Recent content on plaintext
tl;dr: If you depend on the bracex Python library, and there’s a good chance you do but haven’t noticed yet, upgrade to version 3.0 . A few weeks ago, I had a shower thought about supply chain security. More precisely, I wondered which packages in the PyPI ecosystem were common transitive dependencies but often overlooked by security researchers. Digging around, I stumbled across…
Since forver ago, I have been using oh-my-zsh with a fairly standard configuration. Plugins for commands I often use, utility functions, and all the clutter you accumulate after years of building and breaking software. That included fuzzing configuration, an unreal amount of version managers, and custom configurations, including those recklessly appended by automatic installers. Since my…
I’m getting back into hacking on Ethereum nodes. Some of my tests are RPC-heavy, so a local setup is required. This will also speed up development since requests remain in my local network. However, I haven’t found an easy Docker Compose setup for running Geth and Prysm together. version : "3.8" services : geth : image : ethereum/client-go:stable container_name : geth restart :…
In recent weeks, Germany has been on the international news. In the state elections in Thuringia and Saxony (where I live), the extreme right-wing AfD and left-wing BSW have gotten huge voter support. Their focus on immigration, border security, and crime, as well as skilled harping on East-West differences in Germany, seems to have had a significant impact. Background Describing East Germany is…
Long story short, I got disillusioned with my previous work and its context. I started my project, the Smart Contract Security Field Guide (SCSFG) to cope with it. Here are some nice features: New code samples instead of the same-old code you see everyone steal over and over A section for hackers to give inspiration when stuck and explanations where the attack vector is clear A section for…
Corporate parties - essentially designed to celebrate company triumphs, whether hitting revenue targets or instilling the company’s mission and vision into the employees - can often devolve into nothing more than an extravagant distraction. This illusion of harmony, of success, of the ‘perfect’ work environment is essentially the art of corporate virtue signaling. It’s a…
I enjoy getting lost in work. I mean, really enjoy it. I forget to eat and sleep, especially when developing software. There is something addicting about building an MVP as fast as possible, finding the perfect architecture, refactoring your previous hacks, and eventually making your code observable and running smoothly. Whenever I take a vacation, I find myself not really taking time off,…
I have used my off-time from audits in the past months to write more about security. Especially in a nascent ecosystem like Ethereum still is, the most considerable impact can be delivered by educating people. Education has to happen in different modes of complexity, depending on the target audience: Developers must be educated on how previous hacks happened and how to avoid making similar…
On March 11, 18:11, my dad passed away. After about a year with lung cancer and two weeks with COVID-19, he finally does not have to struggle anymore. I miss him dearly. After he got COVID, the doctors diagnosed him with pneumonia. He spent a week in the hospital before being released. He needed oxygen 24/7 and, in 30-minute intervals, switched from lucid moments where he was his usual self to a…
Registry is a box rated at hard difficulty. There are quite a few steps involved, but with a bit of persistence and little experience with Docker internals ( hint hint ), it looks more daunting than it actually is. Let’s go through the process of breaking in step by step! Out initial nmap scan is as unexciting as it can be: # Nmap 7.80 scan initiated Fri Jan 10 17:08:06 2020 as: nmap -sS -sC…
Fuzzy is a fun and short challenge on a docker container. It is especially good for teaching beginners the basics of using a fuzzer to discover new endpoints on a webserver.Spawning the container and probing around a bit, we don’t have too much success. Using dirbuster and a standard wordlist, we find the endpoint /api/action.php . With wfuzz we can now see whether passing any specific…
Mango was an interesting box when it comes to enumeration. It taught me to look more closely and not brush off anything just because I have seen it before. The box is also a prime lesson to aggregate your recon info in a structured manner so it’s easier to apply it at other points when you hit a dead end somewhere. There were also some nice opportunities for small, specialised attack…
This is a quick and dirty workaround for an issue that has been bugging me a lot. Truffle is one of the central, if not the most central development tool for building smart contracts on Ethereum to date. When compiling a Truffle project, the output is stored in build/contracts by default. An artifact simply a JSON object containing a plethora of data. A short sample from the SKALE project: {…
