Recent content on Markuta
iStat Menu version < 7.20.5 has a local privilege escalation vulnerability due to insecure world-writable permissions set by the install helper component. This allows standard users to execute commands as root.
The official respository for cloudflared package has a new hostname in it's baseurl which is not resolving properly. This post shows how you can update your .repo file to resolve the issue.
A short guide on how to get IPv6 VPN working on Unifi Gateway Ultra using socat. This is especially helpful for ISPs that use carrier-grade NAT, a very restricted but common option service providers offer.
The popular MFA provider Authy by Twilio doesn't support exporting TOTP tokens. You are forced to use their cloud backup solution. In this post I share how you could create an offline backup using a rooted Android device and a Python script with the help of Frida. I also briefly look into how the app works and backend API endpoints communication.
Hacking the Amazon eero 6 (3rd gen 2020) wireless device part 2. In this blog post I will be going through the steps taken of trying to read a BGA153 eMMC flash chip, extracting and analysing the firmware image, whilst using cheap and easy to get equipment.
A short blog on how to install and run the latest version (23.05 on ARMv8) of OpenWRT, with the LuCI web management, using QEMU. It covers the installation for macOS with the Apple M1 chip, however, this guide can be applied to any modern platform that supports QEMU.
A technical blog post on finding and exploiting an authenticated JDBC deserialization vulnerability in JSCAPE MFT Server to gain remote command execution. This vulnerability is caused by an out-of-date H2 database library bundled into the default install package. A proof of concept is provided that works on Windows x64.
Hacking the Amazon eero 6 (3rd gen 2020) wireless device, part 1. This part covers device disassembly, identifying pins of interest, brute forcing JTAG pins, and reading serial output.
How to block .zip top-level domains (TLDs) with pfSense and pfBlocker-NG.
PayPal announced support for Passkeys in October 2022. However, 8 months later the security feature still has issues. This blog shows how Passkeys can be registered on the platform but can't be actually used, at least for using mobile phones as Passkeys.
A short blog on how to get root on an emulated device running Android 12 with rootAVD.
The recent (2022) compromise of Lastpass included email addresses, home addresses, names, and encrypted customer vaults. In this post I will demonstrate how attackers may leverage tools like Hashcat to crack an encrypted vault with a weak password.
How to bypass certificate pinning on ProtonVPN macOS app using Frida.
Comparing root detection on 24 banking apps using the latest version of Magisk v24.3 on a Google Pixel 3a running Android 10.
A fun little weekend project on how I found a unique Hyundai Vehicle Identification Number (VIN) from a list of 42,873,633.
EV charging company exposing 140K of customers’ data through their mobile app.
A guide on setting up pfSense and IPv6 on HyperOptic.
Working with Frida and Magiskhide on a rooted Android device.
How to setup a Hugo website using Cloudflare Pages and Github.
A how-to guide on setting up a self hosted Bitwarden server using a Raspberry Pi. This password management solution uses Docker and a Nginx reverse proxy.
A fresh new Jekyll theme called klisé for Markuta.com. The theme includes a dark and light mode, (dark is enabled) by default.
How I found a XSS bug on Spotify's Podcasters subdomain.
A guide on how to use a TP-Link Archer T2U Nano AC600 wireless adapter, along with the mitmproxy tool to create a intercepting set-up for inspecting, modifying and monitoring encrypted HTTPS traffic.
How to acquire a live memory image dump from a Linux system using the LiME Kernel Module. Perform memory analysis using Volatility with a custom Linux profile.
This guide shows how to install and build a MIPS (Little Endian) Debian Stretch (9.4) image for running under QEMU virtualization software. These steps could also be applied to other MIPS architectures.
A how to guide on setting up Nzyme and Graylog v2.3.2 using a Docker compose file. This tutorial can be applied to any platform running Docker software. Includes examples and configuration files.
The BBC Online still forces users to use insecure HTTP by way of redirection. It's been over a year since BBC Online enabled HTTPS on their Homepage. However, deployment on certain paths are still is absent. The most relevant path being News, where the actual content resides.
Review of the KeyGrabber Nano USB Keylogger. An advanced tiny hardware USB keylogger that supports multinational keyboard layouts and languages. This review is of the non Wi-Fi edition.
The recent Kali Linux Kernel update version 4.12.12-2kali1 completely broke wireless functionality resulting in poor performance and range issues. This post shows how to quickly resolve the wireless issues by downgrading back to the previous kernel version 4.11.6-1kali1.
A handful of useful bash shell aliases that I've been using for years. They work on just about every default Unix and Linux system, including Mac OS. This post will be updated regularly.
What I personally use for Password management and a comparison against cracking encrypted databases files with other password managers.
Review of Alfa AWUS052NH Dual-Band (2.4GHz and 5GHz) wireless USB adapter. Testing Packet Injection, Deauth attacks, Evil-twin attacks, and more from various different packages available on Kali Linux. This review is should be suited to a Wireless Penetration Tester.
How to configure Web Servers (Nginx, Apache, IIS, OpenLitespeed and Lighttpd) to Force HTTPS by default.
A simple technique to append PHP code to files that have been processed by IonCube or Zend Guard.
Getting round poor UEFI implentation support for booting into Debian Stretch.
Adjusting Dynamips CPU usage in an virtual environment.
Just a random security researcher from UK
