Prioritize, Keep Pace, Prevail.

RESEARCH

Our research and development program sets industry standards in cyber security

At Dionach we are proud of our well-established research and development program. Our team of consultants are focused on continually uncovering new technical vulnerabilities in software and hardware, raising the bar in security assessment services and sharing our knowledge through whitepapers and various industry channels.

Through the responsible disclosure process we have published numerous vulnerabilities in leading software applications that our team has identified.

As part of our commitment to remaining vendor independent and offering the best technical solution to each client engagement, we also develop proprietary security tools for testing methods including vulnerability scanning, spear phishing and security auditing. In practice, our consultants have a wide range of commercial, open-source and custom tools at their disposal to deliver industry-leading outcomes for our client base.

Some of our custom tools are published as open source on Dionach’s GitHub page: https://github.com/Dionach.

TECHNICAL BLOG

Vulnerability: Domino Sametime Server Reflected Cross-Site Scripting

Domino Sametime is prone to a cross-site scripting vulnerability because it fails to sufficiently sanitize user-supplied data. CVE: CVE-2011-1038Published: Feb 16 2011 09:33AMCVS: 4.3Vulnerable: Domino Sametime 8.0.1 An attacker may leverage this issue to execute arbitrary script code in the browser of an unsuspecting user in the context of the affected site. This

Read More »

Vulnerabilities in Web Content Management Systems

There are vulnerabilities in Web Content Management Systems (WCMS) which are often overlooked, such as stored and reflected cross-site scripting attacks. During my time as a penetration tester I have come across a series of Web Content Management Systems (WCMS) including both Free Open Source Software (FOSS) and Commercial Off

Read More »

Penetration Testing Is Not Vulnerability Scanning

Penetration testing is not vulnerability scanning and should not be confused. Vulnerability scanning is one of the first parts of the penetration test process. I recently received the go-ahead for an external penetration test which referred to the test as “a scan”. This is not the first time I have

Read More »

The Security Value of the Robots.txt file

There is a security value of the Robots.txt file but there are flaws such as ‘disallow’ entries revealing hidden folders, password lists and database backups. This is my view on the use of robots.txt as a security control and the problems of not having one. From my penetration testing experience there has

Read More »

Update to ISO 27001 Planned for 2013

There is an update to ISO 27001 planned for 2013 whereby the management system standards will be harmonised, the dropping of Plan Do Check Act model etc. I went to the UK User Group Consultation at BSI on 25th January. This provided the attendees to get an overview of the

Read More »

Web Services Blind SQL Injection

An informative guide for using blind SQL injection on web services during penetration tests, using Python. There is plenty of documentation for using blind SQL injection in penetration tests. This code demonstrates exploiting blind SQL injection in a web service using Python. We often come across blind SQL injection in penetration tests, and

Read More »

Common ISO 27001 Gaps

Based on a review of 20 gap audit reports for a variety of organizations, this article should help your organization if you are considering ISO 27001, or wish to ensure you comply with best practice. Common-ISO-27001-Gaps.pdf (1.16 MB)

Read More »