O'Reilly Open Source Convention - August 1-5, 2005 - Portland, Oregon
 Convention Coverage

Session

The Latest (and Craftiest) Attack and Penetration Techniques and Tools
Nitesh Dhanjani, Manager, Advanced Security Centers, Ernst & Young LLP

Track: Security
Date: Thursday, August 4th, 2005
Time: 1:45pm - 2:30pm
Location: E144

Dhanjani discusses new and popular network and application Attack and Penetration techniques. Topics that will be covered include:

- Quick review of the Attack and Penetration methodology:
o Footprinting
o Scanning
o Enumeration
o Exploiting remote vulnerabilities
o Attempting privilege escalation
o Installing backdoors and rootkits
o Covering your tracks

- Finding Vulnerabilities via Google: It is easy (and a lot of fun) to use Google in order to look for vulnerabilities such as pointers to sensitive data and resources. This section will detail some of the queries that can be used against Google to find such resources, in addition to already existing tools that automate the process by using the Google API.

- Using the Nessus Framework: Nessus is a free and open source framework for developing custom vulnerability checks. NASL (Nessus Attack Scripting Language) makes it easy to develop plug-ins for the Nessus scanner in order to discover new vulnerabilities on a network. This section demonstrates the ease of use of NASL, along with a quick-start guide on writing your own Nessus plug-ins from scratch.

- Exploiting Web Applications and Services: The most common vulnerabilities affecting web applications and services revolve around improper input validation. Techniques such as SQL-Injection and Cross Site scripting will be discussed.

- Quick look at some useful tools and distributions:
o Aircrack: Break WEP keys
o Metasploit: Framework for writing exploits
o Wikto: New web assessment tool
o Whoppix: ‘Live’ Linux distribution armed with the latest tools and exploits
o Ettercap: One of the best network sniffers available today

- Mac OS X Post-compromise techniques: This section is specific to Mac OS X. Once attackers gain access to your Mac OS X computer, they will want to quickly get a hold of sensitive information on the machine. From gaining password hashes in order to crack passwords to quickly finding sensitive files to installing backdoors, this section covers the techniques used by Mac OS X root-kit authors.



Diamond Sponsors

Computer Associates International Inc., (CA)
Hewlett Packard
SpikeSource
Sun Microsystems

Platinum Sponsors

Novell, Inc.

Gold Sponsors

ActiveState
IBM
Ticketmaster

Silver Sponsors

ActiveGrid
Alfresco
Black Duck Software
CollabNet
Covalent Technologies
Google
GroundWork Open Source Solutions
Intel Corporation
Mergere, Inc.
Microsoft
Oracle
Palamida
SourceLabs
SugarCRM
Yahoo! Inc.
Zend Technologies, Inc.

Media Sponsors

boing boing
C/C++ Users Journal
DevtownStation News
Digital ID World
Enterprise Open Source Journal
Free Software Magazine
InsideMac Radio
Integration Developer News
Linux Journal
LinuxQuestions.org
Open Enterprise Trends
Queue
SDForum
Software Association of Oregon
Version Tracker
Wi-Fi Technology Forum
Women's Technology Cluster
WorldWIT

In-Kind Sponsors

Dell Inc.
Gibson
Griffin Technology
Harman Multimedia
Smugmug

Sponsors

OSCON 2005 Sponsor Opportunities — Email us at

Download the OSCON 05 Sponsor/Exhibitor Prospectus

OSCON 2005 Media Sponsor Opportunities — Call Margi Levin at 707-827-7184 or email at

Press and Media

For media-related inquiries, contact Suzanne Axtell at

Conference News

Want to receive conference news? Sign up for our email newsletter.

O'Reilly Home | Privacy Policy

© 2005, O'Reilly Media, Inc.