Security research papers, conference presentations, and published articles by Debasis Mohanty.
This talk covered some crucial aspects of software security engineering and strategy that most organisations have overlooked or ignored. Primarily the presentation provides some insights on why we still continue to see two decades old bugs and recommendations to consider going ahead. This is a slightly extended version of the OWASP 20th Anniversary talk.
Presented at OWASP 20th Anniversary virtual event, this talk covered some crucial aspects of software security engineering and strategy that most organisations have overlooked or ignored. Primarily the presentation provides some insights on why we still continue to see two decades old bugs and recommendations to consider going ahead.
Presentation on Windows Kernel Exploitation providing insights into common Windows kernel exploitation techniques and the current state of kernel mitigation. Presented at Insomnia Security's internal security conference known as Roachcon (2017).
Around mid of 2005, I was intrigued to write a proof-of-concept keylogger to capture text input events fired using Virtual Keyboards (VK). The PoC keylogger was publicly released on 5th Aug 2005 to demonstrate the hack for a particular banking site. This paper underlines the fact that any site which uses similar VK or OSK can be defeated. Originally published in Hakin9 magazine.
Between 2003 and 2005, Security Information Management (SIM/SIEM) products were new for the industry and in the state-of-the-art stage. This whitepaper was originally published on Wipro Technology's website. The official link is currently broken, therefore making it available here.
Following are very old articles, archived and removed from this website. If you need a copy, feel free to email, or search the title, as copies may exist archived elsewhere. They were written to raise early-stage awareness of techniques and threats that were new or little-documented at the time; the ground they covered is common knowledge today, which is why they've been retired rather than kept live.
An improved follow-up to Demystifying Penetration Testing, written when structured methodology was still uncommon knowledge outside a few consultancies; this expanded that bare-bones approach into a fuller, more complete security testing methodology.
Fear-driven malware hoaxes spread easily by email at the time; this untangled one such fake warning circulating as a genuine FBI alert.
Antivirus evasion was still a niche research area outside vendor labs; this catalogued techniques and matching countermeasures before evasion became a standard red-team topic.
One of the first of its kind: at the time, neither a structured penetration testing approach nor a report structure was documented anywhere; this paper outlined both from scratch.
One of the first of its kind: Google's search operators were barely documented at the time, and this became a go-to reference for finding exploits and vulnerable targets in the wild, including people searching for exposed or pirated software.