<?xml version="1.0" encoding="UTF-8"?>
<rss version="2.0"
	xmlns:content="http://purl.org/rss/1.0/modules/content/"
	xmlns:wfw="http://wellformedweb.org/CommentAPI/"
	xmlns:dc="http://purl.org/dc/elements/1.1/"
	xmlns:atom="http://www.w3.org/2005/Atom"
	xmlns:sy="http://purl.org/rss/1.0/modules/syndication/"
	>

<channel>
	<title>NetSPI Blog &#187; Application Security</title>
	<atom:link href="http://www.netspi.com/blog/category/application-security/feed/" rel="self" type="application/rss+xml" />
	<link>http://www.netspi.com/blog</link>
	<description>Information security consulting</description>
	<pubDate>Mon, 26 Jul 2010 21:26:00 +0000</pubDate>
	<generator>http://wordpress.org/?v=abc</generator>
	<language>en</language>
	<sy:updatePeriod>hourly</sy:updatePeriod>
	<sy:updateFrequency>1</sy:updateFrequency>
			<item>
		<title>Windows Tools in BackTrack</title>
		<link>http://www.netspi.com/blog/2010/07/21/windows-tools-in-backtrack/</link>
		<comments>http://www.netspi.com/blog/2010/07/21/windows-tools-in-backtrack/#comments</comments>
		<pubDate>Thu, 22 Jul 2010 00:37:34 +0000</pubDate>
		<dc:creator>Scott Sutherland</dc:creator>
		
		<category><![CDATA[Application Security]]></category>

		<category><![CDATA[hacker tools]]></category>

		<category><![CDATA[PCI Requirement 11.3]]></category>

		<category><![CDATA[penetration testing]]></category>

		<guid isPermaLink="false">http://www.netspi.com/blog/?p=892</guid>
		<description><![CDATA[
For those of you who aren’t in the loop, BackTrack is a Live Linux distribution that ships with a large number of open source tools that can be used to assess the security of networks, systems, and applications.  At this point, most IT professionals and 14 year old computer geeks are at least generally [...]]]></description>
		<wfw:commentRss>http://www.netspi.com/blog/2010/07/21/windows-tools-in-backtrack/feed/</wfw:commentRss>
		</item>
		<item>
		<title>Invisible Threats: Insecure Service Accounts</title>
		<link>http://www.netspi.com/blog/2010/07/01/invisible-threats-insecure-service-accounts/</link>
		<comments>http://www.netspi.com/blog/2010/07/01/invisible-threats-insecure-service-accounts/#comments</comments>
		<pubDate>Thu, 01 Jul 2010 15:23:36 +0000</pubDate>
		<dc:creator>Scott Sutherland</dc:creator>
		
		<category><![CDATA[Application Security]]></category>

		<category><![CDATA[Least Privilege]]></category>

		<category><![CDATA[Windows Penetration Testing]]></category>

		<category><![CDATA[Windows Service Accounts]]></category>

		<guid isPermaLink="false">http://www.netspi.com/blog/?p=856</guid>
		<description><![CDATA[
In the wonderful world of Windows, service accounts are basically the man behind the curtain.  Almost invisible to the naked eye, they can be used to run almost any application you can dream up.   That includes everything from database services to anti-virus agents.  Unfortunately, many companies have a “set it and [...]]]></description>
		<wfw:commentRss>http://www.netspi.com/blog/2010/07/01/invisible-threats-insecure-service-accounts/feed/</wfw:commentRss>
		</item>
		<item>
		<title>The Systems That Time Forgot</title>
		<link>http://www.netspi.com/blog/2010/06/15/the-systems-that-time-forgot/</link>
		<comments>http://www.netspi.com/blog/2010/06/15/the-systems-that-time-forgot/#comments</comments>
		<pubDate>Tue, 15 Jun 2010 20:04:24 +0000</pubDate>
		<dc:creator>Scott Sutherland</dc:creator>
		
