DEFCON 22 Badge Challenge

Authors: image Brett Buerhaus, image Jason Thor Hall

Original Post: http://potatohatsecurity.tumblr.com/post/94565729529/defcon-22-badge-challenge-walkthrough

Brett, Jon, and I recently went to DEFCON and completed the Badge Challenge put together by 1o57.  Here is the entire adventure as we experienced it with all of the puzzles, their solutions, and the steps to solve them.  Understand that this document contains MASSIVE spoilers so if you do not want to ruin it for yourself please stop reading now.

Continue reading

Detecting Burp Suite – Part 1 of 3: Info Leak

image

I recently started to review the automated vulnerability scanner Burp Suite because of its widespread usage. The tool is used by many security bounty hunters, security professionals, and blackhat hackers for automated scanning and vulnerability detection. While I was using Burp, I was wondering to myself how easy it is for a server to detect that I am using this tool.

Continue reading

Increasing Your Company’s Security by Encouraging Responsible Disclosures.

image

There's always a gamble for security researchers when reporting vulnerability disclosures to companies. Is the company going to read your report? How will they react to me testing their security? Where can I send this report anyway? These are some of the questions the researcher is going to contemplate before making a decision that can financially impact the company they are trying to help.

Continue reading

Facebook – Stored Cross-Site Scripting (XSS) – Badges

The Facebook badges page was vulnerable to stored Cross-Site Scripting (XSS). This was initially reported back in August 2013, but due to communication problems over e-mail it wasn't fixed until early January. Neither party is to blame, but this shows some of the difficulties that companies can face communicating with security researchers.

Continue reading