-
11 Dec 2011Windows security exploits, all over again
There's a good bit brewing in the Windows world regarding security and I suspect 2012 will make for an interesting year...Here are some new pieces I've written for TechTarget along these lines where I cover Windows 8 and SharePoint security, using Metasploit to exploit flaws as well as some Windows security oversights I see in practically every internal security assessment I do. Enjoy!Patching and continuous availability in Windows Server 8SharePoint ...
Continue Reading... -
05 Dec 2011
What happens when third-party patches are ignored
The majority of people I speak with claim they have no means for patching third-party software. As Kelly Jackson Higgins mentions in her recent Dark Reading blog post regarding the rash of Java exploitations, when third-party software goes unmanaged, bad things can happen.It's great that Metasploit has a a module for Java exploitation - something that'll not only benefit me in my security assessments but will also help bring to ...
Continue Reading... -
29 Nov 2011
HDMoore’s Law, revisited
Here's a good read by Mike Rothman (@securityincite) on how we tend to bury our heads in the sand over the most obvious things including HD Moore's Law. For years, I've had a slide in my presentations titled "Future Trends" where I've talked about how exploits are getting easier for those with ill intent:Easier access to toolsLittle knowledge neededLess elaborate “hacks”More internal breachesMobile business → less controlGreater complexity → more ...
Continue Reading... -
06 Oct 2011
My latest bits on Windows 7, Microsoft SCM and Metasploit
Here are some new pieces I've written for my friends at TechTarget on Windows security that you may be interested in including bits on the often overlooked but oh so valuable Security Compliance Manager and Metasploit:Using Windows 7 management tools to your advantageGetting to know Security Compliance ManagerWhy aren’t you using Metasploit to expose Windows vulnerabilities?You know the deal, be sure to check out www.principlelogic.com/resources.html for links to all of ...
Continue Reading... -
23 Dec 2010
Quick step-through of Metasploit Express
I've been raving about the penetration testing tool Metasploit for a while. With the release of Metasploit Express earlier this year I'm even more pleased with all the efforts HD Moore and his team have put forth. Metasploit Express is a commercial product you'll have to pay for but to me it's well worth the investment. It's easier to use, it has nice reporting and more. All the things we ...
Continue Reading... -
12 Aug 2010
Metasploit enters the Web arena
OK, Metasploit has had several Web-related exploits for years but HD and company are now getting serious about taking Web application scanning and exploitation to the next level.As with Metasploit and Metasploit Express, there's only so much you can do with scanner and exploit tools so the verdict is still out. I love this innovation nonetheless....
Continue Reading... -
21 Oct 2009
Metasploit as we knew it going bye bye?
The day I never thought I'd see has come. Once HD Moore announced "Metasploit is hiring" I knew something was going on. Metasploit has been acquired by Rapid7...huh!? Too bad Qualys - maker of my favorite OS/network vulnerability scanner - missed this opportunity!According to the Rapid7 acquisition FAQ Metasploit will remain open source but with a commercial twist. I hope it only gets better...fingers crossed.Hey at least Capitalism prevailed...it's dying ...
Continue Reading... -
26 Jan 2009
Looking for some software to exploit?
If you're learning the ins and outs of Metasploit (one of the most underrated and underused tools in our field) but don't have the software to exploit in a test environment, check out www.securinfos.info/old-softwares-vulnerable.php. Also don't forget about any old copies of Windows, etc. CDs you have lying around....Just load them up on a test machine, VMWare image, or similar and off you go. I can't imagine a more cost-effective ...
Continue Reading... -
17 Dec 2008
What, employees exploiting the new Windows flaw???
I've been talking about (and exploiting in my internal security assessments) this very thing for a long time and it's finally reaching the "mainstream media". Never ever underestimate the intentions of rogue insiders to exploit a Windows flaw like this.It's not just this Windows exploit....It's a whole slew of them. And Metasploit's cheap and very easy to use....
Continue Reading... -
28 Aug 2008
Want to try some ‘sploits but don’t have anything to ‘sploit?
If you've ever wanted to play around with Metasploit - the free pen test/exploitation toolkit - but you didn't know where to start....well, here's an interesting site I came across that hosts free trial versions of software known to be vulnerable to attack using Metasploit, etc..Oh, if you need a quick primer, check out the following articles I've written on Metasploit as well:Metasploit 3.1 updates improve Windows penetration testingMetasploit 3.0 ...
Continue Reading...
Resources
Client Testimonials
“A business associate referred our company to Principle Logic when we were seeking a resource to perform vulnerability /penetration testing for our external and internal networks. We found Kevin Beaver to be professional, well informed, and easy to work with. His testing did not disrupt our networks, and his progress updates were timely.
His final report was very thorough and included security recommendations for our network environment. The executive leadership was so impressed with Kevin’s security expertise, they have extended their agreement to continue to perform periodic testing. We highly recommend Kevin Beaver and Principle Logic as a resource for network security testing.”
(IT managed services firm)
Kevin has written/co-written 12 books on information security including one of the best-sellers of all time:
