Recent content on EvilPacket
Because software supply chain security is a giant tire fire Socket recently introduced Socket Firewall (sfw), self described as “a free tool that blocks malicious packages at install time, giving developers proactive protection against rising supply chain attacks.” The tool works as “a lightweight tool that protects developer machines in real time, blocking malicious dependencies…
While cleaning up my MCP configuration I noticed that Cursor supports a deeplink to aid in the UX / installation of MCP servers.
Select a video to open the original recording. Title Video MTGOX Bitcoin Play video MiFi Pwn Play video Django Admin Data Leakage Play video Gowalla Take 51274 Play video Kayako Play video Nagios XI Play video Ustream Play video Basecamp Play video OpenRealty Play video Rackspace, Part 1 Play video Rackspace, Part 2 Play video Rdio Play video CKCSRF Play video
In December I discovered a supply chain vulnerability that impacted 6,530 public npm package versions, at least I thought I did. Turns out that earlier in October of 2020 Security Innovation published similar research dubbing the issue Repo Jacking . This initially took the wind out of my sails but after I thought about it rediscovery is pretty cool and I was able to expand upon it a bit by…
Last night I tossed up a quick CTF-esque challenge with a couple of flags defined.
I’m excited to finally write up and share my favorite vulnerability I’ve ever found. It’s a story where all the right pieces fell into place to make it exploitable. The names, ports, and other details have been changed to protect the vulnerable even though this took place probably 6 years ago and I believe the devices are now sunsetted.
Today I got my hands on an O.MG cable . It is extremely well manufactured and to most it will be extremely stealthy.
This last week Nick Starke got the chrome debugger metasploit module pushed over the line and merged into master. I figured I’d write up a quick intro to the module and how it might be used should you happen to stumble across a chrome debugger laying around the network.
I discovered an exposure on SAP’s BrilliantHire API - an exposed Node.js debugger instance that provided full remote code execution capabilities and access to sensitive AWS credentials, database encryption keys, and production source code. The finding highlights how a simple misconfiguration can lead to complete system compromise.
Summary I discovered that developers do leave remote JavaScript debuggers and headless browsers laying around on the internet leading to sensitive data exposure and an interesting remote position for an attacker.
Capture the Flag and contest wins from competitions I’ve participated in over the years with team Psychoholics. #PFY
Here are some vulnerabilities I’ve found over the years. It is in no way a complete archive, but it’s a pretty good list of CVEs
2021 Speakeasy JS - Attacking Open Source using Abandoned Resources 2020 OpenJS World - Fireside Chat on JavaScript Security Node.js Global Summit - JavaScript Supply Chain Security 2019 LocoMocoSec, JavaScript Supply Chain Security Container Security Summit - JavaScript Supply Chain Security Absolute AppSec - EP #65 Real Talk JavaScript - Secure JavaScript 2018 BrazilJS - Becoming a Security…
If you ever find Server Side Request Forgery (SSRF) in a node.js based application and the app is using the request module you can use a special url format to detect the existence of files / directories.
I’ve learned a long time ago that not all security research pans out with a stack of vulnerabilities but every time I venture down a rabbit hole I learn something along the way. This is one of those times.
Before you read this post please run git --version and if it’s not 2.14.1 or greater then please go upgrade it.
The Practical Developer DevDiscuss one day got me thinking about mentorship and how it’s impacted my life. It doesn’t fit in a tweet or a thread of tweets so you get the story about how a mentorship gave me my entire career in security. This is going to be a bit stream of mind so give me a break on grammar and spelling :)
Earlier this week Zach Grace published an article on one way that you could backdoor a Node.js Express application without touching disk. This jogged my memory of something I posted in our team’s chat this last week but never wrote about; how I would in memory backdoor an express application. It’s a bit different than how Zach approached it so I thought it would be good to expand upon his post…
Just before the New Years I published 140+ advisories on Node.js modules. I’ve been researching ways to compromise developers & node.js applications without compromising the npm registry or their CDN.
5 years ago at DEFCON 19 I gave a talked titled “Pillaging DVCS repos for fun and profit.” The technique & tool I outlined in that talk has been very fruitful through out the years and plenty of security consultants have told me that this had helped them have breakthroughs during penetration tests. If it’s useful to us it’s also useful to attackers.
Last year (2015) I had a thought, “who else is downloading and running / testing random modules on npm.” Postulating that there might be bots, build systems or other researchers mass downloading and running modules from npm. I figured it might be an interesting vector to attack systems and gain a foothold for some org and I was curious to know what that traffic looked like.
Developers have increasingly become a more valuable target to compromise in recent years. The DevOps movement means they have more access to production, not to mention the plethora of source code and keys that you are likely to find.
At the end of April I found a flaw in a module that Express and many other frameworks use. This flaw allows a remote attacker to block the event loop of a remote site causing a Denial of Service effectively blocking the site from being accessed. This type of attack is known as a Regular Expression Denial of Service attack and we’ve found it to be quite common in applications and modules we test.
Table of Contents Heading 2 Heading 3 Heading 4 Heading 5 Emphasis Button Link Paragraph Ordered List Unordered List Notice Tab Accordions Code and Syntax Highlighting Blockquote Tables Image Gallery Slider Youtube video Custom video Here is an example of headings. You can use this heading by the following markdown rules. For example: use # for heading 1 and use ###### for heading 6.
Responsibility of Contributors Lorem ipsum dolor sit amet, consectetur adipiscing elit. Purus, donec nunc eros, ullamcorper id feugiat quisque aliquam sagittis. Sem turpis sed viverra massa gravida pharetra. Non dui dolor potenti eu dignissim fusce. Ultrices amet, in curabitur a arcu a lectus morbi id. Iaculis erat sagittis in tortor cursus. Molestie urna eu tortor, erat scelerisque eget. Nunc…