Postman was an easy-going box. It required careful enumeration and beyond that did not have too much resistance in privilege escalation. This makes it a prime example for real-world M&M security where the initial foothold is hard, but there is few resistance on the inside. Let’s start out by scanning the machine: # nmap -sS -sC -oN postman.nmap -v 10.10.10.160 # Nmap 7.80 scan initiated Sun…
Last week I received an email in my inbox about a hackathon hosted by the awesome folks over at Amberdata . They are a provider for on-chain data and cover a large variety of blockchains - including Ethereum, Bitcoin, and Stellar. I have met the developers in the team in late 2018 when I was looking for my next gig in the Ethereum ecosystem and long before that I was stunned by the large variety…
This is a write-up from the 36th Chaos Communication Congress, 2019. It has been my fourth Congress. Timed shortly after Christmas, it feels like meeting a second kind of family after the holidays. Hackers from all over the world gather in Leipzig to celebrate the weirdness of our community, break technology, learn new things, and have caffeine-fuelled fun.On my initial recon walk with friends we…
Obscurity is a medium-difficulty box. It was super fun to solve because it involved great excuses for me to write some neat little helper scripts and find a vulnerability in Python code. Something you don’t do too often in these challenges. Let’s dive right in with a nmap scan: $ nmap -sS -sC -oN obscurity.nmap -v 10.10.10.168 Nmap 7.80 scan initiated Fri Jan 10 12:57:06 2020 as: nmap…
OpenAdmin is yet another medium-difficulty machine, which was a blast to hack on! It involved dealing with various stack components, such as interacting directly with a MySQL database. Furthermore, hopping across multiple users through different escalation vectors was very satisfying. Let’s see how it is done!Our first nmap scan does not yield any exciting results: $ nmap -sS -sC -oN…
Traverxec is an interesting box, mainly because the HackTheBox team rated it as easy while the community disagreed and voted it to medium difficulty. It involved a funky privilege escalation that I had not seen before. Let’s see how it’s done! Our first nmap scan does not return exciting results: $ nmap -sS -sC -oN traverxec.nmap -v 10.10.10.165 # Nmap 7.80 scan initiated Mon Dec 9…
Wall was as much a fun and educational box as it was frustrating and stretching my patience. It felt like the system was updated by the creator to have some features in place meant to annoy people trying to break in. Nevertheless, there are some nice WAF evasion techniques to consider here, as well as the lesson to never give up on enumeration Starting with a SYN scan, executing scripts where…
My blogging journey has taken me far. I started writing articles about six years ago. Things got serious after I started studying Computer Science. Among the students of my class there was a lot of chatter. The tendency was that who was unable to communicate would soon start failing exams and eventually quit. In this setting, I started writing technical articles, first on an intranet website.…
This year marks the first time I got to attend DEFCON Las Vegas — one of the largest hacker conferences in the world. There are a plethora of things to discover and try out. The talks can be streamed later, but the workshops and spontaneous gatherings? A challenge that caught my eye was the honeypot challenge in the packet hacking village. The setting is simple: You gain access to an SSH honeypot.…
This is the first post of a sporadic series where we will dive into the weeds of more complex Python code review samples. I will take (slightly modified) real-world code samples, explain some common mistakes that have been made, and how we can improve things. Let’s jump right in! In this scenario, we have a component that is supposed to handle artifacts containing log messages. It is structured as…
fs0ciety is yet another low-hanging fruit among the HackTheBox challenges. It’s great for beginners who want to test their process for cracking password-protected zip files and recognition of various encodings.For that, we will use fcrackzip - simply for the reason that it has been around for ages and ships with Kali by default. I have sourced my wordlist from here . Let’s fire up the…
tl;dr Just check out the image and read the details below it if you want to know even more. :) A few days back I read an article by Yunyun Chen explaining Hashing in an infographic. I enjoyed it and read some comments, which pointed out a couple of weak spots that result from common misconceptions about (cryptographic) hashing. Mostly this is a result of the distinction between the concept of a…
