Abhijeet Patil | 21 May 08:13
Picon

[Announcement] ClubHack Magazine Issue 28, May 2012 Released

Dear All,

Here we are with the 28th issue of ClubHack Magazine.

This issue covers following articles:-

0x00 Tech Gyan - Steganography over covert channels
0x01 Tool Gyan - Kautilya
0x02 Mom's Guide - HTTPS (Hyper Text Transfer Protocol Secure)
0x03 Legal Gyan - Section 66C - Punishment for identity theft
0x04 Code Gyan - Don’t Get Injected – Fix Your Code
0x05 Poster - "Look both side before crossing one way track"

Check http://chmag.in/ for articles.
PDF version can be download from:- http://chmag.in/issue/may2012.pdf

Send us your feedback, articles at info <at> chmag.in

Regards,
Team CHMag
http://chmag.in/

_______________________________________________
The Web Security Mailing List

WebSecurity RSS Feed
http://www.webappsec.org/rss/websecurity.rss

Join WASC on LinkedIn http://www.linkedin.com/e/gis/83336/4B20E4374DBA

WASC on Twitter
http://twitter.com/wascupdates

websecurity <at> lists.webappsec.org
http://lists.webappsec.org/mailman/listinfo/websecurity_lists.webappsec.org
Chintan Dave | 18 May 08:34
Picon

Need some help with one XSS Vector

Hi,

I am running into one issue with XSS and was interested if there is any way I can bypass it.
Following the response code where user supplied input is embedded. Input is taken via a text box.

<script type="text/javascript">alert('No Information is found for the card 1');</script>

User supplied input 1 is highlighted in red. I am trying to break out of this alert box, however when a single quote is given as input, the output is escaped using a backslash. It is as follows:

Input:     1'
Output: <script type="text/javascript">alert('No Information is found for the card 1\'');</script>

I am using IE 8 and tried using back ticks just to check if I can get around this limitation, however it did not work.
Any suggestion on how to break out of this would be much helpful.

All characters except the single quote, <!-- and </script> are working. Using a

I tried the following vector to escape out:

Input:     1`);alert(1);(`');
Output: <script type="text/javascript">alert('No Information is found for the card 1`);alert(1);(`');</script>

Appreciate your help and support in advance.

Thanks,
--
Regards,
Chintan Dave
_______________________________________________
The Web Security Mailing List

WebSecurity RSS Feed
http://www.webappsec.org/rss/websecurity.rss

Join WASC on LinkedIn http://www.linkedin.com/e/gis/83336/4B20E4374DBA

WASC on Twitter
http://twitter.com/wascupdates

websecurity <at> lists.webappsec.org
http://lists.webappsec.org/mailman/listinfo/websecurity_lists.webappsec.org
Dermot Blair | 15 May 23:37
Picon
Favicon

New Open Source Web Application Vulnerability Scanner Available

Hi All,

There is a new web application vulnerability scanner available. It is called WebVulScan and it is open source. Here is the link for it if you want to check it out: http://code.google.com/p/webvulscan/

Regards,

Dermot Blair
_______________________________________________
The Web Security Mailing List

WebSecurity RSS Feed
http://www.webappsec.org/rss/websecurity.rss

Join WASC on LinkedIn http://www.linkedin.com/e/gis/83336/4B20E4374DBA

WASC on Twitter
http://twitter.com/wascupdates

websecurity <at> lists.webappsec.org
http://lists.webappsec.org/mailman/listinfo/websecurity_lists.webappsec.org
Sebastian Schinzel | 15 May 12:50
Favicon

Classic examples for secure webapps

Dear all,

Two examples come to my mind when I think about classic examples of
secure software development: OpenSSH and Qmail. Both

a) were designed with security in mind
b) were heavily audited (--> open source)
c) are widely used in security sensitive environments for long times (> 10 years) 
d) had relatively few known security bugs despite b), and c).

My question is:
Are there any web applications that can be seen as a classic example of
secure software development on the web (similar to OpenSSH and  Qmail
in the network service area)?

