lists.openwall.net | lists / announce owl-users owl-dev john-users john-dev passwdqc-users yescrypt popa3d-users / oss-security kernel-hardening musl sabotage tlsify passwords / crypt-dev xvendor / Bugtraq Full-Disclosure linux-kernel linux-netdev linux-ext4 linux-hardening linux-cve-announce PHC | |
Open Source and information security mailing list archives
| ||
|
Message-Id: <200903020352.n223q3dK019210@www5.securityfocus.com> Date: Sun, 1 Mar 2009 20:52:03 -0700 From: kowsik@...il.com To: bugtraq@...urityfocus.com Subject: Announcing Cap'r Mak'r If you are a DPI/IPS/Firewall/Anti-something-or-the-other geek, here's what you have to do to go from a piece of content (malware, pdf, image exploit, etc) to a packet capture: - set up a server - configure it to either post or download the content - use a client to generate the traffic - capture the packets - and then forget to pass "-s 0" to tcpdump *argh* - now repeat, rinse for IPv6 No more. Point your browser to http://www.pcapr.net/caprmakr (login required), upload a file and embed it into HTTP or SMTP streams. The generated pcap? Yours to keep, forever. See http://www.pcapr.net/view/kowsik/2009/1/1/22/adobe-acrobat-jbig2-buffer-overflow.pdf.pcap.html for what's possible with Cap'r Mak'r. Enjoy! K.
Powered by blists - more mailing lists