<?xml version="1.0" encoding="UTF-8"?>
<rss version="2.0"
	xmlns:content="http://purl.org/rss/1.0/modules/content/"
	xmlns:wfw="http://wellformedweb.org/CommentAPI/"
	xmlns:dc="http://purl.org/dc/elements/1.1/"
	xmlns:atom="http://www.w3.org/2005/Atom"
	xmlns:sy="http://purl.org/rss/1.0/modules/syndication/"
	xmlns:slash="http://purl.org/rss/1.0/modules/slash/"
	>

<channel>
	<title>Maestro Security Blogs &#187; Web Application Security</title>
	<atom:link href="http://maestro-sec.com/blogs/category/appsec/websec/feed/" rel="self" type="application/rss+xml" />
	<link>http://maestro-sec.com/blogs</link>
	<description>::Hack IT to Master IT::</description>
	<lastBuildDate>Wed, 21 Apr 2010 11:50:36 +0000</lastBuildDate>
	<generator>http://wordpress.org/?v=2.9.2</generator>
	<language>en</language>
	<sy:updatePeriod>hourly</sy:updatePeriod>
	<sy:updateFrequency>1</sy:updateFrequency>
			<item>
		<title>Free Online .htaccess generator</title>
		<link>http://maestro-sec.com/blogs/2010/04/free-online-htaccess-generator/</link>
		<comments>http://maestro-sec.com/blogs/2010/04/free-online-htaccess-generator/#comments</comments>
		<pubDate>Tue, 06 Apr 2010 05:59:21 +0000</pubDate>
		<dc:creator>w0lf</dc:creator>
				<category><![CDATA[Web Application Security]]></category>
		<category><![CDATA[.htaccess]]></category>
		<category><![CDATA[administration]]></category>
		<category><![CDATA[web security]]></category>

		<guid isPermaLink="false">http://maestro-sec.com/blogs/?p=553</guid>
		<description><![CDATA[Stumbled upon this pretty little nice page which can help you generate your .htaccess file. Can come handy for many web admins.
For those who are still not aware of .htaccess files you can have a look here &#38; here.
]]></description>
		<wfw:commentRss>http://maestro-sec.com/blogs/2010/04/free-online-htaccess-generator/feed/</wfw:commentRss>
		<slash:comments>0</slash:comments>
		</item>
		<item>
		<title>Attackers Exploit Web Application (Service) Flaw to break into the Mail Accounts</title>
		<link>http://maestro-sec.com/blogs/2009/09/attackers-exploit-web-application-service-flaw-to-break-into-the-mail-accounts/</link>
		<comments>http://maestro-sec.com/blogs/2009/09/attackers-exploit-web-application-service-flaw-to-break-into-the-mail-accounts/#comments</comments>
		<pubDate>Wed, 23 Sep 2009 04:51:59 +0000</pubDate>
		<dc:creator>w0lf</dc:creator>
				<category><![CDATA[Application Security]]></category>
		<category><![CDATA[Penetration Testing]]></category>
		<category><![CDATA[Web Application Security]]></category>
		<category><![CDATA[Access control list]]></category>
		<category><![CDATA[bruteforce]]></category>
		<category><![CDATA[hijack mail accounts]]></category>
		<category><![CDATA[web application]]></category>
		<category><![CDATA[web vulnerability]]></category>
		<category><![CDATA[yahoo]]></category>

		<guid isPermaLink="false">http://maestro-sec.com/blogs/?p=514</guid>
		<description><![CDATA[HI All
&#8220;Attackers are exploiting a known vulnerability in Yahoo&#8217;s network to
launch brute force attacks against users&#8217; Yahoo mail accounts.  The
attackers are using hijacked mail accounts to send spam.  The main Yahoo login page has mechanisms in place that protect accounts from brute force attacks, but the recent attacks have been exploiting a web
application (services) that [...]]]></description>
		<wfw:commentRss>http://maestro-sec.com/blogs/2009/09/attackers-exploit-web-application-service-flaw-to-break-into-the-mail-accounts/feed/</wfw:commentRss>
		<slash:comments>0</slash:comments>
		</item>
		<item>
		<title>File upload security recommendations</title>
		<link>http://maestro-sec.com/blogs/2009/03/file-upload-security-recommendations/</link>
		<comments>http://maestro-sec.com/blogs/2009/03/file-upload-security-recommendations/#comments</comments>
		<pubDate>Thu, 26 Mar 2009 17:31:12 +0000</pubDate>
		<dc:creator>w0lf</dc:creator>
				<category><![CDATA[Application Security]]></category>
		<category><![CDATA[Web Application Security]]></category>
		<category><![CDATA[file upload]]></category>
		<category><![CDATA[secuity]]></category>

