













| Title | Description | Download |
| .NET White Paper | Overview of the security architecture of Microsoft’s .NET Framework. | Download Now |
| .NETMon™ White Paper | .NETMon monitors the .NET common language runtime enabling detailed analysis of how the .NET framework enforces security controls. | Download Now |
| 2007 Top 10 Malicious Code Trends | Details the trends that were observed in the evolution of malicious code over the course of 2007 | Download Now |
| 802.11 Attacks | Provides a step by step walkthrough of popular wireless attacks | Download Now |
| AJAX Security White Paper | Check out our Presentation on Ajax Security from the Rich Web Experience. | Download Now |
| ASP.NET Forms Authentication | This article describes limitations of the FormsAuthentication.SignOut method, and provides more information about how to ease cookie reply attacks when a forms authentication cookie may have been obtained by an malicious user. | Download Now |
| AJAX Storage White Paper | A look at AJAX applications using Flash "cookies" (shared objects) and Internet Explorer User-Data Persistence to store data out side of the standard browser cache. | Download Now |
| CookieDigger™ White Paper | CookieDigger helps identify weak cookie generation and insecure implementations of session management by web applications. | Download Now |
| Corporate Incident Response Plan White Paper | Whether your company needs to comply with new legislation, defend against financial loss, protect its corporate reputation - or a combination of the three - it is crucial that you have a comprehensive incident response plan. | Download Now |
| Data Loss Prevention Program | Safeguarding Intellectual Property | Download Now |
| Foundstone SSLDigger™ - The Need for Strong SSL Ciphers | SSLDigger is a tool to assess the strength of SSL servers by testing the ciphers supported. Some of these ciphers are known to be insecure. | Download Now |
| Foundstone Hacme Books User Guide | The Hacme Books application simulates a ‘real-world’ eCommerce bookstore and was built with known and common vulnerabilities to teach application developers, programmers, architects and security professionals how to create secure Java software. | Download Now |
| Foundstone SiteDigger™ 2.0 - Identifying Information Leakage Using Search Engines | Learn how to use search engines and Foundstone SiteDigger to identify accidental exposure of confidential information including financial records, passwords, and personal information via your Web site. | Download Now |
| Foundstone Hacme Bank™ User and Solution Guide | User and Solution Guide for Foundstone's Hacme Bank security application training tool. | Download Now |
| Got Citrix? Hack It! Presentation | Presentation deck used by Shanit Gupta at Shmoocon 2008 | Download Now |
| Hacking the Kiosk: Managing the Risk of Public Information Systems | Find out how to identify threats and uncover common vulnerabilities in kiosks | Download Now |
| How Virtualization Affects PCI DSS | Part 1: Mapping PCI Requirements and Virtualization | Download Now |
| How Virtualization Affects PCI DSS | Part 2: Review of the Top 5 Issues | Download Now |
| IIS Lockdown and URLScan | Foundstone Review of Microsoft's IIS Lockdown and URLScan tools. | Download Now |
| Insecure Trends in Web Technologies | A Review of Insecure Implementations of Rich Internet Applications | Download Now |
| ISA Server SP1 Audit White Paper | Provides an overview of a security assessment conducted by Foundstone of Microsoft’s ISA Server 2000 after the addition of the Service Pack 1 (SP1). | Download Now |
| Java Client Side Application Basics: Decompiling, Recompiling and Signing | Java Web Start is a mechanism for program delivery through a web server. These programs are initiated by the client’s web browser, deployed, and ultimately executed independently on the system. | Download Now |
| Key Components of a Risk-Based Security Plan | How to Create a Plan That Works | Download Now |
| Managing a Malware Outbreak | Sality - A Case Study | Download Now |
| Microsoft System Architecture 2.0 | Foundstone Security Review of Microsoft Systems Architecture 2.0 (MSA 2.0). | Download Now |
| Microsoft/Foundstone IP SEC | Using Microsoft Windows IPSec to Help Secure an Internal Corporate Network Server. | Download Now |
| Mobile Application Security Testing | Methodology, tools and techniques for testing mobile applications. | Download Now |
| Passive Host Characterization Presentation | Matthew Wollenweber Presentation at ShmooCon 2008 | Download Now |