Thanks,
Sebastian

---
Sebastian Schinzel

Universität Erlangen-Nürnberg
Lehrstuhl für Informatik 1
IT-Sicherheitsinfrastrukturen

Web: 	http://www1.cs.fau.de/
Twitter:	http://twitter.com/seecurity

_______________________________________________
The Web Security Mailing List

WebSecurity RSS Feed
http://www.webappsec.org/rss/websecurity.rss

Join WASC on LinkedIn http://www.linkedin.com/e/gis/83336/4B20E4374DBA

WASC on Twitter
http://twitter.com/wascupdates

websecurity <at> lists.webappsec.org
http://lists.webappsec.org/mailman/listinfo/websecurity_lists.webappsec.org

cfp | 10 May 13:48
Picon

Breakpoint 2012 Call For Papers

_________/_ _ _ _\________ \ / _______\ \__/_ _ _ _ _ _/_________/_ _ _/ __/_______/ \\ __/ __________/ _/_____ _\ \__ / _ / \___ ___________ __\______ \__ / / //____ /________\\ /_\ _ /_\ _/ / _/ / /____________\ \________/ /____/_____ _/ \ \ _____________ \___ /_________\ \ \ __\ /_/_ _ _ /_____________\ /________/\ \ / __/ /__________ ______ _________ ________ \_______\ _/ \________\ __ /__ \ / ______\ /_ _\ /__ _\ / / / _/__\ /___\ /_/ __/ //_________\ /__ / \ \/ / / /_ /_______ /____________// /________\ /____ \ / _ _ _/_ / _ _/___________\ /_____________\_ _ /_______/ / - --- Breakpoint 2012 --- - \ . ______________________________________ ._\\. (___. : Intercontinental Rialto : : Melbourne, Australia : : October 17th-18th : :__ . ___: )____________________________________\\ . www.ruxconbreakpoint.com www.twitter.com/ruxconbpx b p .____. --|-r--o-| _|_______________---------------------------------------------|- | e i | \_ \ _ / Introduction | -|-a--n-|_________/ /_____\---------------------------------------------|-- k t |____| Breakpoint is a new security conference being held on the 17th and 18th of October 2012, in Melbourne Australia. The event will show case the work of expert security researchers from around the world on a wide range of topics. Breakpoint is organised by the Ruxcon conference team and will offer a specialised and more professional security conference to complement and lead into the larger and more casual Ruxcon weekend conference. Breakpoint will cater towards security researchers and industry professionals alike, with a focus on cutting edge security research. With just one day separating both conferences, Breakpoint presents a great opportunity for our selected speakers to receive a complimentary trip to Australia and experience both the Breakpoint and Ruxcon conferences, not to mention the great weather, awesome parties, and friendly people. Melbourne is Australia's cultural capital, with Victorian-era architecture, extensive shopping, museums, galleries, theatres, and large parks and gardens. It is a city of many subcultures, personalities and styles, and it is these layers that make it so interesting. Melbourne has a vibrant arts and music scene, eccentric cafes, cobbled lane-ways, quirky shops, intimate bars and restaurants, and is known as one of the world's great streetart capitals. b p .____. --|-r--o-| _|_______________---------------------------------------------|- | e i | \_ \ _ / Important Dates | -|-a--n-|_________/ /_____\---------------------------------------------|-- k t |____| * May 10 Call For Presentations Open * July 30 Call For Presentations Close * October 15-16 BreakPoint Training * October 17-18 BreakPoint Conference * October 20-21 Ruxcon Conference b p .____. --|-r--o-| _|_______________---------------------------------------------|- | e i | \_ \ _ / Topic Scope | -|-a--n-|_________/ /_____\---------------------------------------------|-- k t |____| Topics of interest include, but are not limited to: o Mobile Device Security o Exploitation Techniques o Reverse Engineering o Vulnerability Discovery o Rootkit Development o Malware Analysis o Code Analysis o Virtualization, Hypervisor Security o Cloud Security o Embedded Device Security o Hardware Security o Telecommunications Security o Wireless Network Security o Web Application Security o Law Enforcement Activities o Forensics o Threat Intelligence o You get the idea b p .____. --|-r--o-| _|_______________---------------------------------------------|- | e i | \_ \ _ / Submission Guidelines | -|-a--n-|_________/ /_____\---------------------------------------------|-- k t |____| In order for us to process your submission we will require the following information: 1. Presentation title 2. Detailed summary of your presentation material 3. Name/Nickname 4. Mobile phone number 5. Brief personal biography 6. Description of any demonstrations involved in the presentation 7. Information on where the presentation material has or will be presented before Breakpoint * Preference will be given to presentations that contain original research that will be first presented at Breakpoint. * As a general guideline, BreakPoint presentations are between 45 and 60 minutes, including question time. If you have any enquiries about submissions, or would like to make a submission, please send an email to bpx <at> ruxconbreakpoint.com. b p .____. --|-r--o-| _|_______________---------------------------------------------|- | e i | \_ \ _ / Speaker Benefits | -|-a--n-|_________/ /_____\---------------------------------------------|-- k t |____| Speakers at BreakPoint will be entitled to the following benefits: - A return economy airfare to Melbourne (total cost limit applies) - Three nights acommodation at the Intercontinental Rialto - Complimentary registration for Breakpoint and Ruxcon conferences - Invitation to all BreakPoint and Ruxcon parties - Unlock 'Presented on world's smallest continent' achievement * All speaker benefits apply to a single speaker per submission. b p .____. --|-r--o-| _|_______________---------------------------------------------|- | e i | \_ \ _ / Contact | -|-a--n-|_________/ /_____\---------------------------------------------|-- k t |____| If you have any questions or queries, contact us at: * Email: bpx <at> ruxconbreakpoint.com * Twitter <at> ruxconbpx ______________________________________________________________ _._) presented by (_._ | .%$$% .. | ' __________. ._____ ________.&&$ '$$%$.__________ ' ._\ /___.___\ \_____/ ____/$ &&$\ /_ -:-\ \_____\ | /____/ /________\'$#%. .$&&'/____/ /-:- /____/ \________/ \____\ ' %$$$%' /_____/ . www.ruxcon.org.au . _|_ _|_ '(______________________________________________________________)' ~ ascii by ozzy ~
_______________________________________________
The Web Security Mailing List

