Introduction to nmap, Part 2

Here is Part 2 of our video for understanding the basics of nmap.  I discuss some of the logging output, the scripts found in Nmap, and the output that Nmap gives you for reporting or comparison later.

 

I really did want to go more into the Lua portion of the scripting engine, and perhaps make a simple script, but time constraints halted that. I hope to get more adept at video creation and hopefully editing, to make a more concise video tutorial.

Nmap target specifications: http://nmap.org/book/man-target-specification.html

 

http://nmap.org/book/nse-usage.html

 

Explanation of all Nmap scripts: http://nmap.org/nsedoc/

 

nmap icon courtesy of insecure.org

Here is a new episode of Brakeing Down Security!

Risk Management discussion with Josh Sokol - Part 2

This week we take some time to talk about risk management with Josh Sokol.  This is part 2 from our interview with him last week... We talk some more about Simple Risk from the POV of Risk Management, licensing/modification of Simple Risk.

Mr. Boettcher and Josh discuss the merits of Qualitative vs. Quantitative Risk Analysis, and which one is better...

We also discuss NIST 800 series guidelines, and how he used those to excellent effect in Simple Risk.

 

NIST 800 Series docs - http://csrc.nist.gov/publications/PubsSPs.html

 

 

Intro "Private Eye", transition "Mining by Moonlight", and Outro "Honeybee" created by Kevin MacLeod (incompetech.com) 
Licensed under Creative Commons: By Attribution 3.0
http://creativecommons.org/licenses/by/3.0/

Here is a new episode of Brakeing Down Security!

Interview with creator of Simple Risk, Josh Sokol!

Here is a new episode of Brakeing Down Security!

Sqlmap - a little how-to, and getting your developers involved in using it.

Mr. Boettcher and I discussed SQLMAP, a tool that can automate the process of pentesting databases and even registries on Windows.  We discuss some functions of the program and why developers should get training on these.

Mr. Boettcher and I talk about how Infosec professionals should help to educate QA and Developers to be able to look at their processes and incorporate security testing, using tools like sqlmap in the Software lifecycle.

 

SQLMAP links

SQLMAP Wiki and more detailed documentation - https://github.com/sqlmapproject/sqlmap/wiki

http://sqlmap.org/

https://github.com/sqlmapproject/sqlmap

http://hackertarget.com/sqlmap-tutorial/

https://www.owasp.org/index.php/Automated_Audit_using_SQLMap

http://www.binarytides.com/sqlmap-hacking-tutorial/

http://blog.spiderlabs.com/2013/12/sqlmap-tricks-for-advanced-sql-injection.html

Here is a new episode of Brakeing Down Security!

Part 2 with Georgia Weidman!

It only gets better in Part 2 of our Interview with Georgia Weidman, Author, Security Researcher and Creator of the Smartphone Pentesting Framework.

 

She talks about how people underestimate the mobile platform for pentesting purposes, and we even find out that in addition to Teaching a class on exploit development at BlackHat this year, she's going to be helping a great organization overseas.

We also got her talking about some do's and don'ts of pentesting! ;)

Please enjoy!

 

Georgia's book on No Starch: http://www.nostarch.com/pentesting

on Amazon.com: http://www.amazon.com/Penetration-Testing-Hands-On-Introduction-Hacking/dp/1593275641 (non-sponsored link)

Here is a new episode of Brakeing Down Security!

Nmap (pt1)

So, I uploaded this little tutorial of nmap, a very nice tool I use on a regular basis, both at home and at work.

I did some basic scans, showed off the command line and the Windows 'Zenmap' version, as well as discussed some regularly used switches.

The next video I do about nmap will discuss more switches, the Nmap Scripting Engine (NSE), and how to format reports and the output nmap provides.

 

 

Nmap icon courtesy of livehacking.com

Here is a new episode of Brakeing Down Security!

Part 1 with Author and Mobile Security Researcher Georgia Weidman!

We have a real treat the next two weeks.  Author and Mobile Security Researcher Georgia Weidman, who we also found out will be providing exploit development training at Black Hat this year.

She is the author of an awesome book "Penetration Testing: A Hands-On Introduction to Hacking" (http://www.amazon.com/Penetration-Testing-Hands-On-Introduction-Hacking/dp/1593275641/ref=sr_1_1?ie=UTF8&qid=1405304124&sr=8-1&keywords=georgia+weidman)

She sat down with us over Skype and gave a nice talk about where she came from,  and why she wrote the book, and even what she's about to do in the future (that's next week) ;) You'll have to listen next week to find out the awesome trip she's about to take.

http://www.bulbsecurity.com/

 

Here is a new episode of Brakeing Down Security!