Recent content on Hackerman's Hacking Tutorials
It looks like higher reasoning effort (and even later models) are not always better for triaging security results. I continued Kurt's experiments from Needles and haystacks: Can open-source & flagship models do what Mythos did? with 26 distinct claude-4.6/4.7 and gpt-5.4/5.5 combinations with different context window sizes and reasoning efforts.
LLMs regularly ignore my Markdown instructions. As the I part of (A)I , I got tired and created some deterministic automation to format the output to my preferences. I will discuss the problem, our solutions, bugs, lessons learned, and the final product. I am going to try a new format here. This blog has the important stuff that I care about. This is for humans. All the AI discussions and the…
I used GPT-5.4 and Claude Opus 4.6 to reverse engineer the Aula F108 Pro keyboard's software using Ghidra MCP. This is how I did it, what setbacks I had, and how (A)I borked the keyboard's screen despite constant supervision and review. A common issue with the keyboard is that it ACKs bad messages, then silently drops them. Did Gene Wolfe write this firmware? I also introduce the novel wording of…
I wake up and read the news. Daniel Miessler has only declared my job dead three times this week. Another frontier lab has found a bazillion bugs. Half of LinkedIn is "SAST is dead." The war is, well. Welcome to the age of AI. In this blog I reflect on "Manual Work is a Bug" and on how AI has changed my workflow. I introduce the (not so novel concept) of "AI-Docs." A knowledge base for both humans…
The "radical" idea to add prompts and code context directly to SARIF files for AI triage.
Ladies and gentlemen, my name is Parsia and I'm here to ask and answer one simple question: WTF is AI-Native SAST? (RIP TotalBiscuit). Spoiler: It's SAST+AI. But that doesn't make it useless. Quite the opposite, I'll make the case for passing all your code to AI while tokens are cheap. Don't believe the marketing, though. Current LLMs need serious hand-holding to go beyond surface-level bug…
We want to use custom OpenAI compatible API LLMs with GitHub Copilot Chat in VS Code without API keys. We will use LiteLLM as a proxy for authentication and use the Azure AI model support in Chat as a hack. Problem Statement GitHub Copilot Chat in VS Code (moving forward, called Chat 1 ) allows custom LLM deployments, but only supports API keys and not AAD/Entra ID. API keys are icky and not cool…
Kusto is important at my current employer and one of my work besties does SecOps. So, I've decided to learn more Kusto. Solves for the first eight tasks for Kusto Detective Agency challenge Echoes of Deception. It turns out Kusto is not just a better looking SQL, it does a lot more. E.g., it can make a graph and find paths (yes, as I've just searched, T-SQL can also do this). It makes me wonder if…
This is a quick peek inside Burp AI. I'll show how to proxy its requests, what actually happens when you trigger a feature. This knowledge allows us to redirect Burp AI to your own AI instance. As far as I know, this is not publicly documented. I covered a shorter version in my DEF CON 33 Bug Bounty Village talk The Year of the Bounty Desktop: Bugs from Binaries . See the extended slides (pages…
A few weeks ago I wrestled with a complex Kusto query. I shared what I learned at work in a presentation. In this blog, I'll use a public example to walk you through it.
This is not a bug, but some notes about the new Steam "Open in Desktop" button. I am going to show how to look for bugs in these kinds of browser-to-desktop interactions.
We will continue the tree-sitter adventure and tackle the problems we couldn't solve with just tree-sitter queries. We can get results with a combination of queries and the Concrete Syntax Tree (CST). In the previous post , I focused on just using queries. While they're useful for finding specific nodes, they're not enough. Code is at https://github.com/parsiya/knee-deep-tree-sitter . Don't forget…
tree-sitter is a parser generator. You can use it to parse source code which is the first step of static analysis. For example, GitHub uses it to highlight code, code navigation, and also in CodeQL extractors. TL;DR : Queries are great for capturing text from code. But to extract anything moderately structured we need to traverse the syntax tree. And, yes, the title is based on Doom Episode 1 Knee…
I want to use Semgrep as a light code intelligence tool with a few experiments. I will write custom rules to extract info from code and then process the results. The type of these experiments is inspired by Martin Jambon who is actually a core Semgrep developer. These are supposed to be self-contained but short experiments. You can see his at https://github.com/mjambon/dev-random .
As is tradition, I started the SANS Holiday Hack and this time I almost did everything. Previous years' writeups: /categories/holiday-hack/ . Holiday Hack Orientation Picked up the fishing pole. Cranberry Pi: Type answer . Linux 101 Visit Ginger Breddie in Santa's Shack on Christmas Island to help him with some basic Linux tasks. It's in the southwest corner of Frosty's Beach.
Semgrep has an experimental and (IMO) more readable rule syntax. I am converting my own reference into a tutorial.
As is tradition, I started the SANS Holiday Hack and stopped midway. A very fun static analysis problem came along ;) Previous years' writeups: /categories/holiday-hack/ .
I will talk about how I parsed Semgrep rules in YAML with Rust, how I created Rust structs from JSON schemas for Semgrep rules, and finally, what didn't work. This blog post has different sections with code so you can follow and experiment.
I will discuss the (not novel) concept of code review hot spots. Hot spots are parts of the code that might contain vulnerabilities. They are not suitable for automatic reporting, so security engineers should review them manually. I will define what I call a hot spot; I'll find some examples with Semgrep; and finally, I'll show how I collect these rules.
Let's talk about the security nightmare of handling hundreds of different game installations. Over the years I have become the de facto security engineer responsible for EA's "game package managers" Origin and the EA App and we have our own unique issues.
Here are some of my answers to the SANS Holiday Hack 2021. As usual, it's a pretty fun and accessible challenge. Previous writeups: SANS Holiday Hack 2018 Solutions Some SANS Holiday Hack 2019 Solutions Some SANS Holiday Hack 2020 Solutions
The Visual Studio Code server in Windows Subsystem for Linux uses a local WebSocket WebSocket connection to communicate with the Remote WSL extension. JavaScript in websites can connect to this server and execute arbitrary commands on the target system. Assigned CVE-2021-43907 and zero bounty. I paid 5 USD for the EC2 machine hosting the proof-of-concept. It's really funny that PlayStation paid…
Semgrep's experimental autofix feature can automagically modify vulnerable code. A few things can be fixed like this but it's worth exploring. This post is an introduction to creating fixes for your Semgrep rules. I have included links to the playground for practicing. If you prefer running the rules via the command-line please see the rules and code at…
You would think modifying a GitLab repository from its CI job should be straightforward. Well, it's not. Here's how I did it.
In part 3 of my attack surface analysis series, I will discuss an undisclosed RCE. This bug uses a combination of all tricks introduced in part 2 of the series . We will see command-line switch injection from a custom protocol handler, loading remote files, reversing a custom scripting engine to instrument the application, and log file injection. Pretty nice chain if I may say so.
A few days ago I saw a tweet about thick client vulnerability. I am not linking to it because it appeared to be someone new to the industry and very excited. The Original Tweet Well, most of these are not vulnerabilities. So, I am compiling my tweets into a blog post. It's important that we only go after actual vulnerabilities and not spread misinformation. Funnily, I have talked about several of…
Why are We Here? What this blog is about: Why I like Semgrep. Why I think you should use it. How I use Semgrep. What this blog is not about: What static analysis is. Semgrep tutorial.
We have an XSS in a desktop application, what happens next? How can you escalate it to remote code execution? Let's see.
In Part 2 of the Attack Surface Analysis series I talked about how passing a remote file with a UNC path can lead to unexpected results. I am documenting how I created a share using an EC2 instance. This guide is for AWS, but it's a Linux machine running in the cloud. You can easily replicate it.
Recently, I looked at the NordPass Password Manager browser extension . I could not find any guides on manual testing of browser extensions. I decided to write my own. So, here we are, "pushing the boundaries of science."
Custom protocol handlers are an obscure attack surface. They allow us to convert local attacks into remote ones and are an alternative way to jump the browser sandbox without 0days ). Similar to the first part of this series A Novel Way to Bypass Executable Signature Checks with Electron I will analyze this attack surface and discuss a few interesting public bugs. I wanted to discuss two of my…
Recently, I have started moving my non-critical websites to GitHub pages. I am documenting the process in one place for future me.
