Technical security research and notes
in previous posts we have looked at guardrail triggers , token burn , hostname beacons , malicious skills , context bombs , and exploding search space . this time: service sandbagging. active defense is planting traps that force an agent to reveal itself or change the economics of its run. sandbagging does both by abusing how agent harnesses treat tool timeouts and protocol errors. honeypots have…
From Tracebit ’s Context bombs: stopping AI attackers in their tracks (research write-up here ). We call the defensive version a context bomb: a short piece of text designed to trigger a model’s safety guardrails, planted directly in the attacker’s path — a decoy secret, environment variable, or DNS record. An AI agent that reads it will frequently refuse to continue. as part of their…
in previous posts we have been looking at different active defense approaches: guardrail triggers , token burn , hostname beacon , malicious skills , context bombs . I want to explore one I recently read in an academic paper. first, active defense is planting traps that force an agent to reveal itself or change the economics of its run. an enumeration trap does the second by making the agent fan…
in the previous post we looked at hostname beacons. this time: malicious skills. active defense is the practice of planting traps that force an agent to reveal itself or change the economics of its operation. skills are a high-signal trap because they are mostly run by agents. a human might skim a SKILL.md . an agent is designed to load it and follow it. a strong example is the openclaw / clanker…
in the previous post we opined on token burns in active defense, this time we will consider hostname beacons. first, active defense is the practice of placing traps that force an attacker or automated agent to reveal itself or interrupt its own workflow rather than relying only on prevention or passive detection. a hostname beacon is a unique resolvable name planted so that any DNS lookup (or…
sticking with the theme of applied active defense ( previous post ), I wanted to explore token burn (lots of names here; unbounded consumption [1] or a form of misalignment). this is probably the weakest of the active defense posts I want to make but still worth exploring. first, active defense is the practice of placing traps that force an attacker or automated agent to reveal itself or interrupt…
the previous post briefly touched on active defense in the scope of AI agents and LLMs. active defense is the practice of placing traps and tripwires that force an attacker (or an automated agent) to reveal itself or interrupt its own workflow rather than relying only on prevention or passive detection. a guardrail trigger is text or an image crafted to cause model refusal on inference. the model…
another by-product of anatomy of a frontier lab agent intrusion: a technical timeline of the july 2026 incident is that the adversary mindset is not the same. puppet accounts , social engineering and grinding through k8s manifests were all part of the process for the agents. one caveat is these reports are not based around token costs as they were frontier labs. but in the not so distant future…
After reading the most recent hugging face incident report ( Anatomy of a Frontier Lab Agent Intrusion: A Technical Timeline of the July 2026 Incident ), it dawned on me we have entered an era where untraceable bespoke C2 channels could be the norm. When a SOTA model can code any protocol, communicate over audio and video, and fully adapt to the land it operates in, fingerprinting live…
The 2026-07-28 Model Context Protocol specification is out. One interesting addition for application security: List results are cacheable Responses from tools/list , prompts/list , resources/list , and resources/read now carry ttlMs and cacheScope ( SEP-2549 ). This allows clients to determine the best caching strategy for responses and reduce unnecessary re-fetching. On paper, cache hints help…
Misconfigured GraphQL implementations can allow for attackers to bypass authorization and access internal APIs. These “secondary context attacks” exploit the gap between GraphQL’s frontend interface and backend REST services, often turning simple path traversal into significant data access. The Backend for Frontend Pattern In the Backend for Frontend (BFF) pattern, a middleware…
The @trickest Inventory project is an interesting resource. It has a massive set of hostnames, live services, spidered URLs, and cloud data organized by Bug Bounty program. There is so much more data than I have interest in storing for my needs. In fact, the only thing I am interested in is the hostnames resource. Here is a quick and dirty way to pull the hostnames.txt file from every program…
Edit : 1.1b fixes an auto shutdown issue in burpsuite, I would highly recommend this release over 1.1a. The rest of the post still applies. This is a small release but a useful one. Release 1.1b adds the ability to parse projects for portions of siteMap and proxyHistory. For example, the following will only respond with the proxyHistory request.headers and request.body . Note, the URL is always…
In this two part series we are going to take Burp Suite Project files as input from the command line, parse them, and then feed them into a testing pipeline. The series is broken down into two parts: Getting at the Data (i.e. from the CLI to feeding the pipeline) 8 Bug Hunting Examples with burpsuite-project-parser (i.e. from the pipeline to testing) This post is focused on bug hunting examples.…
In this two part series we are going to take Burp Suite Project files as input from the command line, parse them, and then feed them into a testing pipeline. The series is broken down into two parts: Getting at the Data (i.e. from the CLI to feeding the pipeline) 8 Bug Hunting Examples with burpsuite-project-parser (i.e. from the pipeline to testing) Introduction Two years ago I pushed to Github a…