WebSecurity RSS Feed
http://www.webappsec.org/rss/websecurity.rss

Join WASC on LinkedIn http://www.linkedin.com/e/gis/83336/4B20E4374DBA

WASC on Twitter
http://twitter.com/wascupdates

websecurity <at> lists.webappsec.org
http://lists.webappsec.org/mailman/listinfo/websecurity_lists.webappsec.org
MustLive | 5 May 22:50
Picon

Bypassing web antiviruses and attack via tables corruption in MySQL

Hello participants of Mailing List.

As I've wrote last month in the list, I've presented full translation of my
articles (in a form of new complex article), which I told
you briefly in my post Bypassing of security mechanisms
(http://lists.webappsec.org/pipermail/websecurity_lists.webappsec.org/2011-September/008051.html).
And now I will tell you about other my articles, written in September 2011
and in April 2012. Request full translation of any of them if needed.

I'll tell you briefly about my two articles concerning bypassing web
antiviruses and attack via tables corruption in MySQL. Which I wrote in
September and in April accordingly. These topics should be interesting for
you (especially for those, who haven't read them before).

1. Effective use of cloaking against web antiviruses
http://websecurity.com.ua/5359/

In this article I told more about the cloaking - the way how web antiviruses
became fighting with it and other ways of bypassing them with cloaking. This
is third article in my series about bypassing of web antiviruses (after
2010's "Bypass of systems for searching viruses at web sites" and 2011's
"Bypassing of behavioral analysis or malware strikes back").

