Learning is an ongoing activity ... practicing makes it fun
As mentioned earlier, the goal of MCP is to streamline AI integration by using one protocol to reach any tool **Protocol level abuse** - MCP Naming confusion (name spoofing) Threat actor registers a MCP server with a name almost identical to the legitimate one. When the AI assistant performs a name-based resolution, rather than resolving the legit name, it resolves the malicious name, possibly…
MCP was designed for convenience not security. Since its introduction in November 2024, researchers have put a lot of effort into understanding this protocol and its vulnerabilities. These vulnerabilities come in different flavours. Some of these are: OAuth vulnerabilities, the ability to execute arbitrary commands via command injection, unrestricted network access, file system exposure, tool…
Model Context Protocol (MCP) is an open-source standard used to connect AI applications to external systems. It is a stateful protocol. source: What is the Model Context Protocol (MCP)? - Model Context Protocol One can use MCP to connect language models to data sources - files, databases, etc. Alternatively, if you wish to connect to external tools such as a calculator, search engines, etc., or…
In the first post, we learned about temperature, top_k and top_p. We then built a Decoder-Only Transformer using pure NumPy in the second post. The third post we took advantage of PyTorch. In this final post, we put the raw code needed to run a full decoder only transformer, to generate baby names. Hope you enjoyed this series. As always, if you think there is something I should have done…
In this third in this series post, we build on what we did in the previous post to now build GPT from scratch. We will leverage Andrej Karpathy Makemore series . Where as Andrej used Tiny Shakespeare, we will use the baby names dataset that he used in one of his earlier trainings Import the libraries import torch import torch.nn as nn import torch.nn.functional as F import matplotlib.pyplot as plt…
In this post, we build a ** Decoder-Only Transformer ** from scratch, using ** only numpy **. I wanted to put this together to see if I can find an easier way to build this very popular architecture, while at the same time, seeing if it helps someone else. As you go through, if you find I missed anything or have some suggestions for improvement, please do not hesitate to drop me a line. As we go…
This post is part of a 4 part series on learning and building a decoder-only transformer from scratch. This is the first post that focuses on learning about **temperature**, **top_p** and **top_k** as they are used in language models. Without further ado, let's move ahead. # import the libraries. import numpy as np import matplotlib.pyplot as plt from scipy.special import softmax # Let get our…
BIG shout out and thanks to Tushar Arora for putting this together for our SOC team. It is always exciting to see the junior analyst expand their minds, while supporting other's growth. I am very thankful for his willingness to put together this scenario and submit the formal write-up/solution as a blog post. Keep up the good work Tushar. You have my vote for being promoted to the next level😆…
Download a copy here: Download File: Little Note[Book] on Adversarial AI - Nik Alleyne.pdf SHA256Sum: f7282afbdf15bbf2ed8fea70e1b0a27630a9c359a3a17f1b4cf274f599cd6ec6 Over the past few months, I have been working on expanding my knowledge on Adversarial AI. Rather than putting together a bunch of blog posts, I decided to consolidate everything into one book. Along with this book, there are 63…
First up, this post is significantly influenced by Miloš ynwarcs script for the above vulnerability. My objective here is to simplify the understanding of what the script is doing. If you intend to follow along, see: https://github.com/ynwarcs/CVE-2024-38063/tree/main for the original script. In the SANS SEC503, we use Scapy a lot for instructing on packet crafting as well as doing lots of demos…
Back in 2016, I wrote an article on my blog at www.securitynik.com titled " On recruiting and retaining talented Cyber Security professionals ". ( https://www.securitynik.com/search?q=center+for+strategic ). In that article, I referenced a Center For Strategic and International Studies report: ( https://www.csis.org/analysis/recruiting-and-retaining-cybersecurity-ninjas ) and agreed with the…
Similar to " Solving the CTF challenge - Network Forensics (packet and log analysis), USB Disk Forensics, Database Forensics, Stego " this challenge is meant to support our team's development. This challenge can be looked at from both the Blue and Red Team perspectives. Blue team because, this is how we hope to find threats either from a "live" system or more specifically, in this case, from the…
