Slashdot Mirror
OWASP's VulnXML Database
Ingo Struck writes "The
Open Web Application Security Project released the VulnXML db for early access to the public. VulnXML is a description of static known vulnerabilities. It provides all necessary information to let an execution engine automatically craft and launch appropriate HTTP, SOAP or WebDAV requests and analyse the response whether the attack had success. Besides it provides some human readable classification of the
described vulnerability. A tool to execute VulnXML records is currently being developed and will help developers to check their web applications against a suite of well-known vulnerabilities described in a portable format."
fp
I've wanted an army of Zombies ever since playing a Necromancer in junior high.
Thank you, thank you, thank you... you've given me the tools to make my dreams come true.
-1 Uncomfortable Truth
New! Slashdot Troll Supply Store
Get your latest goatse, penisbird, lemonparty, and tubgirl gear!
http://nero-online.org/store.php
Check out my Michael T-Shirt
New! Slashdot Troll Supply Store
Get your latest goatse, penisbird, lemonparty, and tubgirl gear!
http://nero-online.org/store.php
I AM THE CLIT COMMANDER!
-- You are such a fucking fag
1 It will soon be illegal because of SCO and DMCA
2 GPL is anti-capitalist (use bsd instead)
3 Its hard to use (Gnome for example hide all the features that make it useable in its secret gconf database)
4 Its unstable (2.2 is the exception, but unless you apply about 1000 patches and backports its too old to be useful)
5 The software sucks (Openoffice, *puke* at the bloat)
6 The UI is inconsistent (read : gnome file dialog)
7 You have to type commands (None in windows since 95)
8 It doesn't run Windows programs (wine dosen't count)
9 You cannot buy a computer with Linux (Lindows at walmart dosen't count)
10 Linux companies are going out of bussiness (Mandrake for example)
11 RMS is a communist arsehole (note the arse)
12 High total cost of ownership
13 Too many distros
14 Un-american (American software sucks anyway)
15 Its not from microsoft (Therefore it does not have a monopoly in order to succeed)
16 Poor security track record (look at the kernel change logs)
17 Anyone and their 14 year old brother can add (buggy) code (and yes, it DOES sneak through CVS)
18 Even BeOS was better (try it and you will see te light)
19 Eugenia doesn't like it (she dosen't like anything actually)
20 It SUCKS!!!!!!!!!!!!! (-1, flamebait dosen't change this)
As always, it sounds like this is a double egded sword -- won't this give script-kiddies a new engine for quickly scanning for possibly vulnerable targets?
Not that I'm saying this is a bad thing -- it's just one more tools that security professionals will have to use to stay ahead of the competition.
modbomb me at will! I cannot be stopped, you domain hijacking terrorist
New! Slashdot Troll Supply Store
Get your latest goatse, penisbird, lemonparty, and tubgirl gear!
http://nero-online.org/store.php
Just in time for July 6th!
Now that's security by obscurity! <rimshot />
Thank you, ladies and germs, I'll be here all week.
Carousel is a lie!
so we've just replaced script kiddies with a (very small) shell script?
Free as in mason.
Straight from the modded down setion of OSnews, the TRUTH about linux. Eugina can suck my cock while it BLEEDS! (Text in brackets pre-empt kneejerk responses)
1 It will soon be illegal because of SCO and DMCA
2 GPL is anti-capitalist (use bsd instead)
3 Its hard to use (Gnome for example hide all the features that make it useable in its secret gconf database)
4 Its unstable (2.2 is the exception, but unless you apply about 1000 patches and backports its too old to be useful)
5 The software sucks (Openoffice, *puke* at the bloat)
6 The UI is inconsistent (read : gnome file dialog)
7 You have to type commands (None in windows since 95)
8 It doesn't run Windows programs (wine dosen't count)
9 You cannot buy a computer with Linux (Lindows at walmart dosen't count)
10 Linux companies are going out of bussiness (Mandrake for example)
11 RMS is a communist arsehole (note the arse)
12 High total cost of ownership
13 Too many distros
14 Un-american (American software sucks anyway)
15 Its not from microsoft (Therefore it does not have a monopoly in order to succeed)
16 Poor security track record (look at the kernel change logs)
17 Anyone and their 14 year old brother can add (buggy) code (and yes, it DOES sneak through CVS)
18 Even BeOS was better (try it and you will see te light)
19 Eugenia doesn't like it (she dosen't like anything actually)
20 It SUCKS!!!!!!!!!!!!! (-1, flamebait dosen't change this)
Shove it.
