4 min
Javascript
Java API Client - How to Augment It and Share with the Community
The prerequisite is that you get the client: clee-r7/nexpose_java_api · GitHub
This blog post will show you how to augment the java api client and use it in 4
easy steps.
The Java API client uses XML templates to generate requests. Browse to the
src/org/rapid7/nexpose/api folder within the API source code, you will see the
templates for the currently supported API client requests. i.e:
AssetGroupSaveRequest.xml.
There are currently 2 versions of
1 min
Nexpose
How to Check for Remote Desktop Protocol (RDP) Services
There are many organizations concerned with the critical Microsoft Security
Bulletin MS12-020
Remote Desktop
Protocol (RDP) vulnerability. Here is a quick way to check if you have Remote
Desktop Protocol running on your system or network. I used NMAP
to check my home network.
In the highlighted text below you can see that NMAP can check for the RDP
service running. If you can't patch, this is important because at
3 min
Metasploit
New Metasploit Swag Store Is Online
You may remember the awesome Metasploit T-shirt contest we ran in April of last
year .
We received a ton of submissions at the time and selected a winning T-shirt,
designed by Danny Chrastil.
It was a long and arduous journey for us to get the T-shirts printed and to get
the back-end systems up and running for the Metasploit Swag Store
...but it's finally here. Yes, you'll
notice tha
3 min
URI Parsing: It's harder than you think... or is it?
I have to admit, parsing a URI is tricky. Most Metasploit modules try to do it
with some kind of crazy custom regex-fu, but unfortunately most of them are kind
of buggy. Because of this, I've committed a new patch to HttpClient -- a
target_uri function that can automatically parse the URI for you. It's only a
4-line change, but should change the way we code HTTP-related modules.
Before I demonstrate how you can take advantage of target_uri, I should briefly
explain why you should avoid doing
2 min
Metasploit
Weekly Metasploit Update: Wmap, Console Search, and More!
In addition to the nuclear-powered exploit, we've got a new slew of updates,
fixes and modules this week for Metasploit, so let's jump right into the
highlights for this update.
Updated WMAP Plugin
Longtime community contributor Efrain Torres provided a much-anticipated update
to the Wmap plugin. Wmap automates up a bunch of web-based Metasploit modules
via the Metasploit console, from HTTP version scanning to file path bruteforcing
to blind SQL injection testing. If you're not already familiar
2 min
Metasploit
Weekly Metasploit Update: POSIX Meterpreter and New Exploits
This is a pretty modest update, since it's the first after our successful 4.2
release last week. Now
that 4.2 is out the door, we've been picking up on core framework development,
and of course, have a few new modules shipping out.
Meterpreter Updates
James "egyp7" Lee and community contributor mm__ have been banging on the POSIX
side of Meterpreter development this week, and have a couple of significant
enhancements to Linux Meterpreter. T
2 min
Microsoft
Information Disclosure: Out of Office Auto Replies
Out of office replies are a blessing and a curse for organizations from an
operational security perspective. Many of the out of office auto replies I
receive contain too much information. Since many security professionals are at
the RSA Conference this week I've had plenty hit my inbox. This is nothing
compared to December around the holiday season. Like anything the information in
the replies can be used for good and bad. Good people are trying to ensure that
work continues while they are away
2 min
Nexpose
Rapid7 Wins Coveted SC Magazine Award for Best Vulnerability Management Tool
Thorsten George, VP of Worldwide of Marketing and
Products for Agiliance on the left and
Bernd Leger, VP of Marketing, Products &
Solutions at Rapid7 on the right
Sitting in a room of hundreds of industry leaders and security vendors, it was
extremely gratifying to hear our name called and being asked on stage to receive
one of the coveted SC Magazine Awards last night in San Francisco. Rapid7 won
the prestigious “Best Vulnerability Management Tool” Award in the Reader's Trust
Award Category.
2 min
Quality Security: People, Process, and Products
Here at Rapid7 we have tons of talented people across the board, sometimes it's
scary. One of the people who I've interacted with a lot is Jennifer Benson, our
VP of Customer Experience. Through Jen I have found that three tenants of
People, Process, and Products (the 3Ps) are very handy when it comes down to
delivering just about anything. We use the 3Ps here at Rapid7 to deliver quality
customer experiences. Jen is very smart and she breaks many things down by using
the 3Ps. There is a reason
1 min
Metasploit
Free Microsoft Virtual Machines for Testing
I am often asked how security professionals and students can safely test
security software. My usual response is, they should create a virtual lab with
diverse operating systems for testing. The problem that many encounter is they
don't have licenses available to install the operating systems.
During my creating and testing the Metasploit Javascript Keylogger, I came
across free virtual machines from Microsoft that are sure to be useful to
security professionals, web designers, and web programm
1 min
Nexpose
Nexpose Java API
We are really excited to see the Nexpose community coming up with all sorts of
cool and useful ways to automate Nexpose via our APIs. Since we have published
our Ruby and .Net
API client libraries, we have had
some requests for a Java library as well. And now we have open sourced a Java
based library for accessing the
Nexpose API. This library is BSD licensed s
12 min
Dangerous Things #1: Interview with Dan Guido, co-founder of Trail of Bits
Having been involved in information security for the last 15 years, I've had the
opportunity to meet some really amazing people and to view the industry through
their eyes. I've been toying with the idea of a blog series where I interview
some of the people I've had the privilege to meet, and hopefully to introduce
some of my readers to the awesome research that's being done. I've decided to
call the blog series "Dangerous Things", which is a reference to the fact that
so many of us in this indu
2 min
Metasploit
Metasploit 4.2 Released: IPv6, VMware, and Tons of Modules!
Since our last release in October, we've added 54 new exploits, 66 new auxiliary
modules, 43 new post-exploitation modules, and 18 new payloads -- that clocks in
at just about 1.5 new modules per day since version 4.1. Clearly, this kind of
volume is way too much to detail in a single update blog post.
IPv6 Coverage
Metasploit 4.2 now ships with thirteen brand new payloads, all added to support
opening command sessions and shells on IPv6 networks. In addition, Metasploit's
existing arsenal of p
4 min
Cyber attack ranked within the top 5 risks in terms of probability
“The more complex the system, the greater the risk of systemic breakdown, but
also the greater the potential for opportunity” - Klaus Schwab Founder and
Executive Chairman World Economic Forum.
The World Economic Forum released their Global risks
2012 report, outlining the perceived impact, likelihood and interconnectedness
of 50 prevalent global risks ranged in five risk categories: economic,
environmental, geopolitical, societal and technological.
In this post I'
3 min
Metasploit
The Art of Keylogging with Metasploit & Javascript
Rarely does a week go by without a friend or family member getting their login
credentials compromised, then reused for malicious purposes. My wife is always
on the lookout on Facebook, warning relatives and friends to change their
passwords. Many people don't understand how their credentials get compromised.
Password reuse on several websites is usually the culprit. Password reuse is a
problem even if the website encrypts the passwords in their databases. An
attacker only needs to insert some