After my 2010's article, where I wrote about such simple and well known way
of hiding from web antiviruses bots as cloaking, which similarly used from
90s for hiding from search engines bots, in August 2011 I've found the first
change. If I've made my own web antivirus immune to cloaking already in 2008
(from the first version), then from other vendors, such as search engines,
we had need to wait. And in the end of August 2011 I've found Google's bot,
who changed its UA. But due to other mistakes, it couldn't hide well his
true face :-), so it was possible for malware to use cloaking for hiding
from the bot. So it's needed to fight with cloaking more effectively.

2. Attack via tables corruption in MySQL
http://websecurity.com.ua/5796/

In this article I told about attacks on web applications via tables
corruption in MySQL. This attack I've described in 2009 (in my advisory
about WordPress) and later in 2011 (in my advisories concerning IPB), but
now I've wrote detailed article about it.

Best wishes & regards,
MustLive
Administrator of Websecurity web site
http://websecurity.com.ua

_______________________________________________
The Web Security Mailing List

WebSecurity RSS Feed
http://www.webappsec.org/rss/websecurity.rss

Join WASC on LinkedIn http://www.linkedin.com/e/gis/83336/4B20E4374DBA

WASC on Twitter
http://twitter.com/wascupdates

websecurity <at> lists.webappsec.org
http://lists.webappsec.org/mailman/listinfo/websecurity_lists.webappsec.org

Elie Bursztein | 4 May 07:25
Picon

Submit to WOOT: USENIX Workshop on Offensive Technologies

Hi everyone,

WOOT is the USENIX Workshop on Offensive Technologies and this year
will focus on the future of web exploitation and HTTPS security.

One of the specificity of WOOT is that it is meant to be a a bridge
between the industry and the academic world which always give rise to
interesting discussion :)

So if you just gave a cool talk at BSide or got something interesting
planned for Black Hat or DEFCON, it is exactly the type of work we'd
like to see submitted to WOOT.

Don't be shy, it will be a very fun workshop ! The WOOT call of paper
is available here: http://ow.ly/aH1X0

--
Elie
http://elie.im - Twitter: @elie

_______________________________________________
The Web Security Mailing List

WebSecurity RSS Feed
http://www.webappsec.org/rss/websecurity.rss

Join WASC on LinkedIn http://www.linkedin.com/e/gis/83336/4B20E4374DBA

WASC on Twitter
http://twitter.com/wascupdates

websecurity <at> lists.webappsec.org
http://lists.webappsec.org/mailman/listinfo/websecurity_lists.webappsec.org

Mon | 3 May 10:51
Picon

Re: CRLF Injection - HTTP Response Splitting

Hi Tanuj,

Thanks for your reply. I tried with a larger string (%0d%0a%0d%0a%0d%0a%0d%0a%0d%0a%0d%0a%0d%0a, %0d%0a%0d%0a%0d%0a%0d%0a%20%0d%0a%0d%0a%0d%0a%0d%0a, etc.)

The response doesn't split and %0d%0a appear as printable characters in the output.

Location: https://domain.org/path/res.asp?https=redirect&key1=value1&key2=value2&key3=value3%0d%0a%0d%0a%0d%0a%0d%0a%20%0d%0a%0d%0a%0d%0a%0d%0aContent-Length:%200

%0d%0a encoding for CRLF doesnt seem to work, hence, I was trying different encodings.

Br,
--
m0n


On Wed, May 2, 2012 at 5:01 PM, Tanuj Pathak <Tanuj.Pathak <at> mphasis.com> wrote:
Hi Mon,
 
First of all, we appreciate you to discuss  the concern because the output varies for different applications. So nothing is stupid or superb doubt here.
For your case we wanted to you to check with a large set of string also ( like  %0d%0a %0d%0a %0d%0a%0d%0a %0d%0a  ) as primary step. Then we can go to a conclusion.
 
 
Tan

From: websecurity-bounces <at> lists.webappsec.org on behalf of Mon
Sent: Mon 4/30/2012 6:02 PM
To: websecurity <at> webappsec.org
Subject: [WEB SECURITY] CRLF Injection - HTTP Response Splitting

Hi all,

May be this a very stupid question, however, after many unsuccessful attempts, I would appreciate your assistance.

