s a man He’s white He’s Christian We know he’s Christian because that’s who thinks it’s a good idea to people for doing or getting abortions. Religion, in other words, is the cause. It’s not because he’s from the South, which…
Bug Bounty Ethics and the Ubering of Pentesting
There is a vocal group within the pentesting community that is speaking out against the bug bounty industry, and if you’re familiar with the controversy around Uber the complaints might sound familiar. Some of the charges that frequently come up are: Bug bounties are exploitative of bounty hunters Bug bounties are bad for traditional pentesters Bug bounties don’t…
How to Achieve Maximum Interaction on Your Tweets
[ An example tweet from my timeline created within minutes of this post. ] Twitter is a black box to many, including people who use it often. Some tweets take off instantly, and others (which you’d expect to do well) just fizzle and die. There’s luck involved, but not as much as you might think. Here’s how to…
Concise, Transparent Communication as the Primary Metric of Competency
Two of his biggest ideas were about how space and time work. This thing you’re reading right now explains those ideas using only the ten hundred words people use the most often.1 The doctor figured out the first idea while he was working in an office, and he figured out the second one ten years later, while he…
The Media is Trading Advertising Dollars for Lives
CNN, Fox News, and similar channels are seeing amazing numbers right now. People can’t look away from the screen, and every time they’re tempted to, some one breaks in with: …breaking news now from someplace in the world where something might be suspicious… And that keeps you watching through the drug, drug lawsuit, insurance, and catheter commercials. These…
The Lupus in Liberalism
The most dangerous aspect of the extreme left is that it functions as an immune disorder. Immune systems are generally good for us. They see threats and they mobilize attacks them. That’s positive. Immune disorders, however, are quite nasty. Allergies, for example, are basically hyperactive immune systems that cause the body to panic over things like pollen and…
Embrace the Moderates
The biggest obstacle we face in the battle against Islamic terrorism is law enforcement’s inclination to see all Muslims as dangerous or potentially dangerous. This undermines our only chance for actual security, which is moderate Muslims helping the authorities by reporting suspicious behavior within their own communities. If the vast majority of Muslims, who are moderate and decent…
The Eye of Siri
I’ve written a lot about the concept of Universal Daemonization and how personal assistants will be such a big part of that future. Basically, our personal assistants (Siri, Cortana, etc.) will be our 24/7 advocates. They will be reading daemon information from everything and everyone around us, and telling us what they think we should know about the…
Spring 2015 Pew Poll Has 60+ Million Muslims Supporting ISIS
In no country surveyed did more than 15% of the population show favorable attitudes toward Islamic State. Source: Most dislike ISIS in Muslim countries | Pew Research Center Pew just put out a poll showing that “Most Dislike ISIS in Muslim Countries”, which is no-doubt both true and a good thing. I think most non-racists/Islamaphobes already knew that.…
Justified vs. Unjustified Terrorism
John Kerry just said that the Friday the 13th Paris attacks were different than the Charlie Hebdo attacks because the latter were somehow justified. There was a sort of particularized focus and perhaps even a legitimacy in terms of — not a legitimacy, but a rationale that you could attach yourself to somehow and say, OK, they’re really…
Why Many Moderate Muslims Don’t Believe the ISIS Threat
It’s widely accepted that the only solution to extreme Islam is moderate Islam. But many moderate Muslims aren’t convinced it’s a real problem. The short answer to the “why?” question is conspiracy. What many in the west don’t realize is how much of the Muslim world believes 9/11 was an inside job. They think it was Israel, or…
Take 1 Security Podcast: Episode 19
Topics for this episode: News and analysis [ ] A couple of months into my job with IOActive [ ] Paris Attacks: resilience vs. prevention [ ] Updating the OWASP IoT Project (no longer the Top 10) It’s an umbrella project. [ ] Adding to the IoT project the SCADA Top 10 List (read the list), and Nabil…
We Need Apple Pay for Medical Data
