Conferences on Willis Vandevanter

Exploiting XXE In File Upload Functionality

Sun, 01 May 2016 00:00:00 +0000

Just wanted to post some details from my BH USA 2015 briefing “Exploiting XXE In File Upload Functionality”.

https://www.youtube.com/watch?v=LZUlw8hHp44

I also gave an updated version of the presentation in November for the Blackhat Webcast Series. It included more file types; PDF, JPG, and GIF. The link is here: https://www.blackhat.com/html/webcast/11192015-exploiting-xml-entity-vulnerabilities-in-file-parsing-functionality.html

Blackhat 2015 Arsenal

Thu, 10 Sep 2015 00:00:00 +0000

Last month at Blackhat Arsenal 2015, Pete and I presented on Serpico. This was our second time at Arsenal. Yet again, awesome people, great venue, and overall a highlight for me of BH/DC/LV. We got some excellent feedback on the project, so thank you to anyone who stopped by.

Last year I posted the top 3 feature requests and we squashed them (woot!). These are requested features/bugs this year and their associated issue on github:

Fix Image Breakage in Presentations

Automated Presentation creation was added the week before and had a rather embarassing stack trace in certain combinations; this was fixed in this commit

Statistics

More than a few people asked for more correlation; “Support Findings Trending” (Issue 25).

Wiki Additions

Add the following information to the wiki:

Report Creation Example
Presentation Creation
Export/Import Examples

Submit To Kali

Here is the submission: New Tool Request: SERPICO

Blackhat 2014 Arsenal Experience

Mon, 11 Aug 2014 00:00:00 +0000

Last week at Blackhat Arsenal 2014, Pete and I (@will_is) presented on Serpico. Arsenal was a great experience and I would highly recommend to anyone as an attendee or presenter. We got some great feedback on the project, so thank you to anyone who stopped by.

Here were the top 3 feature requests and their associated issue on github:

Global Variables

This feature would allow a user to add their own variable in the UI that would render in the template. A classic use case would be to edit the Executive Summary through the UI rather than inside of a template.

Github Issue: Support “Global Variables” for reports Released 08/22

More Findings

As of the most recent build Serpico comes with 8 findings; this is an area of active development. More than one person asked for findings from open sources such as CWE.

Github Issue: Include 40 Findings with the default installation

Plugin to 3rd Parties

This feature would allow a user to parse findings from different vulnerability scanners and import the results.

Github Issue: Support a connector to Nessus