January 2010

31 - Microsoft may scan you

December 2009

30 - recap of a scope call

November 2009

19 - need to do a GET before POST, fuzzing with BURP and WebScarab

October 2009

7 - Signing things

August 2009

22 - Man vs. web app
3 - keep passphrases ‘in the mind’

July 2009

23 - tech notes on vSwitches and layer 2 attacks
2 - Best to skip the pen test gigs with too short of attack windows

June 2009

30 - Staffing and teams

May 2009

31 - Defending data? Incentivize.

April 2009

20 - frustrating log forwarding issue, resolved it today!

March 2009

31 - Need to create a quick script to detect if a credit card number pattern is being written to any file on a Linux server?

February 2009

28 - removed for the time being

January 2009

25 - Insects

December 2008

13 - Know thy network well
6 - popular clearnet blog entries from the past

November 2008

18 - this will fuel paranoia
11 - It’s hard to build a smart SIEM

October 2008

30 - A quasi technical article
11 - "Don’t buy technology to detect" Come again?
7 - powersploiting

August 2008

7 - Mission Statements

May 2008

31 - PCI ASV re-cert test
4 - True penetration testing?

April 2008

30 - Predictive markets & betting on when apps or companies get owned
14 - When virtual servers play havoc

March 2008

24 - Test commercial web app scanners for free and without restrictions?
14 - Us and them development

February 2008

15 - Rogue modems are still plentiful?

January 2008

31 - The booming exploit market and bye bye to swaths of products

December 2007

28 - “Big money! Big prizes! I love it!”
27 - Follow-up on using unicornscan for a big scan (400,000+ public IPs)

November 2007

28 - The business of morale
6 - Another tidbit on PCI

October 2007

16 - How do you do software wrong?
14 - Trying out unicornscan

September 2007

24 - Flip the reporting and get the customer to speak
10 - Singularity Summit
5 - Anything alert you?

August 2007

23 - Tech note on Syslog, TCP, and Cisco ASA/PIX
6 - Attackers will win so what can you do?

July 2007

22 - Network Visualization

June 2007

30 - building a better security events system
9 - Why do we make processes?

May 2007

16 - PCI: Not our problem...
4 - PCI ASV wonderland

April 2007

13 - An example of why human effort is helpful when assessing web applications
4 - Booting Linux Faster

March 2007

25 - MadWifi + Ubiquiti SuperRange Cardbus + back|track = Works great
18 - Real-time event analysis
1 - Does market share really matter in security?

February 2007

28 - Unbalanced reliance on prevention
27 - Work on feature requests or try to code that really cool idea?
18 - Spotlight on Innovation
12 - Expectations & product failures

January 2007

30 - quick tip: bash 3.x supports timestamps in history entries
7 - The losing value of blind assessments

December 2006

8 - Follow-up on full compromise
1 - Ex-coworkers, google analytics, and “stalking”

November 2006

23 - nmap junkie?
9 - Compromised? Where are the logs?

October 2006

27 - Time for an IDS?
25 - Agile vs. Security
17 - Informative survey from Jeremiah Grossman
9 - Is a tool list a competitive advantage?

September 2006

24 - A few data points for assessing threats
22 - Cross Site Scripting possible in PortWise HTTP deamon
19 - Competing for network-based security assessments
18 - Cisco VPN group name and password testing
14 - Is it possible to prioritize the deployment of common security tools for most companies?

August 2006

30 - Intro to systemtap
22 - Déjà vu with big time port scanning
22 - The VA and Bureaucracy Part 3
21 - Books on Reversing
21 - Does security need to be designed in from the start?
20 - Sorry for duplicates / Built new server stack
8 - Cory's Blackhat Training Day 1
7 - security tools to checkout (new to us; from blackhat/defcon)
7 - The Exploit Laboratory class at BlackHat Training was great.
5 - BlackHat/Defcon quickies

July 2006

31 - Quickly allowing SELinux to run an application
29 - The VA and Bureaucracy Part 2
26 - stolen personal account info
21 - BlackHat in Las Vegas coming up
17 - Back from the dead

June 2006

30 - Review: Fab, The Coming Revolution on Your Desktop
9 - The VA and Bureaucracy
6 - Review: The World is Flat
5 - I've been too lazy

May 2006

23 - follow-up on web app scanners (technical vs logical vulnerabilities)
17 - more on the failures of automated web app scanners
15 - the police will always respond to a report of an email threat
8 - Reasonable expectations?
3 - maximizing nmap scans for accuracy

April 2006

27 - OpenPGP smartcards
25 - FireBug
25 - tough to find where to begin
24 - idealism vs realism debate, great points
19 - bug tracking, web-based tracking tools
18 - "wacky govt project"
16 - Internet Routing Tables, BGP, and lots of numbers.
13 - Forensic tools
7 - Friday Fun

March 2006

30 - Apple Mania
29 - Sun Fire T2000 Server Review: Encryption Routines
26 - A quick summary on how DHCP quarantining works
23 - Bought a duo core laptop
19 - library paths, ldconfig & crle
17 - Lost Onfolio
14 - Scan fast and evade triggers
13 - Tools for fingerprinting apps, services, and OSes
10 - Rubies, Rubies, Ruby
10 - Firewalls part 3
2 - Using IP geolocation for security

February 2006

24 - Some free advice
17 - How much for your unknown critical MS exploit?
15 - Pictures coming soon of RSA 2006
11 - Firewalls Part 2
8 - Basecamp for project collaboration
5 - Web application scanners often fail crawling
3 - Quick list of cool new things in Nmap 4.00

January 2006

31 - Which vulnerability tests did Nessus run? How long did it take? Which tests take the most time?
29 - Firewalls Part 1
23 - Sanitizing docs converted from Word to PDF
22 - This vulnerability scanner is so fast it must be good!
21 - Editor wars and IDEs
21 - Nessus tuning
20 - Components of Risk Assessment
19 - A late entry to our scanning laptop race
19 - Getting crazy with proxy chaining
17 - Spinning up on rails
15 - Ruby, Python, and Java application deployment
13 - Web Application Cheat Sheet (version 2)
12 - Security purgatory for the regulatory afflicted
11 - PIX 7 on the Mind - Part 1
9 - Beware of 1and1.com
8 - Searching for the fastest laptop to run resource hungry security tools
2 - Checking out the upcoming RSA 2006 Conference

December 2005

27 - $70,000 worth of new opteron servers for nmap scanning and they suck?
26 - Experimenting with LC5 and Rainbow tables. Part 1