Recent content on Andreas Happe
Published in EMSE , arxiv version : Penetration-testing is crucial for identifying system vulnerabilities, with privilege-escalation being a critical subtask to gain elevated access to protected resources. Language Models (LLMs) presents new avenues for automating these security practices by emulating human behavior. However, a comprehensive understanding of LLMs’ efficacy and limitations in…
I am using an (now 5 years old) Xiaomi Mi Mix 3 as a backup phone for travelling. Given its age, the phone is no longer receiving official updates from Xiaomi, which poses security risks and limits access to new features. To address this, I installed LineageOS, a popular custom ROM that provides regular updates and enhanced privacy features a couple of years back. Recently, I’ve updated the…
Published in TOSEM , arxiv version : Enterprise penetration-testing is often limited by high operational costs and the scarcity of human expertise. This paper investigates the feasibility and effectiveness of using Large Language Model (LLM)-driven autonomous systems to address these challenges in real-world Active Directory (AD) enterprise networks. We introduce a novel prototype designed to…
arxiv version : Large Language Model (LLM) - based Automated Program Repair (APR) systems are increasingly integrated into modern software development workflows, offering automated patches in response to natural language bug reports. However, this reliance on untrusted user input introduces a novel and underexplored attack surface. In this paper, we investigate the security risks posed by…
arxiv version : This paper presents a critical examination of the surprising efficacy of Large Language Models (LLMs) in penetration testing. The paper thoroughly reviews the evolution of LLMs and their rapidly expanding capabilities which render them increasingly suitable for complex penetration testing operations. It systematically details the historical adoption of LLMs in both academic…
Presented at DeMeSSAI'25 in Venice, Italy , arxiv version : Large Language Models (LLMs) have emerged as a powerful approach for driving offensive penetration-testing tooling. Due to the opaque nature of LLMs, empirical methods are typically used to analyze their efficacy. The quality of this analysis is highly dependent on the chosen testbed, captured metrics and analysis methods employed. This…
Now that I have a minimal home server running , I thought it would be good idea to monitor temperature, disk usage and such. The simplest solution that I found was to use Glances and use Home Assistant to store and display the data.
By now, I am using Proton Drive for cloud data storage and Proton Mail as my primary mail service. While I trust Proton with my data, I do not want to rely on them completely. As I have a small server standing around at home, it’s kinda obvious to use it for automatically performing backups of my cloud data. I try to use systemd services and timers for this, as this makes monitoring and…
I am running a home server for a while now. I have been using it to host some services that I use regularly. In this post, I will share my experience with some of the services I have set up on my home server. This initial post will go over local git hosting using gitea , audiobook streaming using audiobookshelf and a self-hosted RSS reader using tt-rss .
I am using Fedora Silverblue as one of my main desktops. Recently, I’ve been moving some services to a server behind tailscale but was still using its local IP address when at home at my Silverblue desktop. While doable, using an IP-address with an invalid HTTPS certificate wasn’t that pretty — so why not just access it through tailscale even within the same network, it’s…
I’ve been using a mini-computer as home-server for the last couple of years. Originally, I used it to share files between my computers, but over time more and more services (like RSS-readers, media-libraries, home automation, etc.) were moved on that surprisingly capable mini-server. I’ve grown up using Linux (well, I was already 16 when Linux became available around here, but you get…
Adding Plan-and-Execute Planner All sources can be found in our github history . When using LLMs for complex tasks like hacking, a common problem is that they become hyper-focused upon a single attack vector and ignore all others. They go down a “depth-first” rabbit hole and never leave it. This was experienced by me and others . Plan-and-Execute Pattern One potential solution is the…
Simplify our Tool-Calling Agent through create_react_agent LangGraph has some amazing Prebuilt Components , one of them is the create_react_agent function that allows you to hughely simplify creating new tool-using agents. The full source code can be found within our github history . The simplified version This willb e based upon our recent configuration-improved version . Similar to that version,…
