All Posts

3 min IT Ops

Logging from Tableau for Successful DataOps

Lately, we’ve been seeing a growing number of customers using Logentries in support of DataOps – the practice of collecting, normalizing and redistributing data throughout an organization so teams can make smarter business decisions. With teams ranging from engineers to support to marketing & sales relying on data for every day decision making, a critical requirement of those within a DataOps role is to actively monitor their organization’s data platforms. I recently had the pleasure of chatt

1 min Metasploit Weekly Wrapup

Metasploit Weekly Wrapup for 2015-10-15

Welcome to this week's Metasploit Wrapup. I'm your host Brent Cook, tagging in for egypt who just finished speaking about Metasploit at the Texas DIR Telecommunications Forum . This week was largely focused on bug fixes and refinements. In the fixes bucket, PowerShell sessions now properly upgrade with the 'sessions -u' command. Fixing this also revealed some general proble

4 min IT Ops

Exploring Lambdas and Streams in Java 8

Java 8 introduced a host of new features, including lambda functions and streams. In this article I will focus on these two features as they are the most impactful features that were added in this new version of Java. Lambda Functions If you ever had to write a GUI for an application with an OO language you’ll understand the pain of writing event handlers, such as a mouse click event. So much boilerplate needed because you had to define a disgusting inline class with a single method. With the

6 min Log Management

10 Best Practices for Log Management and Analytics

Introduction Today’s Log Management and Analytics Challenges Within the last decade, the advancement of distributed systems has introduced new complexities in managing log data. Today’s systems can include thousands of server instances or micro- service containers, each generating its own log data. With the rapid emergence and dominance of cloud-based systems, we have witnessed explosive growth in machine-generated log data. As a result, log management

5 min Project Sonar

Rapid7 Labs' Project Sonar - Nexpose Integration

With the release of Nexpose 5.17, customers were enabled to easily gain an outsider's view of their internet-facing assets.  This capability was made possible through integration with Rapid7 Labs' Project Sonar . What is Project Sonar? Project Sonar is a community effort to improve security through the active analysis of public networks. This includes running scans across public internet-facing systems, organizing the results, and sharing the data with the

5 min

TLS Coverage Improvements in Nexpose 6.0.2

Over the last couple of years, some of the most serious and widely publicized vulnerabilities have been related to the Transport Layer Security (TLS) protocol and its predecessor, Secure Sockets Layer (SSL). Because TLS is so fundamental to keeping network communications secure, new flaws that are discovered can have a disproportionate effect on an organization's risk. From Heartbleed to POODLE , FREAK

1 min Logentries

Logentries Joins the Rapid7 Family

I'm very excited today to join the Rapid7 family. The acquisition is good news for Logentries customers, Rapid7 customers and all of our employees.  It means that great minds and innovative technology have come together to solve some of our thorniest IT and security challenges. The Logentries team has been on a mission over the last few years -- Revealing the Power of Log Data to the World. While pursuing our mission, I am often asked why log data has become so valuable. The answer is simple: l

2 min Exploits

R7-2015-17: HP SiteScope DNS Tool Command Injection

This is a vulnerability advisory for the HP SiteScope DNS Tool Command Injection vulnerability, made in accordance with Rapid7's disclosure policy. Summary Due to a problem with sanitizing user input, authenticated users of HP SiteScope running on Windows can execute arbitrary commands on affected platforms as the local SYSTEM account. While it is possible to set a password for the SiteScope application administrator, this is not enforced upon installation. Therefore, in default deployments, an

1 min Metasploit

Metasploit Framework Tools Reorg

There are a wide variety of interesting and useful tools in the Metasploit Framework. Many of these are available from the top-level of Metasploit in the form of modules and library code. You can find countless tutorials and blogs about how to put msfconsole, msfvenom and other top-level commands to good use. However, not many people know about the 'tools' directory, which contains many useful, single-purpose scripts, with topics spanning from exploit development to statistics. One of the probl

4 min Metasploit

New Metasploit Tools to Collect Microsoft Patches

Patch testing and analysis are important parts in vulnerability research and exploit development. One popular reason is people would try this technique to rediscover patched bugs, or find ways to keep an 0day alive in case the fix in place is inadequate. The same process is also used to find the range of builds affected by a vulnerability, which tends to be useful to predict the value of the exploit, improving target coverage and reliability. Going through Microsoft patches is no easy task, tho

3 min Nexpose

Nexpose 6.0: Using Adaptive Security

Overview Adaptive Security is a new feature released in Nexpose 6.0 that dynamically collects and analyzes the important network changes with minimal configuration needed from the user. This new feature allows you to create workflows called automated actions that can respond to various behaviors occurring in your environment automatically. For further explanation, please feel free to read Adaptive Security Overview. Triggers and Actions Currently Adapti

2 min Windows

Metasploit Framework Open Source Installers

Rapid7 has long supplied universal Metasploit installers for Linux and Windows. These installers contain both the open source Metasploit Framework as well as commercial extensions, which include a graphical user interface, metamodules, wizards, social engineering tools and integration with other Rapid7 tools. While these features are very useful, we recognized that they are not for everyone. According to our recent survey of Metasploit Community users, most only used it for the open source comp

3 min IT Ops

Revealing Hidden Insights with Docker & timeslice()

Over the last few months, you’ve probably noticed that we’ve been talking about Docker quite a lot – we think this lightweight and powerful way of managing environments is only going to increase in popularity. Docker has been evolving their logging capabilities with each release, so of course we’re interested in how we can help you get log data from Docker into Logentries for quick and powerful analysis. In August, we announced a new way to collect and analyze Docker logs for free with our Doc

2 min

Adaptive Security Overview

In Nexpose 6, we are introducing Adaptive Security, a smarter way to automate actions taken based on security incidents as they occur in your environment. The ultimate goal is to give back to security teams the time spent configuring tools to respond to a threat and automating the tedious and repetitive tasks taken to understand changes in the asset inventory and the threat landscape. With Adaptive Security, you can create workflows called automated actions that respond to new and existing asse

6 min Metasploit

Flipping Bits in the Windows Kernel

Recently, the MS15-061 bulletin has received some attention. This security bulletin includes patches for several Windows Kernel vulnerabilities, mainly related to win32k.sys. Details of one of them, discovered by Udi Yavo, have been very well covered. First, the same Udi Yavo published details about the Use After Free on a blog entry. Later, Dominic Wang wrote a even more detailed analysis of both the vulnerability and its exploitation on this paper. Finally, Meysam