The state of Web Application Security and their Firewalls

Back from Troopers09 in Munich after presenting our (Wendel Guglielmetti Henrique from Trustwave  and yourstruly) research on Web Application Firewalls. Troopers was great and the organizers (Enno Rey and co) made a great job out of the conference. Kudos to them!  During the presentation we demonstrated some tools that will help security analysts and penetration testers to identify WAFs and fingerprint their rules.We hope to release these tools soon.. meanwhile if you would like to beta test, please send me a note.

Last week Bryan Miller from Syrinx Technologies interviewed me on Web Application Security and WAFs. You may listen to this podcast here where I gave my views on web application security and an introduction to the presentation for Troopers. If you would like to keep updated with this podcast, you may subscribe using the RSS feed.

[slideshare id=1344590&doc=wendel-sandro-troopers09-1-090426151524-phpapp02]

Multiple vulnerabilities in OpenX 2.6.4 and older

Which means that if you are running OpenX, make sure to update to the latest version which was issued just now. The latest download can be found here.

We posted an advisory detailing some well hidden SQL injection vulnerabilities as well as XSS, the possibility of arbitrary file deletion and CRLF injection. Additionally, we made available a video (below) on your favorite video sharing site explaining how we were able to identify the flaws by making use of Acunetix Acusensor (not much skills involved there), analyze the flaws and eventually develop some code to exploit one of the blind SQL injection vulnerabilities. This exploit is not publicly available  but interested organizations can contact [email protected] for further details.

[youtube http://www.youtube.com/watch?v=kiNeiMS2Iu0]

(IN)SECURE Magazine and other updates

This is an update of what's been happening on this end:

• Issue 19 of (IN)SECURE Magazine is out, and with it you'll find a report on RSA Europe 2008 and an article called "How security can hurt us" by yours truly. The magazine has a number of high quality articles and is  freely available from the main website.


• Upcoming research: Vulnerabilities and tools related to Web Application Firewalls. Wendel Guglielmetti Henrique combined his and my research and presented it at H2HC. The presentation was called "Playing with Web Application Firewalls". Additionally, I presented my research at a local ISACA chapter. This research is still in its initial stage but is already showing significant results. Will be putting a separate post on this.


• The blog at Acunetix now features posts by yours truly on (you guessed it) Web Application Security.


• If you are based in Malta, then you might be interested in the Malta Infosec linkedin group that will be organizing some informal events "real soon". The blog is at Maltainfosec.org.

Ladies and Gentlemen please welcome..

EnableSecurity! I will be publishing my security research and rants as well as providing Security Consultancy, Research and Design. A brief "who am I" can be seen at the Linkedin Profile page, while Google has further details.

So what sort of things am I doing?

• Wireless security auditing


• Web Application Security


• VoIP security research


• Reverse Engineering

I'll continue developing SIPVicious and publish additional tools to help security professionals get the job done.

And one more thing - I suggest that you subscribe to the RSS as I shall be releasing some research later on this week.