Recent content on Jordan Wright
My daughter and I love listening to the Yoto Daily podcast on her Yoto player . It’s a daily podcast featuring a friendly host, and it’s content is the perfect laid back way to start or end the day. Having a daily, bite-sized podcast is such a fun part of our routine that I decided to make one myself. It’s called the “Curious World” podcast (she came up with the…
About a year ago, the Python Software Foundation opened a Request for Information (RFI) to discuss how we could detect malicious packages being uploaded to PyPI. Whether it’s taking over abandoned packages , typosquatting on popular libraries , or hijacking packages using credential stuffing , it’s clear this is a real issue affecting nearly every package manager.
One of the questions I see most often from Gophish users is “how do I get past my spam filter?” Generally, my answer to this is something along the lines of “just whitelist the IP address,” since it’s my opinion that phishing simulations should be a test of the people and processes , not the email infrastructure. But what if we do want to test the email…
It’s been a while! While I haven’t posted as much here, I have been writing quite a bit over on Duo’s blog about the really cool research I’ve gotten to do this past year with the incredible Duo Labs team. Any spare time I’ve had has been spent working on Gophish. This past year I’ve released a new hand-crafted, artisinal website , responded to nearly 400…
Back in March, Wikileaks released over 30,000 emails “sent to and from Hillary Clinton’s private email server while she was Secretary of State”. I decided to make a quick map showing how emails were sent through the server, mapping the senders and recipients. This post is a quick explanation of how I did it.
San Antonio is a great city. According to Yelp , there are over 1200 places to get a taco - how could it not be great? Unfortunately, any time you get a huge group of people together there will be crime, and SA is no exception. Our SAPD stay busy 24/7, constantly putting their lives on the line to keep the city safe, and I’m thankful for all the work they do. Being an amateur API aficionado,…
Being a Thought Leader is Hard @thought__leader - Thinking thoughts for you, so you don’t have to. The infosec industry is full of “thought leaders”. These are people who are on the forefront of the industry, keeping up with latest trends, technologies, and philosophies. Or they are heavy on the buzzwords and prolific on Linkedin/Twitter. That works, too . Unfortunately, both of…
Introduction When looking at how Tor works , we’ve looked at the various types of nodes that make up the Tor network. However, you’ll notice that we haven’t dealt too much with exit nodes . Exit nodes are the final link in a Tor “circuit”, or path from the client to the server. Since exit nodes send data to the final destination, they can see the data as if it had…
Introduction Every morning, the infosec field is greeted with an onslaught of freshly registered malicious domains. These domains are used to host phishing sites, maintain botnet command and control, harvest stolen information, and more. Having the complete list of registered domains day-by-day offers substantial visibility that can be used for intel and repsonse. Fortunately, such lists not only…
Introduction I’m excited to announce that the gophish “alpha” release is almost complete! I’m just cleaning up a few bugs, touching some things up, etc. In the meantime, I wanted to write a quick post to show off some really slick features that I was able to add earlier than planned. Creating pixel-perfect email templates and landing pages are crucial to delivering the best…
For this challenge, we were given an HDD image and asked to find the flag on it.
This challenge starts off with the following hint: I was sniffing some web traffic for a while, I think i finally got something interesting. Help me find flag through all these packets. This challenge started off with a pcap. Let’s take the cheap way out and do a basic Wireshark filter for frame contains flag :
Web 200 was a fun challenge that required us to chain together a few basic concepts to get the flag. When navigating to the URL given, we see that the challenge is based on a “Lawn Care Simulator 2015”.
This one was surprisingly easy if you knew where to look.
