Security Wrench Attack Mitigation
The Threat of a Wrench In security, there’s an issue some of us just call the wrench attack. This is named because of the below popular XKCD…
Lolware
Blogging on security and insecurity
Latest posts
Meta has an answer to Youtube Face
I know you’ve seen it You’re probably familiar with “Youtube Face”, the somewhat annoying algorithm “hack” wherein people pretend to be…
Hack Smarter - Evasive
Hack Smarter - Evasive Write Up I felt compelled to create this write up because I really like this box. There’s also a few things I’ve…
Using Powershell to manage binary registry keys
Managing Binary Registry Keys Microsoft has a guide here on Working with registry entries. It’s pretty good for most purposes but I found it…
openRT Vulnerabilities
Vulnerability Review of openRT Here we’re going to conduct a web application security review of the OpenRT application. openRT Github…
Windows 11 - Enable "Firmware Protection" by InTune or otherwise
Windows 11 - Firmware Protection setting is not simply a setting Most of these can be turned on using fairly obvious means. However, if you…
Time to Shutdown CT Advisor
Time to Shutdown CT Advisor In 2015, I built CTAdvisor for a couple of reasons. The first is that the new Certificate Transparency standard…
My Cats implement Diffie Hellman in Powershell
My two cats use Diffie Hellman to exchange keys How else would they plan to overthrow me without being spied on? Usual disclaimer. This is a…
How vssshield kills ransomware
Ransomware using vssadmin Ransomware has a long history of deleting shadow copies from an infected machine, in an attempt to hinder recovery…
Encoding Neil Madden's Psychic Signatures
Encoding Psychic Signatures Neil Madden produced a fantastic blog on a cryptographic vulnerability he calls “psychic signatures”: https…
Using Microsoft Sentinel to roll honey tokens on Windows
Credentials in Your Environment A recurrent theme in both real life attacks and penetration tests has been the scanning of local networks…
Exploit for many Wordpress themes - CVE-2022-0316
Detection and exploitation of Wordpress theme CVE-2022-0316 This vulnerability involves a piece of code that for unknown reasons, has been…
Using Azure MFA for on premises Active Directory
On premise Active Directory - Getting MFA This question, “how can I implement MFA with my on premise Active Directory”, has come up an awful…
Neutralising Script Based Ransomware
Scripts causing ransomware In modern times, Microsoft Windows has gotten better about protecting users from untrustworthy executables. You…
React XSS Protection Cheat Sheet
SEO is a funny thing Although I never set out to write a ‘React XSS Cheat sheet’, this blog for some reason is the third Google hit for this…
Obtaining Corporate Credentials via the Autodiscover Circus
Layout It’s fairly common for an organisation’s website to exist outside the organisation’s operational security policies. There’s a common…
Secure Active Directory management with PAM and JEA
Introduction to the tooling This tutorial is going to involve combining two Microsoft features: Privileged Access Management, and Just…
Dumbest pentesting script to ever succeed
Scanning for passwords in description fields in AD In today’s episode of “I can’t believe this is real”, the below Powershell script has a…
Abusing Google Safebrowse for phished credentials URLs
When Google Safebrowse scans your site I recently submitted a non existent page to Google Safebrowsing, using this link. The first result…
Hack The Box DAB Writeup Security Assessment
Introduction to the target. Here we present a writeup of the “Dab” server and the applications it hosts. As we walk through each issue…
Reverse engineering GoDaddy's tracking script
Background An article by Igor Kromin has provided an insight into a practice by GoDaddy involving injecting Javascript into customer sites…
Enumerating Azure Federated Domains
Enumeration Introduction There are a wealth of blog posts and tools for enumerating domains. This is often the first step of an engagement…
Security and Caching headers with S3 websites
Using Lambda @ Edge to add headers to S3 websites There are a lot of advantages to running a website on Amazon S3. Unfortunately, for a long…
Open Source marketing after two years
A quick history of CT Advisor I initially jumped on the CT Advisor idea as soon as I read Google’s Certificate Transparency announcements…
Intercepting and Capturing MFA Logons
