All Posts

3 min Penetration Testing

#pwnSAP Tweet Chat Debrief

On December 3, Rapid7 security researcher Juan Vazquez hosted a panel of experts for a tweet chat to discuss SAP system hacking. The #pwnSAP chat was a great discussion – here are some highlights. Juan's first question was, “Can you start by telling us a bit about how SAP system hacking has changed lately?” @todb called this research paper, SAP Penetration Testing Using Metasploit – How to Protect Sensitive ERP Data

3 min Metasploit

Weekly Metasploit Update: SAP and Silverlight

SAP SAPpy SAP SAP We've been all SAP all the time here in the Independent Nations of Metasploit, and expect to be for the rest of the week. You might recall that Metasploit exploit dev, Juan Vazquez published his SAP survey paper a little while back; on Tuesday, we did a moderated twitter chat on the hashtag #pwnSAP with the major S

4 min

Logentries Add-Ons for Heroku Environment pt. 1 – CloudAMQP

We recently announced ouradd-on program at Logentries , which allows third party vendors to send their log data toLogentries < and to highlight important events for their users via ourtagging, alerting and reporting features . This allows vendors to predefine what log events their users really need to know about and if there are particular thresholds that indicate trouble may be looming. Users

5 min IT Ops

Log Management 101 - Where Do Logs Come From?

We’ve had a lot of people asking for the Log Management Primer for a while now. And, surprisingly, many of these folks have a strong technical background, including developers. Some want it for themselves, and some want it to pass on to a colleague, manager, etc. I’m going to explain what logs are, where they come from and how you can get your logs. If you’re a developer, this post probably isn’t for you as we don’t dig into the code

1 min Research

A Pentester's Introduction to SAP & ABAP

If you're conducting security assessments on enterprise networks, chances are that you've run into SAP systems. In this blog post, I'd like to give you an introduction to SAP and ABAP to help you with your security audit. The full SAP solution (ERP or SAP Business Suite) consists of several components. However, to manage the different areas of a large enterprise, probably one of the better known components or features of the SAP solution is the development system based on ABAP

2 min Metasploit

Weekly Metasploit Update: Patching Ruby Float Conversion DoS (CVE-2013-4164)

Metasploit 4.8.1 Released Thanks to the revelations around the recent Ruby float conversion denial of service, aka CVE-2013-4164 discovered and reported by Charlie Somerville, this week's release is pretty slim in terms of content; on Friday (the day of the first disclosure), we pretty much dropped everything and got to work on testing and packaging up new Metasploit installers that ship with R

3 min Metasploit

Weekly Metasploit Update: BrowserExploitServer (BES), IPMI, and KiTrap0D

Browser Exploit Server This release includes the much vaunted and anticipated BrowserExploitServer (BES) mixin , the brainchild of Metasploit exploit developer Wei @_sinn3r Chen. Metasploit, at its core, is designed to be both an exploit delivery system and exploit development system, so this new mixin should help tremendously with the latter. BES, in a

3 min IT Ops

Where Are My AWS Logs?

Over my time at Logentries, we’ve had users contact us about where to find their logs while they were setting up Logentries . As a result, we recently released a feature for Amazon Web Services called the AWS Connector, which automatically discovers your log files across your Linux EC2 ins

5 min Metasploit

Exploiting the Supermicro Onboard IPMI Controller

Last week @hdmoore published the details about several vulnerabilities into the Supermicro IPMI firmware . With the advisory's release, several modules were landed into Metasploit in order to check Supermicro's device against several of the published vulnerabilities: Module Purpose smt_ipmi_static_cert_scanner This module ca

2 min

November 2013 Patch Tuesday Summary

The November Patch Tuesday advisories are out, and across the board mixed feelings own the day. Relief and frustration must be present for Windows and Security administrators alike. Relief because for the first time in a few months, this is a relatively straightforward Patch Tuesday, with fixes for most Windows versions, the ever-present IE roll up patch (MS13-088), and some Office components, but nothing esoteric or difficult to patch.  No SharePoint plugins, no complicated .NET patching, no

2 min

New in 5.7.16 - Search, Track, and Report on Assets by Open Ports

So, you want to find all assets that have HTTP enabled? Want to monitor which non-standard ports are open across your organization? Now you can. Starting in Nexpose 5.7.16 you can search, track, and report on assets by open ports. That's definitely a good thing considering that monitoring non-standard ports is a must. A recent report by Palo Alto Networks highlighted the importance of m

2 min Metasploit

Tech Preview Feedback: Vulnerability Validation in Metasploit Pro 4.8

By guest blogger and Rapid7 customer David Henning, Director Network Security, Hughes Network Systems A few weeks ago, Rapid7 asked me to participate in the Metasploit Tech Preview for 2013. I've participated in a couple of other product previews in the past. I like the interaction with the Rapid7 development teams.  This tech preview was smooth and it was easy to participate. Previous testing sessions required interactions over e-mail and there was some associated lag. This preview was mana

15 min Metasploit

Don't Get Blindsided: Better Visibility Into User and Asset Risks with Metasploit 4.8

Not having visibility can be dangerous in many situations. The new Metasploit 4.8 gives you better visibility in four key areas: * View phishing exposure in the context of the overall user risk * See which vulnerabilities pose the biggest risk to your organization * Have all host information at your fingertips when doing a pentest * Discover the latest risks on your network with new exploits and other modules See Phishing Exposure as O

2 min

Network complexity: Bad for Business, Great for Job Security

For years I've written about how dangerous network complexity is for business. It's simple math. The crazier things are in your environment, the less control you have. In other words, the more applications, computers, network segments, people, policies, cloud service providers, and so on in your environment the harder it is to manage the risks. It's a direct, quantifiable, and predictable inverse relationship. Yet, no matter the degree of complexity n

3 min Metasploit

Learn to Pentest SAP with Metasploit As ERP Attacks Go Mainstream

This month, a security researcher disclosed that a version of the old banking Trojan “Trojan.ibank” has been modified to look for SAP GUI installations, a concerning sign that SAP system hacking has gone into mainstream cybercrime.  Once a domain of a few isolated APT attacks, SAP appears to be in the cross hairs of hackers that know just how much sensitive data ERP systems house, including financial, customer, employee and production data.  With more than 248,500 customers in 188 countries, SAP