Re: Info about attack trees

[Gage Bystrom <themadichib0d () gmail com>]

If you havnt guessed from the replies, there are no such thing as an attack
tree. Sure things maybe methodical, but I don't think of things as being
like a tree.

The classical method is something along the lines of preform recon,
enumerate, attack, presist/extract data. You react based upon the
information you gather, the more information you have, the clearer it is on
to what the next step ought to be.

No offense, but I don't think it'd be a good idea to make a master thesis
about the textbook methodology of a field you are not familiar with,
especially since you seem to be diving into it with multiple misconceptions
and assumptions.
On May 25, 2012 5:51 AM, "Federico De Meo" <adegod () gmail com> wrote:

> Hello everybody, I'm new to this maling-list and to security in general.
> I'm here to learn and I'm starting with a question :)
>
> I'm looking for some informations about attack trees usage in web
> application analysis.
>
> For my master thesis I decided to study the usage of this formalism in
> order to reppresent attacks to a web applications.
> I need a lot of use cases from which to start learning common attacks
> which can help building a proper tree.
>
> > From where can I start?
>
> I've already read the OWASP top 10 vulnerabilities an I'm familiar with
> XSS, SQLi, ecc. however I've no clue on how to combine them together in
> order to perform the steps needed to attack a system. I'm looking for some
> examples and maybe to some famous attacks from which I can understand which
> steps are performed and how commons vulnerabilities can being combined
> together. Any help is really appreciated.
>
>
> -------------------
> Federico.
> _______________________________________________
> Full-Disclosure - We believe in it.
> Charter: http://lists.grok.org.uk/full-disclosure-charter.html
> Hosted and sponsored by Secunia - http://secunia.com/
_______________________________________________
Full-Disclosure - We believe in it.
Charter: http://lists.grok.org.uk/full-disclosure-charter.html
Hosted and sponsored by Secunia - http://secunia.com/