SSRF protocol smuggling involves an attacker injecting one TCP protocol into a dissimilar TCP protocol. A classic example is using gopher (i.e. the first protocol) to smuggle SMTP (i.e. the second protocol): 1 gopher://127.0.0.1:25/%0D%0AHELO%20localhost%0D%0AMAIL%20FROM%3Abadguy@evil.com%0D%0ARCPT%20TO%3Avictim@site.com%0D%0ADATA%0D%0A .... An common example of using Gopher to protocol smuggle…
I recently (May 2018) published odle which is a Ruby gem and binary that takes XML data from various security tools and outputs their JSON equivalent. The goal is to be (1) simple, (2) fast, and (3) work on many platforms with only one dependency – nokogiri. Quick Example of Piping Security Results Below are two examples using odle to convert output from one tool (e.g. burpsuite) as input for…
Recently ColdFusion was shown vulnerable to XXE based attacks in OXML documents; CVE-2016-4264 . The blog post linked gives an example building the file using python; cool! It’s easy to backdoor files in a similar fashion with OXML XXE . The fastest way to do this is using the “Overwrite File inside DOCX/etc” function. You can add any XLSX at this point, OXML_XXE ships with a sample.xlsx. You will…
Finding hosts or domain names associated with a company where the domain name does not include the name of the company can sometimes be difficult. There are common ways to do it such as ASN or scope information (e.g. bug bounty ToE or IP block). One technique that I use (and I am guessing others do as well) is through an Organization field in a SSL Certificate that is shared by multiple domains.…
Just wanted to post some details from my BH USA 2015 briefing “Exploiting XXE In File Upload Functionality”. https://www.youtube.com/watch?v=LZUlw8hHp44 I also gave an updated version of the presentation in November for the Blackhat Webcast Series. It included more file types; PDF, JPG, and GIF. The link is here:…
I landed the SSRF Cloud Metadata technique in a few different scenarios recently. If you haven’t seen the talk BHUSA 2014 - Bringing a Machete to the Amazon I recommend it. To make life a little easier created a living URL list for Metadata broken down by cloud. There are a few more than he discusses in the talk but still has work to go. Submit a PR if you see some missing.…
An XML Entity testing cheatsheet. This is an updated version with nokogiri tests removed, just (X)XE notes. XML Declaration(s): 1 2 <?xml version="1.0" standalone="no"?> <?xml version="1.0" standalone="yes"?> Vanilla entity test: 1 <!DOCTYPE root [<!ENTITY post "1">]><root>&post;</root> SYSTEM entity test (xxe): 1 <!DOCTYPE root [<!ENTITY post SYSTEM "file:///etc/passwd">]> Parameter Entity. One…
Last month at Blackhat Arsenal 2015, Pete and I presented on Serpico. This was our second time at Arsenal. Yet again, awesome people, great venue, and overall a highlight for me of BH/DC/LV. We got some excellent feedback on the project, so thank you to anyone who stopped by. Last year I posted the top 3 feature requests and we squashed them (woot!). These are requested features/bugs this year and…
I was researching something else and thought this was a cool way to execute a command through the open method in ruby: 1 open("|[CMD]") The key is starting the open with pipe. For example, 1 open("|ls") Or to exec and print the result in one line: 1 open("|ls").each {|out| puts out } Not sure where I saw it originally, but this is an interesting older read:…
OXML is a common document format; think docx (Microsoft Word Document), pptx (Microsoft Powerpoint), xlsx (Excel Spreadsheet), etc. An OXML document is a zip file containing XML files and any media files. When the document is rendered, the rendering library unzips the document and then parses the containing XML files. The order the XML files are parsed and which files maintain precedence over the…
I seem to find open LDAP servers on the Internet more often than I should. Here are some notes on using ldapsearch Installing ldapsearch on Ubuntu 1 apt-get install ldap-utils Root-DSE object nmap includes a script to gather info from a LDAP root-dse object ( http://nmap.org/nsedoc/scripts/ldap-rootdse.html ). We can also use ldapsearch to test: 1 ldapsearch -p [PORT] -x -b "" -s base…
gumbler is a script I wrote to search through git commits and introduced in the blog post “Searching Through Git Commits” . Recently I wanted to run Gumbler across all repositories for an organization, the steps are discussed below. First, we need to grab a list of repositories for the ORG. This can be done using the API 1 2 3 curl "https://api.github.com/orgs/[ORG…
gumbler is a script I wrote to search through git commits. Examples from github are discussed below. .gitignore A gitignore file is used to specify files that should not be tracked by git (source gitignore ). In the default case, gumbler will read the gitignore file for the project and search every revision for a case where a file from gitignore was committed. Possible use cases would be as a pen…
An XML Entity testing cheatsheet. Testing was done using an older vulnerable version of nokogiri. In IRB you can require previous versions of gems. Certain techniques (e.g. XInclude) may require additional settings in Nokogiri. XML Headers: 1 2 <?xml version="1.0" standalone="no"?> <?xml version="1.0" standalone="yes"?> Vanilla entity test: 1 <!DOCTYPE root [<!ENTITY post "1">]><root>&post;</root>…
A hostname with an IPv6 address is stored as a AAAA resource record in DNS (see AAAA record ). There are many DNS hostname bruteforcing tools, personally I like Fierce . Suppose we have already run our hostname bruteforcing tool against a target domain (e.g. facebook.com). Below we use dig to do a AAAA record lookup for each hostname. Note, the DNS server we use matters. In this example we use…
Last week at Blackhat Arsenal 2014, Pete and I ( @ will_is ) presented on Serpico. Arsenal was a great experience and I would highly recommend to anyone as an attendee or presenter. We got some great feedback on the project, so thank you to anyone who stopped by. Here were the top 3 feature requests and their associated issue on github: Global Variables This feature would allow a user to add their…