http://blog.clearnetsec.com/articles/2006/08/05/blackhat-defcon-quickies en-us 40 <p> I don’t want to repeat what everyone else is writing about regarding attending BlackHat and Defcon, but several were freakin’ cool:<br> <blockquote> <ul> <li> Joanna Rutkowka’s Blue Pill stuff. Totally own x64 Vista on AMD (Pacifica) using the new AMD processors virtual machine technology. Undetectable. “Writing signatures to detect things is rookie” -- an awesome quote by Joanna. </li> <br> <li> johnny cache and David Maynor’s layer 2 exploit. Get remote shell root access to a Mac, Windows, or whatever if the wireless card is simply ON (no need to associate or anything). Damn I would love to have this exploit on hand. </li> <br> <li> HD Moore’s talks: <ul> <li> Thermoptic Camoflauge: IDS and IPSes suck for lots of reasons. Signature based IDS and IPS systems really suck. Joanna’s quote from above kind of says it all, “rookie”. With the new metasploit, you’ll be able to evade anything and everything on the market. </li> <br> <li> Six Degree of XSSploitation: Cross site scripting is freakin’ dangerous. Douse with lots of browser vulns, and well, it’s getting ridiculous to have fun on the Internet. Nothing is safe, so unplug. </li> <br> <li> Metasploit Reloaded. The metasploit story is just getting better – it is the best framework to build exploits. The 3.0 version is being completely rewritten in Ruby so that is good for us. </li> </ul> <br> <li> Jeremiah Grossman’s Hacking Intranet Websites from the Outside. I haven’t seen this before – using JavaScript to serendipitously enumerate internal IP addresses, perform port scans, retrieve portions of the user’s browser history via checking CSS values, and even login and modify the DMZ rules in home DSL routers to allow external connections to a particular ‘live’ internal device. All done without exploiting anything – just using plain valid JavaScript. </li> </ul> </blockquote> Sat, 05 Aug 2006 21:34:00 -0600 urn:uuid:4bfff9da-0216-4fec-8fda-7d17a689ca08 tate@ClearNetSec.com (Tate Hansen) http://blog.clearnetsec.com/articles/2006/08/05/blackhat-defcon-quickies