The latest version of the Certified Ethical Hacker (CEH) Courseware is due to be released and presented for the first time at Hacker Halted USA 2008 in June. Many small details of CEH Version 6 have been peppered on the Internet, as well as snippets of teaser copy on EC-Council’s own web site.

“With a total of 28 new and never seen before modules, covering the latest concepts, featuring more real life cases, and showcasing the latest hacking and security tools, the Certified Ethical Hacker (Version 6) will be the most advanced course ever.”

So I requested an interview with EC-Council to see if we could get confirmation as well as clarification. The questions are compiled from my own list as well as some others that were suggested by readers of The Ethical Hacker Network (EH-Net). EC-Council replied in a very timely manner with answers from both Haja Mohideen, co-founder of EC-Council, and Chuck Swanson, the instructor scheduled to teach the very first v6 offering of the course.

del.icio.us

Discuss in Forums (5)

By Brian Wilson, CISSP, CCNA, CCSE, CCAI, MCP, Network+, Security+, JNCIA

Last year at ChicagoCon 2007, Brian Wilson gave a great talk entitled "Cain & Abel: Windows Can Hack, Too!" Although the presentation and audio recording of the talk can be downloaded from the ChicagoCon site at Library Media Lab 2007 Evening Presentation Files, I had totally forgotten to publish his videos. Just in case things didn't go as planned during the live event or his laptop crapped out on him, Brian made a video of the MITM attack he demonstrated using Cain. They made it on the DVD passed out to the attendees, but unfortunately not in his column... until now!

del.icio.us

Discuss in Forums (14)

ChicagoCon 2008s from May 12 - 18, 2008 features all new keynoters, additional security boot camps, exams on-site followed by two days of ethical hacking presentations and breakout sessions. And without an exhibit hall full of sales pitches, you're free to learn from the pros, network with peers and advance your infosec career. 

Westchester, IL (PRWEB) January 29, 2008 -- Presented by the Ethical Hacker Network (EH-Net) and its parent company, The Digital Construction Company (TDCC), ChicagoCon is positioned to become the premier security event in the industry by bringing together the biggest names in education and certification under one roof for a week of security training like no other. With boot-camp style, hands-on classroom training, the (s)pring edition of ChicagoCon will host 13 courses from May 12 - 16 featuring a cross-section of the security landscape. We will also showcase researchers and InfoSec professionals during the conference portion of the event from May 16 - 17. From the novice, to the ultimate techie to those reaching for the CISO chair... everyone interested in a career in security will find something at ChicagoCon, your one-stop shop for security training and certification.

But ChicagoCon is not just another boot camp, security conference or hacker con. It's all of those wrapped into one. By providing top instructors, well known certifications, and 2 days of presentations, this unique event adds plenty of additional value to already strained training budgets. As a bonus, daily keynote addresses by industry experts Special Agent Patrick M. Geahan (FBI Cyber Crimes Division), Ralph R. Echemendia (world renowned hacking instructor), Mike Murray (Director Neohapsis Labs) and Matthew Carpenter (SANS, Intelguardians) will be presented only to the training students. Luke McOmie of TruTV's Tiger Team will provide the opening keynote for the conference on Friday afternoon for all to enjoy.

Overview: Hello, challenge fans. Matt Carpenter and I have brewed up a new one for your analysis. The evidence is below. Analyze it and answer our questions. As always, we'll choose three winners: one technical champ, one creative victor whose answer is technically correct, and one lucky person chosen at random. As you work through this challenge, please observe this very important warning! As they say on TV, DO NOT TRY THIS AT HOME. We'll go even further by saying, DO NOT TRY IT AT WORK EITHER. The commands included in this challenge are _highly_ destructive, and some of them are hardware specific. They will hose a machine badly. If you insist on testing the commands, at least use a strongly virtualized environment that isolates virtual hardware from physical hardware, and set a snapshot before each command so that you can revert to a pristine state. We wrote the challenge using VMware Workstation, and did not suffer damage to our underlying hosts. However, we cannot guarantee that your VMware experience will match our own. In other words, to borrow from the TV vernacular yet again, YOUR MILEAGE MAY VARY. Furthermore, some so-called "virtualized environments" other than VMware are merely emulators that do not isolate hardware well, nor do they support snapshots. The commands below could damage such environments, so be very careful. You have been warned!

If you can’t answer this challenge 100%, still send something in to qualify as a random winner. This month’s prize is my book, Malware: Fighting Malicious Code, which I authored with Lenny Zeltser. Each winner gets a signed copy.

--Ed Skoudis, Intelguardians
Author, Counter Hack Reloaded

del.icio.us Slashdot It!