In testing a web application, I found that on sending the following request header:

GET /path/path-contd/resource.asp?key1=value1&key2=value2&key3=value3 HTTP/1.1
....


I got the the following response header:

HTTP/1.1 302 Found
Date: xxxx
Server: xxxx
Location: https://<full-domain>/path/path-contd/resource.asp?https=redirect&key1=value1&key2=value2&key3=value3
....

I tried to inject "CRLF" (%0d%0a) in value3 to perform a HTTP Response Splitting, however, the input was always output to the response header as text and the injected CRLF (%0d%0a) was never executed. I tried:

1. double url encoding: %250d%250a
2. encoding the attack vector to unicode 16-bit
3. injecting %0d%0a (and double encoded value) in value1 instead
4. injecting %0d%0a (and double encoded value) in value2 instead

Am I missing something trivial or any other attack vector to bypass CRLF Injection protection/filter? Is this the right approach? Or should I safely assume that the application is performing proper URL sanitization?

Look forward to your replies. My apologies again in case my question is naive.

Br,
m0n

Information transmitted by this e-mail is proprietary to MphasiS, its associated companies and/ or its customers and is intended
for use only by the individual or entity to which it is addressed, and may contain information that is privileged, confidential or
exempt from disclosure under applicable law. If you are not the intended recipient or it appears that this mail has been forwarded
to you without proper authority, you are notified that any use or dissemination of this information in any manner is strictly
prohibited. In such cases, please notify us immediately at mailmaster <at> mphasis.com and delete this mail from your records.

_______________________________________________
The Web Security Mailing List

WebSecurity RSS Feed
http://www.webappsec.org/rss/websecurity.rss

Join WASC on LinkedIn http://www.linkedin.com/e/gis/83336/4B20E4374DBA

WASC on Twitter
http://twitter.com/wascupdates

websecurity <at> lists.webappsec.org
http://lists.webappsec.org/mailman/listinfo/websecurity_lists.webappsec.org
mastah yeti | 30 Apr 18:30
Picon
Gravatar

Abusing Password Managers with XSS

New post on abusing password managers with Cross-Site Scripting.
http://labs.neohapsis.com/2012/04/25/abusing-password-managers-with-xss/

_______________________________________________
The Web Security Mailing List

WebSecurity RSS Feed
http://www.webappsec.org/rss/websecurity.rss

Join WASC on LinkedIn http://www.linkedin.com/e/gis/83336/4B20E4374DBA

WASC on Twitter
http://twitter.com/wascupdates

websecurity <at> lists.webappsec.org
http://lists.webappsec.org/mailman/listinfo/websecurity_lists.webappsec.org

nullcon | 29 Apr 17:32

nullcon Delhi 2012 Call for Paper/Call for Event

Hi All,

For the very first time nullcon now comes to Delhi - to showcase cutting
edge security technologies and discuss new attack vectors and security
threats among the  Corporate world and the Government sector. The event
brings together thought leaders,Corporates, Government and security
professionals all under one roof.

Prototype:
-------------
We are introducing a new sub-event - Prototype at nullcon Delhi 2012. The
event provides opportunities to innovative companies to showcase their
latest and new technology/products to the nullcon audience. The main aim
behind Prototype is to enable and boost companies driving innovation in
security domain and provide them a perfect platform to boast about their new
technology and at the same time grab the attention of potential investors
and business partners at minimal cost. For more details about the event, its
costing and how your organization can participate kindly contact:
info_at_nullcon.net

Categories:
—————

The talk time duration includes time for questions and answers (5-10
minutes).

1. Research Category  (40 mins - 1 hr) is a deep knowledge technical track
that includes
new research, tools, vulnerabilities, zero days or exploits.