Intercepting and Capturing MFA Logons One of the interesting classes of vulnerabiltiies are those that are fairly well known to security…
The bloat of AMP
I rebuilt this website a while back using AMP AMP had just been popularised at the time I was considering rebuilding this site. It sounded…
Using Hadoop with Clojure to process Active Directory Data
Using Hadoop to process Active Directory user lists Powershell offers some really nice exporting and reporting capabilities. Most sysadmins…
Netregistry has no support for MFA either
Namecheap has recently come under fire This post entitled “Namecheap still doesn’t support 2FA in 2017” has attracted a lot of attention…
Continuous Backup Tests with Docker
Side issue: These snippets would ideally be embedded gists for ease of management - but AMP prevents this. At some point I’ll come up with a…
Awesome security audit
Awesome Sec Audit This fully accredited security auditing service used by 500 of the Fortune 500 will fully audit your security environment…
mwave requests bank logins of customers
Right when you thought security couldn’t get any worse This blog will be short and sweet because a few images say it all. I’ve spent a lot…
The improving state of SSL deployment
Increase in SSL use There have been a number of blogs lately regarding the increasing SSL deployment across the Internet. Rather than review…
Intelligent Backend Routes with Rails and nginx
Introduction A fairly common deployment involves running nginx as the first hop on an application server, which in turn routes to your…
Use protobufs - now
Introduction If you’ve ever touched any form of web development, ever, you’ve probably used JSON to get data from a server to a client. Ajax…
Argon2 code audits - part one - Infer
Introduction This article is the first part in a series in which we use popular tools to audit the Argon2 library. Let’s start with a quick…
Let's Encrypt - It's happening
Using Lets Encrypt Today, the Let’s Encrypt team announced beta program launch. This is a huge step forward for the Internet in general. We…
Testing ReactJS for XSS vulnerabilities
Introduction React is a Javascript framework from Facebook. Although it can be utilised natively, I’m going to focus on its front-end use…
Property based tests, contracts with Ruby
Base App For this demonstration, we are going to be using the venerable Fizzbuzz application. For those who haven’t seen it, it’s a common…
Concurrent Vulnerability scanning with Erlang
Background Following the recent series of major vulnerabilities, a trend that’s become popular has been the online scanner. It was far…
Fuzzing nginx - Hunting vulnerabilities with afl-fuzz
No 0day here If you were looking for it, sorry. As of 48 hours of fuzzing, I’ve got 0 crashes. AFL - successful fuzzing American Fuzzy Lop…
nginx - Built against LibreSSL
CentOS For some time, I’ve been managing a CentOS RPM of LibreSSL built against nginx. You can still get that at the below link if you’re…
Taking the Matasano Crypto Challenge
Salespeople Yes, I’m putting this first. Even before introduction. If you’re in sales, the moment you see something slightly technical you…
HP D2D / Storeonce Backdoor
Introduction This page has been rewritten following extensive communication with HP that occured following the disclosure made in this blog…
libscrypt - password hashing library
Introduction Several recent - highly publicised compromises - have involved mass leakage of passwords. This is a major annoyance - consider…
Connectwise Password Recovery
Connectwise password decryption and recovery The release notes for the 2012.2 edition of Connectwise claim, as a welcome feature, “The…
LolDNS
LolDNS is my fork of djbdns. The goal here has been to go beyond the many current forks of just perpetuating the product, and to actually do…
cPanel Wordpress version/vulnerability scanner
Introduction I’ve found myself in front of a number of cPanel servers lately. The first thing I became aware of it that cPanel has a series…
Forensic research into an FX29 Compromise
Recently I was tasked with looking into a server that appeared to have been compromised. Various symptoms included load average of 18+, and…
HP P2000 on VMware - LUN 0
tl;dr For those of you who don’t know, the HP P2000 produces a “management LUN”, operating on LUN 0, which it presents to all hosts within…
McAfee Updater - I just shat on your filesystem
This document discusses a vulnerability in McAfee’s updater. The download for this, and a KB article discussing it, is found here: https…