A brief description of how to crack Flask session cookies and an introduction to the Cracked Flask Lab.
A brief description of how to crack Flask session cookies and an introduction to the Cracked Flask Lab.
DigiNinja
Security and general IT tools and tips
Latest posts
The DNS server that WSL2 uses returns records in a different way to a normal DNS server and because of this I ended up trying to log into the wrong server. This is my quick analysis of what is different, and what it caused to happen.
The DNS server that WSL2 uses returns records in a different way to a normal DNS server and because of this I ended up trying to log into the wrong server. This is my quick analysis of what is different, and what it caused to happen.
Talking about a way I found to split XSS payloads over multiple inputs to bypass input length limitations and input filtering.
Talking about a way I found to split XSS payloads over multiple inputs to bypass input length limitations and input filtering.
Overriding the JavaScript alert function to find a hidden XSS.
A story of how I tracked down a Cross-Site Scripting issue by overriding the built in alert function to trigger a breakpoint.
I've added a new lab for looking at different ways to use HTML5 postMessage and their associated vulnerabilities.
I've added a new lab for looking at different ways to use HTML5 postMessage and their associated vulnerabilities - HTML postMessage Lab .
Another update to the Authlab, this time covering how to use John the Ripper and Hashcat to crack the keys used to sign JWTs. For more information, and a walk through.
Another update to the Authlab, this time covering how to use John the Ripper and Hashcat to crack the keys used to sign JWTs. For more information, and a walk through, see JWT Cracking Authentication Lab .
I've just added a new challenge to the lab looking at exploiting the none algorithm. For more information, and a walk through.
I've just added a new challenge to the lab looking at exploiting the none algorithm. For more information, and a walk through, see JWT None Authentication Lab .
A story about having to push through elitism to get to the real community.
My story relating being a newcomer to a triathlon forum, asking for advice, and the initial elitist responses I got, and what I've heard some newcomers to the hacker community saying about our community. The TLDR; is that there are macho jerks everywhere, but if you persevere, the majority of people are nice and are willing to help.
An offer to take some friends running during SteelCon 2019.
An offer to take some friends running during SteelCon 2019.
A walkthrough of a process which allows off the shelf hardware to automatically acquire a valid TLS certificate on startup.
A walkthrough of a process which allows off the shelf hardware to automatically acquire a valid TLS certificate on startup.
A proof of concept demonstration to go with the blog post.
A proof of concept demonstration to go with the blog post.
I was recently contacted byto help him with an XSS issue he was having problems with. Ryan knows his stuff, and if he was having problems with something, I knew it had to be a fun challenge. This blog post covers debugging quirks in browser behaviour and some information on how JavaScript URIs work.
I was recently contacted byto help him with an XSS issue he was having problems with. Ryan knows his stuff, and if he was having problems with something, I knew it had to be a fun challenge. This blog post covers debugging quirks in browser behaviour and some information on how JavaScript URIs work.
A set of walkthroughs for the challenges set in my.
A set of walkthroughs for the challenges set in my.
I want my blog to reach as wide an audience as possible and to help with that, I'm asking for my readers to make suggestions for changes which will help make the site more accessible.
I want my blog to reach as wide an audience as possible and to help with that, I'm asking for my readers to make suggestions for changes which will help make the site more accessible.
Using HTTP pipelining to hide requests.
In this post I'm going to discuss using HTTP pipelining to hide malicious HTTP requests. This is not domain fronting but uses similar techniques to get the same result, an observer who is not able to perform TLS interception is only able to see the "good" request which conceals the "bad" request.
A worked example of setting up domain fronting with Cloudflare using ESNI.
Whether you think it is true 'domain fronting' or just something that is similar, this post walks through how Cloudflare use SNI to protect against attackers modifying the HTTP Host header and then how ESNI can be used instead to help ensure any 'bad' traffic goes unnoticed by observers.
A 101 on domain fronting along with some examples.
Domain fronting has been around for years and I've always understood the concept but never actually looked at exactly how it works. That was until recently when I did some work with Chris Truncer who had us set it up as part of a red team test. That was the point I had to get down and understand the actual inner workings. Luckily Chris is a good teacher and the concept is fairly simple when it is…
A worked example of setting up domain fronting with Cloudfront.
This post accompanies the post A 101 on Domain Fronting and in it we are going to setup both a site to use for domain fronting and then a fronted site.
Some research on how to hide commands from the bash history.
Have you ever logged in to a box, started running commands, and then remembered the bash history will be logging everything you run. I've done it occasionally so thought I should do some research on what the options are. This post covers what I came up with, please get in touch if you have any other ideas.
Protecting against XSS in SVG
A client had the requirement to allow users to upload SVG files to their web app, these files then had to be displayed. As SVG files can contain JavaScript and can be used for Cross-Site Scripting attacks, I had to do some investigating to find ways to allow them to do what they wanted safely.
