Recent content on GeekyRyan
HackTheBox Web Application Fuzzing - Parameter Fuzzing Link to heading This is part of a multi-part series documenting my process for completing the HackTheBox modules. This post covers parameter fuzzing, which involves identifying which parameters a web application accepts and processes. This is crucial for finding potential vulnerabilities or hidden functionality. Overview Link to heading…
HackTheBox Web Application Fuzzing - Sub-domain Fuzzing Link to heading This is part of a multi-part series documenting my process for completing the HackTheBox modules. This post covers using ffuf to identify sub-domains (i.e., *.website.com) for any website. Sub-domains are websites underlying another domain. For example, https://photos.google.com is the photos sub-domain of google.com. Overview…
HackTheBox Web Application Fuzzing - Value Fuzzing Link to heading This is part of a multi-part series documenting my process for completing the HackTheBox modules. This post covers value fuzzing, which involves testing different values for a known parameter to find the correct input that returns the desired result (such as a flag). Overview Link to heading After fuzzing a working parameter, we…
HackTheBox Web Application Fuzzing - VHost Fuzzing Link to heading This is part of a multi-part series documenting my process for completing the HackTheBox modules. This post covers VHost fuzzing, which allows us to identify sub-domains that do not have public DNS records or sub-domains under websites that are not public. Overview Link to heading As we saw in the previous section, we were able to…
HackTheBox Login Brute Force - Skills Assessment Part 1 Link to heading This is part of a multi-part series documenting my process for completing the HackTheBox modules. This particular post will cover part 1 of the 2 part skills assessment. What is the password for the basic auth login? Link to heading This one is simple. We’re provided with a username and password list. We can use a tool…
HackTheBox Login Brute Force - Skills Assessment Part 2 Link to heading This is part of a multi-part series documenting my process for completing the HackTheBox modules. This particular post will cover part 2 of the 2 part skills assessment. What is the username of the ftp user you find via brute-forcing? Link to heading We can review /etc/passwd to see the ftp user.
HackTheBox Login Brute Force - Medusa Link to heading This is part of a multi-part series documenting my process for completing the HackTheBox modules. Medusa is another popular login brute-forcing tool similar to Hydra. It supports multiple protocols and is known for its speed and efficiency. Medusa can perform parallelized attacks, making it suitable for large-scale brute-forcing tasks. It also…
HackTheBox Login Brute Force - Hydra Link to heading This is part of a multi-part series documenting my process for completing the HackTheBox modules. Hydra is a fast and flexible login brute-forcing tool that supports numerous protocols. It is widely used in penetration testing to identify weak credentials on various services. Hydra can perform both dictionary and brute-force attacks, making it a…
HackTheBox Login Brute Force - Dictionary Attacks Link to heading This is part of a multi-part series documenting my process for completing the HackTheBox modules. This post covers capturing a flag from a web API using dictionary attacks. Dictionary attacks are more efficient than brute-force attacks when the target’s credentials are likely to be based on common words or phrases. This type…
HackTheBox Login Brute Force - Brute Force Attacks Link to heading This is part of a multi-part series documenting my process for completing the HackTheBox modules. This first post covers capturing a flag from a web API by brute-forcing a 4-digit PIN. This is a simple challenge (not even really a challenge, tbh), but it’s a good warm-up for more complex brute-force tasks later on.
