Christmas Kitty
Merry Christmas and happy new year! Thanks Hao Tian (田好) for making this Christmas Kitty:
Thomas van der Berg
Thomas van der Berg is a certified security professional (CRTP, 2025; PNPT, 2024; OSCP, 2018; CEH, 2016) from Leeuwarden, the Netherlands.
Latest posts
Web pentesting with Firefox Containers and Container Proxy
I thought I’d share my workflow for web pentesting with Firefox containers. It has advantages by allowing you to be logged in to multiple accounts at the same time, which helps with authorization testing, and also makes it easy to separate traffic sent to the intercepting proxy and other traffic without configuring Foxyproxy patterns. I’ve been using it for years but I haven’t really seen it used…
Fix CJK font order on Linux (Ubuntu)
A short post for something I’ll probably need to remember in the future. In Unicode, Chinese simplified, traditional, and Japanese style characters all use the same glyphs. Font rendering is used to turn the glyph into a simplified, traditional, or Japanese style character. Today I found my Ubuntu system was using Japanese style characters while I wanted it to use Chinese simplified (since I’m…
avoiding RSI and improving computer ergonomics with some scripting and a dmenu hack called kbmenu
RSI issues A few months ago I got some beginning RSI symptoms: pain and tingling sensations throughout the lower arms and hands. The direct cause was an intense weekend writing a large pentest report, combined with programming scripts to ease the reporting in the future. At the same time I was configuring my new laptop and using a new windowing system which relied heavily on key combinations…
Rejoice! You can use KDE filechooser in Firefox and other GTK apps
Today, I found out that it’s possible to use KDE filechooser in Firefox and other GTK applications thanks to the xdg-desktop-portal project. To take advantage of this, make sure xdg-desktop-portal-kde is running (Starts automatically on Kubuntu. You should be able to run it manually if KDE is installed). Set the environment variable GTK_USE_PORTAL=1 , for instance by appending export…
Diving into userscripts
Userscripts are something I never really investigated but always intrigued me. Last weekend I decided to finally check out how to make them. The trigger was the following page: This nag page has been showing up lately whenever I click on a web link from a YouTube description or comment. Yes YouTube, of course I want to leave the website! It’s the world wide web and I clicked on a link!* It kind of…
makepty: A static executable to upgrade raw shells to PTYs
I’ve recently been spending time creating a static executable that can replace python3 -c 'import pty;pty.spawn("/bin/bash")' for platforms which lack python, inspired by a FreeBSD box I was attacking on HackTheBox. The result: makepty , a little Rust program that simply creates a PTY and connects it with stdin and stdout. Click on the video above to see it in use. You can get more information on…
How Microsoft implemented and then removed a crucial Teams feature on Linux
Microsoft Teams is the most downloaded software of 2020. It is now used by offices, schools, courtrooms, governments, and pretty much every other type of organization. As the lockdown was active in april, I had to download Teams to contact my colleagues, as many others had to. At my current assignment, it is the main communication tool for the company. One feature Teams lacked at that time is to…
Fastest fix for responsible disclosure I've seen
Last week I was trying to buy something to fix a bicycle tire. I ended up on BikeBudget and while looking around found a security vulnerability. After reporting it on friday their response was the fastest and nicest I’ve seen! Within an hour the vulnerability was fixed and they mailed me. In the end they offered to send me the tire fixing set for free, and they sent me a whole box of swag! Thanks!…
I created a webapp to help me learn simplified Chinese characters
Find common Chinese characters using pinyin. Click the image to try it now: What It’s a tool that allows you to enter pinyin and optionally a tone number and shows only the commonly used Chinese characters with this pronunciation. It allows you to switch between the top 3500 character list (frequently used) or the top 6500 (relatively common), Some other features include showing or hiding all…