2. Technical Category  (30 mins - 1 hr)  comprises of known security issues,
case
studies, twist to an existing research, tool, vulnerability, exploit or
research-in-progress. Although this track is fairly technical, it covers
known techniques and analysis and is specially created for security
professionals who are not too much into new research, are auditors,
management
professionals and newbies.

3. Desi Jugaad (1 hr) is our signature research category talk and includes
any local
Indian/Asian hacks.

Submission Topics:
———————————————

1. One of the topics of interest to us is Desi Jugaad(Local Indian/Asian
Hack) and has a separate track of its own. Submissions can be any kind of
local hacks that you have worked on (hints: electronic/mechanical meters,
automobile hacking, Hardware, mobile phones,  lock-picking, bypassing
procedures and processes, etc. Be creative!)

2. The topics pertaining to security and hacking in the following
domains(but not limited to):
- Hardware Hacking(ex: RFID, Magnetic Strips, Card Readers, Mobile Devices,
Electronic Devices)
- Tools/exploits/Zero-days (noncommercial)
- Programming/Software Development security and weaknesses
- Network vulnerabilities.
- Information Warfare, cyber espionage, cyber crime, cyber laws
- Malware, Botnets
- Web attacks and application hacking
- New attack vectors
- Mobile malware, vulnerabilities, exploits, VOIP and Telecom
- Virtualization security, hacking VMs, breaking out of VMS etc
- Cloud security, threats and exploitation
- Critical Infrastructure
- Satellite hacking
- Wireless hacking
- Forensics

Submission Format:
———————————————

Email the Paper to: cfp_at_nullcon.net
Subject should be: CFP Delhi 2012 <Paper Title>
Email Body:
1. Name
2. Handle
3. Track (& Time required in case of General/Business track)
4. Paper Title
5. Country(and City) of residence
6. Organization and Designation
7. Contact no.
8. Have you presented or submitted this paper at any other conference(s) or
magazine(s)?
Yes, No. If yes, where? and how this submission is different from the
previous ones. Note that new research talks already given elsewhere or are
due to be given elsewhere prior to nullcon will be considered as Technical
category
talks unless they consist of cutting edge and ground breaking
technology, which is at the judgment of the review committee.
9. Are you releasing an open source tool?
Yes/No. (If yes, please include the source code for review)
10. Are you releasing an exploit?
Yes/No. (If yes, please include the source and vulnerability details for
review)
11. Are you releasing a new vulnerability/Zero-day?
Yes/No. (If yes, please send us the details, including reproduction
procedure, for review)
12. Why do you think your paper is different/innovative (for all tracks) and
how does it qualify as new work/research(for Research track only)?
13. Are there any live demonstrations (These earn you good points during
review)?
Yes/No. (If Yes, how many? Also please explain each demo)
14. Brief Profile ( <= 500 Words)
15. Paper Abstract - Please provide detailed working or your research/work.
The more details you provide the better it is for the reviewers. Please keep
the abstract to the point. Please do not try to hide the technical details
or say “I can't disclose it till bla bla” as it does not help the reviewers
in any way and may give your paper a low score because of insufficient
information available in the abstract.
16. Your high resolution photo (attached)

NOTE:
—————
Only the original authors should submit their research and any submission
from a third party will be rejected. The Abstract should clearly mention the
techniques and hacks in detail and merely mentioning that it works will not
help in understanding the research
to its full extent. nullcon is open knowledge/research sharing platform and
hence product/company marketing and pitches will be rejected. We request you
not to submit any product specific talk. For product specific talks kindly
look at Prototype sub-event.

Important Dates:
———————————————

CFP Opens:                                   25th April 2012
1st round of Speaker list Online:  10th June 2012
CFP Closing Date:                        30th June 2012
Final speakers List online:           10th July 2012
Conference Dates:                        26-29 September 2012

Speaker Benefits:
—————————————

For Research (and Desi Jugaad) Category

1. Complimentary Accommodation for 3 nights.
2. Travel Reimbursement (Either actuals or the below mentioned amounts,
whichever is less)
- North/South America to Delhi (USD $800)
- Africa/Europe/Australia to Delhi (USD $600)
- Asia to Delhi (USD $500)
- Anywhere in India to Delhi (INR Rs.6000)
3. Complimentary VIP conference pass.
4. Invitation to Mehfil-E-Mausiqi (null networking party).

