It’s a sad statement to make that anyone can become a hacker, with a few dollars and the right contacts anyone can “order” an infected website. A simple email will give anyone the means to access credit card numbers, addresses, and all of your personal…
Author Archives Invicti
THE AUTHOR
Invicti
Consider outside of the box for security – It can be exposing
In the past few days, a site selling Durex condoms have had a small ‘exposure’ problem.  As reported, the site had been suffering (time length unknown) from several basic security exposures, including even allowing orders to be viewed online, without a login – simply by…
Third Annual Meetings of Heads of Information Systems Security RSSI’2010
Invicti reseller Hat Web Security Labs will be exhibiting Invicti WVS in the Third Annual Meetings of Heads of Information Systems Security RSSI’2010. The event will take place between 3rd and 4th of June 2010 at the Cyber Parc Elgazala, Tunis. Click here for more…
Invicti WVS helps Digicure discover web vulnerabilities
A proper web security audit is a mixture of automated and manual tests; Invicti WVS provides a comprehensive tool for automated testing purposes and useful toolbox Digicure can use for manual penetration testing as well. “The most impressive thing about Invicti Web Vulnerability Scanner must…
SQL Injection hits again; 168,000 personal records exposed
A hacker, who calls himself “ins3cted”, has demonstrated to Webwereld via video how by exploiting a simple SQL injection, he can retrieve 168,000 personal records from a Dutch website called Experience the OV (http://www.ervaarhetov.nl). Citizens living in the provinces of Gelderland, Overijssel and Flevoland are…
Security usability and accessibility
Recently security and accessibility issues have become an important topic to me. Although I had always considered accessibility and more specifically usability important in my designs, since I’m now down to one active hand two to a surgery on the other hand, I am now…
XSS redirect attack – root compromized via simple tricky redirect
As the attacks on infrastructure become more complicated, the true nature of deep penetration attacks prove food for thought for all developers and operators. Consider this case – where the Apache open source infrastructure itself became significantly exposed by a simple XSS attack that utilized…
The road to glory, from XSS to Root on apache.org
On the 9th of April 2010, Apache.org infrastructure suffered a direct and targeted attack on the server hosting the Apache issue-tracking software, Atlassian JIRA. This is the second major compromise the Apache Software Foundation suffered in less than a year, when last August, the main…
Invicti WVS Version 6.5 build 20100407 released
An updated build of Invicti WVS Version 6.5 has been released. This build includes a number of bug fixes Bug Fixes: Fixed: Login Sequence Recorder was not using client certificates when recording a login sequence Fixed: Login Sequence Recorder was not using the configured User…