Version 1.1 of Image Location and Privacy Scanner

After a bit of insomnia, I released the Image Location and Privacy Scanner version 1.1, my passive HTTP scanning plug-in for PortSwigger Burp Pro and OWASP ZAP. It contains a few minor updates, speed ups, and new hidden location tag detection compared to the previous version. More importantly, it has better documentation which might lead… Read More

Useful HTTP Security Headers

In a previous blog post, I wrote about a whole bunch of HTTP headers which compromise your security and how to disable them all on many different types of servers. This time, I discuss “good” headers and give instructions for enabling. I also delve into “possibly good” headers including when you might need them and… Read More

Linked In Got Hacked!

Somewhere in my spam folder today, I noticed this pathetic email, containing my old and no longer valid Linked-In password: I am aware {$Linked-In-Password$} one of your pass word. Lets get directly to the point. You do not know me and you are most likely wondering why you’re getting this mail? No one has compensated… Read More

Image Location & Privacy Scanner, Official Release, v1.0

It’s Here, Version 1.0 The Official v1.0 release of the Image Location & Privacy Scanner has arrived! This security tool plugin for Burp or OWASP ZAP security proxy tools will scan images for privacy exposure including GPS locations, camera serial numbers, even facial recognition tags. See my presentation about this software at this link. Version… Read More

Smoke – Modern Hash Digest Encapsulation

Smoke – A unified means of generating, transmitting, encapsulating, and validating multiple hash digests simultaneously to replace existing stand-alone hash digest software. The software generates digests in parallel and is notably faster than using individual algorithms serially on large files. Smoke operates much the same way as existing hash digest tools, like md5sum, and Smoke… Read More

Image Location & Privacy Scanner v0.4

New Version: Image Location & Privacy Scanner v0.4 I have completed another update of the Image Location & Privacy Scanner, a plugin for Burp or OWASP ZAP security proxy tools. More camera types have their serial numbers detected. With some Panasonic camera, it will also give the name and age of the person in the… Read More

PolarSSL Security Snowstorm – Tools Could Not Save Us

Note: I originally posted this blog entry on the Aspect Security blog around 2015-02-13. I am mirroring it here with only formatting changes. Introduction The spat of SSL and TLS issues over the last year have caused concern about the quality of the encrypted tunnel in Internet communications. The various creatively named BEAST, CRIME, &… Read More

Accidental Offensive Security: Analysis of Buffer Overrun in a Security Tool

During a project working with Hydra, a Network Login Auditor, we discovered and corrected a buffer overrun issue with possible security implications that might include the auditor being attacked by the auditee. TL;DR Attacker using Hydra or Medusa can get pwn’d by the victim website responding with remote code execution via buffer overrun exploit.… Read More

Image Location & Privacy Scanner v0.3

Announcement: Image Location & Privacy Scanner v0.3 I have completed a large update of the Image Location Scanner software; so many new features in fact, it gets a new name: “Image Location & Privacy Scanner”. It now detect serial number from the cameras in scanned images and even the camera owner’s name from some Canon… Read More