This year like last year and unlike 2018, I only did a few of the SANS Holiday Hack challenges. I got invited into this private bug bounty program with a desktop application in scope (those are quite rare) so I had to poke at it. To be fair, I hit the motherlode and submitted $10K of bounties. Previous writeups: SANS Holiday Hack 2018 Solutions Some SANS Holiday Hack 2019 Solutions
A few months ago I found a way to subvert the update process of an Electron application to get local privilege escalation. The application stores the updater under a path where standard users have write access. But it also checked if the executable was signed by the vendor. I managed to bypass the signing using a backdoored Electron application.
Earlier in December 2020, my PlayStation Now report was disclosed. You can see the report at https://hackerone.com/reports/873614 . That is my first paid bounty and my first disclosed report. It was quite exciting. I doubt I can top it.
The other day I customized the Python built-in SimpleHTTPServer with some routes. I did not find a lot of info about it (most use it to serve files). This is how I did some basic customization.
I will talk about some edge cases of the Same-Origin Policy (SOP). It affects browser based thickclient platforms so it's not just for web application security. This is a more detailed dive into this topic that I touched briefly in the localghost talk.
I had the hono(u)r of presenting in the DEF CON 28 Appsec village . Unfortunately, my super-duper awesome $15K PlayStation bug was not disclosed yet so I did not talk about it. Be sure to read it, it's great. Slides in PDF Youtube link: https://youtu.be/Cgl51ZcACLg?t=90
An intentionally insecure system is insecure. As Raymond Chen says , "You can't make up for the absence of any actual vulnerability by piling on style points and cranking up the degree of difficulty."
In this post we will use our knowledge from Thick Client Proxying - Part 10 - The hosts File to proxy GOG Galaxy 2. I will also introduce some automation to make our lives easier.
A friend pointed me to this Go quiz about slices by Serge Gotsuliak . It's an interesting exercise and points out the intricacies of Go slices. I decided to explore it in detail. These oddities might have security implications.
Welcome to the 10th installment of Thick Client Proxying . A series running since 2016. Woot! Today I will talk about traffic redirection using the hosts file.
This is how I reduce the noise in Burp's HTTP history when testing thick clients. You can use the methods here to create your own Burp configuration file or build upon the one I have created. I am going to identify common noisy requests that appear in Windows and then ignore them in Burp.
I was looking at an application (not related to my day job) and I decided to reverse engineer how it creates logs. I cannot name the app (yet) but hopefully, this is useful.
This blog is about a GitHub Security Lab Spot The Bug challenge that had an overlooked bug. Github Security Lab's Twitter account tweets code snippets from time to time. The challenge is to spot the bug. Disclosure : I might be completely wrong because we only have access to the snippet in the picture and people at the GitHub Security Lab are better than me in static analysis.
A while ago I read Time Management for System Administrators by Tom Limoncelli . This blog is my reviewed notes. You can find my raw notes in my clone at: https://parsiya.io/automation/time-management-sysadmins-notes/ Tom is also the author of one of my favorite articles Manual Work is a Bug . I have written about it: Reflections on 'Manual Work is a Bug' The Dark Side of 'Manual Work is a Bug'
A few years ago I did the Context Information Security challenges. They used it for recruiting so I never published the results. However, they have now switched to Hack The Box and the old challenges are gone. So I am publishing what I did. You can see the page with the old challenges using the Wayback Machine at:…
These are my notes for the booklet Documentation Writing for System Administrtors . It's from 2003, so some of the tools and procedures are old. However, somethings never change and it's still useful. https://www.usenix.org/short-topics/documentation-writing-system-administrators
I did some of the solutions for the SANS Holiday Hack Challenge of 2019. Last year I participated for the first time. You can find the solutions below: SANS Holiday Hack 2018 Solutions
This post discusses what I learned about executing JavaScript code in Java with Mozilla Rhino. By the end of this post, you will know: What Rhino is. How to use Rhino in your Java application (e.g., a Burp extension). Some tips and tricks when dealing with Rhino. Alternative options to using Rhino. Code is at: https://github.com/parsiya/Parsia-Code/tree/master/java-rhino