hntr, shareable workspaces for target data
In the last weeks I hacked together a tool to help me organize my (temporary) target and infrastructure data I gather during audits. All existing …
Archive · 14 entries
Security
All Entries
Smuggling HTTP headers through reverse proxies
Summary: Under some conditions, it is possible to smuggle HTTP headers through a reverse proxy, even if it was explicitly unset before. This is …
Bug Bounty: Bypassing a crappy WAF to exploit a blind SQL injection
Some time ago I found a blind SQL injection on a bug bounty target. The web page was built with ASP.NET and had a big attack surface. After crawling …
Re-using socket FDs vs reverse shell
There is a simple trick Seb and me used in a few CTFs which it seems some CTFS players are not aware of – at least that’s what it looks like …
Solving ROP primer level2
Some days ago I started reading into Return Oriented Programming and had a lot of fun doing some VMs and exercises I found over the internet. ROP is a …
CVE-2016-5195 (Dirtycow) Local Root PoC
After the proof of concept code for CVE-2016-5195 (DirtyCow) was released, the game was on to ‘weaponize’ this PoC to a full local root …
Webanalyze, utility to uncover technologies used on websites.
webanalyze is a (Go) port of wappalyzer, a browser extension to display technologies used on websites. To use this in a performant way to test …
Announcing pentrack.io
It’s been a long time I’m working on this and I’m happy to announce my new project: pentrack.io. PenTrack is a server platform to …
Be careful when going client only (Firebase)
Firebase, the scalable real-time backend Developing client-only applications with JavaScript and services like Firebase offer a nice way to …
Drupal Security Scanner
DPscan.py to DrupalScan Recently I was in the need of a simple “drupal security scanner” which enumerates all modules of a drupal project …
Cracking salted MD5 with Hashcat
Some days ago during a pentest I found a critical sql injection vulnerability which gave me access to the user database. Most of the time finding this …
EPLUS Group (mobile network operator) security issue (SMS flood, MSISDN verification)
Some months ago (16th of Sep.) I found a security issue on an EPLUS service page, which allows you to send as much SMS as you want to their customers …
Advanced INSERT INTO Injection by Taking Advantage of the Primary Key
The idea I recently found a security issue in myBloggie. Injeting malicious code into the SQL-statement was quite simple, the only thing you had to do …
myBloggie 2.1.6 SQL Injection and Persistent XSS
Information Software: myBloggie 2.1.6 Severity: High Author: Robin Verton Date: Jun. 12 2011 Vendor: http://mybloggie.mywebland.com/ Software …