Discuss in Forums (4)

Free Summit Pass Worth $1,745!!

Although ChicagoCon 2008s offers the 2-day workshop, Cutting-Edge Hacking Techniques - Hands On, written by Ed Skoudis, if you really want to see the latest and greatest techniques being used in the pen testing world as well as further your career in this exciting field, then the SANS Penetration Testing Summit in Vegas is the place to be.

SANS WhatWorks in Penetration Testing & Ethical Hacking Summit with Ed Skoudis features wonderful presentations by the top practitioners in ethical hacking including not only Ed Skoudis but also HD Moore, Johnny Long and many other top penetration testing experts in the United States and Europe who are coming together at the Paris Hotel on June 2 - 3 in Las Vegas to share their latest and most sophisticated techniques. "With presentations and workshops from industry thought leaders, this summit will help penetration testers, security assessment personnel, and managers responsible for vulnerability assessments operate more efficiently and effectively," says Skoudis. "You will leave the Summit with an arsenal of solutions that you can put to use immediately." For more detailed information, be sure to read the Summit Brochure. One lucky EH-Net member will be given a complimentary summit pass worth $1745. Good luck.

del.icio.us

Discuss in Forums (4)

Participation on EH-Net is the ONLY way to win. Start a thread that sparks lots of interest; share thoughts and experiences; help a newbie... quality is more important than quantity.

Only EH-Net members are eligible!
Registration Is FREE!

By Chris Gates, CISSP, CPTS, CEH

WTF is XPath Injection?  Data can be stored in a XML file instead of an SQL Database.  To sort through complex XML documents, developers created the XPath language.

http://www.w3.org/TR/xpath

XPath is a query language for XML documents, much like SQL is a query language for databases.  Instead of tables, columns, and rows XML files have nodes in a tree.  And like SQL, XPATH also had the potential for injection issues if queries are not properly sanitized.

Why is XPath Injection so dangerous?

• XPath 1.0 is a standard language. SQL has many dialects all based on a common, relatively weak syntax.
• XPath 1.0 allows one to query all items of the database (XML objects). In some SQL dialects, it is impossible to query for some objects of the database
  using an SQL SELECT query (e.g. MySQL does not provide a table of tables).
• XPath 1.0 has no access control for the database , while in SQL, some parts of the database may be inaccessible due to lack of privileges to the application.

del.icio.us

Discuss in Forums (2)

Editor's Note: This article was written in 2005 and was originally published on CSP Magazine. Due to numerous requests, it is being republished on EH-Net.

It is said that luck seems to find those prepared for it. And, as difficult as it is to admit, stuff happens. We may find that our current job doesn't satisfy our financial or intellectual goals, a natural disaster may strike or, the unthinkable, we may be deemed expendable! If you had to hit the pavement tomorrow, do you have the knowledge and experience to determine your own destiny? If not, what is lacking in your CV? What gaps in your knowledge or holes in the list of your credentials should you fill? What would make your resume stand out from the crowd? Could any of us be better prepared to take advantage of good luck or better yet overcome the bad variety?

As many in the IT field do from time to time, I too stopped recently to see where I stood in my career, where my chosen field is headed and what was my place in it? Think of it as a Personal Disaster Recovery Plan. Looking at my resume, I noticed a vast amount of experience, plenty of knowledge regarding the specific duties of each of the positions I held and a few certifications. What I seem to lack is a highly respected credential that would verify all of that experience, fill in some technical gaps of items I don't perform on a daily basis and be recognized by non-technical executives. That credential gap can clearly be filled by an IT certification, but which one is right for me and my career goals?

del.icio.us

Discuss in Forums (3)

When approaching security industry luminaries over the course of the last year about the CEPT certification, the typical first response I have received is usually quite blunt: "Oh great", "YET ANOTHER CERTIFICATION. Just what the security industry needs".  And, to this point, I do have to agree, the security industry does not need another certification that:

• Tests a basic level of knowledge of INFOSEC subjects (ala the CISSP, SECURITY+, SCNP, ad infinitum.)
• Only tests the ability to regurgitate memorized information over a 2-6 hour time period
• Is easily compromised by cheaters downloading actual exam questions for $59.90 from "teh interwebs"
• Or, even worse, cheaters that cheat the exam cheater companies by pirating a copy of exam questions from bittorrent

All of this results in a large group of people that have achieved a specific certification, but, in reality, have no real understanding of the subjects tested OR, more importantly, the ability to perform job duties that the certification is CERTIFYING in the first place!

del.icio.us

Discuss in Forums (5)