3 min
Penetration Testing
#pwnSAP Tweet Chat Debrief
On December 3, Rapid7 security researcher Juan Vazquez hosted a panel of experts
for a tweet chat to
discuss SAP system hacking. The #pwnSAP chat was a great discussion – here are
some highlights.
Juan's first question was, “Can you start by telling us a bit about how SAP
system hacking has changed lately?” @todb called this research paper, SAP
Penetration Testing Using Metasploit – How to Protect Sensitive ERP Data
3 min
Metasploit
Weekly Metasploit Update: SAP and Silverlight
SAP SAPpy SAP SAP
We've been all SAP all the time here in the Independent Nations of Metasploit,
and expect to be for the rest of the week. You might recall that Metasploit
exploit dev, Juan Vazquez published his
SAP
survey paper
a
little while back; on Tuesday, we did a moderated twitter chat on the hashtag
#pwnSAP with the major
S
4 min
Logentries Add-Ons for Heroku Environment pt. 1 – CloudAMQP
We recently announced ouradd-on program at Logentries
, which allows third party vendors to send
their log data toLogentries < and to highlight
important events for their users via ourtagging, alerting and reporting features
. This allows vendors to predefine
what log events their users really need to know about and if there are
particular thresholds that indicate trouble may be looming. Users
5 min
IT Ops
Log Management 101 - Where Do Logs Come From?
We’ve had a lot of people asking for the Log Management
Primer for a while
now. And, surprisingly, many of these folks have a strong technical background,
including developers. Some want it for themselves, and some want it to pass on
to a colleague, manager, etc. I’m going to explain what logs are, where they
come from and how you can get your logs.
If you’re a developer, this post probably isn’t for you as we don’t dig into the
code
1 min
Research
A Pentester's Introduction to SAP & ABAP
If you're conducting security assessments on enterprise networks, chances are
that you've run into SAP systems. In this blog post, I'd like to give you an
introduction to SAP and ABAP to help you with your security audit.
The full SAP solution (ERP or SAP Business Suite) consists of several
components. However, to manage the different areas of a large enterprise,
probably one of the better known components or features of the SAP solution is
the development system based on ABAP
2 min
Metasploit
Weekly Metasploit Update: Patching Ruby Float Conversion DoS (CVE-2013-4164)
Metasploit 4.8.1 Released
Thanks to the revelations around the recent Ruby float conversion denial of
service, aka CVE-2013-4164
discovered and reported by Charlie Somerville, this week's release is pretty
slim in terms of content; on Friday (the day of the first disclosure), we pretty
much dropped everything and got to work on testing and packaging up new
Metasploit installers that ship with R
3 min
Metasploit
Weekly Metasploit Update: BrowserExploitServer (BES), IPMI, and KiTrap0D
Browser Exploit Server
This release includes the much vaunted and anticipated BrowserExploitServer
(BES) mixin
, the brainchild of Metasploit exploit developer Wei @_sinn3r
Chen. Metasploit, at its core, is designed to be
both an exploit delivery system and exploit development system, so this new
mixin should help tremendously with the latter. BES, in a
3 min
IT Ops
Where Are My AWS Logs?
Over my time at Logentries, we’ve had users contact us about where to find their
logs while they were setting up Logentries
. As a result, we recently released a feature for Amazon Web Services called the
AWS Connector, which automatically discovers your log files across your Linux
EC2 ins
5 min
Metasploit
Exploiting the Supermicro Onboard IPMI Controller
Last week @hdmoore published the details about
several vulnerabilities into the Supermicro IPMI firmware
. With the advisory's
release, several modules were landed into Metasploit in order to check
Supermicro's device against several of the published vulnerabilities:
Module Purpose smt_ipmi_static_cert_scanner
This module ca
2 min
November 2013 Patch Tuesday Summary
The November Patch Tuesday advisories are out, and across the board mixed
feelings own the day. Relief and frustration must be present for Windows and
Security administrators alike.
Relief because for the first time in a few months, this is a relatively
straightforward Patch Tuesday, with fixes for most Windows versions, the
ever-present IE roll up patch (MS13-088), and some Office components, but
nothing esoteric or difficult to patch. No SharePoint plugins, no complicated
.NET patching, no
2 min
New in 5.7.16 - Search, Track, and Report on Assets by Open Ports
So, you want to find all assets that have HTTP enabled? Want to monitor which
non-standard ports are open across your organization? Now you can. Starting in
Nexpose 5.7.16 you can search, track, and report on assets by open ports.
That's definitely a good thing considering that monitoring non-standard ports is
a must. A recent report
by Palo Alto Networks highlighted the importance of m
2 min
Metasploit
Tech Preview Feedback: Vulnerability Validation in Metasploit Pro 4.8
By guest blogger and Rapid7 customer David Henning, Director Network Security,
Hughes Network Systems
A few weeks ago, Rapid7 asked me to participate in the Metasploit Tech Preview
for 2013. I've participated in a couple of other product previews in the past. I
like the interaction with the Rapid7 development teams. This tech preview was
smooth and it was easy to participate. Previous testing sessions required
interactions over e-mail and there was
some associated lag. This preview was mana
15 min
Metasploit
Don't Get Blindsided: Better Visibility Into User and Asset Risks with Metasploit 4.8
Not having visibility can be dangerous in many situations. The new Metasploit
4.8 gives you better
visibility in four key areas:
* View phishing exposure in the context of the overall user risk
* See which vulnerabilities pose the biggest risk to your organization
* Have all host information at your fingertips when doing a pentest
* Discover the latest risks on your network with new exploits and other modules
See Phishing Exposure as O
2 min
Network complexity: Bad for Business, Great for Job Security
For years I've written about how dangerous network complexity is for business.
It's simple math. The crazier things
are in your environment, the less control you have. In other words, the more
applications, computers, network segments, people, policies, cloud service
providers, and so on in your environment the harder it is to manage the risks.
It's a direct, quantifiable, and predictable inverse relationship.
Yet, no matter the degree of complexity n
3 min
Metasploit
Learn to Pentest SAP with Metasploit As ERP Attacks Go Mainstream
This month, a security researcher disclosed that a version of the old banking
Trojan “Trojan.ibank” has been modified to look for SAP GUI installations, a
concerning sign that SAP system hacking has gone into mainstream cybercrime.
Once a domain of a few isolated APT attacks, SAP appears to be in the cross
hairs of hackers that know just how much sensitive data ERP systems house,
including financial, customer, employee and production data. With more than
248,500 customers in 188 countries, SAP