The Threat on Your Desk: Building an Evil USB-C Dock
BadUSB attacks have been a threat for years, but is the USB-C dock sitting on your desk the latest threat in disguise?
Pentest Blog Posts
Reverse SSH: A Fast, Stable Reverse Shell Handler
Want to use SSH for reverse shells? Now you can.
Device Code Phishing: A Frontend UI
A framework for OAuth 2.0 device code authentication grant flow phishing.
Hacking the Hive: Discovering Vulnerabilities in Aerohive Devices
Learn how to write your own firmware for Aerohive devices! With a bonus side order of some remote code execution!
Same-Origin Policy: From birth until today
A web browser’s same origin policy plays a major role in preventing Cross-Site Request Forgery attacks. The standard is clear on what the acceptable behaviour is, but do all browsers follow it?
Automating a Thorny SQL Injection With SQLMap
SQLMap is one of the best tool in exploiting sql injection. However, there are moments where this tool will not produce the expected results if we do not supplying the correct options. This post covers a tricky SQL Injection vulnerability that I found in a recent assessment.
Universal Second Factor - Phishing-proof 2FA for general human beings
U2F is an open, driverless, digital signature challenge-response protocol for secure two factor authentication. It’s designed to improve user security through ease of use.
SCADA Penetration Testing: Do I need to be prepared?
In this blog post Nilesh shares his experience performing a SCADA assessment, what pentest approach works best for highly sensitive systems, and preferred tools of the trade.
Hunting For Bugs With AFL 101 - A Primer
An overview of how to begin searching for vulnerabilities within software, by fuzzing the binary with AFL