Improving Configuration Handling, esp. for Tools While being quite happy that the initial prototype worked within hours, its code was very prototype-y, i.e., much of its configuration was hard-coded. In a second step, we want to fix this by making our target information (the SSH connection) configurable and remove all hard-coded credentials from the code. Big Picture We are already using…
The first parts of this series were about getting more done while at work as well as making it easier to switch from work into leisure mode . Both have a rather bottom-up feeling to them. In contrast, this post will be top-down: investigating my scheduling habits and trying to get them to a point where they actually protect myself from over-scheduling too much work. My Scheduling Habits thus far…
While the initial experiment focused upon productivity , the main goal of this series is to improve my work/life balance. Getting more productive should just allow me to switch from work to leisure earlier. Currently I have access to my university office, so I have a nice geographical separation between Work/“The Office” and “Everything Else”. So basically I want to keep…
Last winter I was lucky to enroll in the so-far best lecture of my PhD studies: From Surviving to Thriving: Crafting your good personal Life by the great Geraldine Fitzpatrick . The course was about stress, mindfullnes, crafting, productivity.. nothing mind-blowing nor rocket science but comprehensive, accessible, and charmingly presented. Recently I read Do Nothing which I thoroughly enjoyed.…
Presented at FSE'23 in San Francisco, US , arxiv version : Offensive security-tests are a common way to pro-actively discover potential vulnerabilities. They are performed by specialists, often called penetration-testers or white-hat hackers. The chronic lack of available white-hat hackers prevents sufficient security test coverage of software. Research into automation tries to alleviate this…
Presented at FSE'23 in San Francisco, US , arxiv version : The field of software security testing, more specifically penetration testing, is an activity that requires high levels of expertise and involves many manual testing and analysis steps. This paper explores the potential usage of large-language models, such as GPT3.5, to augment penetration testers with AI sparring partners. We explore the…
TL;DR WSL2 seems to be one big lolbin when it comes to EDR Scenario/Background During a recent assumed-breach pen-test assignment I was stranded as a low-level user on a fully-updated Windows 10 Enterprise system (10.0.19045) including a deployed CrowdStrike Falcon EDR suite (6.49.16303.0). As I respect CrowdStrike I did not want to execute any malicious scripts on the host, so what to do? WSL2 to…
During a recent assumed-breach pen-test assignment I ran into a problem: the customer had an up to date Windows Active Directory environment, CrowdStrike was rolled out as an EDR and a dedicated Incident Response Team was monitoring for alerts.. and I needed some Active Directory Enumeration to be done before I was planning out my next steps. I assumed, which later proved correctly, that just…
During a recent security assignment I came upon a projects folder stored on a Microsoft Active Directory server and accessible thought the network (SMB/CIFS). It had the commonly used layout of a single subdirectory per project, users should only be able to access their corresponding projects and this is configured through ACLs. Initial tests did indicate that the access rights were given away…
So a customer of mine thought about ordering a Red Team Assessment and wanted me to go through their local network beforehands — no need to make it too easy for the red teamers. The customer’s network was a typical windows network, dated but kept up to date by two admins. Microsoft Defender was rolled out at all clients, and on some servers. A laptop with Kali Linux was connected to…
So I’ve been using a Raspberry Pi 4b+ together with a WaveShare LTE Modem as 4G router/access-point for my home network setup. I do like my hardware to be quiet and thus fan-less, alas the Raspberry Pi 4b+ gets a tad on the warm side. So this was a perfect opportunitiy to play around with an older Raspberry Pi 3b+ which should use approx. 20-25% less power (both, during idle and load) and…
AppSec includes all tasks that (hopefully) introduce a secure software development life cycle to development teams. Its final goal is to improve security practices and, through that, to find, fix and preferably prevent security issues within applications. It encompasses the whole application life cycle from requirements analysis, design, implementation, verification as well as maintenance. To…
