Sensepost released their JSP/PHP/ASP pivot/covert channel named reDuh :

Basic concept :

• Glenn has the ability to upload / create a JSP page on the remote server
• Glenn wishes to make an RDP connection to the server term-serv.victim.com (visible to the web-server behind the firewall)
• The firewall permits HTTP traffic to the webserver but denies everything else

http://www.sensepost.com/research/reDuh/

Skape released whentrust as opensource :
http://www.codeplex.com/wehntrust

Thanks skape and good luck at MS

PS. Don't underestimate Whentrust, even with Windows2003 and Hardware NX it still increases protection (nx pages)

There are quite a few sql injection tools around, Pangolin is one of the most sophisticated blind SQL injetion tool I have come across, you can find it here :Pangolin Enjoy

For those into RCE, you surely came across Themida and know it can be a bitch.
Here is the PEB hooking loader from ARteam :

1. you will need to build fake_kernel32.dll and fake_advapi32.dllsolutions, and 2 dlls will be created in ..\..\fake\ folder.
2. in ..\..\fake\ folder you have adjust_fake.exe which you MUST use onnewly created dlls to get valid import table for kernel32/advapid32.dll
3. rebuild themida loader project, as fake_kernel32.dll and fake_advapi32.dllare stored in resources of themidaloader.exe
   

Another nice ARTeam release : http://arteam.accessroot.com/releases.html

Addendum :in other news ARTeam is hooking Services .exe To Hide Softice

Here is an old but still relevant and nice description on how to analyse a session ID (cookie, session value) from scusi , includes all required code.



@scusi