		<category><![CDATA[Application Security]]></category>

		<category><![CDATA[asset management]]></category>

		<category><![CDATA[Configuration Management]]></category>

		<category><![CDATA[PCI DSS Requirement 2]]></category>

		<category><![CDATA[penetration testing]]></category>

		<guid isPermaLink="false">http://www.netspi.com/blog/?p=835</guid>
		<description><![CDATA[Do you know about ALL of the systems on your network? If so, you’re in the minority. Identifying and actively managing all the systems on a network is not an easy task. Environments are constantly changing, asset owners come and go, and without a good asset management process, systems get lost in the shuffle. Unfortunately, [...]]]></description>
		<wfw:commentRss>http://www.netspi.com/blog/2010/06/15/the-systems-that-time-forgot/feed/</wfw:commentRss>
		</item>
		<item>
		<title>Are You Testing Your Web Application for Vulnerabilities?</title>
		<link>http://www.netspi.com/blog/2010/05/05/are-you-testing-your-web-application-for-vulnerabilities/</link>
		<comments>http://www.netspi.com/blog/2010/05/05/are-you-testing-your-web-application-for-vulnerabilities/#comments</comments>
		<pubDate>Wed, 05 May 2010 17:11:19 +0000</pubDate>
		<dc:creator>Steve Kerns</dc:creator>
		
		<category><![CDATA[Application Security]]></category>

		<category><![CDATA[code reviews]]></category>

		<category><![CDATA[PCI]]></category>

		<category><![CDATA[PCI-DSS]]></category>

		<category><![CDATA[Pentesting]]></category>

		<guid isPermaLink="false">http://www.netspi.com/blog/?p=728</guid>
		<description><![CDATA[As an organization that performs a large volume of code reviews and penetration tests, NetSPI is frequently asked which type of application assessment is the best option. Your primary options are a code review or a web application penetration test. Both are recommended and both find many of the vulnerabilities commonly found in web applications [...]]]></description>
		<wfw:commentRss>http://www.netspi.com/blog/2010/05/05/are-you-testing-your-web-application-for-vulnerabilities/feed/</wfw:commentRss>
		</item>
		<item>
		<title>Penetration Testing: Stopping an Unstoppable Windows Service</title>
		<link>http://www.netspi.com/blog/2010/03/26/penetration-testing-stopping-an-unstoppable-windows-service/</link>
		<comments>http://www.netspi.com/blog/2010/03/26/penetration-testing-stopping-an-unstoppable-windows-service/#comments</comments>
		<pubDate>Fri, 26 Mar 2010 20:07:32 +0000</pubDate>
		<dc:creator>Scott Sutherland</dc:creator>
		
		<category><![CDATA[Application Security]]></category>

		<category><![CDATA[Bypass Antivirus]]></category>

		<category><![CDATA[Not_Stoppable]]></category>

		<category><![CDATA[Pentesting]]></category>

		<category><![CDATA[Stop Windows Service]]></category>

		<guid isPermaLink="false">http://www.netspi.com/blog/?p=563</guid>
		<description><![CDATA[Usually disabling Windows services is trivial, but some don't shutdown as easy as we would like. This blog describes a relatively simple way to stop those resistant services.]]></description>
		<wfw:commentRss>http://www.netspi.com/blog/2010/03/26/penetration-testing-stopping-an-unstoppable-windows-service/feed/</wfw:commentRss>
		</item>
		<item>
		<title>What&#8217;s Happening in the Application Security Arena?</title>
		<link>http://www.netspi.com/blog/2010/01/07/what-is-happening-in-the-application-security-arena/</link>
		<comments>http://www.netspi.com/blog/2010/01/07/what-is-happening-in-the-application-security-arena/#comments</comments>
		<pubDate>Fri, 08 Jan 2010 00:52:19 +0000</pubDate>
		<dc:creator>Steve Kerns</dc:creator>
		
		<category><![CDATA[Application Security]]></category>

		<category><![CDATA[OWASP]]></category>

		<category><![CDATA[vulnerability assessment]]></category>

		<guid isPermaLink="false">http://www.netspi.com/blog/?p=619</guid>
		<description><![CDATA[According to Gartner, 75% of the attacks are coming though web applications and not through the network. This means greater emphasis needs to be placed on application security. However, this does not appear to be happening.]]></description>
		<wfw:commentRss>http://www.netspi.com/blog/2010/01/07/what-is-happening-in-the-application-security-arena/feed/</wfw:commentRss>
		</item>
		<item>
		<title>Vulnerability Alert: FCKeditor Arbitrary File Upload</title>
		<link>http://www.netspi.com/blog/2009/12/19/vulnerability-alert-fckeditor-arbitrary-file-upload/</link>
		<comments>http://www.netspi.com/blog/2009/12/19/vulnerability-alert-fckeditor-arbitrary-file-upload/#comments</comments>
		<pubDate>Sat, 19 Dec 2009 19:32:16 +0000</pubDate>
		<dc:creator>Scott Sutherland</dc:creator>
		
