Clik here to view.
Understanding & practicing java deserialization exploits
A good periodic reminder when attempting to learn things is that reading about the subject is not the same as actually practicing the subject you read about. That is why it’s always a good thing to...
View ArticleClik here to view.
Brute forcing encrypted web login forms
There are a ton of ways to brute force login forms, you just need to google for it and the first couple of hits will usually do it. That is of course unless you have Burp in which case it will be...
View ArticleClik here to view.
Quantum Insert: bypassing IP restrictions
By now everyone has probably heard of Quantum Insert NSA style, if you haven’t then I’d recommend to check out some articles at the end of this post. For those who have been around for a while the...
View ArticleClik here to view.
Repurposing the HP audio key logger
The last couple of days there has been some fuzz about the HP audio key logger as disclosed by modzero in their blog post and the detailed advisory that they released. The following sentence in their...
View ArticleClik here to view.
Win10 secure boot inside vmware fusion
Quick blog to remind myself what the correct combination of options are to run Windows 10 Pro x64 with secure boot enabled within VMWare Fusion. Couple of reason why you’d want to do this: Avoid a...
View ArticleClik here to view.
Meterpreter, registry & unicode quirk work around
So this is a quick post with hopefully the goal of saving somebody else some time. Just for the record, I could have missed something totally trivial and I will hopefully get corrected :) When working...
View ArticleClik here to view.
[python] Poor man’s forensics
So after a period of ‘lesser technical times’ I finally got a chance to play around with bits, bytes and other subjects of the information security world. A while back I got involved in a forensic...
View ArticleClik here to view.
Idea: Abusing Google DLP for NSA-style content searching
Errr ok, so the “NSA-style content searching” might be a bit overrated then again it’s usually only the intelligence agencies which perform this type of bulk searches as far as I know. Anyhow, here is...
View ArticleClik here to view.
PowerShell overview and introduction
This is a long overdue post I was planning on writing as a reference for myself, since I don’t write that much PowerShell. Depending on your own knowledge about powershell you can just skip to whatever...
View ArticleClik here to view.
pageant key extraction automated
Well this will be a rather short post since it’s about the automation of my previous blog post in which we analysed the memory dump of the pageant process and manually extracted unencrypted keys. You...
View ArticleClik here to view.
Discovering the secrets of a pageant minidump
A Red Team exercise is lotsa fun not only because you have a more realistic engagement due to the broader scope, but also because you can encounter situations which you normally wouldn’t on a regular...
View ArticleClik here to view.
Parsing the hiberfil.sys, searching for slack space
Implementing functionality that is already available in an available tool is something that has always taught me a lot, thus I keep on doing it when I encounter something I want to fully understand. In...
View ArticleClik here to view.
Writing your own blind SQLi script
We all know that sqlmap is a really great tool which has a lot of options that you can tweak and adjust to exploit the SQLi vuln you just found (or that sqlmap found for you). On rare occasions however...
View ArticleClik here to view.
Quick POC to mitm RDP ssl
So the other day I stumbled upon this great article from Portcullis Labs. The article explains how you can man-in-the-middle an RDP SSL connection. This can be helpful in obtaining the user’s password,...
View ArticleClik here to view.
[old] VMware vSphere client XML External Entity attack
So this is a *really* old blog post that I wrote a while back when I discovered, or at least so I believed, an XXE bug in the VMware vSphere client. I reported this to the VMware security team but they...
View ArticleClik here to view.
Solving RogueCoder’s SQLi challenge
So I’m hanging around on #vulnhub (freenode) when RogueCoder silently drops a SQLi challenge, which you can find here: http://ethax.secnet.org/challenges/sqli-01.php?id=1 At first I ignored it since...
View ArticleClik here to view.
Encrypted Screenshots
You might be wondering why on earth you’d need to take encrypted screenshots, in that case here are a couple of reasons: The machine on which you take screenshots has different levels of classification...
View ArticleClik here to view.
[QP] raw sockets & iptables
Funny how sometimes you don’t realize stuff until you actually try to interact with it instead of just observing it. I’ve used tcpdump many times behind a normal iptables ruleset, I’ve also used...
View ArticleClik here to view.
Remote hash dumping: no processes or tool upload needed
So after my last article, in which I describe an alternative way to execute code on a remote machine if you have the local administrator’s password, I kept wondering what else could be done with the...
View ArticleClik here to view.
Alternative psexec: no wmi, services or mof needed
For me the fun in hacking still remains in finding new ways to achieve the same goal. On one of those days with splendid sun and people having their beer, I thought it would be a good idea to start...
View Article
![ONEW – KAKERA -Unmei no Piece- – EP [iTunes Plus M4A]](http://is1-ssl.mzstatic.com/image/thumb/Music221/v4/d0/fb/86/d0fb86a5-ba60-4bea-41fb-7f54c125f518/VEATP-45908.jpg/296x296bb.webp)
/pic9814888.png)