Introduction This post is long overdue. Back in May 2013, I released a Twitter bot called @dumpmon whose sole purpose was to track and report password dumps and other sensitive information shared on paste sites such as Pastebin. Since that time, dumpmon has proven - to my excitement - to be valuable to researchers, being featured in news articles , Defcon slides, and HIBP ! After two years,…
Introduction Welcome to the third post in my series on how Tor works! In the past two posts , we talked about how clients tunnel traffic through relays, as well as introduced the idea of unpublished relays called bridges. But how do clients know what relays are active? How is the Tor network actually organized and maintained? This post will answer this question by talking about a living document…
Introduction Welcome back to my series on how Tor works! In the last post , we took a look at how Tor operates from a very high level. In this post, we’ll dive a bit deeper, taking a look at a potential issue with relays in order to introduce a new concept: bridges .
Introduction Two months ago, one of my DigitalOcean instances started attacking another host with massive amounts of bogus traffic. I was notified by the abuse team at DO that my VPS was participating in a DDoS attack. I managed to track down that the attackers leveraged an RCE vulnerability in Elasticsearch to automatically download and run malware. After re-building the box from scratch (with…
Introduction I recently wrote about an Elasticsearch RCE vulnerability that is being heavily exploited in the wild. To see what kind of attacks are taking place, I decided to write a simple honeypot designed to mimic a vulnerable Elasticsearch (ES) instance. Say hello to elastichoney !
TL;DR If you have an elasticsearch instance that is publicly available, upgrade to 1.4.3 or later now . Elasticsearch (the “E” in ELK) is a full-text search engine that makes data aggregation and querying easy. It has an extensive JSON API that allows everything from searching to system management. This post will show how a new vulnerability, CVE-2015-1427, allows attackers to leverage…
Introduction Tor is an anonymity tool used by those who want to stay private and uncensored when browsing the Internet. Over time, it’s grown to be pretty darn good at this. This makes the security, stability, and speed of the underlying network critical to those depending on it. But how does Tor work under the hood? In this series of posts, we’ll take a deep dive into the structure…
Introduction It’s been a busy couple of months! I thought it would be worth providing a long-overdue update into the development status of gophish . Overall, the project is getting closer to beta status every day, and I’m hoping to see a 0.1 release at the end of March. Without further ado, let’s dive in and see where we’re at.
Introduction During the process of planning a vacation, I came across a nice hotel I wanted to stay at. When looking at some possible dates, I noticed the nightly rate would fluctuate dramatically . This made me question if I was going to wind up paying way more just because I wanted to stay at the hotel on a certain day. Then I considered the alternative - maybe I could scrape the prices every…
Introduction Back in December, SANS released another installment of their annual holiday challenge. I enjoyed taking on the 2012 challenge , so I was excited to see what SANS had in store this year. This year’s challenge didn’t disappoint with a nice mix of basic network recon, web application hacking, and some forensics. This post will detail how I found each required…
So you accidentally committed a password or API key to Github. Ouch. “No problem!”, you think, “I’ll just follow Github’s helpful information on how to delete sensitive information and I’ll be fine!” Just today, I saw a great article detailing one developer’s experience with committing sensitive information to Github. Unfortunately, this article…
Busy year. It seems as though each year brings more and more events that throw our industry into the forefront of attention - and they’re never good. At the same time, it’s key to remember that these events allow us to learn and evolve as an industry. Let’s take a look at some of the key things we as an infosec industry can learn from 2014:
Introduction The Tor Project has announced that they have received threats about possible upcoming attempts to disable the Tor network through the seizure of Directory Authority (DA) servers. While we don’t know the legitimacy behind these threats, it’s worth looking at the role DA’s play in the Tor network, showing what effects their seizure could have on the Tor network.*
Friendly Reminder: Browser makers may track every key you type in the URL bar Introduction Technologies like Google Chrome’s Omnibox makes searching easier. However, these quick search suggestions come at a price. This post is a friendly reminder that you may want to consider turning off predictive search to protect your privacy.