		<guid isPermaLink="false">http://maestro-sec.com/blogs/?p=465</guid>
		<description><![CDATA[Blogged here recommentions and security tips for file upload module which is commonly targetted by hackers.
Any feedbacks/suggestions would be of great help  
]]></description>
		<wfw:commentRss>http://maestro-sec.com/blogs/2009/03/file-upload-security-recommendations/feed/</wfw:commentRss>
		<slash:comments>0</slash:comments>
		</item>
		<item>
		<title>Lessons to learn from Twitter Admin</title>
		<link>http://maestro-sec.com/blogs/2009/01/lessons-to-learn-from-twitter-admin/</link>
		<comments>http://maestro-sec.com/blogs/2009/01/lessons-to-learn-from-twitter-admin/#comments</comments>
		<pubDate>Thu, 08 Jan 2009 14:41:19 +0000</pubDate>
		<dc:creator>w0lf</dc:creator>
				<category><![CDATA[Application Security]]></category>
		<category><![CDATA[Web Application Security]]></category>
		<category><![CDATA[Hacking]]></category>
		<category><![CDATA[password policy]]></category>
		<category><![CDATA[twitter hack]]></category>

		<guid isPermaLink="false">http://maestro-sec.com/blogs/?p=362</guid>
		<description><![CDATA[
In an interview with GMZ, the 18 year old confessed that he had access to Twitter&#8217;s admin console. He also helped himself gain access to few high profile requests.
Check this out.

GMZ targetted a popular user named &#8220;Crystal&#8221; which later turned out to be an employee of Twitter and had administrative access. GMZ then launched a [...]]]></description>
		<wfw:commentRss>http://maestro-sec.com/blogs/2009/01/lessons-to-learn-from-twitter-admin/feed/</wfw:commentRss>
		<slash:comments>0</slash:comments>
		</item>
		<item>
		<title>Twenty Dont&#8217;s for ASP Developers</title>
		<link>http://maestro-sec.com/blogs/2008/11/twenty-donts-for-asp-developers/</link>
		<comments>http://maestro-sec.com/blogs/2008/11/twenty-donts-for-asp-developers/#comments</comments>
		<pubDate>Sat, 15 Nov 2008 08:40:28 +0000</pubDate>
		<dc:creator>Mayank</dc:creator>
				<category><![CDATA[Application Security]]></category>
		<category><![CDATA[Web Application Security]]></category>
		<category><![CDATA[ASP]]></category>

		<guid isPermaLink="false">http://maestro-sec.com/blogs/?p=258</guid>
		<description><![CDATA[
Firewalls block hackers from directly connecting to your network shares. Windows administrators keep their systems up-to-date with the latest software patches to thwart worms such as Nimda and Code Red. And user passwords are stronger than ever. But are we secure yet? While the situation is much better than it was just a couple years [...]]]></description>
		<wfw:commentRss>http://maestro-sec.com/blogs/2008/11/twenty-donts-for-asp-developers/feed/</wfw:commentRss>
		<slash:comments>0</slash:comments>
		</item>
		<item>
		<title>Top 15 SQL injection scanner</title>
		<link>http://maestro-sec.com/blogs/2008/10/top-15-sql-injection-scanner/</link>
		<comments>http://maestro-sec.com/blogs/2008/10/top-15-sql-injection-scanner/#comments</comments>
		<pubDate>Wed, 15 Oct 2008 10:00:25 +0000</pubDate>
		<dc:creator>w0lf</dc:creator>
				<category><![CDATA[Application Security]]></category>
		<category><![CDATA[Penetration Testing]]></category>
		<category><![CDATA[Web Application Security]]></category>
		<category><![CDATA[automated tools]]></category>
		<category><![CDATA[SQL injection]]></category>

		<guid isPermaLink="false">http://maestro-sec.com/blogs/?p=169</guid>
		<description><![CDATA[Well personally I don&#8217;t totally depend on automated scanners totally for appsecs but they do help in many cases where the task is repeating or large number of input fields need to be audited. but Appscan would be my choice if it was freeware  

Besides mentioned below are list of top 15 SQL Scanners [...]]]></description>
		<wfw:commentRss>http://maestro-sec.com/blogs/2008/10/top-15-sql-injection-scanner/feed/</wfw:commentRss>
		<slash:comments>3</slash:comments>
		</item>
		<item>
		<title>Hacking Yahoo, Gmail or any Bank accounts.</title>
		<link>http://maestro-sec.com/blogs/2008/10/hacking-yahoo-gmail-or-any-bank-accounts/</link>
		<comments>http://maestro-sec.com/blogs/2008/10/hacking-yahoo-gmail-or-any-bank-accounts/#comments</comments>
		<pubDate>Thu, 09 Oct 2008 14:35:50 +0000</pubDate>
		<dc:creator>w0lf</dc:creator>
				<category><![CDATA[Information Security]]></category>
		<category><![CDATA[Phishing]]></category>
		<category><![CDATA[Web Application Security]]></category>
		<category><![CDATA[brute forcing]]></category>
		<category><![CDATA[Gmail hacking]]></category>
		<category><![CDATA[hijack mail accounts]]></category>
		<category><![CDATA[keylogger]]></category>
		<category><![CDATA[phishing]]></category>
		<category><![CDATA[Shoulder surfing]]></category>
		<category><![CDATA[Sniffing]]></category>
		<category><![CDATA[Social Engineering]]></category>
		<category><![CDATA[web application]]></category>
		<category><![CDATA[web vulnerability]]></category>
		<category><![CDATA[yahoo hacking]]></category>

