Security talk at Reading Geek Night - FlasHack

Hi! Lovely summer, isnt it? :) I'm enjoying carrying out a lot of testing, researching and also a bit of developing.

But I always try to make time for sharing knowledge! I think sharing is the best part of the hacking community (and the Internet), people writing articles, blog posts and also twitts sharing their experience of computer security. And I love doing it when I can, especially as I know the people listening are passionate about the subject.

This is the reason I'm going to speak again at Reading Geek Night next week. I'll be doing a talk about how to decompile, modify, analyze and abuse Flash applications.

If you are interested in finding out how you can have some fun with Flash files and you can excuse my English and bad jokes, you are more than welcome to join me at another Reading Geek Night!

See you :)

Back from RootedCon 2010

I know, I didn't write anything about the Rootedcon as I promised last week but following the congress I came up with some new ideas and I have been busy coding them.

I don't know how to describe the congress. Simply amazing is a good approach. I met a lot of fantastic people and saw a lot of friends again. And, of course, we talked and learnt about security, so, what more I can ask for?

The first day (the Thursday) we had some less technical sessions about how to start a career as pentester and the actual situation of the national (Spanish) security. We also received a very interesting speach about computer forensics. The day ended in a pub near the congress place talking with the speakers and meeting people I only know from Internet.

Friday was a very intense day. The most technical sessions took place on this day. Also the CTF (Capture The Flag) tournament started. It was a shame that I was unable to participate, but I didn't want to miss any of the sessions, maybe next year! ;) We saw some 0-days exploits in the conferences: One for airodump, another for a support ActiveX program widely use in some big companies such as Telefonica and Symantec and others for the Oracle Financials 12. The most technical speach was the presentation of the Radare2 tool. Very low level programming and high level concepts which was difficult for me to understand. I'll try to download it and understand better how it works and how to use it.

Last day the sessions were very interesting too. Android forensic, metadata security, cryptography, botnets and one about hackers in the comics too! It was a very good mix of themes to finish the event. Also we had dinner with almost all the speakers so we kept talking about security even after three days. After dinner we went to a party but I'm not going to comment on this... ;)

I have to admit that after the congress I was really tired but also shocked! I met all these incredible people who know a lot about security making me realise that I need to keep studying and researching because out there are more things that I can imagine... and I want to learn them all!

P.S. I'll try to add the slides of the rest of the speaks when they release them. They release the slides today and you can see them online at Slideshare.

Using Firefox as a penetration test tool

Today I'm going to do a speak at "Reading Geek Night 4" about how to use Firefox as a pentesting tool.

It's going to be a short talk with some demos and I'll show different more or less common Firefox extensions and how use them to bypass or test the security in web pages. You can read more about it at the official web page.

See you there!

UPDATE: I just post in my personal blog some information about the talk and the extensions I used.