Introduction I’ve always been a proponent and contributor of open-source projects and information. I strongly believe that information and knowledge should be shared as much and as freely as possible - progress happens this way. As such, I’ve decided to “open-source”, if you will, the academic essays I wrote regarding information security and software development my last…
Introduction Tor is often used to protect the anonymity of someone who is trying to connect to a service. However, it is also possible to use Tor to protect the anonymity of a service provider via hidden services . These services, operating under the .onion TLD, allow publishers to anonymously create and host content viewable only by other Tor users. The Tor project has instructions on how to…
Introduction Mobile applications are often viewed as black-box applications. However, these applications often suffer from the same (or similar) vulnerabilities as their web application counterparts. In a previous post , I showed how we can perform dynamic analysis on iPhone applications by intercepting the inbound/outbound traffic with the Burp proxy. In this post, we’ll explore static…
Introduction A while back, I came across the article from the The Washington Post describing We Heart It, a social network claiming over 30 million users . If you haven’t seen it, We Heart It (from here on out abbreviated as WHI) is a social network which encourages people to post and share photos and images of things that inspire them. Having such a large user-base, I was interested in…
Introduction Sites like phishtank and clean-mx act as crowdsourced phishing detection and validation. By knowing how to look, you can consistently find interesting information about how attackers work, and the tools they use to conduct phishing campaigns. This post will give an example of how phishing kits are used, how to find them, as well as show a case study into other tools attackers use to…
Introduction It’s been a while! I’ve been busy getting gophish closer and closer to beta. Should be ready soon! Until then, here’s a quick look at some comment spam scripts I discovered when perusing through the content over at phishtank.com . As a side note, the scripts were bundled as some Louis Vuitton spam, though that doesn’t seem to relate to the content of the spam…
Introduction I’ve been playing around with Go for about a month now, and I’ve really grown to like it. After getting used to the syntax and remembering what a pointer is for (thanks, Python), Go has become a favorite language to develop with. I’m even using it for the Matasano Crypto Challenges (which are awesome ). While the standard library in Go is definitely robust, being a…
Introduction Since the Simple Phishing Toolkit (SPT) was discontinued, I’ve wanted to create a simple, effective, and open-source phishing toolkit. In recent years, we’ve seen a rise in spear-phishing attacks targeting large organizations, most of which are largely successful. The goal of this toolkit will be to provide businesses and penetration testers with the ability to quickly and…
Introduction A while back, I published a post on the Raidersec blog demonstrating how to perform a deauthentication attack using Python and Scapy. I enjoyed writing the post, since I got the opportunity to learn in-depth about how different wireless attacks work, beyond just learning how to exclusively use the aircrack suite . So, with that being said, this post will kick off a short series of…
Introduction When looking at the functionality of mobile apps, it’s clear that they aren’t that different than web applications. They often just serve as a frontend for the data stored on a central backend server or database. As such, if developers aren’t careful to protect these apps, many of the same vulnerabilities we find in standard web applications (such as injection…
The Initial Post I recently published a blog post which showed a practical attack against Linkedin’s Intro. The post reached the front page of Hacker News (a full writeup of my experience with the “Hacker News Effect” will be posted soon for those interested), which caused the post to gain quite a bit of publicity and traction. Soon after, I was contacted by Linkedin’s…
Update 10/28/2013 6:30PM CDT - I have been in contact with Linkedin’s security team and a hotfix has recently been released to address the findings below. This fix applies the styling rules to a randomly generated ID, as opposed to the class based styling seen below. This provides more specificity in applying the rules, making it more difficult to override. I am no CSS expert so there could…
Introduction When performing a social engineering engagement, recon is key. In a previous post , I demonstrated a few ways in which we could automate the recon process. However, the methods I showed were simply ways to find the profiles of people that might belong to a particular organization. During SE engagements, we often either run across email addresses (by, say, simply scraping the main…
``` #!/usr/bin/env python print 'Hello, World!' ``` Hi there! My name is Jordan, and I am a security researcher, developer, and hobbyist. For the past few years, I created and maintained a blog for an organization I started called Raidersec . While I fully intend to leave the existing content on the Raidersec blog, I thought it would be ideal to create a personal blog on which I can continue…