Network Security Assessment, 3rd Edition

Appendix B. Sources of Vulnerability Information

You can keep abreast of emerging threats and vulnerabilities via Twitter, bug trackers, and mailing lists to maintain a safe environment. In this appendix, I’ve assembled some short lists of sources that consultants and hackers use on a daily basis.

Twitter Accounts

Through observing Twitter, you can track significant emerging threats and security trends. The following handles provide particularly useful insight across many domains:

@hdmoore	@thegrugq	@ivanristic	@halvarflake	@thezdi	@daniel_bilar	@shodanhq
@mdseclabs	@jduck	@exploitdb	@mattblaze	@taviso	@cyberwar	@haroonmeer
@dinodaizovi	@trailofbits	@hashbreaker	@jonoberheide	@subTee	@4Dgifts	@dlitchfield
@mikko	@mdowd	@carnal0wnage	@cBekrar	@jgrusko	@daveaitel	@sensepost

Bug Trackers

The Google Project Zero team and ZDI operate publicly accessible bug trackers that detail upcoming disclosures and unpatched vulnerabilities, as follows:

• Google Project Zero

• Zero Day Initiative

Open projects including OpenSSL and the Linux kernel also run public bug trackers that reveal useful details of unpatched flaws. During testing, it is also worth reviewing release notes to understand known weaknesses in software packages.

Mailing Lists

The following mailing lists are used to discuss security vulnerabilities and issues:

• Full Disclosure

• BugTraq

• Pen-Test

• Web Application Security

• Nmap-Dev

Security Events and Conferences

The sites of popular security conventions ...