SpiderLabs Blog

Weak passwords? Better call The Doctor.

Every network presents its own unique opportunity for a penetration tester. Often, hidden among the ...

NAC doesn’t like your penetration testing device? IPv6 to the rescue!

Sometimes when I conduct a network penetration test it's just too easy to get to the "crown ...

SpiderLabs Radio: June 19, 2014

In this episode:

SpiderLabs Radio: June 12, 2014

In this episode:

Setting HoneyTraps with ModSecurity: Adding Fake Hidden Form Fields

This blog post continues with the topic of setting "HoneyTraps" within your web applications to ...

Microsoft Patch Tuesday, June 2014

June's Microsoft Patch Tuesday contains seven bulletins, including two rated "Critical" and five ...

From a Username to Full Account Takeover

In the past year there have been many major data breach incidents in which usernames, email ...

SpiderLabs Radio: June 5, 2014

In this episode I talk about some odd ransom ware targeting Apple iDevices and I go over the ...

Microsoft Advance Notification for June 2014

Microsoft will be releasing the next security patch release on Tuesday, June 10th. This release ...

CVE-2014-0515 Goes to Brazil for World Cup 2014

The FIFA World Cup 2014 begings June 12 and enthusiasm about the event has shown itself in ...

SpiderLabs Radio: May 30, 2014

In this episode I talk about:

CVE-2014-2120 – A Tale of Cisco ASA “Zero-Day”

A few months ago I was trying to PoC a known cross-site scripting vulnerability in the Cisco ASA ...

Third-Party Auth Token Theft: The Big Picture

Nothing sets the technical journalists abuzz like the prospect of a catastrophic, Internet-wide ...

Wireless Cameras and Webcams: Are You Being Watched?

Trustwave SpiderLabs recently disclosed vulnerabilities in several models of Y-Cam brand wireless ...

SpiderLabs Radio: May 22, 2014

In this episode I talk about:

Java-based Malware Distributed Through Spam

For the past few months, we've observed more spam with Java-based malware attachments. The recent ...

Mass Malicious PDF Email Campaigns from Cutwail

Over the last two weeks we have noticed a high number of emails with PDF attachments in our spam ...

Trustkeeper Scan Engine Update - May 21, 2014

We're back to bring you a large Scan Engine update. We've packed this release with tons of new ...

2014 Trustwave Global Security Report Available Now

Baby's first NX+ASLR bypass

Recently, I've been trying to improve my skills with regards to exploiting memory corruption flaws. ...

DEFCON 22 CTF Qualifiers Writeup

Hi folks!

SpiderLabs Radio: May 15, 2014

In this episode:

Microsoft Patch Tuesday, May 2014

May's Microsoft Patch Tuesday contains eight bulletins, the most of any release so far this year. ...

SpiderLabs Radio: May 8, 2014

In this episode:

Microsoft Advance Notification for May 2014

Tuesday, May 13 marks the next Microsoft security patch release. This release will contain eight ...

Exploit Kit Roundup: Best of Obfuscation Techniques

The world of exploit kits is an ever-changing one, if you happen to look away even just for one ...

[Honeypot Alert] Open Flash Charts File Upload Attacks

Our web honeypots picked up some increased scanning/exploit activity for the following file upload ...

Detecting A Surveillance State - Part 4 Cellular Attacks

This is the fourth and final post in my series of posts about state actor surveillance ...