Why didn't these guys just add this as a plugin to Nessus? Would have made more sense.
This could also be used to create a "Super" Nessus. Remember that script kiddies and system administrators both use such tools. I think that in the long run, it will help the latter more.
You can't judge a book by the way it wears its hair.
IMPORTANT NOTE: There are many merchandising attempts for goatse.cx around the web-- none of them are real, none of them are official. Do not buy this gimmick merchandise. The official goatse.cx merchandise is coming soon!
So trolls, don't buy from the Slashdot troll store
Theres 20 other reasons not to buy from trollstore
1 It will soon be illegal because of SCO
2 GPL is anti-capitalist
3 Its hard to buy
4 Its unstutible
5 The fabric sucks
6 The designs are inconsistent
7 You have to dry clean it.
8 You can't buy it from windows
9 You cannot buy it.
10 Troll store is going out of business
11 Nero is a communist arsehole
12 High total cost of ownership
13 Too many items
14 Un-american
15 Its not from microsoft
16 Poor feedback track record
17 Anyone and their 14 year old brother can mae their own store.
18 Even goatsemerch was better
19 Eugenia doesn't like it
20 It SUCKS!!!!!!!!!!!!!
It's how Michael is able to post continuously without sleeping.
Hi, Billy Maze here, for CrackMasters!
Ever want to stay away and troll for hours on end?
Ever think the slashdot editors were a little sub-human with their persistant news posts? Now you too can be an asshole like one of the Trolls and Editors! CrackMasters will keep you awake for upto two fortnights! Let's goto CrackMasters' top customer, Michael, and ask how he does it. Michael?
Michael: Hello Biwwy. I've posted continously without sleeping, all thanks to CrackMasters.
BMaze: Yes, that's what I've been telling all your troll moderators in the audience. We want to know how well CrackMasters has improved your lifestyle. Care to comment?
Michael: Yeah, Biwwy. I've always had this malevolent attraction to CmdrTaco, but he was never quite receptive. So, I used CrackMasters' product for about 1 month, went to the FBI and created an artificial entity named "Kate Fent", and immediatly CmdrTaco was allured by my gay-appeal in a matter of days. CmdrTaco thinks Kate Fent isn't me, but I'll be the one to confess what happens in the beadroom.
BMaze: That sound great. Have you ever solicited our product to anyone and helped sell this great American name: CrackMasters?
Michael: Yep. You see, CmdrTaco and me (Kate Fent) can't have children. So, we goto the orphanage to buy one. We can never make out a decision on which livestock^H^H^H^H^H^H^H little boy we want to take home. I don't bring candy much, so the orphans started asking about the kittle bag of CrackMasters I carried around. CrackMasters was an instant hit with the kids. They love the taste and I've since donated five Pentium 200 computers to the orphanage with Linux and Quake3 insalled. Those kids are up all night fragging and trading porn. They will remember the name, CrackMasters, come 20 years. I'm sure they'll pass on such a quality name to their grandkids.
BMaze: That sounds terrific! Have you tried starting a slashdot poll, pitting ol' caffeine to CrackMasters?
Michael: I'm working on CowboyNeal, but he isn't receptive to my sexual advances on him. It'll take a big boost, perhaps CrackMasters plus, to allure CowboyNeal's urges to me and have him submit to my dairy-wand.
BMaze: I thought you'ld never ask! CrackMasters Plus is the new product that not even the most fat and ugliest of mother fucking geeks can resist. Slip some CrackMasters Plus in their drinks and voila! Instant a'whorin' crack whore! This is Billy Maze, for CrackMasters!
xml = souped up ini files. kidding...
collins, brian
This story has been posted for 43 minutes, and only 20 or so comments? man, where is everybody?
This post was brought to you by the number 584811 and the characters / and .
Check out BXML for a binary encoding of XML to efficiently carry scientific/array-type data. Feedback appreciated.
Help me! I'm being attacked in the rear by GAY NIGGERS FROM OUTER SPACE!
I know security is the first thing that leaps to my mind when I read that name. ;)
The coolest voice ever.
What is even more ironic is that Larry fancies himself some sort of "linguist" or "English" major. He went to college and read a couple books on Shakespeare so now he thinks he is some kind of language expert. Well it doesn't work that way.
Take a look at Perl. Does it look like it was designed by anyone who knew anything about the English language? No, it doesn't. It honest-to-God looks like it was designed by someone who was an Egyptian hieroglyphics major who spent all his free time watching Star Trek -- in other words, someone completely disconnected with reality.