For Technical Category

1. Complimentary VIP conference pass.
2. Invitation to Mehfil-E-Mausiqi (null networking party)

* Only one speaker will be eligible for the benefits in case there are two
or more speakers for a talk.

** By submitting a paper and agreeing to talk at nullcon the speaker gives
null the right to post, publish, re-distribute online and offline, soft
and/or hard copies of his/her presentation material including slides, source
code, detailed paper and the recorded video of the speaker and presentation.

nullcon Call For Events (CFE)
--------------------------------------------------
Want to conduct a sub-event at nullcon? Want to show off your special
skills?
Be creative.
Anything innovative is welcome.

If your Event gets selected, a maximum of 2 complimentary VIP passes will be
provided to you depending on your event.
Submit your proposal to cfp_at_nullcon.net
Email Subject: nullcon Delhi 2012 Event <Your_event_name>
Email Body:
 1. Team members names, emails, phone
 2. Organization
 3. City, country
 4. Event name
 5. Time duration (1 hr, 3 hrs, whole day?)
 6. Event details (including step by step information on how will you
conduct the event)
 7. Why do you think the event is innovative and should be organized at
nullcon?
 8. Have you ever conducted a similar event before this? If yes, please
provide all the details including the response.

Hints:
   - Want to teach us how to assemble/disassemble a biometric device using
home made stuff or how to make an autobot out of a radio/microwave/car etc ,
submit a proposal
   - Have a rock band? want to play at nullcon? submit your proposal.
  - A CTF or a game
  - A corporate sub-event
  - Anything that is interesting.

Regards
null Team

--
null - Spreading the right knowledge
null Mailing list charter:
http://null.co.in/section/about/null_list_charter/

_______________________________________________
The Web Security Mailing List

WebSecurity RSS Feed
http://www.webappsec.org/rss/websecurity.rss

Join WASC on LinkedIn http://www.linkedin.com/e/gis/83336/4B20E4374DBA

WASC on Twitter
http://twitter.com/wascupdates

websecurity <at> lists.webappsec.org
http://lists.webappsec.org/mailman/listinfo/websecurity_lists.webappsec.org

Ivan Buetler | 29 Apr 21:15
Picon

OWASP 2012 Online Competition

Dear security experts,

Hacking-Lab is proud to announce the upcoming online OWASP 2012 hands-on
competition about web security issues. The competition will start next
Tuesday (May 1 2012) and ends June 17th, 2012. It's all about web
security, including the Greece Hackademics challenges plus some advanced
Hacking-Lab challenges. The winner will gain a free ticket to either the
OWASP AppSec EU conference in Athens or AppSec US. 

Winner Selection Criteria
a) how many points you receive (complete)
b) how complete your solutions are (quality)
c) how fast you are completing the challenges (time)
d) creativity, unseen solutions, geek factor

The OWASP GEC (Global Education Committee) and Hacking-Lab have the
right to select the winner in case of identical a) to d) levels. OWASP
teachers, Hacking-Lab volunteers, Compass Security Switzerland staff are
not allowed to play. Sorry for that, folks.

Checkout the upcoming "OWASP 2012 Online Competition" here
* https://www.hacking-lab.com/events/

Train your Brain - Explore Hacking-Lab with this free online security
competition. 

Kind Regards
Ivan Buetler, E1

_______________________________________________
The Web Security Mailing List

WebSecurity RSS Feed
http://www.webappsec.org/rss/websecurity.rss

Join WASC on LinkedIn http://www.linkedin.com/e/gis/83336/4B20E4374DBA

WASC on Twitter
http://twitter.com/wascupdates

websecurity <at> lists.webappsec.org
http://lists.webappsec.org/mailman/listinfo/websecurity_lists.webappsec.org


Gmane