<?xml version="1.0" encoding="UTF-8"?><!-- generator="WordPress/abc" -->
<rss version="0.92">
<channel>
	<title>GDS Security Blog</title>
	<link>http://www.gdssecurity.com/l/b</link>
	<description>Gotham Digital Science Security Blog</description>
	<lastBuildDate>Tue, 10 Aug 2010 14:38:41 +0000</lastBuildDate>
	<docs>http://backend.userland.com/rss092</docs>
	<language>en</language>
	
	<item>
		<title>Constricting the Web: The GDS Burp API</title>
		<description><![CDATA[Last week, I presented &#8220;Constricting the Web: Offensive Python for Web Hackers&#8221; at Black Hat USA 2010 and DEF CON 18 with Nathan Hamiel.  In this talk, we presented methods and techniques for using Python in custom tools to allow testers to be more effective at finding flaws in web applications.  One of [...]]]></description>
		<link>http://www.gdssecurity.com/l/b/2010/08/10/constricting-the-web-the-gds-burp-api/</link>
			</item>
	<item>
		<title>GWTEnum: Enumerating GWT-RPC Method Calls</title>
		<description><![CDATA[Google Web Toolkit (GWT) applications do not provide a straight forward way to enumerate all services and method calls. By default, GWT obfuscates client-side Javascript code which, as a tester, prevents one from being able to easily enumerate GWT-RPC method calls. Most pen testers typically limit testing to only the method calls that can be [...]]]></description>
		<link>http://www.gdssecurity.com/l/b/2010/07/20/gwtenum-enumerating-gwt-rpc-method-calls/</link>
			</item>
	<item>
		<title>ISSD Conference</title>
		<description><![CDATA[The very first International Secure Systems Development Conference (ISSD) is being held this week in London, and GDS is very happy to be supporting it from the start as both speakers and conference sponsors.  Event details are as follows:
The International Secure Systems Development Conference
London 20-21st May 2010, Westminster Conference Centre
Getting Started in Building Security [...]]]></description>
		<link>http://www.gdssecurity.com/l/b/2010/05/17/issd-conference/</link>
			</item>
	<item>
		<title>Fuzzing GWT RPC Requests</title>
		<description><![CDATA[In a previous post,  I went through the process of parsing GWT RPC requests to determine the method and parameter values sent. In this post I will discuss, GwtParse, a tool that I wrote to automate this process in order to easily determine the values within a GWT RPC payload that can actually be manipulated. [...]]]></description>
		<link>http://www.gdssecurity.com/l/b/2010/05/06/fuzzing-gwt-rpc-requests/</link>
			</item>
	<item>
		<title>OWASP NYNJMetro &#8211; Pentesting Adobe Flex Applications</title>
		<description><![CDATA[I&#8217;ve uploaded my slides from the presentation I gave last week at the OWASP NYC Chapter on Pentesting Adobe Flex Applications.
In an upcoming post, I&#8217;ll describe in detail working with custom objects and how to craft AMF messages containing them and other data types.
]]></description>
		<link>http://www.gdssecurity.com/l/b/2010/04/23/owasp-nynjmetro-pentesting-adobe-flex-applications/</link>
			</item>
	<item>
		<title>Penetrating Intranets through Adobe Flex Applications</title>
		<description><![CDATA[In my last post, Pentesting Adobe Flex Applications with a Custom AMF Client, I described how one could write a client using Python and PyAMF to perform manual penetration testing of Flex applications.  The example application I focused on utilized RemoteObjects and communicated via binary AMF encoded messages, a common roadblock for security testers. [...]]]></description>
		<link>http://www.gdssecurity.com/l/b/2010/03/17/penetrating-intranets-through-adobe-flex-applications/</link>
			</item>
	<item>
		<title>Multiple DOM-Based XSS in Dojo Toolkit SDK</title>
		<description><![CDATA[We released an advisory today to Bugtraq regarding a DOM-Based XSS bug I found in the Dojo Toolkit SDK 1.4.1 and earlier versions. The Dojo team was informed on February 19, 2010 and released the fix today along with some other security bugs. If you want some more information on this bug as well as [...]]]></description>
		<link>http://www.gdssecurity.com/l/b/2010/03/12/multiple-dom-based-xss-in-dojo-toolkit-sdk/</link>
			</item>
	<item>
		<title>Abusing WCF to Perform Remote Port Scans</title>
		<description><![CDATA[Last weekend at Shmoocon, I demonstrated how an attacker can trick certain WCF web services into performing an unauthorized port scan of machines behind a firewall.  For those that were not able to attend the talk, the slides are posted here. The part that covers the port scanning technique may not be clear in isolation, so [...]]]></description>
		<link>http://www.gdssecurity.com/l/b/2010/02/12/abusing-wcf-to-perform-remote-port-scans/</link>
			</item>
	<item>
		<title>Breaking Password Based Encryption with Azure</title>
		<description><![CDATA[During a recent security review, we came across a .NET application that was encrypting query string data to thwart parameter based attacks. We had not been given access to the source code, but concluded this since each .aspx page was being passed a single Base64 encoded parameter which, when decoded, produced binary data with varying [...]]]></description>
		<link>http://www.gdssecurity.com/l/b/2010/01/29/breaking-password-based-encryption-with-azure/</link>
			</item>
	<item>
		<title>WCF Binary Soap Plug-In for Burp</title>
		<description><![CDATA[Update 2010:  With the official release of Burp Suite v1.3, both plug-ins discussed in this post can be used with either Pro or Free versions of Burp.
If you run into a Silverlight application that consumes WCF, there’s a good chance it will use Binary XML Message Encoding to send data between the Silverlight client and the [...]]]></description>
		<link>http://www.gdssecurity.com/l/b/2009/11/19/wcf-binary-soap-plug-in-for-burp/</link>
			</item>
</channel>
</rss>
