This section includes different publications, articles, presentations, projects and tools we have developed and have been involved in, due to our personal interest, or due to specific needs related to the professional services performed in our customer base.

Publications

"WHITE PAPER: A tool for capturing SMB files with Wireshark". David Perez & Jose Pico. May 2010. (EN)
"SVN cheatsheet". Jose Pico. May 2010. (EN)
"Seguridad en Bluetooth - To Blue, or Not to Blue: That is the Question". Raul Siles. FIST Conference - Barcelona, FiberParty 2010 Edition [url]. February 2010. (ES)
"Assessing and Exploiting Web Applications with the open-source Samurai Web Testing Framework". Raul Siles. IBWAS09 Madrid (OWASP) [url]. December 2009. (EN)
"Hacking Challenges: Have Fun Improving Your Skills!". Raul Siles. SANS London 2009 [url]. December 2009. (EN)
"'Prison Break – Breaking, Entering & Decoding' security challenge: official answers". Raul Siles. EthicalHacker.net [url]. September 2009. (EN)

Tools

Wireshark SMB plug-in

This freely available plugin for Wireshark provides the ability to save SMB files contained in a Wireshark trace, thus demonstrating that SMB traffic is a high-risk and high-impact vulnerability for the enterprise information security. This article in our blog and this white paper in our Lab contain all the details regarding the tool.

NOTE: from Wireshark development version 33229 on, Wireshark source code includes this functionality, so this patch should not be applied to the source code anymore before compiling.

RaDa

RaDa is a small trojan binary we wrote a while ago in order to illustrate how easy it is to remotely control a system, even traversing through multiple proxies and firewalls, once the system has been infected. Besides that, RaDa was the core of the Scan of the Month #32 contest we organized for the Honeynet Project, where participants had to perform an in-depth forensic analysis of it and publish both the results and the techniques and methods used during the analysis, in community benefit.

The report containing the official answers and solution to the contest can be downloaded here. The original page for the contest, including all the participant's submissions, can be found here.

nc2

The nc2 program is a customized version of the well known netcat (nc) utility, slightly modified to get rid of two little annoyances available on the initial implementation. The nc2 Linux version, unlike its predecessor, adds the "-L" option, an option only available in the original Windows version. The nc2 Windows version, unlike its predecessor, stops its execution as soon as it finishes a file transfer, without forcing the user to press CTRL+C, a behaviour only available in the original Linux version.

For more information regarding nc2 refer to the post we published in our previous blog, RaDaJo, a while ago. Nevertheless, since we released the nc2 program, newer implementations of netcat have seen the light, not only solving these problems but also adding new functionality. We specially recommend the ncat tool, included in current Nmap versions.