Hook, Line, and Phishlet: Conquering AD FS with Evilginx
Evilginx phishing AD FS
A detailed walkthrough of the process and hurdles faced in leveraging Evilginx3 to conduct a successful phishing campaign on a AD FS protected domain.
Bee-yond Capacity: Unauthenticated RCE in Extreme Networks/Aerohive Wireless APs - CVE-2023-35803
IoT Aerohive Extreme Networks Exploits Tools RCE Buffer Overflow
CVE-2023-35803 - An adventure in finding and exploiting a buffer overflow in Extreme Networks/Aerohive Wireless Access Points
Pentah0wnage: Pre-Auth RCE in Pentaho Business Analytics Server
web Exploits RCE Auth Bypass SSTI
Check that regex.
The Threat on Your Desk: Building an Evil USB-C Dock
Implants Red Teaming BadUSB Tools
BadUSB attacks have been a threat for years, but is the USB-C dock sitting on your desk the latest threat in disguise?
Reverse SSH: A Fast, Stable Reverse Shell Handler
Want to use SSH for reverse shells? Now you can.
Device Code Phishing: A Frontend UI
A framework for OAuth 2.0 device code authentication grant flow phishing.
Hacking the Hive: Discovering Vulnerabilities in Aerohive Devices
IoT Aerohive Exploits Tools
Learn how to write your own firmware for Aerohive devices! With a bonus side order of some remote code execution!
CCTV: Now You See Me, Now You Don't
IoT IP Camera CCTV
How to take over an IoT camera stream.
Same-Origin Policy: From birth until today
Browser CSRF SoP CORS
A web browser’s same origin policy plays a major role in preventing Cross-Site Request Forgery attacks. The standard is clear on what the acceptable behaviour is, but do all browsers follow it?
Automating a Thorny SQL Injection With SQLMap
sqli sqlmap web
SQLMap is one of the best tool in exploiting sql injection. However, there are moments where this tool will not produce the expected results if we do not supplying the correct options. This post covers a tricky SQL Injection vulnerability that I found in a recent assessment.
Universal Second Factor - Phishing-proof 2FA for general human beings
MFA/2FA U2F Fido
U2F is an open, driverless, digital signature challenge-response protocol for secure two factor authentication. It’s designed to improve user security through ease of use.
SCADA Penetration Testing: Do I need to be prepared?
In this blog post Nilesh shares his experience performing a SCADA assessment, what pentest approach works best for highly sensitive systems, and preferred tools of the trade.
Hunting For Bugs With AFL 101 - A Primer
An overview of how to begin searching for vulnerabilities within software, by fuzzing the binary with AFL
Bypassing SAML 2.0 SSO with XML Signature Attacks
SSO Saml XSW
Unfortunately, many SAML consumers don’t validate responses properly, allowing attacks up to and including full authentication bypass.
iOS Application Security Review Methodology
iOS Mobile App Review
The following post aims to provide a high level overview of an iOS application security review methodology and an introduction of some tools publicly available to perform the analysis.