Quckly find if you’re vulnerable to the latest WebDav/IIS vulnerability:
http://epixoip.pastebin.com/f9512361A
And if you care exploiting… yourself? http://www.skullsecurity.org/blog/?p=285
Do you own an IIS&WebDAV *combination*? Disable WebDAV. Microsoft will probably be here with a patch in 1/2/n weeks.
I just got a message from Kelly Sonora, regarding a list of free courses they’ve assembled – it’s really good, so you should definitely check it out! http://www.computer-colleges.com/blog/2009/diy-ciss-degree-100-open-courses-on-computer-information-systems-and-security/
It’s amazing being able to share your passion with others from a stage..
Thank you all who attended the “Security in Web Applications” session – I hope it was at least slightly useful and entertaining!
See you on WebTech 2010!
The presentation and documents you might need to understand it (40 minutes… was NOT enough 
) – http://www.securityguy.org/webtech_2009.tar.gz
The guide is taken from NSA Security Configuration Guides, but is stripped of all the “junk”. You can download the whole package here, have in mind that except the .doc file I’m linking here (modified by me and reduced to half it’s size by deleting all the “see how great is Vista” marketing materials… ), there are also some scripts and security policies you will need – so head to NSA, download the .msi there, and if you like you can use the shorter guide to reduce the reading material.
Short version HERE
There is an inherent weakness in the paper ID system. The fact that you can submit any details there, and the only thing that is really matched against you, is your face. Well, matched against what the person sees looking at you – but nowhere else.
There are databases of criminals containing their faces, but these databases have the same weakness too – the other part of the information, the textual one – name, date of birth, place of birth, etc, are matched against other textual information, and no face info is matched in the way fingerprints are.
I don’t know if that make it clear… so I’ll try to explain better. (More …)
So, you wanted some kind of protection from 0-day exploits… here it is.
Amazing work by F-Secure! http://www.f-secure.com/weblog/archives/00001607.html
From their website:
You may also remember that Microsoft patched MS08-078 around the same time. Multiple versions of Internet Explorer were affected on multiple versions of the Windows OS and exploit code was circulating at the time. Exploit Shield 0.5 was able to proactively protect against those exploits. (More …)
I cannot stress the importance of this document enough… and how interesting it is. So… jump in!
http://www.nsa.gov/public_info/_files/cryptologic_spectrum/tempest.pdf