		<guid isPermaLink="false">http://maestro-sec.com/blogs/?p=136</guid>
		<description><![CDATA[Well Here I will not be providing some PoC to hack into these mailing accounts. I will be telling you the methodology that can be used to hack into any of these mailing accounts. The real effort will be yours.  
Lets start without any more disclaimer speech and sort.

Roughly below mentioned techniques are used [...]]]></description>
		<wfw:commentRss>http://maestro-sec.com/blogs/2008/10/hacking-yahoo-gmail-or-any-bank-accounts/feed/</wfw:commentRss>
		<slash:comments>10</slash:comments>
		</item>
		<item>
		<title>Clickjacking&#8230;</title>
		<link>http://maestro-sec.com/blogs/2008/10/clickjacking/</link>
		<comments>http://maestro-sec.com/blogs/2008/10/clickjacking/#comments</comments>
		<pubDate>Mon, 06 Oct 2008 15:44:33 +0000</pubDate>
		<dc:creator>w0lf</dc:creator>
				<category><![CDATA[Web Application Security]]></category>
		<category><![CDATA[browser vulnerability]]></category>
		<category><![CDATA[clickjacking]]></category>

		<guid isPermaLink="false">http://maestro-sec.com/blogs/?p=119</guid>
		<description><![CDATA[Two researchers, Robert Hansen and Jeremiah Grossman were planning to present their research on Clickjacking @ OWASP , New York City but had to postpone their presentation because they figured out that the exploitation of this vulnerability can be worst. Affected Vendors requested them to postpone their disclosure so that they can fix it. Most [...]]]></description>
		<wfw:commentRss>http://maestro-sec.com/blogs/2008/10/clickjacking/feed/</wfw:commentRss>
		<slash:comments>5</slash:comments>
		</item>
		<item>
		<title>Secapps &#124; GNUcitizen</title>
		<link>http://maestro-sec.com/blogs/2008/10/secapps-gnucitizen/</link>
		<comments>http://maestro-sec.com/blogs/2008/10/secapps-gnucitizen/#comments</comments>
		<pubDate>Fri, 03 Oct 2008 12:44:03 +0000</pubDate>
		<dc:creator>w0lf</dc:creator>
				<category><![CDATA[Web Application Security]]></category>
		<category><![CDATA[CSRF]]></category>
		<category><![CDATA[GHDB]]></category>
		<category><![CDATA[Secapps]]></category>

		<guid isPermaLink="false">http://maestro-sec.com/blogs/?p=111</guid>
		<description><![CDATA[Gnucitizen has started a new project called Secapps which will be hosting all online web tools. Seems to be nice idea. As of now, they have hosted 2 tools: GHBD and CSRF. Both seem to be nice tool especially the GHDB tool. It has coded a huge DB of Goodle dorks from Johnny.ihackstuff.com.
The project is [...]]]></description>
		<wfw:commentRss>http://maestro-sec.com/blogs/2008/10/secapps-gnucitizen/feed/</wfw:commentRss>
		<slash:comments>0</slash:comments>
		</item>
		<item>
		<title>Jhoomla exploit in wild&#8230;</title>
		<link>http://maestro-sec.com/blogs/2008/09/jhoomla-exploit-in-wild/</link>
		<comments>http://maestro-sec.com/blogs/2008/09/jhoomla-exploit-in-wild/#comments</comments>
		<pubDate>Wed, 24 Sep 2008 05:10:56 +0000</pubDate>
		<dc:creator>w0lf</dc:creator>
				<category><![CDATA[Web Application Security]]></category>
		<category><![CDATA[exploit]]></category>

		<guid isPermaLink="false">http://maestro-sec.com/blogs/?p=58</guid>
		<description><![CDATA[Last month, we at our client side were busy fighting phishing attacks. In 30 days we had around 25 phishing attacks. These phishing sites were all hosted on compromised sites with Jhoomla applcation hosted on it. So we had 25 compromised Jhoomla sites. However we were not able to figure out the exploit being used [...]]]></description>
		<wfw:commentRss>http://maestro-sec.com/blogs/2008/09/jhoomla-exploit-in-wild/feed/</wfw:commentRss>
		<slash:comments>0</slash:comments>
		</item>
	</channel>
</rss>
