New additions to Damn Vulnerable Linux 1.4

Just a sneak preview on current changes:

[Application Development] Add LogWatch (schneider)
[DVL Core] Add XEN (schneider)
[Reverse Code Engineering] Add Insight GDB Debugger (schneider)
[Tutorials] Add CPU Sim - An Interactive Java-based CPU Simulator (schneider)
[Reverse Code Engineering] Add JAD Java Decompiler (schneider)
[Tools] Add VLC Media Player (schneider)
[Documentation] Add TeTex (schneider)
[Documentation] Add JabRef (schneider)
[Application Development] Add Kile (schneider)
[Documentation] Add kDissert Mindmapper (schneider)
[Peneration Testing] Add JBroFuzz (schneider)
[Application Development] Add WebScarab (schneider)
[Peneration Testing] Add CAL9000 (schneider)
[Reverse Code Engineering] Add KDBG (schneider)
[Application Development] Add xchm (schneider)
[DVL Core] Add gtk libs (schneider)
[Tools] Add xvidcap (schneider)
[Tools] Add AcroRead (schneider)
[Tools] Add Scite (schneider)

Insight GDB Debugger - own branch?

I just had a look at the Insight GDB debugger frontend. Even it does not look like OllyDbg or Ida Pro under Windows, it seems to be a very promising tool to play with. The “frontend” is not really a frontend. It can be described as an own solution hooking to GDB and looks better than DDD. Written in tcl/tk it is easy to extend Insight. Unfortunatly it is currently not based on extensions or plugins. However I will play with it during the next days and try to extend it with a simple HelloWorld. One of my goals is to extend Insight to visualize the code and to add some additional analysis features.
I never developed much in tcl/tk so I have to optimize my skills. Should be not that hard. Next weekend I know more.
It would be great to catch one developer out of the community who can help with this. I do some announement next weekend as well. So if you are interested in developing an own outstanding GDB visual debugger and you good - and I really mean good - in developing software, go and contact me!

Results of Video Section Analysis, Training ISOs and the new Release of Damn Vulnerable Linux

I just have done some analysis of the hits at the video section. This is really a surprise. The WEP video is top most - no surprise. But it is directly followed by Reverse Code Engineering on Windows and Assembly Language videos!
Ok. If this is what the community is interested in we will focus on it. At the moment we are developing some training ISOs at IITAC. One ISO will contain a complete course on Reverse Code Engineering on Windows including many videos (around 45) and all necessary tools (!). The ISO is NO lame tool collection but a full course and sized at the momemt with 850 MB.
For development of the assembly language videos we will use the new release of Damn Vulnerable Linux. This release includes some more tools like Insight as GDB frontend. As well some bug fixes have to be done. To produce videos I have included Wink and Xvidcap at DVL. In my case I will use Wink to build some short tutorials on how to start with assembly language using HLA High Level Assembly. All material will be collected as ISO again but will have for sure NOT 850 MB :) If somebody of you wants to contribute some video material contact me!

Reverse Code Engineering Portal and new training concept - finally!

We are currently working for the revamp of the Reverse Code Engineering (RCE) Portal which will be the partner website of the Damn Vulnerable Linux portal. The RCE portal will look like the DVL portal but with a different focus - 100% reverse code engineering in all variants. With this we will combine forces and will setup a new knowledge and training concept. Heavily based on video lessons combined with training courses both portals will offer a wide range of learning options.
Training and courses will be quite different from what you might expect. Using practical training experiences we will use the “Learning-by-Teaching” methodology. This means we will enable courses for small groups where each group member has to participiate(!) in the course. Goal is to fight modern mentality: “I just want to take, but I never give”. Using this method we should have a growing number of training material by time.
This means some more thinking on the schedule and contents, but IMO this should be the best path to community knowledge.
BTW: producing a short training video is very simple and not combined with much work! Just record your screen while doing some security analysis and add some textual annotations - or add some audio. Two advantages: (1) with this you cam be sure that you have really understood a topic and (2) you take part in building a l33t knowledge base!
I will check out some free recording software today and build a “trainer” package for those not able to use commercial tools like Camtasia or Captivate (I prefer Camtasia). As well I will do a first training example this weekend.

Can not get Snort running

Actually I have a problem with Snort. The problem is to initialize and to start it caused by some concurrency between the standard mysql installation and those settings which Snort wants to have. If anybody can help with this I will fix this for the next release. In my case I have no luck with Snort… Thanks! .

More Videos added at Damn Vulnerable Linux Portal

OK. Some more videos have been added (about 30) at the Damn Vulnerable Linux Portal. With this it seems that I have fished the YouTube videos empty… If you have interesting videos, contact me! With this it seems that we are still in need for assembly language videos, they are VERY frequented!

DVL included Mplayer Buffer Overflow Vulnerability (CVE-2007-2948 and SAID 24302)

A stack overflow was found and reported by Stefan Cornelius of Secunia Research in the code used to handle cddb queries. Two other similar issues were found by Reimar Döffinger while fixing the issue.

Adding vulnerabilities can be so easy… just sit and wait :)

EXP/HTML.VML.Gen - FALSE POSITIVE !!!

A component of the portal website makes some “virus” trouble. At the moment I have no clue why this is recognised by the AVs but I do not want to switch off the video section. Heh… Damn Vulnerable Website :D

This website is NOT INFECTED !!!. The initialization of the VML support …”document.namespaces.add(”v”, “urn:schemas-microsoft-com:vml”); ” … seems to release the virus warning at some virus scanners in a randomized way! We use this for the Podcast component. The root cause are is the heuristics which the scanners use!

Bug fixing for the next release of Damn Vulnerable Linux

Seems that the next release of Damn Vulnerable Linux will focus on two topics: (1) bug fixing and (2) adding more training material. Unfortunatly community is lazy by contributing tutorials.

At the moment I have encountered some minor bugs (e.g. menu items open a console but console closes immediatly) and some other bugs (SNORT is not running and makes trouble with the standard MySQL installation / .lock files).

More about the bugs during the next time, I will add the defects at the bug tracker.