mTLS in Chromium Headless Mode on Ubuntu
I recently needed to access an application which required mTLS using an automated browser to facilitate security testing. The last time I attempted this (several
GrimBlog
Just another hacking blog...
Latest posts
“NginxDay2022”: NGINX LDAP reference implementation Zero Day Vulnerability
A recent zero-day vulnerability has been publicly shared revealing a critical issue with the nginx-ldap-auth software package allowing attackers to potentially bypass authentication and disclose key information on vulnerable servers.
SQLAlchemy Postgres On Conflict Do Update “can’t adapt type ‘method'”
Some time ago I encountered an error in my python code interacting with a Postgresql database: The relevant code was inserting Common Platform Enumeration data
Exploiting xdLocalStorage (localStorage and postMessage)
Some time ago I came across a site that was using xdLocalStorage after I had been looking into the security of HTML5 postMessage. I found that the library had several common security flaws around lack or origin validation and then noticed that there was already an open issue in the project for this problem, added it to my list of things to blog about and promptly forgot about it. This week I have…
Parsing .DS_Store Files
Python script to parse directory and file names from a .DS_Store file.
MSSQL : You get admin! You get admin! EVERYONE GETS ADMIN!
TLDR: Domain Users permitted to authenticate to Microsoft SQL databases can use the limited privileges they are granted to run a stored procedure. The stored
It’s just a printer… What’s the worst that could happen?
As you would expect, office printers are often identified when conducting a penetration test of an office network. These devices often seem to be overlooked
Office365 ActiveSync Username Enumeration
TLDR: There is a simple username enumeration issue in Office365 s ActiveSync, Microsoft do not consider this a vulnerability so I don t expect they will fix
Loading Dirty JSON With Python
Recently I needed to parse some data embedded in HTML. At first glance it appeared to be JSON, so after pulling the text out of
Cracking LM Hashes with Ophcrack – No GUI
Believe it or not, despite the fact it is 2016 I am still finding LanManager (LM) hashes on internal networks during penetration tests. Although in my