full-disclosure - Re: MalBox Release! A Program Behavior Analysis System!

lists.openwall.net		lists / announce owl-users owl-dev john-users john-dev passwdqc-users yescrypt popa3d-users / oss-security kernel-hardening musl sabotage tlsify passwords / crypt-dev xvendor / Bugtraq Full-Disclosure linux-kernel linux-netdev linux-ext4 linux-hardening linux-cve-announce PHC
Open Source and information security mailing list archives

Hash Suite: Windows password security audit tool. GUI, reports in PDF.

[<prev] [next>] [<thread-prev] [thread-next>] [day] [month] [year] [list]

Message-ID: <20110514234323.GA30465@foo.fgeek.fi>
Date: Sun, 15 May 2011 02:43:23 +0300
From: Henri Salo <henri@...v.fi>
To: Chris M <chris@...lroute.net>
Cc: full-disclosure@...ts.grok.org.uk
Subject: Re: MalBox Release! A Program Behavior Analysis
 System!

On Sat, May 14, 2011 at 10:55:30PM +0100, Chris M wrote:
> Not convinced.
> 
> Tried to upload a few samples, "only support EXE files" ---- no DLLs? yet
> you take URLs? only to exes?
> 
> The file I upped was a PE file. Just with a renamed extension.
> 
> Also submitted a couple of "known bad" files and got a list of tcp ports
> back.... how is this operating? _SHARED_ sandbox?
> 
> Whats it based on?
> 
> More information would be appreciated :)
> 
> -C

I can still get HTTP 500 errors easily. That service is running vulnerable version of Tomcat and still saying wrong TCP-connections with any scan url/exe-sample. JS checks aren't done in backend.

Best regards,
Henri Salo

_______________________________________________
Full-Disclosure - We believe in it.
Charter: http://lists.grok.org.uk/full-disclosure-charter.html
Hosted and sponsored by Secunia - http://secunia.com/