0ld_is_g0ld is a HackTheBox challenge and a great way for beginners to familiarize themselves with PDF password cracking. If you have used Hashcat before, it’s an easy win. Verifying we indeed are targeting the correct file format: $ file 0ld\ is\ g0ld.pdf 0ld is g0ld.pdf: PDF document, version 1.6 We can extract the hash using the pdf2hashcat.py util script: ./pdf2hashcat.py 0ld\ is\…
Yesterday I stumbled across some code like this… def search_children ( statespace , node , start_index = 0 , depth = 0 , results = []): if depth < MAX_SEARCH_DEPTH : n_states = len ( node . states ) if n_states > start_index : for j in range ( start_index , n_states ): if node . states [ j ] . get_current_instruction ()[ 'opcode' ] == 'SSTORE' : results . append ( node . states [ j ] .…
A few weeks back I have started contributing to the awesome Mythril project. Mythril is a security scanner for smart contracts that allows everyone to look for vulnerabilities on- and off-chain by being able to analyze raw smart contract code, as well as the actual Solidity code file. To make setting it up more easy, the devs provide a Docker container for easy deployment and use via docker run .…
A few days back I stumbled across an interesting problem. I was asked to develop a solution that was doing some analysis work on geolocation data stored in KMZ format. Existing solutions like fastkml (64KB) and pykml (42KB) seemed nice at the first glance, proved to be unnecessary overhead, however. They’re mostly meant to manipulate and write data into KML format. I just needed to read the…
Sense was a HackTheBox machine that really tested my patience during the enumeration phase. It is a box designed around the popular pfSense firewall. Let’s dive in! Firstly, we start our usual standard nmap scan: Starting Nmap 7.60 ( https://nmap.org ) at 2018-02-27 19:44 CET Nmap scan report for 10.10.10.60 Host is up ( 0.034s latency ) . Not shown: 998 filtered ports PORT STATE SERVICE…
Bashed is a great entry-level box for people who are just getting started with HackTheBox. If you are just getting started with penetration testing, the value of this box is less in its technical content but rather in giving you the chance to exercise through your processes once. A bit like jumping into the water for the first time after doing dry-swimming. Let’s jump in! First we run a…
Nibbles was one of the first machines I broke on HTB. It is a relatively simple machine that requires a little bit of reconnaissance and leads you to a (hopefully) easy win by letting you poke around the website. Let’s dive in!First, we run a quick port scan: nmap -sS 10.10.10.75 -oX htb-nibbles.xml , which gives us the following result: Starting Nmap 7.60 ( https://nmap.org ) at 2018-02-26…
A friend of mine is following a PhD in a non-technical field. And his boss is a bully. Work mainly happens with high-level statistical analysis tools. No one knows anything about programming and most problems are solved by hand. While on a positive note this means good chances to get a student job, it also means that progress moves slowly, especially when it comes to working with large datasets.…
I recently found myself in the situation where I was given access to a huge MySQL database that contained network traffic flows and IDS signature match data. As I work a lot with graph-based approaches, I needed to convert the table’s flow data into a graphml file for later visualization and analysis with scripts I have already written. Now without further ado here’s the code: import…
A few hours back I stumbled into a problem where I had to perform a lookahead of n elements in a list to do some calculations. The first thought: Just take the current index and get all elements until i+n. I started writing.. for i in range ( len ( iterable )): ---- SNAP ---- Stop. This is awfully unpythonic. There has to be a better way! Browsing the itertools recipes I found the pairwise…
After the exams, I had some free hours so I decided to show my blog some more love and look for a new theme. The old one, a customized version of Chunk was little more than a hack to have a theme at all. Here’s a quick reminder of how this site used to look: I had a thorough look at Flex , Elegant , and many other popular themes but none of them struck me as really minimalist . So even…
After the exams I had some free hours so I decided to show my blog some more love and look for a new theme. The old one, a customized version of Chunk was little more than a hack to have a theme at all. Here’s a quick reminder of how this site used to look: I had a thorough look at Flex , Elegant and many other popular themes but none of them struck me as really minimalist . So even though…
