SpiderLabs Blog

Trustwave Protections Deployed: MS11-083

Last week, it was Microsoft's Patch Tuesday! For November, Microsoft released one "critical" ...

Trustwave Protections Deployed: Duqu

Recent reports of the zero-day exploit found in the Win32k True Type Font Parsing engine and ...

NickiSpy.C - Android Malware Analysis Demo

Recently I got the chance to dig into a nice little piece of Android spyware, commonly known as ...

ModSecurity Advanced Topic of the Week: Commercial Rules Overview

As you may have heard, Trustwave recently announced the availability of commercial rules and ...

Interesting Authentication Bypass Vulnerabilities

Recently I've been writing a talk called "Authentication Bypass Zoo: Pwnage and Poetry 2" which ...

Google Android Focus Stealing Vulnerability Demo

Way back in August 2011, myself and Sean Schulte gave a presentation at DEF CON 19 called "This is ...

TWSL2011-013: Multiple Vulnerabilities in IceWarp Mail Server

The Spiderlabs team at Trustwave published a new advisory today which detail issues discovered in ...

Analyzing PDF Malware - Part 1

Background

Trustwave Releases New ModSecurity Rules and Support

ModSecurity is the most popular open source web application firewall (WAF) deployed today. We ...

Blinkie Lights howto by nosteve

At DEF CON 19, I showed a project that uses an LED matrix to display network sessions. The goal of ...

Advanced BNAT in the Wild

Just this week, we were asked to help out with some "TCP weirdness" that was identified out on a ...

ModSecurity Advanced Topic of the Week: Remote File Inclusion Attack Detection

Remote file inclusion (RFI) is a popular technique used to attack web applications (especially php ...

Morto: More than Meets the Eye

There's been a lot of talk the past week or so about Morto. For those unfamiliar or unaware, Morto ...

Implementing AppSensor Detection Points in ModSecurity

This is a follow-up to a previous blog post entitled "Real-time Application Profiling" that ...

Detecting Malice with ModSecurity: (Updated) CSRF Attacks

UPDATE - since this original post, we added new data manipulation capabilities to v2.6.0 with the ...

(Updated) Mitigation of Apache Range Header DoS Attack

Update After deeper research into the underlying vulnerability and analyzing customer traffic, ...

ModSecurity Advanced Topic of the Week: (Updated) Exception Handling

UPDATE - since this original post, we added new exception handling capabilities to v2.6.0 which are ...

What Do Bug Bounties Cover?

Over the past few days in the UK we have been bombarded with arguments and debates over the use of ...

ModSecurity Advanced Topic of the Week: Automated Virtual Patching Script

Automated Virtual Patching Example Script

ModSecurity Advanced Topic of the Week: Audit Log Searching with ModGrep

This is an updated section from my previous book Preventing Web Attacks with Apache and discusses a ...

Auto-BAHN: Using Smart phones to create emergency, ad hoc networks

Thomas Wilhelm, Sr. Security Consultant at Trustwave SpiderLabs, revealed a proof of concept this ...

TWSL2011-008: Focus Stealing Vulnerability in Android

The SpiderLabs team at Trustwave published a new advisory today, which details an issue identified ...

Regression Workaround for TWSL2011-007: The iOS SSL Validation Vulnerability (UPDATED)

Trustwave SpiderLabs recently released an advisory (TWSL2011-007) regarding improper x509 ...

What Web Application Security Monitoring Can Learn From Casino Surveillance

New Edition of SpiderLabs Radio - Interviews with SpiderLabs DEF CON Speakers

This month, Zack Fasel and Tom Mackenzie interview the SpiderLabs Team Members presenting at DEF ...

Detecting Malice with ModSecurity: HoneyTraps

This week's installment of Detecting Malice with ModSecurity will discuss how to implement ...

Live ModSecurity Challenges at Blackhat Arsenal

ModSecurity is participating in the upcoming Blackhat Arsenal Tools Demo next week in Las Vegas.

ModSecurity SQL Injection Challenge: Lessons Learned

This is a post-mortem blog post to discuss the successful Level II evasions found by participants ...