Two’s Complement is required for representing signed integers. If the high bit is 1 (i.e. if the binary number is 128 or greater in an 8-bit system), then the number is negative. To find the negative value, invert all bits and add 1. Example: To convert the binary number 11111010 to decimal: First, invert all the bits: 00000101 Then, add 1: 00000101 + 1 = 00000110 Finally, convert to…
Consider an 8-bit system. What happens when you add 1 to the maximum value of 255 ( 11111111 in binary)? An integer overflow occurs. The 8 bit result becomes 00000000 because only 8 bits are kept. 11111111 +00000001 --------- 1 00000000 < 9th bit carry-out The carry bit is then set in the CPUs eflags register, indicating that an overflow has occurred. Decisions can then be made by the CPU based on…
Capturing Live Network Traffic from a Kubernetes Pod Link to heading Occasionally, you need to troubleshoot network behavior inside a Kubernetes pod — maybe you’re chasing a DNS issue, testing service connectivity, or inspecting strange application traffic. tcpdump is still one of the best tools for this, but pods are intentionally minimal, and most containers won’t have it installed.…
Modifying Machine Code in Executables Link to heading In this post, we’ll walk through a simple but fun reverse-engineering exercise: taking a compiled C program, locating the machine instructions responsible for printing characters, and modifying those bytes directly in the executable. This is a great way to build intuition around how compilers translate code, how functions map to assembly, and…
Introduction Link to heading If you have ever initialized a new Go project with go mod init main and later tried to write tests for it, you may have seen this cryptic error: cannot import "main" At first glance, this doesn’t make much sense — after all, your code and tests are both in package main . However, there’s a subtle interaction between how Go handles modules, packages, and test harnesses…
The initramfs (initial RAM filesystem) is a temporary in-memory filesystem used for systems that do not know in advance certain things about their hardware at boot time. It is used to bootstrap the real root filesystem and provide necessary drivers and tools to mount it. Some examples of when an initramfs is needed include: Systems that use encrypted root filesystems, where the initramfs contains…
In this article we’ll take a quick look at major/minor page faults in Linux. Minor Page Faults: These occur when a process attempts to access a memory page that is already present in physical RAM but is not yet mapped into the process’s own virtual address space. The operating system handles these faults by simply updating the process’s page table to include the mapping to the…
Anacron is designed for tasks that need to run periodically (daily, weekly, monthly) on systems that are not continuously powered on. If a scheduled cron task is missed because the system is off, anacron will run the task once the system is available. On many systems, anacron is pre-installed. If not, install it with: $ sudo apt install anacron Anacron's configuration is in the /etc/anacrontab…
The process control block in Linux (formally named the task_struct) is a data structure maintained by the kernel that contains all of the necessary information to maintain a process on the system. The task_struct is a large struct in the kernel containing many fields. Some example fields are process id (pid), file descriptors, environment variables, the command used to start the process, memory…
to do…
Introduction Link to heading This post covers a simple and efficient solution for implementing liveness probes in pods running console applications (think background services or utility DaemonSets). A common question I see in Kubernetes forums is: “How do I use health probes with console apps?” The typical responses often suggest: Sidecar Container with HTTP Server: Requires coding the server,…
Introduction Link to heading Combining multiple Kubernetes secrets into a single directory can streamline secret management in your applications. This guide walks you through the process of achieving this in Kubernetes, ensuring efficient and organized secret management. Creating Secrets Link to heading First, create your secrets using the kubectl create secret command: kubectl create secret…
Introduction Link to heading Knowing the type of a file you’re working with is not just a matter of curiosity — it’s often a necessity. This is especially true when you’re deciding whether or not a particular operation can be carried out on that file. Go, with its comprehensive standard library, offers a straightforward approach to identifying a file’s MIME type, ensuring…
Introduction Link to heading In this post, we’ll take a quick look at URL validation using Golang. It’s common to implement URL validation as a task within a HTTP request pipeline, typically as middleware. There are many different definitions of “validation”. For the purpose of this article, we will simply validate that a URL conforms to a particular text pattern. I often…
