BeyondTrust

Security in Context: The BeyondTrust Blog

Welcome to Security in Context

Bringing you news and commentary on solutions and strategies for protecting critical IT infrastructure in the context of your business.

Happy Secure New Year from eEye and Metasploit

Posted December 28, 2011    The eEye Research Team

Since we announced our initial Retina Community integration with Metasploit, we’ve received tremendous positive feedback, both on the integration itself, as well as for delivering a uniquely seamless penetration testing toolset as a community offering. As we look toward 2012, we want to continue on that path and help deliver a Secure New Year, courtesy of eEye and Metasploit.

For many of our customers and community users, automating their vulnerability management processes with Retina and Retina CS is just the first step. Taking a ‘roll up the sleeves’ approach, many choose to test the exploitability of various vulnerabilities as part of their validation processes. In short, this large base of users was the drive for our initial integration with penetration testing tools.

In 2005 eEye, along with our friends at Core Security, delivered one of the industry’s first (and still widely used) integrations between vulnerability management and exploitation frameworks – Retina and Core Impact, respectively.

As is often the case with commercial markets, open source and ‘freemium’ models often appear alongside. This was true for penetration testing as well. As the open source products in this area began to mature and gain adoption within our user community as well, again, we dedicated development resources to delivering integrations with these products as well.

Since our original integration with Metasploit, there have been significant changes to the free, open source version of the Metasploit project. Some are process-based (registration requirements and version distribution, for example) and some are engineering-based (underlying engine functionality of how third party organizations like eEye and security professionals can integrate with the engine).

One of the biggest changes was Metasploit’s move away from an XML-RPC based protocol for scripting the Metasploit engine. Our original integration was via the command line interface and also via XML-RPC which could be used for local and remote engine communication. The Metasploit team has since stopped supporting XML-RPC and instead has switched to a new MessagePack based communication format. An interesting choice, one that seemed to preclude open integrations with what was once a fairly popular open source project.

eEye is committed to our integration with Metasploit, as well as to ensuring there remains a community-based (aka “FREE”) offering for automated and integrated vulnerability management and penetration testing. In the spirit of this commitment, we’ve worked overtime to deliver a fully integrated offering, once again, with Metasploit and their new MessagePack-based interface.

Want Retina Community?  Go Get It!

Both our commercial and community offerings of Retina again have the same level of integration and capabilities with Metasploit as before. However, eEye R&D is not a “that’s good enough” type of organization. They went a step further and added some performance improvements that make the Retina integration with Metasploit lightning fast as well. (It’s worth noting that these integrations are also available with commercial offerings of both Retina and Metasploit as well.)

From the R&D team at eEye we want to wish the Metasploit team and users of our integrated platforms happy holidays and a secure new year for users everywhere, both commercial and community.

Tags:
, , ,

Leave a Reply

Additional articles

PBPS-screenshot-blog aug2014

Failing the Security Basics: Backoff Point-of-Sale Malware

Posted August 22, 2014    Marc Maiffret

At the beginning of this month, US-CERT issued a security alert relating to a string of breaches that had been targeting Point of Sale (POS) systems. The alert details that attackers were leveraging brute forcing tools to target common remote desktop applications such as Microsoft’s Remote Desktop, Apple Remote Desktop, Splashtop and LogMeIn among others….

Tags:
, , , , , ,

Troubleshooting Windows Privilege Management Rules with Policy Monitor

Posted August 21, 2014    Jason Silva

When defining and testing PowerBroker for Windows rules for production or pilots, customers sometimes tell us, “I don’t think this policy / program is working.” This is usually a case of the policy not properly triggering because of the way the rule was created. A unique feature of PowerBroker for Windows compared to other solutions is a client-side…

Tags:
, , ,
darren-mar-elia

BeyondTrust Webcast: Darren Mar-Elia’s 4 Active Directory Change Scenarios to Track

Posted August 20, 2014    Chris Burd

In our latest webcast, we joined Darren Mar-Elia, CTO at SDM Software, to discuss best practices for Active Directory (AD) change management. Here are some key takeaways from the presentation, followed by a link to a full-length video of the presentation. Mar-Elia kicks things off with a critical insight: that the best AD change management…

Tags:
, , , , , , ,