Security Publications and Presentations
ImmuniWeb® Self-Fuzzer Firefox Extension
ImmuniWeb® Self-Fuzzer is a simple Firefox browser extension designed to detect Cross-Site Scripting and SQL Injection vulnerabilities in web applications.
September 10, 2013
Welcome to the World Wild Web [French]
In our interconnected world, users are everyday facing an hostile environment, even if most of them are usually not aware of the underlying risks. During his talk at 4th brokers forum which occurred in Chavannes-de-Bogis, Frederic BOURLA presented some of the threats which could deadly impact brokers businesses. This short talk is a basic and visual security awareness initiation for brokers and insurers.
July 1, 2013
Fuzzing: An introduction to Sulley Framework
Fuzzing is the art of knowing how to put heavy pressure on software in order to find security vulnerabilities. Fuzzing frameworks have been among us since many years. Some of them have made the difference and been adopted by well-known computer security researchers. This paper is an introduction to the fascinating world of fuzzing by exploring the awesome Sulley Fuzzing Framework. We also intend to demonstrate how quick and easy it could be to find security breaches and weaknesses in nowadays software.
May 6, 2013
CVE-2013-0804: Novell GroupWise Untrusted Pointer Dereference Exploitation
In November 2012 High-Tech Bridge Security Research Lab discovered multiple vulnerabilities in Novell GroupWise 2012. Details of the vulnerabilities were disclosed in April 2013. This paper demonstrates vulnerability exploitation to execute arbitrary code on the vulnerable system.
April 3, 2013
Manipulating Memory for Fun & Profit
Memory analysis and manipulation can provide security analysts with formidable weapons. During his talk at Information Security Day for ISACA Luxembourg Chapter, Frédéric BOURLA presented most memory manipulation tricks from both offensive and defensive angles. The talk first dealt with the attacker’s layer, from pivoting attacks to IEEE1394 issues through In-Memory Fuzzing, which permits auditors to bypass built-in features, network limitations and encryption to remain able to uncover security vulnerabilities in a running application. In a second stage, the talk focused on the benefits of memory manipulation in Computer Forensics and Malware Analysis fields, especially when facing sophisticated malcode, such as kernel rootkits or heavily encrypted reverse Trojans. Basically, this talk aimed to open the doors to a fascinating world which could easily allow security analysts to save lots of time during their recurrent duties.
February 6, 2013
In-Memory Fuzzing with Java
Nowadays, a wide range of techniques can be used to find vulnerabilities and bugs in binaries applications. The aim of this paper is to introduce the main concepts of In-Memory Fuzzing, to summarize its advantages and drawbacks and to present the debugging library which is currently developed by High-Tech Bridge to help building in-memory fuzzers.
December 17, 2012
CVE-2012-1535: Adobe Flash Player Integer Overflow Vulnerability Analysis
Vulnerabilities in Adobe Flash Player has been widely used by cyber criminals since 2006 to penetrate remote systems. During the month of August 2012 a widespread 0day was used to perform attacks by using Microsoft Word documents as the principal attack vector. This security publication explains the particulars of the CVE-2012-1535 security vulnerability in detail.
October 11, 2012
The Growing Hacking Threat to Websites: An Ongoing Commitment to Web Application Security
The World Wide Web is the growth engine of our decade. Because the Web has the power to make everything available to anyone, anytime, where ever they are, through which ever device, even century-old businesses are adopting Web-centric business models. Government information systems are also becoming Web-centric because they, too, realise that technology allows them to meet and exceed the expectations of citizens with lower budgets. In essence, Web applications have become vital to almost any organisation, but these applications can be dangerously weak links in the network security perimeter.
September 5, 2012