All Posts | Malicious Link - Blog by mubix - Rob Fuller
Recently found an LFI in a PHP application and one of the cool things I learned about recently was PHP filter chains. More info here: https://www.synacktiv.com/en/publications/php-filters-chain-what-is-it-and-how-to-use-it.html However, if you are using this in a URL, it’s pretty hard to do anything too complicated since it expands the text to the point where web servers won’t accept…
Lesson 4 - User Blaming Security is NOT everyone’s job in the company. Stop trying to force the issue. It’s security’s job to enable, incentivize and protect. In the Marine Corps, I was taught that every Marine is a “Rifleman”, meaning that any Marine, no matter their MOS (Military Occupational Specialty) - aka their job, could be called upon to engage with the enemy…
Lesson 3 - Detection Reality People and Honey tokens are THE BEST detective tool you have. Go buy a Thinkst Canary, they detect me more than any multi-million dollar EDR. Period. Let me clarify something quickly before I get roasted. I am not saying that EDR (Endpoint Detection and Response) agents don’t have a place, it’s just that they have taken over for Anti-Virus for being mostly…
Update: 10/15/2022 One of the hard parts of implementing a block like this is the concern that it will “break something”. The DFIR Report’s post on Bumblebee Round 2 has a great suggestion on how to detect legitimate (and illegitimate) use of ISO mounting using Event ID 12 of the Microsoft-Windows-VHDMP-Operational logs. It’s not one of the main Application/System/Security…
ldapsearch is a extremely powerful tool, especially for Windows Active Directory enumeration. It’s one of my primary tools when performing pentesting or red teaming against an environment with Active Directory, but also comes in quiet handy to know as many times it can come default installed or part of a base image, so its a bit Living-Off-The-Land-esq. Another point towards ldapsearch is…
Lesson 2 - Least Privilege No one should have administrative access. All elevated access should be checked out when you need it and checked back in (automatically if possible). Just like UAC. MFA should be required, proximity or push based. And every use of a break glass account should be highly monitored I think “Least Privilege” has been harped on at least … you know what, let…
Lesson 1 - YOU could be “Legacy” Stop thinking that just because it did or didn’t work X way when you learned it, it still does or doesn’t. That could be 20 years ago. Technology changes faster than you do. I guess that’s a bit mean for a title but here’s the thing: One of the greatest yet most challenging things about doing any job in technology is staying current.
Today I keynoted @BSidesVancouver. It was an honor to be asked and I had a great time. Conference Link: https://hopin.com/events/bsides-vancouver-2022/ I talked about 11 lessons learned over my career that contradict some of the edicts that are well known in the Cyber Security space. Before we get into the lessons though, let me attack the things I know many of you reading this already have queued…
World Password Day (who knew that was a thing?) is upon us. It is the first Thursday of May every year, and that falls on May 6th this year. I’m not sure how to start this blog post, but the meat of what I want to get into is password security and the evolution over the years. In the 1900s (… yes people are saying that now… feel old yet?), password security was pretty simple.
TL;DR Here are the concerns I have regarding the SolarWinds/FireEye breach: The accounts stored in an organization’s SolarWinds Orion may be underestimated. I recently did a pentest for a firm that had over 200 credentials stored in their SolarWinds Orion database, but only 15 showed in the interface (the SolarWinds credential interface is complicated with sections for each connection type…