Script Kiddie Noobsauce

[phernandez]

Script Kiddie Tactics (or the Lack Thereof) -McGrew Security Blog

From the "you're not kidding anyone" file:

The real bottom-of-the-barrel here is the attacker that tries to compromise a site with a tool meant for vulnerability assessments. These are tools that are not built for any sort of stealth or finesse, because they are meant to be run in the course of a vulnerability assessment by a pentester (using the term loosely here) or systems administrators that want the scan over with quickly. In this case, it doesn’t matter if it leaves a huge signature in the logs or if the IDS screams bloody murder, because the person responsible for tending to those alerts is the person who ran the tool, or is at least aware of the test. This is not as desirable for an attacker who is trying to avoid getting caught or alerting admin/security staff of a breach.

Robert Wesley McGrew of U3 drive hacking fame adds to the discussion with some telling log dumps. Enjoy!

[AngelicKnight]

Check out his blog, it's made of all sorts of win, particularly the "Epic Failure" entry.

[moxquito]

Check out his blog, it's made of all sorts of win, particularly the "Epic Failure" entry.

This is one of the funniest websites I've come across in a long time. Couldn't stop laughing

[AngelicKnight]

Yeah, I'm addicted. I've now worked my way back into the December archives.

[phernandez]

LOL - epic find! Had to back out of that site or my productivity would have plummeted to zero today

[AngelicKnight]

Golden.