All Posts

Metasploit, Google Summer of Code, and You!

Spend the summer with Metasploit I'm proud to announce that the Metasploit Project has been accepted as a mentor organization in the Google Summer of Code! For those unfamiliar with the program, their about page sums it up nicely: > Google Summer of Code is a global program focused on introducing students to open source software development. Students work on a 3 month programming project with an open source organization during their break from univer

1 min Application Security

Apache Struts Vulnerability (CVE-2017-5638) Protection: Scanning with Nexpose

On March 9th, 2017 we highlighted the availability of a vulnerability check in Nexpose for CVE-2017-5638 – see the full blog post describing the Apache Struts vulnerability here . This check would be performed against the root URI of any HTTP/S endpoints discovered during a scan. On March 10th, 2017 we added an additional check that would work in conjunctio

4 min Komand

How to Onboard and Train Your Security Team

Hiring the right people is the first step when building a great security operations team. But you also have to train them on how your company approaches and implements security measures. The common reality is that many companies lack the time or expertise to design and execute an effective training program. Hiring the best security people still means they need to understand how your network and systems are confi

9 min Metasploit

Pen Testing Cars with Metasploit and Particle.io Photon Boards

TL;DR This post details how to use the MSFRelay library for Photon boards to write your own Metasploit compatible firmware. Specifically for an add-on called Carloop. If you have a Carloop and just want it to work with Metasploit without having to write any code (or read this) then I've also provided the full code as a library example in the Particle library and can be found here

4 min Vulnerability Disclosure

R7-2017-01: Multiple Vulnerabilities in Double Robotics Telepresence Robot

This post describes three vulnerabilities in the Double Robotics Telepresence Robot ecosystem related to improper authentication, session fixation, and weak Bluetooth pairing. We would like to thank Double Robotics for their prompt acknowledgement of the vulnerabilities, and in addressing the ones that they considered serious. Two of the three vulnerabilities were patched via updates to Double Robotics servers on Mon, Jan 16, 2017. Credit These issues were discovered by Rapid7 researcher Deral

4 min IT Ops

Log Analysis for System Troubleshooting

Systems of all kinds create log data constantly and voluminously. In searching out the most compelling reasons to dig into and analyze such data, we compiled a list of seven reasons that usually drive such activity. In this blog post we tackle the first of those 7, which include: 1. System troubleshooting 2. Security incident response 3. Security troubleshooting 4. Performance troubleshooting 5. Understanding user behavior or activities 6. Compliance with security policies 7. Complianc

3 min Metasploit

Metasploit Weekly Wrapup: March 10, 2017

The last couple of weeks in the infosec world have appeared busier, and buzzier, than most others. It seems almost futile to pry everyone away from the current drama--that being the bombshell revelation that intelligence agencies collect intelligence--long enough to have them read our dev blog. Regardless, we've been busy ourselves. And if you're the least bit like me, you could probably use a quick respite from the cacophony. Keeping up with all the noise is enough to make anyone feel lik

5 min CIS Controls

The CIS Critical Security Controls Explained - Control 5: Secure Configuration for Hardware and Software on Mobile Devices, Laptops, Workstations, and Servers

Stop No. 5 on our tour of the CIS Critical Security Controls (previously known as the SANS Top 20 Critical Security Controls) deals with Secure Configuration for Hardware and Software on Mobile Devices, Laptops, Workstations, and Servers. This is great timing with the announcement of the death of SHA1. (Pro tip: don't use SHA1

3 min Automation and Orchestration

Sybil Attacks, Detection and Prevention

Synopsis Sybil attacks are named after a fictional character with dissociative identity disorder. Sybil Attacks are attacks against the reputation of online social networks by proliferation of fake profiles using false identities. Fake profiles have become a persistent and growing menace in online social networks. As businesses and individuals embrace social networks the line between physical and online world is getting blurred. Hence it is critical to detect, prevent and contain fake accounts i

4 min Honeypots

Apache Struts Vulnerability (CVE-2017-5638) Exploit Traffic

UPDATE - March 10th, 2017: Rapid7 added a check that works in conjunction with Nexpose's web spider functionality. This check will be performed against any URIs discovered with the suffix “.action” (the default configuration for Apache Struts apps). To learn more about using this check, read this post . UPDATE - March 9th, 2017: Scan your network for this vulnerability

4 min Microsoft

Attacking Microsoft Office - OpenOffice with Metasploit Macro Exploits

It is fair to say that Microsoft Office and OpenOffice are some of the most popular applications in the world. We use them for writing papers, making slides for presentations, analyzing sales or financial data, and more. This software is so important to businesses that, even in developing countries, workers that are proficient in an Office suite can make a decent living based on this skill alone. Unfortunately, high popularity for software also means more high-value targets in the eyes of an

3 min Komand

Security Orchestration and Security Automation: What is the Difference?

What's the difference between security orchestration and security automation ? While you probably understand that they are different, you may not know exactly where the line is drawn between them or how they fit together. In this post, we'll explain what each one means and how security orchestration and automation can be used together

3 min CIS Controls

The CIS Critical Security Controls Explained - Control 1: Inventory and Control of Hardware Assets

The Rapid7 Security Advisory Service relies heavily on the CIS top 20 critical controls as a framework for security program analysis because they are universally applicable to information security and IT governance. Correct implementation of all 20 of the critical controls greatly reduces security risk, lowers operational costs, and significantly improves any organization's defensive posture. The 20 critical controls are divided into Basic, Foundational, and Organizational families, and each con

4 min Vulnerability Disclosure

The Cloudflare (Cloudbleed) Proxy Service Vulnerability Explained

TL;DR This week a vulnerability was disclosed, which could result in sensitive data being leaked from websites using Cloudflare's proxy services. The vulnerability - referred to as "Cloudbleed" - does not affect Rapid7's solutions/services. This is a serious security issue, but it's not a catastrophe. Out of an abundance of caution, we recommend you reset your passwords, starting with your most important accounts (especially admin accounts). A reasonable dose of skepticism and prudence will go

8 min IT Ops

Roots and Culture: Logging and the Telephone Bill

Telephone systems were the Internet before there was an Internet. Think about it. By 1920 millions of people were exchanging data on a worldwide network using a device that connected on demand. Sounds like the Internet to me. But unlike the current day Internet, the telephone system cost money to use. Alexander Graham Bell’s investors wanted it that way. That’s why they gave him the money. Thus, people who used the telephone system had to pay for it. So going as far back as 1877, every mont