In a recent session with our team as part of our MDR Wednesdays program, we were discussing reconnaissance and the usage of port 0. Not surprisingly, quite a few persons were surprised to hear about port 0 and its usage in reconnaissance. This blog post is meant as an additional resource, to aid the understanding. One of the first steps, any threat actor will perform in any attack, is…
This post is part of the series of learning more about Nikto and web application scanning from the perspectives of both the hack and its detection . From the hacking perspective, Nikto is the tool used. From detection perspective, the tools and or processed used for the network forensics are log analysis, TShark, Zeek and Suricata. The Hack - Beginning Nikto - File Upload Vulnerability testing…
This post is part of the series of learning more about Nikto and web application scanning from the perspectives of both the hack and its detection . From the hacking perspective, Nikto is the tool used. From detection perspective, the tools and or processed used for the network forensics are log analysis, TShark, Zeek and Suricata. The Hack - SQL Injection with default evasion.…
This post is part of the series of learning more about Nikto and web application scanning from the perspectives of both the hack and its detection. From the hacking perspective, Nikto is the tool used. From detection perspective, the tools and or processed used for the network forensics are log analysis, TShark, Zeek and Suricata. The Hack - Beginning Nikto - Command Execution / Remote Shell…
This post is part of the series of learning more about Nikto and web application scanning from the perspectives of both the hack and its detection . From the hacking perspective, Nikto is the tool used. From detection perspective, the tools and or processed used for the network forensics are log analysis, TShark, Zeek and Suricata. The Hack - Remote File Retrieval with evasion type 4 -> Prepend…
This post is part of the series of learning more about Nikto and web application scanning from the perspectives of both the hack and its detection . From the hacking perspective, Nikto is the tool used. From detection perspective, the tools and or processed used for the network forensics are log analysis, TShark, Zeek and Suricata. Posts in this series: The hack - Testing for injection types of…
This post is part of the series of learning more about Nikto and web application scanning from the perspectives of both the hack and its detection . From the hacking perspective, Nikto is the tool used. From detection perspective, the tools and or processed used for the network forensics are log analysis, TShark, Zeek and Suricata. Other posts in this series: Hack - Leveraging the information…
This post is part of the series of learning more about Nikto and web application scanning from the perspectives of both the hack and its detection . From the hacking perspective, Nikto is the tool used. From detection perspective, the tools and or processed used for the network forensics are log analysis, TShark, Zeek and Suricata. The Hack -Misconfiguration / Default File" with evasion type 1 ->…
The idea of this series, is to use Nikto to learn about common vulnerabilities in web services. Once those vulnerabilities are identified, we will then attempt to exploit them where possible. As I work in a SOC, we have to be prepared to detect. As a result, we will analyze logs, packets (Tshark), IDS (Suricata) and Zeek data. This is all in the spirit of hack and detect . We will attempt to learn…
Before digging any deeper, I must state, this notebook/post heavily leverages the work done by Joe Petroske on " Hunting Beacon Activity with Fourier Transforms " along with his notebook on GitHub at https://github.com/target/Threat-Hunting/blob/master/Beacon%20Hunting/find_beacons_by_fourier.ipynb . More importantly, it ties together what we teach in the SANS SEC595: Applied Data Science and…
Silk is one of the tools used to analyze network flow data and something we teach in the SANS SEC503, Network Monitoring and Threat Detection . In this post, I am walking through some of the tools within the SiLK suite, to show their basic and somewhat common usage. There is no specific order to their usage and at times, you may even see the same tool being used multiple times but in different…
At work, we develop and run various Cyber Security challenges to help the Analyst (and the rest of the team) to rapidly build and demonstrate their skillset. This challenge was put together by one of our Managers Jean . I thought this was an interesting challenge that covered a number of areas. As a result, I thought I should take a stab at it. Here is my write up of my analysis. Summary On July…
In a previous post , I crafted a TCP 3-way handshake, to setup a connection with a remote device. In this post, we are going to sniff traffic between two devices and send a RST packet to tear down the connection. Think about what your IPS does as you go through this post. First up, the manual process. Let's say a server (in this case netcat ) is listening on port 9999 as shown here. 1 2…