Apple Pay is an improvement over paying with a credit card, but only marginally. What we really need is a better (faster and more secure) way to give someone your personal information. The primary use case I can think of is filling out forms. Doctors’ offices. The DMV. Credit applications. Etc. It especially sucks when there are multiple…
Universal Daemonization as Asset Management
I’ve written a decent amount about Universal Daemonization—the idea that objects such as humans and restaurants and office buildings can be interacted with in a standardized way, using standardized protocols. So Siri could send a temperature increase request to the /climate API for a restaurant on your behalf and the building would adjust to your preference automatically. Or…
Testing HSTS-protected Sites Using Burp
If you do a lot of web assessments using Burp (or any proxy, really) you might be having issues with HSTS-enabled sites. The issue is with modern browsers (especially recently) being very strict with who you can and cannot talk to. Basically, before they were just warning you that something could be dangerous, but now they’re simply not…
A Brilliant Way to Detect Bias
How does it work? Think about what it means to be biased. What it means for a selection process to be biased against applicants of type x is that it’s harder for them to make it through. Which means applicants of type x have to be better to get selected than applicants not of type x. [1] Which…
The Problem With Twitter “Likes”
Twitter changing to from favorites to likes is good in a couple of ways, but bad in others. The positive Favorite is a strong word for when you just meant “like” Sometimes you want to show support, but not save the item The negative If someone tweets “Terrorists Kill 11 in Algeria”, and you think you want to…
Asking Physicists About Free Will
My buddy Jason works at FermiLab, and he posted recently on one of my free will threads, saying he was going to ask some physics friends about something free will related. I asked him to ask them what they thought of free will in general, and he asked me to frame the argument so he could ask the…
Facebook’s Big Play
As I wrote about a few years back, Facebook is planning something big. Real big. Their plan is to replace Google and become the next AOL. Not AOL as in the lame service that nobody likes or remembers now, but the AOL that used to BE the internet for many years. And for many people I think Facebook…
Learning is an Integration Problem
Gunnar Peterson is one of my favorite infosec thinkers. He’s extremely clear-minded in his approach to problems and solutions. Here he talks about security issues vs. integration issues: We don’t have a security problem with integration requirements. We have an integration problem with security requirements. ~ Gunnar Peterson I love this, and I think we can abstract it…
How Twitter Should Work
Twitter’s central concept should be curation. Curation should run throughout the product’s DNA like “quality results” does for search, and the reason for this is simple: people don’t have the time or energy to manage precisely what they want from the entire planet earth.. And that’s what Twitter is. It’s realtime humanity. All of it. So let’s approach…
Why Libertarians Tend to Be White, Male, and Young
Libertarianism is bound to be attractive to those types of people who have enough power and clout in society that government really is their biggest obstacle. So, for example, it makes sense that people like the Koch Brothers, or people like Cliven Bundy, are libertarians. For the Koch Brothers, there’s literally no entity in existence which has any…
Powering Innovation With Inputs
In my own life, I found that whenever I wasn’t sure what to do next, I would go and learn a lot, read a lot, talk to experts. I don’t know how the human brain works but it’s almost magical: when you read enough or talk to enough experts, when you have enough inputs, new ideas start appearing.…
All Companies Are Tech Companies
I picked up an interesting concept from my reading/consuming recently: All companies are tech companies. They just use that tech to sell different things. I think this is fascinating because it captures the true disruptive power of technology. It shows that it’s not just a tool for your business, but rather the entire infrastructure for it. Examples are…
Replacing Passwords with Out-of-band Challenges
I think passwords will give way to another type of authentication—one that is less annoying to users, less vulnerable to attack, and that’s more sustainable over time. Out of band challenges. The concept here is that you are already authenticated in another service, and that service is used to authenticate you to the current resource you’re trying to…
- 1
- 2
- 3
- …
- 6
- Next Page »