<?xml version="1.0" encoding="UTF-8"?>
<rss version="0.92">
<channel>
	<title>Cyber31337</title>
	<link>http://cyber31337.com</link>
	<description>Cyber Security Posts</description>
	<lastBuildDate>Sun, 13 Jun 2010 10:16:00 +0000</lastBuildDate>

	<language>en</language>
	

	<item>
		<title>Information Gathering</title>
		<description><![CDATA[A critical step when attempting to test the security of a target company/system/network, is to gain a thourough understanding of what it is you plan to attack.  While this may be handed to you in a neat little bundle if you're doing a white box test, there are a lot of situations where you may find yourself starting with little more then a web site or company name. [...]]]></description>
		<link>http://cyber31337.com/Articles/InfoGathering.html</link>
			</item>	
	<item>
		<title>Patch Scanning with MBSA</title>
		<description><![CDATA[If you can&#8217;t verify a security control is in place&#8230; then don&#8217;t count on it being in place.  In talking to a friend, a large part of his company&#8217;s security protections relied on their firewall, Anti-virus, and patching.  As we dug deeper into it, I found that they don&#8217;t really review the firewall [...]]]></description>
		<link>http://cyber31337.com/Articles/Patch-Scanning-with-MBSA.html</link>
			</item>
	<item>

		<title>Verifying Checksums</title>
		<description><![CDATA[These days, it&#8217;s not uncommon to download a known application from an unknown source.  It may be because the site uses multiple download mirrors (many linux distributions are downloaded this way), because the software was downloaded from a torrent, given to you by a friend, or for any number of other reasons.  The good news [...]]]></description>
		<link>http://cyber31337.com/Articles/Verifying-Checksums.html</link>
			</item>
	<item>
		<title>Built in Windows Port Re-director</title>
		<description><![CDATA[The other day I was in the situation pictured below.  Basically I had a command shell with admin privileges on Server1.  What I really wanted was RDP (Remote Desktop) access to Server2, but I didn&#8217;t have direct access to it due to firewall restrictions.  In this particular situation, trying to install any [...]]]></description>

		<link>http://cyber31337.com/Articles/Port-Re-director.html</link>
			</item>
	<item>
		<title>What&#8217;s wrong with an LM Hash?</title>
		<description><![CDATA[I&#8217;ve heard that storing the LM hash is a bad idea.  Why?
Hmmm, where to start..  To begin with, before hashing the password, all lower-case characters are converted to upper case.  This significantly reduces the number of hash combinations that need to be attempted to crack the password. When looking at the reduced [...]]]></description>
		<link>http://cyber31337.com/Articles/Whats-wrong-with-LM-Hash.html</link>
			</item>

	<item>
		<title>Password Salts</title>
		<description><![CDATA[Salting a password.  As we&#8217;ve already discussed it the &#8220;Obtaining Windows Password Hashes&#8221; article, when you set your password (using Microsoft Windows as an example), it hashes your password, stores the hash, and then discards the actual password you supplied.  So when user1 sets their super secrete password to &#8220;password&#8221;, the system will hash it, [...]]]></description>
		<link>http://cyber31337.com/Articles/Password-Salts.html</link>
			</item>
	<item>
		<title>Cracking the hash</title>

		<description><![CDATA[After obtaining the password hash (for ways to do this, see the article here), we have to figure out what the password actually is. Well, okay, depending on what you&#8217;re trying to accomplish, you may be able to just pass the hash, but for the sake of this article we want to find out what [...]]]></description>
		<link>http://cyber31337.com/security/cracking-the-hash/</link>
			</item>
	<item>
		<title>Obtaining Windows Password Hashes</title>
		<description><![CDATA[When attempting to determine the password on a windows system, the first step is to get access to the hashed version of the password. Notice that I said that you&#8217;re trying to get the hashed version of the password, and not that you&#8217;re trying to get the actual password.  This is an important distinction to [...]]]></description>
		<link>http://cyber31337.com/Articles/Obtaining-Windows-Password-Hashes.html</link>

			</item>
</channel>
</rss>