Recently I had a couple of customers that needed some guidance about secure software development. I assume that this happens because I am a developer gone pen-tester so I’ve seen both side of the “problem”. Of course, suggestions differ between software stacks and the overall customer professionalism level, but there is a common starting ground that should be suitable for any…
During a recent presentation on HTTP Header Security I was asked for a “simple” flow chart with directions which headers can be used without too many problems. The result was this: What was the reasoning? Initially, basic headers that unify browser behavior are set. They control behavior that is already set when using modern browsers (e.g., Referrer-Policy ) or unify non-standard…
Given that I’ve spent more time in my flat (hello, COVID-19) I also spent more time looking at my book shelf.. and wasn’t too happy with it: in hindsight, some of the books I’ve read are way to pretentious and the books I remember as life-changing were mostly read on my kindle anyways. Speaking of Kindles, my first kindle (must be bought around 2008 in the United States) was…
So I am back at teaching web application security. This time I wanted to setup a CTF challenge for my students. To not reinvent the wheel, or rather, to stand on the shoulders of giants I am reusing the OWASP Juice Shop vulnerable web app in its CTF mode. Normally I would teach at a (physical) lab which would make the setup easy: all students are situated in the same physical room, I can setup the…
After I’ve bought a new and fast 1TB SSD , it’s time to setup my aging Desktop again. Last time I went with Fedora Core , this time I will try to reduce some of the ubuntu-iness of a Ubuntu 20.10 Desktop for that. After preliminary tests Ubuntu seems to be more resource efficient than Fedora Silverblue and I should be able to remove most of Ubuntu’s problematic packages. Given…
Now that wireguard will be part of the upcoming Linux 5.6 Kernel it’s time to see how to best integrate it with my Raspberry Pi based LTE-Router/Access Point Setup . What is my scenario? Raspberry Pi 3 with a LTE hat, using a public IP address. This will be the VPN server (called edgewalker in this post) An Android Phone that should use the VPN for all communication when connected An Linux…
2019 was a year in which I expanded my comfort zone and forced myself to face some fears. I haven’t always been victorious, there’s enough to face next year. I see progress and hope; I do not feel trapped in my situation but rather see a comfy base from which I can explore further. I shed some possessions, mostly donated them or gave them away to friends. This calms my mind…
After 15 or so years I’m finally closing down my own company (it was a small one-person vehicle, in Austrian Einzelpersonenunternehmen or EPU). How so? I’ve been self-employed since I’ve started to study at university. Mostly I did software engineering for various research projects at AIT . There was a short side-project (a failed startup that I created with friends of mine),…
The last weeks I’ve tried to improve upon my Raspberry Pi based LTE-Router/Access Point . Normally I would heave tons of software on it, try it out and let it simmer on. I did that this time too: the ELK-Stack (too little memory) and HomeAssistant (too little SmartHome-devices in my flat) only had a short intermezzo on this hardware. What stuck? Before that a small note: originally I was…
Nach dem guten Feedback meiner Studenten auf meine Web Application Security Vorlesung lies ich mich überreden, im Wintersemester 2019 einen Teil einer weiteren Vorlesung zu halten: SecOps — Secure Operating Systems, also quasi Security Themen für Administratoren. Mein Part umschloss Linux, Virtualisierung und (sehr kurz) Mobile Systeme. Mein BrainDump dieser Vorlesung kann hier bezogen…
Diese Unterlagen entstanden zeitgleich während einer von mir gehaltenen Vorlesung an dem Technikum/FH Wien. Nach dem positiven Feedback der Stundenten wurden die Unterlagen überarbeitet und ich hoffe, dass sie auch von anderen Personen genutzt werden können. Inhalt Der Inhalt orientiert sich grob an den OWASP Top 10: Allgemeine Sicherheitsgrundlagen Was sind Web-Applikationen? Authentication und…
From coding.. My developer life started at 14 when I enrolled at the HTL Villach with a focus on IT. In those five years I learned to code: Assembler, C, C++, COBOL, and that new thing: Java. I continued the path at the Technical University of Vienna , eventually earning my Master's Degree in Software Engineering. In parallel to my studies, I started to work at the Austrian Institue of Technology…
Sometimes I want to work on client assignments (penetration-tests) from home, if I do that I am using my company VPN so that all traffic is routed thorugh their public IP address (which is white-listed by the client). I do not want for traffic to ever leave that VPN as that would look like as if I’d be performing cyber attacks from my private home IP address. The same requirements arise for…