This will be a short post about a recent issue I encountered when using Nginx as a Kubernetes ingress. Though, this could also be encountered when using Nginx as a reverse proxy as well. The two definitions are functionally similar. We recently had a client call in complaining of our application returning random 502s (Bad Gateway). After some investigation and the common finger-pointing, I found…
Introduction Link to heading Netcat is a versatile networking utility that can be used for a wide range of tasks. It has often been referred to as the “network swiss-army knife”. Netcat was first released in the mid-90s, and I personally find it ironic to be blogging about it in 2023! But I feel like it is a somewhat cryptic tool, and new engineers or college graduates may not be…
Despite being a great language, PowerShell is not impervious to errors. Errors that occur within your code can stop it’s execution or even cause unexpected changes in the resources that your script is managing. Learning to handle these errors gracefully is the foundation of defensive coding. Today, we’ll take a quick look at how PowerShell handles errors with Try-Catch-Finally blocks.…
This will be a quick and dirty post, so please forgive any spelling/grammar mistakes. I was writing a little CLI tool in Golang to track todo items. Just a dumb little app to help hone my skills a bit, but still something useful that serves a purpose to me. I don’t write a ton of code at work (mostly just scripting/pipelines when I do), so I’m constantly working on something like this…
I was recently involved with troubleshooting some API’s hosted in Kubernetes throwing http/502’s. This was incredibly difficult to diagnose because it seemingly happened at random, and I had never encountered anything like this. Being that I had never dealt with this in the past, and I (nor my team) was able to figure it out within a reasonable amount of time, I turned to google. My…
I’m not really a fan of photography. I don’t particularly enjoy the intracies of tuning a high-end DSLR camera. Nor am I a fan of being out in nature to photograph a fall sunrise (though, that does sound peaceful). However, I do take a lot of pictures with my phone (currently, a Pixel 6). Moreso now that I am a new father. I am protective of these photos. So much that I sync them…
In this article, we’ll take a quick look at building a Golang app with Github actions. This process can be applied to just about any app written in any language though. We’ll cover the following: What are github actions? Setting up the workflow to build, test, and deploy a binary Github Actions is a cross-platform CI/CD pipeline that allows you to build, test, package, and release your…
In this article, we’ll take a quick look at chaining two pipelines together in Azure Devops, so that the completion of one pipeline, triggers the other to run. Microsoft documentation is leaps and bounds ahead of where it used to be. However, I still feel like there is a lot of room for improvement, as it took me a while to figure this out. Our two pipelines will exist in the same…
If you need to update the secret for a service principal in Azure Devops, prior to it expiring, you may be surprised to find that this cannot be done via the Azure Portal. In this article, I’ll show you two methods for updating a secret for a service principal prior to expiration. Update the secret via the Azure Devops Portal: Link to heading Go to “Service Connections” in the…
If you want to the local version of a dependency in Go rather than one in a remote repository, use the replace keyword. The replace line goes above your require statements, like so: module github.com/rnemeth90/foo replace github.com/rnemeth90/bar = > /Users/rnemeth90/Projects/bar require ( github.com/rnemeth90/bar v1.0.0 ) Now when you compile this module go build or go install , it will use your…
This will be a short post on querying REST APIs with Powershell. It’s hard to argue that REST APIs are the predominant technology for interacting with networked services. They provide a gateway for interacting with a 3rd party (or self-hosted) product without having to go through the exercise of a more complicated integration. REST APIs communicate in a common format, typically JSON.…
JSON is a widely used format for representing structured data. Developers like it because it is easy to read, most common languages have a library for interacting with it, and most public APIs accept JSON in HTTP requests. In this post, we’ll look at parsing a JSON file using Go! We will be using the io/ioutil package to open a json file on local disk, and encoding/json to parse the JSON…
By default, scale-out operations performed manually or by cluster autoscale rules require the allocation and provisioning of new nodes, and scale-in operations delete nodes. Scale-down mode is a relatively newer concept that allows us to choose whether to delete or deallocate nodes. Having the ability to deallocate, rather than delete, nodes is a major performance benefit, as the time it takes to…