		<category><![CDATA[Application Security]]></category>

		<category><![CDATA[ASV Scanning]]></category>

		<category><![CDATA[PCI Requirement 11.2]]></category>

		<category><![CDATA[Upload Exploit]]></category>

		<category><![CDATA[vulnerability assessment]]></category>

		<guid isPermaLink="false">http://www.netspi.com/blog/?p=549</guid>
		<description><![CDATA[The worst kind of vulnerability in your environment is the one you don’t know exists. The “FCKeditor Arbitrary File Upload” issue seems to be just such a vulnerability.]]></description>
		<wfw:commentRss>http://www.netspi.com/blog/2009/12/19/vulnerability-alert-fckeditor-arbitrary-file-upload/feed/</wfw:commentRss>
		</item>
		<item>
		<title>How Good Are Your Application Security Assessments?</title>
		<link>http://www.netspi.com/blog/2009/11/16/how-good-are-your-application-security-assessments/</link>
		<comments>http://www.netspi.com/blog/2009/11/16/how-good-are-your-application-security-assessments/#comments</comments>
		<pubDate>Mon, 16 Nov 2009 18:53:31 +0000</pubDate>
		<dc:creator>Steve Kerns</dc:creator>
		
		<category><![CDATA[Application Security]]></category>

		<category><![CDATA[application security assessments]]></category>

		<category><![CDATA[Heartland Payment Systems]]></category>

		<category><![CDATA[QSA]]></category>

		<guid isPermaLink="false">http://www.netspi.com/blog/?p=481</guid>
		<description><![CDATA[I wonder if Heartland Payment Systems queried the QSA company on the background of the pen tester. Yes, the company was QSA-certified, but did the person or persons actually doing the penetration test have the education and experience needed to perform a pen test well?]]></description>
		<wfw:commentRss>http://www.netspi.com/blog/2009/11/16/how-good-are-your-application-security-assessments/feed/</wfw:commentRss>
		</item>
		<item>
		<title>Internal Penetration Testing: Attacking Systems That Matter</title>
		<link>http://www.netspi.com/blog/2009/11/10/internal-penetration-testing-attacking-systems-that-matter/</link>
		<comments>http://www.netspi.com/blog/2009/11/10/internal-penetration-testing-attacking-systems-that-matter/#comments</comments>
		<pubDate>Tue, 10 Nov 2009 23:23:08 +0000</pubDate>
		<dc:creator>Scott Sutherland</dc:creator>
		
		<category><![CDATA[Application Security]]></category>

		<category><![CDATA[Domain Admin privileges]]></category>

		<category><![CDATA[Hacking Active Directory]]></category>

		<category><![CDATA[Internal Penetration Test]]></category>

		<category><![CDATA[PCI Requirement 11.3]]></category>

		<guid isPermaLink="false">http://www.netspi.com/blog/?p=358</guid>
		<description><![CDATA[The effectiveness of [internal penetration tests] can be greatly increased by focusing on the right systems. The goal of this blog entry is to share my thoughts on a few ways to identify those systems.
]]></description>
		<wfw:commentRss>http://www.netspi.com/blog/2009/11/10/internal-penetration-testing-attacking-systems-that-matter/feed/</wfw:commentRss>
		</item>
		<item>
		<title>Do Not Use the Back Door!</title>
		<link>http://www.netspi.com/blog/2009/11/06/do-not-use-the-back-door/</link>
		<comments>http://www.netspi.com/blog/2009/11/06/do-not-use-the-back-door/#comments</comments>
		<pubDate>Fri, 06 Nov 2009 18:19:59 +0000</pubDate>
		<dc:creator>Dan Gardner</dc:creator>
		
		<category><![CDATA[Application Security]]></category>

		<category><![CDATA[SDLC]]></category>

		<category><![CDATA[secure application development]]></category>

		<category><![CDATA[software backdoors]]></category>

		<guid isPermaLink="false">http://www.netspi.com/blog/?p=459</guid>
		<description><![CDATA[ thought that the practice of installing backdoors in applications was well known to be a very bad idea, and that the practice went the way of the NeXT machine. Perhaps I was wrong.]]></description>
		<wfw:commentRss>http://www.netspi.com/blog/2009/11/06/do-not-use-the-back-door/feed/</wfw:commentRss>
		</item>
	</channel>
</rss>