A walkthrough of my vuLnDAP project
This is a full walk through detailing how I would go through mychallenge. There are probably plenty of other ways this can be done so don't take this as the only or best. If you do have a better way, please let me know.
A logic gate challenge set by Pippa for the 2018 SteelCon kids track.
In 2017, Pippa was learning about cryptography and set a couple of crypto challenges for the SteelCon kids track, this year we are working on logic gates so she has set a challenge based on that.
Invalid HTTP requests and bypassing rewrite rules in lighttpd
Using an invalid HTTP request to bypass rewrite rules in lighttpd and the story of how I found the problem.
SNMP Config File Injection to Shell
A walk through from getting injection into an SNMP config file to getting a shell.
dotnetsheff Headers and Cookies Slides
A copy of the slides from my dotnetsheff talk on HTTP security headers and cookies.
Burp Macros and Session Handling.
A worked example of using Burp Suite macros and session handling.
Programming with Google.
The slides and video from my talk at Wild West Hackinfest on programming by copying and pasting from Google.
Shellshock and the Telnet USER Variable
A quick write up on how to exploit Shellshock on telnet via the USER variable.
Stealing CSRF tokens with XSS
Techniques using both raw JavaScript and jQuery to use XSS to grab a CSRF token and then submit the form it protects.
A custom wordlist generator with a twist.
A custom wordlist generator that creates permutations of all the input words as well as just manipulating them individually.
A banking mutual authentication scheme that does not work.
A write up on how a common mutual authentication scheme used by a number of banks can be easily proxied and turned against the bank.
NoSQLi Lab
With the rise in popularity of NoSQL I figured it was time to build a lab so I could have a play with the different techniques used to attack them. This was the result...
New tool, Sitediff
Imagine the scenario, you are testing a site running an open source package but not sure what version and need to find out. The site does not include any helpful comments in the HTML and there is no README file. The package isn't a popular one so none of the regular fingerprinting apps recognise it, what can you do? Call in Sitediff, it takes a local directory of files and then requests each of…
Accidentally Sharing CrashPlan Data
A story of how Christmas generosity in sharing his backup plan resulted in a friend's files being accessible by all his family.
The plagiarism of Christian Bruhin
There is lots of plagiarism goes on on the internet, unfortunately for Christian, he decided that he was happy to do it and accepted the risks it created.
Windows RDP client, show login page
A short howto on getting the Windows RDP client to show the server login page rather than ask for credentials itself
The results of a small experiment to see what my heart rate was like during my SANS instructor murder board.
The results of a small experiment to see what my heart rate was like during my SANS instructor murder board.
I see a lot of requests for technical help with tools and projects, some good, some bad. This post covers what I like to see when someone asks a question.
I see a lot of requests for technical help with tools and projects, some good, some bad. This post covers what I like to see when someone asks a question.
Here is a little trick I just learned about to help prevent things like API keys from ending up in your Git repo. I've mentioned it to a few Git loving developers who all claimed that it is obvious and that loads of people are already using it, but, as we regularly see keys in GitHub, I'd guess that its a case of what people know they should be doing verses what they are actually doing. The trick uses Git hooks to catch content pre-commit and block anything that it thinks is suspicious.
Here is a little trick I just learned about to help prevent things like API keys from ending up in your Git repo. I've mentioned it to a few Git loving developers who all claimed that it is obvious and that loads of people are already using it, but, as we regularly see keys in GitHub, I'd guess that its a case of what people know they should be doing verses what they are actually doing. The trick…
I've spent the day testing an app which disables the right click context menu, this makes testing tricky so I found a one liner which I could drop into the browser console to re-enable it for me.
I've spent the day testing an app which disables the right click context menu, this makes testing tricky so I found a one liner which I could drop into the browser console to re-enable it for me.
Asking the question, when it is acceptable to miss a vulnerability on a test.
Asking the question, when it is acceptable to miss a vulnerability on a test.
Trying to understand why the EE web portal doesn't have a password change feature.
Trying to understand why the EE web portal doesn't have a password change feature.
A short guide to exploiting POST based reflected XSS using CSRF and iframes.
A short guide to exploiting POST based reflected XSS using CSRF and iframes.
A write up of my recent experiences of getting clients involved during testing.
A write up of my recent experiences of getting clients involved during testing.
A short howto on removing the obfuscation added to non-default passwords by Nessus.
A short howto on removing the obfuscation added to non-default passwords by Nessus.
Pipal analysis of a password dump from the Neofriends dating site.
Pipal analysis of of a password dump from the Neofriends dating site.
Pipal analysis of 13,000 passwords from the Lizard Squad dump.
Pipal analysis of 13,000 passwords from the Lizard Squad dump.
Pipal analysis of 1800 passwords dumped from Minecraft
Pipal analysis of 1800 passwords dumped from Minecraft
Pipal analysis of a password dump from a dating site.
Pipal analysis of a password dump from a dating site.
My opinion on the Sony hack.
Sony were hacked, it was bad. That's all.