If you manage Linux nodes, you know how vital performing regular maintenance is. Installing software patches that modify Linux kernel headers requires a reboot. Normally, as in the past, we would cordon and drain the node and then manually reboot, wait for it to come back online, verify its health, and add it back to the cluster. That’s a lot of manual work! How can we automate this? Weaveworks…
I have somewhat of a niche issue, where I have no network connectivity while connecting to my work VPN inside of WSL v2. I have found others complaining about this issue on Github. Though no one seems to know how to fix it and I have not had the time to properly investigate. Because of this, I’m required to continue using WSL v1. Though, with WSL v1, Docker does not work. I receive this nice…
This problem has bitten me more than once, and I can never remember how to fix it. So, why not write a blog post about it! When running EF Core migrations in a solution, you may come across this error: There are several apparent causes. However, in my case (every time I have seen this), it has been caused by having multiple startup projects selected in Visual Studio. To fix this, simply open your…
In this post, we will discuss how to remove a Kubernetes namespace that is stuck in the ‘terminating’ state. A namespace is like a container. You can use it to store related objects in a Kubernetes environment. Maybe you are hosting a blog in Kubernetes. This blog will likely have a database, a frontend website, a load balancer (service) to spread the incoming traffic among ‘x’ number of frontend…
We can inject configuration into containers using Kubernetes config maps and secrets. These objects can be consumed by a pod as environment variables, command-line arguments, or as configuration files mounted in a volume. For the subject of this article, we will focus on mounting multiple config maps/secrets into a single directory on a pod. Mounting a configmap or secret in a Volume is relatively…
In this blog post, we will attempt to explain the current storage options that exist in Kubernetes. If you are new to Kubernetes, learning about its capabilities of managing the application state can be a daunting task. Container images are built-in layers, with the runtime layer being writable. However, any files on this writable layer are only available for the container’s lifetime. We can mount…
This post will cover a secure method for accessing secrets in Azure DevOps pipelines. Why Azure Key Vault? Link to heading Azure Key Vault is an Azure cloud service used to securely store secrets, keys, and certificates. A secret can be any string of characters, such as API keys, passwords, URLs, etc. Azure Key Vault encrypts data at rest and in transit using HTTPS. Depending on the type of Key…
In this article, we will dive into the process of pod eviction in a Kubernetes cluster, how you can pod prevent pod eviction, and how you can recover from such a situation. What is Pod Eviction? Link to heading Kubernetes pod eviction is a type of involuntary service disruption in which a pod is forcefully stopped on a node or fails to be scheduled on a node. Pod eviction can happen for a variety…
In this post, we’ll take a look at deploying a highly available sFTP solution to Azure Kubernetes with user files stored in an Azure NFSv4 File Share. The sFTP application reads user credentials from a file named users.conf, containing secrets from an Azure Key Vault. Here is the link to my Github account where you can download the code mentioned in this article:…
This article will discuss an issue regarding WSUS failing to download updates from Microsoft Update servers. You may notice that the home page of your WSUS console states that it has downloaded 0MB of updates: You may also see this event (or similar) in the Event Log. This problem is caused by not specifying a valid path when assigning the WSUS content drive when first installing the role. The…
When migrating computer objects using the Active Directory Migration Tool, you may encounter the following error: In addition, the Migration Log may show the following error: This is typically caused by a host-side firewall. To resolve this, deploy a GPO to disable the Windows firewall prior to migrating the computer account. I like to create a special OU for computers (I typically name it…
When deploying new software releases to servers or (insert -as-a-service> here), it’s a good idea to either deploy the releases in a controlled manner or to have a quick rollback plan. This article will be diving into blue/green deployments, canary deployments, ring-based deployments, and feature tag deployments. Blue/Green Deployments Link to heading Blue/green deployments are a deployment model…
This article assumes that you have already created a pipeline in Azure Devops and have it linked to an Azure Devops repo. You will need to create a variable named $vmpassword and assign it the value stored in your key vault. To create a release pipeline that will automatically create a VM (using the password stored in key vault for the local administrator account), do the following: Create a new…