Re: [Full-disclosure] Info about attack trees

["Thor (Hammer of God)" <thor@xxxxxxxxxxxxxxx>]

Here's the best info on attack trees:
http://3.bp.blogspot.com/-P_enGjuZU0I/TxFdFfD1A5I/AAAAAAAABKs/DTzpNDG4THc/s1600/ent_isengard_small.jpg
[Description: Description: Description: Description: Description: Description: 
Description: Description: Description: TimSig]

Timothy "Thor"  Mullen
www.hammerofgod.com
Thor's Microsoft Security 
Bible<http://www.amazon.com/Thors-Microsoft-Security-Bible-Collection/dp/1597495727>


From: full-disclosure-bounces@xxxxxxxxxxxxxxxxx 
[mailto:full-disclosure-bounces@xxxxxxxxxxxxxxxxx] On Behalf Of Urlan
Sent: Friday, May 25, 2012 9:45 AM
To: Federico De Meo
Cc: full-disclosure@xxxxxxxxxxxxxxxxx
Subject: Re: [Full-disclosure] Info about attack trees

Federico,

Check this out: http://cwe.mitre.org/top25/
2012/5/25 Federico De Meo <adegod@xxxxxxxxx<mailto:adegod@xxxxxxxxx>>
Hello everybody, I'm new to this maling-list and to security in general.
I'm here to learn and I'm starting with a question :)

I'm looking for some informations about attack trees usage in web application 
analysis.

For my master thesis I decided to study the usage of this formalism in order to 
reppresent attacks to a web applications.
I need a lot of use cases from which to start learning common attacks which can 
help building a proper tree.

>From where can I start?

I've already read the OWASP top 10 vulnerabilities an I'm familiar with XSS, 
SQLi, ecc. however I've no clue on how to combine them together in order to 
perform the steps needed to attack a system. I'm looking for some examples and 
maybe to some famous attacks from which I can understand which steps are 
performed and how commons vulnerabilities can being combined together. Any help 
is really appreciated.


-------------------
Federico.
_______________________________________________
Full-Disclosure - We believe in it.
Charter: http://lists.grok.org.uk/full-disclosure-charter.html
Hosted and sponsored by Secunia - http://secunia.com/



--
Cordialmente,
Urlan Salgado de Barros
CompTIA Security+ Certified
MSc. in Applied Informatics
Bachelor on Computer Science

_______________________________________________
Full-Disclosure - We believe in it.
Charter: http://lists.grok.org.uk/full-disclosure-charter.html
Hosted and sponsored by Secunia - http://secunia.com/