Personal web page of Foo-Manroot, with articles, write-ups, useful tools, personal projects and more information; mainly about cybersecurity.
Yesterday I finished the OSWP exam. I don’t know yet if I passed or not; but I got enough points and my report should be good. But, anyways, I’m not here for another “yay, I passed, here are my tips to be a l33t h4x0r”; the exam is easy as fuck, you don’t need my help with it. I honestly think you can pass it without even going through the course. 1 No, no… I’m a grumpy bastard, so I’m going to…
Some months ago I created a small workshop to introduce my work colleagues to concolic analysis and angr. Although we don’t need this kind of tools in our day-to-day jobs, it’s still an interesting technology that comes really handy for CTFs :D Intro to angr and concolic analysis.pdf
A year or two ago I created a small workshop to introduce my work colleagues to the basics of Mobile Application testing. Since then, the Mobile Application Security Testing Guide has seen a reorganisation, and both Android and iOS have introduced new security and privacy measures in their systems. Nevertheless, the basics of application testing are still the same. In my opinion, the information…
This post is a companion to the previous one . Here, I will paste my notes with close to no curation, so be advised of their (probably) confusing contents. The solutions were developed on a custom page with some JS to interact with the testnet deployed in the previous post. After opening the page (technically, a DApp, as the cryptobros would say), the following UI is shown: It’s advised to read…
A year or two ago I created a small workshop to introduce my work colleagues to the basics of Smart Contracts security. Besides the presentation, which I include right after this section, I created a small lab with a couple of Virtual Machines to play around my own local testnet. What follows are my raw notes. Keep in mind, I haven’t curated them in any way, so they might be confusing. I’m simply…
Table of Contents: Clickjacking PoC||GTFO Web testing is not a piece of cake Conclusion Many times I’ve joked with profession colleagues about having to report a bunch of highly critical findings, such as Missing security headers . We joke because we know that most of those “findings” are almost irrelevant when it comes to the actual security of the page we’re testing. Like everything in life, it…
This post is simply for my own reference, to copy+paste my scripts below. If you’re reading this and have no clue how these scripts work, do not hesitate to contact me . Netcat server Generate self-signed certificates Serve over HTTPS with Python 2 Serve over HTTPS with Python 3 Obtain files over HTTPS Sometimes I’m need to quickly transfer data between two clients in my local network, or between…
Last month, NorthSec conference took place in an online format; and, with it, a very nice CTF was held. Apparently, the intention was for the participant groups to be formed by around 20 people. Nevertheless my 3 workmates and I decided to give it a shot and it didn’t went so bad, after all (around the 40 th position :D). I don’t have the full list of challenges, nor the solution for all of those…
TL;DR: don't use Wayland for your OSCP exam Recently, I took my exam for the OSCP and I had some technical problems with the proctoring software they use. I’m tempted to tell you my experience on the OSCP and give you some tips; but there are a lot of good resources out there and I don’t have anything to say what’s not already been said. You just have to study the course materials and practice as…
In this post I will explain my solutions for the challenges on the Ciberseg ‘19 CTF. Specifically, these are the ones corresponding to the reverse engineering category. Ciberseg is an annual congress which takes place in the University of Alcalá de Henares. The truth is that previous years it has been always fun, and this year wasn’t less :) Also, the first places were disputed hard and there were…