So you can see why Perl sucks. Not to worry; there are other better languages to use. Try Python or Ruby, or gosh darn it -- Korn Shell. Any of these is better than Perl which should be relegated to set decoration for Raiders of the Lost Ark.
I've used Nessus to scan mine own boxen for months now. Very useful and powerful. Having this shouldn't raise any warning flags, being that a similar tool for this has been around for a long time now.
By the by, turn off stuff you don't need and you'll find most vulnerabilities disappear like magic.
Also, remember to scan your machines from private and public access just in case.
I honestly don't see the purpose in this site or the tool being developed to use it. I use Nessus on a daily basis and it seems to work just fine for this task.
I mean what more could you ask for... a client/server based vuln. scanner that will give you reports in xml, csv, txt, html, doc... Since the site and database has been created, maybe you should just write a program that exports the exploit tests as Nessus nasl scripts so we can do the tests and Snort rules so we can detect testing.
It's a very simple idea, but I've never seen anything like it in an open website. Is this new only because it's not a black hat operation?
From the site:
This database is intended to enable the maintenance of a peer group based set of XML descriptions for web application attacks.
Most people here are comparing this to vulnerability scanners like nessus, but acording to the description provided by the website this appears to be something entirely different. It doesn't check for known vulnerabilities versus services, but rather tries various attacks on web applications. I'm sure that something out there has been created along these same lines before, but I've never heard of it. This sounds like a good idea, and an easy way for inexperienced web application designers to insure that they're not vulnerable to a large database of known attacks.
Sounds pretty cool to me.
...since tomorrow is apparently Defacement Day.
libertarianswag.com
For those interested in open standards for vulnerability assessment, you should check out the Open Vulnerability Assessment Language (OVAL - http://oval.mitre.org/). OVAL provides assessments that DO NOT PERFORM THE ACTUAL EXPLOIT but rather specify logical conditions on the values of system characteristics and configuration attributes to characterize which systems are susceptible to a given vulnerability.
The assessments use SQL syntax but there is an XML version coming soon.
The Open Security Project (OpenSec - http://www.opensec.org/) is also developing a similar standard. The Advisory and Notification Markup Language (ANML - http://www.opensec.org/anml/) is not only working on assessment but an entire advisory format in XML.
was the biggest vulnerability of web services. Let's face it, all some has to do is send 20-40 concurrent soap requests based on the WSDL and the server will grind to crawl. Throw a couple more requests and IIS will likely crash. Luckily IIS will try to restart the webserver 3 times. After that what it does is anyone's guess. If you don't believe me, go ahead and send 2K SOAP messages to a 2.2-2.6Ghz system and watch what happens to the CPU usage.
If people would stick to the relational model, then XML would not be of much use above what a slightly improved comma-delimited format could provide.
I know, some of you don't feel that highly about relational and prefer the older "navigational" formats, but I think relational offers more consistent and logical organization rules and has a better "algebra" to go with it. It is harder to make cross-reference, normalization, and referential integrity rules with structures like XML (except under rare circumstances).
Dr. Codd was a terrible marketer, but he was otherwise a genius.
Table-ized A.I.
Exploit Repository -> Automated Server Compromise -> Multitude of Hacked Servers -> "Zombies" for Distributed Denial of Service Attack
Just because you don't understand the reference, doesn't mean it's offtopic.
You can do the same thing by posting the URL on /.
I give up, some one get me when Elvis returns...
That is very interesting. .
http://www.devmaster.net/ - A Game/Graphics Development website.
Immunity's SPIKE Proxy (http://www.immunitysec.com/spike.html) offers a python, GPL, VulnXML engine, and has for some time. VulnXML is superior to Nessus-style scripting in many ways for purely web-based assessments. Similar to how Nessus says "for all ports that have a web server on them, run these tests" VulnXML allows a fully interoperable and "self-descriptive" way to say "For all files on the web server, check for file.bak, but ignore custom 404 pages that return 200 OK, etc".
I see a disturbing trend, it is not "news for nerds" is is "n3wz for l33t"
I really, really think so..anyone who has worked with any of the existing technologies implementing it for the web should agree if you are not totally masochistic and braindead.
1. take VulnXML db
2. convert to OpenSTA script
3. run OpenSTA
Ceci n'est pas une signature
The only thing to fear (potentially) is that all those signatures are getting written now! And I'll agree with SHEENmaster that the creation of security tools, while a double-edged sword, benefits defenders even more than attackers.
-
Wouldn't a machine-readable vulnerability database allow for a worm that could keep up to date with the latest vulnerabilities by itself?