So I held a lecture on “Web Application Security” for the FH/Technikum Wien last spring and wrote a small booklet for my students (partially because I wanted to avoid discussions during the final exam). I did volunteer for a anonymous feedback round which turned out very positive for me, the booklet was repeatatly mentioned positively. So I distilled and refined it, tried to improve…
I spent some time playing around with various LTE-options for my Raspberry Pi Access Point/Router setup . My Huawei E3372 USB LTE modem works find but only implements a fake network card. This means that a virtual network card is emulated, all traffic is NATted over a virtual router located behind that virtual network card. This happens in addition to the network translation (NAT) that my…
Most of you (and there are a couple of thousands of you) come for my tech-posts, but it seems that some of you get lost reading my non-techie posts too. Time to add on of those, it’s been a while.. I breathe books, they give my brain constant input to thrive on. Recently I went through my goodreads list of reread-good-books to check what influences me and started to reread some of them.…
In one of my last experiments I replaced my crappy T-Mobile (now Magenta) 4G modem/access point with an OpenWRT-based cheap travel router and a 4G USB LTE modem. That doubled my speed over the wireless (WLAN) network but the setup was limited by the outdated and under-powered travel rooter. So I got myself a cheap Raspberry Pi 3b+ and created a minimal Linux-based 4G router/access-point. My basic…
Recently I upgraded from my “old” Motorola/Lenovo G6 plus to a Xiaomi Mi Mix 2s . Why the new phone? Main reasons for that upgrade were: The old phone started to look like a banana. Seriously, I carry my phone in my back pockets and after a year that.. let to a more-than-slightly bent phone. This might have let to another problem: random vibra-call activation. Originally I thought that…
My LTE internet connection (70 Mbit downstream, 15 MBit upstream) came with a combined Huawei B315s LTE modem/access point . As I was using it for the last two to three years a couple of problems did arise: the internet connection was often shaky, oftentimes the uplink connection got lost and I had to power-cycle the modem/access point. Subjectively this got improved with the last system upgrade.…
During a recent assignment the customer server was utilizing a WebSocket for some notification transport, part of my assignment was to fuzz-test the used WebSocket (and the messages transported over it). To do this, I turned to my typical tools: PortSwigger BURP only supports display of WebSocket messages but not altering and/or automated fuzzing of websocket messages. OWASP ZAP can inject and…
During a recent pen-test I stumbled upon a JSON Web Token (in short: JWT) based authorization scheme. JWTs consist of three parts: header, payload and verification information. The initial header part contains the name of the algorithm that will later be used to generate the verification part of the JWT. This is dangerous as an attacker can change this information and thus (maybe) control what…
There’s power in switching mental models. In my work, switching from “there might be a vulnerability in this software” to “i just haven’t found the vulnerability” was a game changer for me. I get nervous prior to presentations; one switch that helped me was that instead of thinking “my goal is to look bright” I try to remember that my goal is to teach the audience something and it doesn’t matter…
So my company moved to a new building which uses HID RFID cards for access control. These cards are typically white with some sort of numeric code printed on one side of them. I have not included an image of my card due to (later) obvious reasons.. Setting up my Proxmark3 RDV4 reader Some time ago I joined the Kickstarter for an updated version of the Proxmark3 RFID reader/writer and immediately…
This year was good work- and health-wise, but bad when it comes to money and relationships. Financially the stock market drop hurt, emotionally getting dumped was painful. For 2019, I plan to keep and improve my healthy 2018 habits: enjoy life as non-smoker, keep on bouldering (6a+ - 6c with a rare sent 7a in-between), finally finish a full Bikram yoga sequence and maybe meditate more often. In…
Wireguard is recently making a splash as human-configurable low-overhead alternative to OpenVPN and IPSec. As some privacy-centric VPN providers are planning to support it (e.g., PIA ) or already have a beta running (e.g., IVPN, as tested by Ars Technica ) it was time for me to look into it. The Setup To get a better feeling about the used technology I directly connected my laptop to my desktop…