As most of my stories in Panama this trip starts with some new friends. At my workplace, the Universidad Tecnológica de Panamá (UTP) , I didn’t have much contact to students, because I spent most of my time on campus inside an office. The international office of the uni was very engaged however and regularly asked me to speak about my experiences and help respresent campus affairs. In this…
Social Networks are awesome for travelling. By pure accident I met some fellow viajeros - two handsome women from Israel and Poland. After a quick chat and meetup we decided to spend our time in Valle de Antón - Anton Valley. From colleagues I already heard a lot about it’s natural beauty. Valle de Antón Mountainside What has been recommended to all of us was La Cascada El Macho : It’s…
Metropolitano Entrance Sign Since 1988 there is a park just on the outskirts of Panama City - El Parque Natural Metropolitano . It’s the only wildlife refuge in the city and is host to an amazing variety of wildlife. There are no special attractions there. It’s a place you just go to in a casual manner to relax and forget your everyday duties for some hours. It’s fairly big and…
My sister and a colleague of her decided to visit me in Panamà. Still being busy with the investigation, I did not manage to find a lot of time for travels during the week. However on the weekends, we managed to make some small trips. One of them lead us into the jungle near the village of Gamboa. Gamboa once was one of several canal zone townships built to house employees working at the Panama…
This is a thing I always forget and have to look up. My Dell XPS 13 (2013) runs on an Intel HD4000 and the drivers are obviously not in the standard repos. This script pulls the (at the time of this writing) most recent driver from the repos of the Intel Open Source Technology Centre . cd /tmp wget --no-check-certificate https://download.01.org/gfx/RPM-GPG-KEY-ilg-2 sudo rpm --import…
For some research on botnet host detection in large-scale networks, I found myself in the situation that I had to apply a set of algorithms to a huge packet dump. To comprehend an amazing paper, I started to play around with the dataset and tried to reproduce the results presented in the whitepaper. Quickly I realized that there was something fishy with my own dataset, so I fired up…
In the travel magazines you always see the same ad pictures. Cristal clear water gently stroking the white-sand beach bordered by palm trees. Deep cyan colours meet intense whites and greens. Amidst this paradisal scenery happily sits a woman drinking from a coconut, enjoying the sun. HARD CUT - company name appears. Guess what - I have been there. Not in the ad spot, in that kind of paradise.…
This was an extraordinary hiking trip full of firsts. I have never ever before been hiking in Panama in tropical weather on an active volcano on a mountain higher than 2,500m It all begins at the Albrook bus station in Panamá City. In the night from Friday to Saturday at midnight we take the bus to David, Chiriquí. The bus system in Panamá seems reliable and this particular bus was comfortable.…
A sunny day, 30°C and air humidity so high that breathing feels like waterboarding. Perfect conditions to go to the beach! Just some hours by car in the province of Colón north of Panamá City, you can find Isla Grande . This island is your typical small Caribbean island with clear waters and palm trees. From Muelle de La Guaira the crossing by boat just takes some minutes with the speedboat and…
I am quite new to working with Amazon Elastic MapReduce clusters. To do some large scale data analysis, I built a Pig script and ran it on a local pig installation to verify its functionality. Works. Neat! Let’s push it to the cluster and get some serious results on the large dataset! Luckily for my bill, it didn’t take too long to fail. [ hadoop@ip-XXX-XXX-XXX-XXX samples ] $ pig -x…
Located about 20 minutes away from the Technological University of Panama - assuming you don’t run into a traffic jam - lies the Ciudad del Saber , the City of Knowledge. When Panama was occupied by the United States, this base directly in front of the Miraflores locks was called Fort Clayton and the US Army headquarters here in Panama City. After the US departure the government founded a…
During a fair on stipends and opportunities to go abroad at the UTP I met some other interns and students of the uni! Amazing people from Portugal, Mexico, Honduras and Poland. We had a coffee together and got to know each other. They are very down to earth and easy-going people. Before we each left for office and studies again, some people invited me to join them on a trip to Taboga. “Of…
A Monday. Got up early. Bought a Spartan breakfast (water and bread). Off we go to the uni! Work! Get shit done! Meet people! “Hoy está cerrado!” . I stand before closed doors, next to me a wildly gesticulating and almost shouting security guard crossing his hands. Yeah, right. Today was a red-letter day! Ah, my forgetfulness followed me all the way to Panama! At least I got up early.…