full-disclosure - Re: Info about attack trees

lists.openwall.net		lists / announce owl-users owl-dev john-users john-dev passwdqc-users yescrypt popa3d-users / oss-security kernel-hardening musl sabotage tlsify passwords / crypt-dev xvendor / Bugtraq Full-Disclosure linux-kernel linux-netdev linux-ext4 linux-hardening linux-cve-announce PHC
Open Source and information security mailing list archives

Hash Suite: Windows password security audit tool. GUI, reports in PDF.

[<prev] [next>] [<thread-prev] [thread-next>] [day] [month] [year] [list]

Message-ID: <CAC9YSs7dJB_b+3Wi032yOQ-uVBh1vtdu2zi2jTvftUEpnCxLtA@mail.gmail.com>
Date: Mon, 28 May 2012 10:20:12 -0400
From: Peter Dawson <slash.pd@...il.com>
To: full-disclosure@...ts.grok.org.uk
Subject: Re: Info about attack trees

==> "there are no such thing as an attack tree."

Eh ??   Seems that Schneier was blowing smoke up in the air with his
thoughts on attack trees !!

Anyhoot, here's another good old linky Military Operations Research V10,
N2, 2005,
<http://www.innovativedecisions.com/documents/Buckshaw-Parnelletal.pdf>
http://www.innovativedecisions.com/documents/Buckshaw-Parnelletal.pdf

/pd
On Fri, May 25, 2012 at 9:46 AM, Daniel Hadfield <dan@...gsweep.co.uk>wrote:

> You can create an XSS with a SQLi
>
> If you can output on the page, you can inject HTML/JS with that variable
>
>
> On 25/05/2012 09:58, Federico De Meo wrote:
> > Hello everybody, I'm new to this maling-list and to security in general.
> > I'm here to learn and I'm starting with a question :)
> >
> > I'm looking for some informations about attack trees usage in web
> application analysis.
> >
> > For my master thesis I decided to study the usage of this formalism in
> order to reppresent attacks to a web applications.
> > I need a lot of use cases from which to start learning common attacks
> which can help building a proper tree.
> >
> > >From where can I start?
> >
> > I've already read the OWASP top 10 vulnerabilities an I'm familiar with
> XSS, SQLi, ecc. however I've no clue on how to combine them together in
> order to perform the steps needed to attack a system. I'm looking for some
> examples and maybe to some famous attacks from which I can understand which
> steps are performed and how commons vulnerabilities can being combined
> together. Any help is really appreciated.
> >
> >
> > -------------------
> > Federico.
> > _______________________________________________
> > Full-Disclosure - We believe in it.
> > Charter: http://lists.grok.org.uk/full-disclosure-charter.html
> > Hosted and sponsored by Secunia - http://secunia.com/
>
> _______________________________________________
> Full-Disclosure - We believe in it.
> Charter: http://lists.grok.org.uk/full-disclosure-charter.html
> Hosted and sponsored by Secunia - http://secunia.com/
>

Content of type "text/html" skipped

_______________________________________________
Full-Disclosure - We believe in it.
Charter: http://lists.grok.org.uk/full-disclosure-charter.html
Hosted and sponsored by Secunia - http://secunia.com/