Full Disclosure mailing list archives
Re: Info about attack trees
From: Peter Dawson <slash.pd () gmail com>
Date: Mon, 28 May 2012 10:20:12 -0400
==> "there are no such thing as an attack tree." Eh ?? Seems that Schneier was blowing smoke up in the air with his thoughts on attack trees !! Anyhoot, here's another good old linky Military Operations Research V10, N2, 2005, <http://www.innovativedecisions.com/documents/Buckshaw-Parnelletal.pdf> http://www.innovativedecisions.com/documents/Buckshaw-Parnelletal.pdf /pd On Fri, May 25, 2012 at 9:46 AM, Daniel Hadfield <dan () pingsweep co uk>wrote:
You can create an XSS with a SQLi If you can output on the page, you can inject HTML/JS with that variable On 25/05/2012 09:58, Federico De Meo wrote:Hello everybody, I'm new to this maling-list and to security in general. I'm here to learn and I'm starting with a question :) I'm looking for some informations about attack trees usage in webapplication analysis.For my master thesis I decided to study the usage of this formalism inorder to reppresent attacks to a web applications.I need a lot of use cases from which to start learning common attackswhich can help building a proper tree.From where can I start?I've already read the OWASP top 10 vulnerabilities an I'm familiar withXSS, SQLi, ecc. however I've no clue on how to combine them together in order to perform the steps needed to attack a system. I'm looking for some examples and maybe to some famous attacks from which I can understand which steps are performed and how commons vulnerabilities can being combined together. Any help is really appreciated.------------------- Federico. _______________________________________________ Full-Disclosure - We believe in it. Charter: http://lists.grok.org.uk/full-disclosure-charter.html Hosted and sponsored by Secunia - http://secunia.com/_______________________________________________ Full-Disclosure - We believe in it. Charter: http://lists.grok.org.uk/full-disclosure-charter.html Hosted and sponsored by Secunia - http://secunia.com/
_______________________________________________ Full-Disclosure - We believe in it. Charter: http://lists.grok.org.uk/full-disclosure-charter.html Hosted and sponsored by Secunia - http://secunia.com/
Current thread:
- Info about attack trees Federico De Meo (May 25)
- Re: Info about attack trees Urlan (May 25)
- Re: Info about attack trees Thor (Hammer of God) (May 25)
- Re: Info about attack trees Gage Bystrom (May 26)
- Re: Info about attack trees coderman (May 26)
- Re: Info about attack trees Georgi Guninski (May 28)
- Re: Info about attack trees coderman (May 28)
- Re: Info about attack trees coderman (May 26)
- Re: Info about attack trees Urlan (May 25)
- Re: Info about attack trees Daniel Hadfield (May 27)
- Re: Info about attack trees Peter Dawson (May 28)
- Re: Info about attack trees Gage Bystrom (May 28)
- Re: Info about attack trees Peter Dawson (May 28)
- <Possible follow-ups>
- Fw: Info about attack trees Jerry dePriest (May 28)
- Re: Info about attack trees Defence in Depth (May 29)