| Remote Forensics System White Paper | The Remote Forensics System application facilitates data acquisition, storage, and analysis in a forensically sound and efficient manner. The application was created by graduate students at Carnegie Mellon University in collaboration with Foundstone. The software is also available for download. | Download Now |
| Securely Registering Applications | Learn how to securely register applications that are automatically initiated. Intro to Foundstone free tool - DIRE | Download Now |
| SecureUML | Describes the SecureUML Visio template which is a custom Unified Modeling Language (UML) dialect to help system architects build roles based access control systems (RBAC). | Download Now |
| Security Training – Why It Benefits Your Organization and How to Make Your Case to Management | This whitepaper explores the reasons why you should invest in Information Security training, and how to present a case to company management. | Download Now |
| Socket Hijacking | Discusses the socket hijacking vulnerability, the impact of the vulnerability and what it takes to successfully exploit the vulnerability | Download Now |
| Software Security: Going Beyond the Development Phase | Find out why securing software from the start is important | Download now |
| Validator.NET™ | Validator.NET enables developers to programmatically determine user input locations that could be potentially exploited by hackers and provides proactive steps to build data validation routines which are loaded into a protection module. | Download Now |
| Virtualization and Risk | Virtualization and Risk - Key Security Considerations for your Enterprise Architecture | Download Now |
| Wireless Intrusion Detection System | This paper presents an overview of the Whiff Intrusion Detection System, which was developed during the summer and fall of 2002 by a team of graduate students majoring in Information Security and Assurance at Carnegie Mellon University. | Download Now |
| Writing Effective Policies Part 1: Dissecting an Email Use Policy | The goal of this whitepaper is to outline the characteristics of an effective policy and explain clearly how to write an effective policy by showing both correct and incorrect examples. | Download Now |
Today we’re making a change to the way we categorize link data in Webmaster Tools. As you know, Webmaster Tools lists links pointing to your site in two separate categories: links coming from other sites, and links from within your site. Today’s update won’t change your total number of links, but will hopefully present your backlinks in a way that more closely aligns with your idea of which links are actually from your site vs. from other sites.
You can manage many different types of sites in Webmaster Tools: a plain domain name (example.com), a subdomain (www.example.com or cats.example.com), or a domain with a subfolder path (www.example.com/cats/ or www.example.com/users/catlover/). Previously, only links that started with your site’s exact URL would be categorized as internal links: so if you entered www.example.com/users/catlover/ as your site, links from www.example.com/users/catlover/profile.html would be categorized as internal, but links from www.example.com/users/ or www.example.com would be categorized as external links. This also meant that if you entered www.example.com as your site, links from example.com would be considered external because they don’t start with the same URL as your site (they don’t contain www).
Most people think of example.com and www.example.com as the same site these days, so we’re changing it such that now, if you add either example.com or www.example.com as a site, links from both the www and non-www versions of the domain will be categorized as internal links. We’ve also extended this idea to include other subdomains, since many people who own a domain also own its subdomains—so links from cats.example.com or pets.example.com will also be categorized as internal links for www.example.com.
If you own a site that’s on a subdomain (such as googlewebmastercentral.blogspot.com) or in a subfolder (www.google.com/support/webmasters/) and don’t own the root domain, you’ll still only see links from URLs starting with that subdomain or subfolder in your internal links, and all others will be categorized as external links. We’ve made a few backend changes so that these numbers should be even more accurate for you.
Note that, if you own a root domain like example.com or www.example.com, your number of external links may appear to go down with this change; this is because, as described above, some of the URLs we were previously classifying as external links will have moved into the internal links report. Your total number of links (internal + external) should not be affected by this change.