Gli amici di Progetto Winston Smith segnalano la giornata europea "Liberta', non paura - fermiamo l'escalation della sorveglianza" (Sabato 11 Ottobre 2008 a Roma), una manifestazione di dissenso nei riguardi della sorveglianza di massa. L'iniziativa e' pensata in germania ma replicabile in ogni singolo stato membro, secondo desiderio.
While writing with Kuza55 an article about local file inclusion advanced exploitation a very interesting code emerged on milw0rm that shows another technique that has advantages and disadvantages but is surely smart and not that well known (while documented on some papers and actually exploited in the past).
As the first of a set of three this paper explains in detail how to abuse some functionalities exposed by mod_negotiation, an Apache module enable by default on many (most?) vanilla setups. Reference platform is a fresh installed Debian Etch system. The "Accept:" HTTP request header allows to optimize the number of requests to discover (bruteforce) filenames and extensions in absence of directory listing. Details follow, a good reading for an hot summer!