livingontheedge
Joined 13 years ago
Karma
5
Submissions
6
Member since
Mar 18
Recent submissions
Comment · 13 years ago
What a great response from Matasano founder! No wonder they have 2 Ex-es (daeken,nbpoole) in this thread.
Comment · 13 years ago
>"Sean's crypto stuff has about 2.5x as much material as the 36Chambers crypto-for-pentesters site had..."
This site never existed, at least according to Matasano's offical website or Twitter account.
>"If the pricing model we use for the challenges ("mail Sean and ask for them and he'll give them to you for free") is too much for you, I don't know what to tell you"
You are deviating from the fact that you promised to give sth away at a national conference, then completely ignored it until s.b obviously pointed it out. What happened between BH-11 to last November - when you started telling everyone to send email to Sean?
Comment · 13 years ago
<!--Removed after seeing response about automating tool-->
You can script the scanner to auto-decode B64 cookie once you found them: http://blog.portswigger.net/2012/12/sample-burp-suite-extens...
It all boils down to: how can you be so sure if your tool/process is finding most vulnerabilities than others, and can you prove it?
If I were your client, I would be very worried by now.
Comment · 13 years ago
"We avoid tools like sqlmap"
"I wish Burp didn't have a Scanner. I might pay $25 more for a branded version of Burp that specifically didn't have that feature, so I could reassure clients I wasn't ever using it."
Tell me, how do you expect to find MOST instances of SQL Injection or XSS without using tools? Do you manually tamper with every cookie parameters? Unless Matasano has better tools and release them publicly, then I am interested in hearing about them.
Comment · 13 years ago
DON'T WORK FOR MATASANO!!! Reasons below:
#1 Lack of honesty. Seriously, they promised releasing those crypto challenges publicly 2 years ago (Blackhat 11: Crypto for Pentesters) and never done so: https://twitter.com/matasano/status/101714851633700864. And now they're using them as a recruiting tool.
#2 Lack of humility: Matasano guys seem to disregard common tools like Burp scanner or Sqlmap. It's fine to cherry-pick tools to suite your needs; but if you choose to disregard them completely just because you feel they're associated with "Security Rookies" then you're more than likely to miss something, consequently disservice your client (they expect you, as a consultant, to find the most vulnerabilities regardless of tools used). Matasano may have better fuzzer/scanner, but since they don't publicly release them, I found that going around and bashing other security tools to position themselves higher than their competitors is a sign of arrogance.
Go work for other companies, I don't want you HN people turn out to be like them!
For those of you who emailed sean at matasano dot com but haven't received any response, go play with Trustwave crypto challeges: https://github.com/SpiderLabs/CryptOMG - And yes they don't have BS subscription model.