OWASP LiveCD

The OWASP Live CD is out! It is based on Morphix, runs completely in Memory. It ships with the following tools and docs:
Tools: WebGoat v4 WebScarab Paros JBroFuZZ Cal9000 Nmap TcpDump WireShark

Docs: OWASP Guide 2.0 OWASP Testing Guide,

The CD is 802mb, and still in beta version, which does not include any specialty tools such as VOIP, RFID, and Wireless. Thus, the pentest directory is almost empty. My first feeling is: lame and nonprofessional. Well, maybe that is why it is still in beta, I hope. If you compare to other hot pentesting live CDs, such as backtrack, I really can't see its point of releasing this CD, except they include all the OWASP guides. In addition, file permissions are not set properly, lots of useless stuff are included. I really don't see the point they released this CD, I love their guides and few applications, but I highly recommended you not to waste time on this crap, grab your desire documentation and application would definitely a better choice. Anyway, it is beta, I hope next I could see a decent release next time.

Not much

Become interested in sniffering recently, having so much fun with hacking my machines around, I am pretty impressed about what ettercap capability, it gives pretty good result when combining with other tools. I will write up a detail tutorial over this topic.

Also I learned some new OS fingerprinting techniques when I reviewed nmap,xprobe and ettercap fingerprinting code. I should come up some new discoveries as time goes on...hopefully!

learning plan

While I started to learn more about buffer overflow, shell coding and the knowledge behind, I get really excited and depressed.Because I am learning something new(least to me, I only know how to compile and use it before) and feel depressed since I basically know nothing about it, esp asm. On the other hand, my focus also shifted to forensics and thereforely pay attention to honeypot, I played around the forensics image from polytech.edu, it is fun and easy, but felt unprofessional compare to challenge on honeynet.org.I decided to learn more these fields (forensics, honeypot, reverse engineering,intruction detection..etc) since honeynet provides detail answer from other known professionals, which is superb! um...Now I have sooo much to learn, cool!

Stupid yahoo messenger

My yahoo messenger has been sucked for a while, so does stupid windows media player...simple reinstall doesn't aid at all, forced me to take time to figure out this whole shit was caused by both of them heavily rely on vbscript.dll and jscript.dll,
with regsvr32 jscript.dll & regsvr32 vbscript.dll finally get them work. I can't believe yahoo uses windows internal library rather than develop an independent lib...lazy yahoo dudes!

New Quarter schedule

New quarter began yesterday, busy life started again. I chose some dummy courses like microeconomic, english, just to fulfill the general requirement for graduation. It sucks! Hate the rules of this kind of stupid game, you always need a degree or cert like to get your resume sharp, or no one is gonna care you or simply ignore your existence no matter how superb you are. I guess this is the reality so I should not complain any more. All rite, so I scheduled to sharpen my programming skills in php, perl, C++ (just start to learn).... Inspired by the idea of rgod, I felt the strength of php CLR, its rich module supports as well as perl and python are huge enough to get most web application based exploit work perfectly. Besides these, it is mature to pay attention to open source application, find bug and code exploit and patch are considered to be the quick and dirty way to win in the community, (and you certainly have to do things like H D, found awesome project like metasploit...) I see the distances between me and guru, it drive me keep catching and never stop! all rite, pretty much about it.

p.s: thanks brother for reminding to keep up blogging.

Web server fingerprinting

I have decided to write a paper over web server fingerprinting, primarily aims to some popular web servers. I know this topic has been done server times and tons tools avaiable to make the whole process failr easy,however, I observered some new techniques been released recently,which starts to influent the current situations. Due to the web is getting important, how to defense and attack the web service and server are extrememly hot and in fact the hotest and critical topic for every IT pro, security professional and programmers.If you have any thought or constructive ideas over this topic, shoot me an email or drop a note here, i will get you back.

First post...little testing....
I will post my personal thoughts here..