Jsunpack-Network Edition Release: Javascript Decoding And Intrusion Detection

No ratings

Presented at ShmooCon 2011 by

Blake Hartstein

As stated in Hartstein’s presentation overview, “Attackers using web exploits are always improving their attacks to make them more effective at exploiting the victim, avoiding detection, and generally making attacks difficult for researchers to understand.” Hartstein outline the improvements of the current Jsunpack-n release over last year’s 2009 introduction of jsunpack at ShmooCon. Among those improvements Hartstein cited the release of full source code, use of Jsunpack-n to actively monitor network traffic, use of customizable rules and built-in detection mechanisms for intrusion detection, PDF and SWF decoding modules, and URL tracking mechanisms.