2 min
New in 5.7.16 - Search, Track, and Report on Assets by Open Ports
So, you want to find all assets that have HTTP enabled? Want to monitor which
non-standard ports are open across your organization? Now you can. Starting in
Nexpose 5.7.16 you can search, track, and report on assets by open ports.
That's definitely a good thing considering that monitoring non-standard ports is
a must. A recent report
by Palo Alto Networks highlighted the importance of m
2 min
Metasploit
Tech Preview Feedback: Vulnerability Validation in Metasploit Pro 4.8
By guest blogger and Rapid7 customer David Henning, Director Network Security,
Hughes Network Systems
A few weeks ago, Rapid7 asked me to participate in the Metasploit Tech Preview
for 2013. I've participated in a couple of other product previews in the past. I
like the interaction with the Rapid7 development teams. This tech preview was
smooth and it was easy to participate. Previous testing sessions required
interactions over e-mail and there was
some associated lag. This preview was mana
15 min
Metasploit
Don't Get Blindsided: Better Visibility Into User and Asset Risks with Metasploit 4.8
Not having visibility can be dangerous in many situations. The new Metasploit
4.8 gives you better
visibility in four key areas:
* View phishing exposure in the context of the overall user risk
* See which vulnerabilities pose the biggest risk to your organization
* Have all host information at your fingertips when doing a pentest
* Discover the latest risks on your network with new exploits and other modules
See Phishing Exposure as O
2 min
Network complexity: Bad for Business, Great for Job Security
For years I've written about how dangerous network complexity is for business.
It's simple math. The crazier things
are in your environment, the less control you have. In other words, the more
applications, computers, network segments, people, policies, cloud service
providers, and so on in your environment the harder it is to manage the risks.
It's a direct, quantifiable, and predictable inverse relationship.
Yet, no matter the degree of complexity n
3 min
Metasploit
Learn to Pentest SAP with Metasploit As ERP Attacks Go Mainstream
This month, a security researcher disclosed that a version of the old banking
Trojan “Trojan.ibank” has been modified to look for SAP GUI installations, a
concerning sign that SAP system hacking has gone into mainstream cybercrime.
Once a domain of a few isolated APT attacks, SAP appears to be in the cross
hairs of hackers that know just how much sensitive data ERP systems house,
including financial, customer, employee and production data. With more than
248,500 customers in 188 countries, SAP
4 min
CTF365: A New Capture The Flag Platform for Ongoing Competitions
By Guest Blogger Marius Corîci, ctf365.com
Before I start, I would like to thank the Metasploit team at Rapid7, and the
Kali Linux team at Offensive-Security for their kindnesses to let us use their
logos on our platform. I'd especially like to thank hdmoore and ckirsch at
Rapid7 as well as Mati Aharoni at Offensive Security. This means a lot to us.
Note: If this article is TL;DR, then I recommend you just go to CTF365.com
create an account, create a team and start p
3 min
Product Updates
Weekly Update - 11/6/13
Disclosures for SuperMicro IPMI
On the heels of last week's bundle of FOSS disclosures
, we've gone a totally different
direction this week with a new round of disclosures. Today, we're concentrating
on a single vendor which ships firmware for Baseboard Management Controllers
(BMCs): Supermicro, and their Supermicro IPMI firmware. You can read up on the
details on HD's blog post
which covers the
4 min
Vulnerability Disclosure
Supermicro IPMI Firmware Vulnerabilities
Introduction
This post summarizes the results of a limited security analysis of the
Supermicro IPMI firmware. This firmware is used in the baseboard management
controller (BMC) of many Supermicro motherboards.
The majority of our findings relate to firmware version SMT_X9_226. The
information in this post was provided to Supermicro on August 22nd, 2013 in
accordance with the Rapid7 vulnerability disclosure policy.
Although we have a number of Metasploit modules in development to test these
iss
5 min
Vulnerability Management And Expert Systems
Overview
An unique feature of the Nexpose vulnerability management (VM) solution is that
the core of the underlying scanner uses an expert system. Many years and
several careers ago, I had been tasked with selecting an appropriate VM solution
at my employer. Among the possible solutions was Nexpose, and I am somewhat
embarrassed to admit that I shrugged off the "expert system" as a marketing
term. I soon came to learn that it was a real thing and started to realize the
true power of such a te
3 min
Cybersecurity
National Cyber Security Awareness Month: The Value of Vigilance
Today is the last day of October 2013, and so sadly, this is our last NCSAM
primer blog. We're hitting on a number of potential threats in this one to help
drive the core point home – users need to be vigilant, not just with regards to
their physical security, but also the security of their information and the
systems used to access and store it.
For those that are new to this series, a quick recap – every week this month we
have created a short primer piece that could be copied and pasted into
1 min
Verizon DBIR
Nightmare on Pwn Street
We've gone a little Halloween-crazy this year over here at Rapid7 Towers. Check
out this week's Whiteboard Wednesday video to hear how organizations are like
the protagonists of horror movies; making decisions that may ultimately make
them vulnerable to attack. In addition, while we were carving our pumpkins and
sewing our costumes, we got to thinking about one of the most horrifying
realities in information security: many organizations keep falling victim to the
same tricks they've seen in the
5 min
Vulnerability Disclosure
Seven FOSS Tricks and Treats (Part One)
Adventures in FOSS Exploitation, Part One: Vulnerability Discovery
_This is the first of a pair of blog posts covering the disclosure of seven new
Metasploit modules exploiting seven popular free, open source software (FOSS)
projects.
Back over DEFCON, Metasploit contributor Brandon Perry decided to peek in on
SourceForge, that grand-daddy of open source software distribution sites, to see
what vulnerabilities and exposures he could shake loose from an assortment of
popular open source enterpri
3 min
Project Sonar
Legal Considerations for Widespread Scanning
Last month Rapid7 Labs launched Project Sonar,
a community effort to improve internet
security through widespread scanning and analysis of public-facing computer
systems. Though this project, Rapid7 is actively running large-scale scans to
create datasets, sharing that information with others in the security community,
and offering tools to help them create datasets, too.
Others in the security field are doing similar work. This fall, a research team
at the
2 min
Events
Social-Engineer CTF Report Released
For the last five years, the team at Social-Engineer have been bringing one of
the most exciting events to DEF CON - the Social Engineering Capture the Flag.
The contest was designed to help bring awareness to the world about how
dangerous social engineering can be. In our 5th year, the competition was
fierce and the report is the best we have ever released.
This year a pool of 10 men and 10 women, from diverse backgrounds and experience
levels, tested their social engineering abilities again
4 min
Cybersecurity
National Cyber Security Awareness Month: Avoiding Cloud Crisis
As you'll know if you've been following our National Cyber Security Awareness
Month blog series, we're focusing on user awareness. We belief that these days
every user in your environment represents a point on your perimeter; any may be
targeted by attackers and any could create a security issue in a variety of
ways, from losing their phone to clicking on a malicious link.
Each week through October we've provided a simple email primer on a topic
affecting users' security. We hope these emails