Metasploit Goes Web
Efrain Torres details metasploit Goes Web Efrain Torres Metasploit Team This topic will present and discuss the new Metasploit plugin for web exploitation and assessment.
Summary
Architecture and Background
Metasploit Goes Web Efrain Torres Metasploit Team This topic will present and discuss the new Metasploit plugin for web exploitation and assessment. WMAP is part of the Metasploit framework and it is build with a different approach compared to other open source alternatives and commercial scanners.
Vulnerability Analysis
WMAP is not build around any browser or spider for data capture and manipulation and as test modules are implemented as auxiliary modules they can interact with any other MSF components including the database, exploits and plugins. Forget about this being another scanner, think of it as new building blocks for massive pwnage that crosses protocol boundaries.
Exploitation and Demonstrations
Efrain 'ET' Torres is a Colombian security researcher that likes to break web applications and dislikes security certifications. Efrain currently works for one of the Big 4's IT Advisory practice in Houston, TX.
Remediation and Defensive Strategies
Prior to coming to the US (5 years ago) he was an independent security consultant while trying to figure it out how to graduate from college. For copies of the slides and additional materials please see the DEF CON 17 Archive here:
Related talks
Main Stage·12 min
Ricky Lawshae
Ricky Lawshae explores picking electronic locks using tcp sequence prediction at DEF CON 17, examining electronic-locks and practical defenses.
Main Stage·46 min
Sho Ho
Sho Ho explores foe feeding controversial news to censored countries at DEF CON 17, examining electronic-locks and practical defenses.
Main Stage·22 min
Pratap Prabhu · Yingbo Song
Pratap Prabhu and Yingbo Song explores smashing the stack with hydra at DEF CON 17, examining electronic-locks and practical defenses.