What is stored in crash dumps? The basic idea behind a crash dump is on abnormal program failure (a fault, or kill signal) the operating system will sometimes (depending on settings) dump core o...
Fuzzotron and Radamsa pcap testcases
What’s Da Fuzz One method of finding unknown vulnerabilties is simply shooting a bunch of trash data at a program to see how it reacts, and trapping any error codes. We can fuzz TCP or UDP serv...
Elasticsearch Elastic Agent and Kibana
Background What do you think when you think about custom log integrations? So sometimes it’s great to be able to take loads of data and condense them into a visualized queryable form. What I f...
I Hacked a Bank and Got Arrested in 2012
Knock Knock Seeing as a decade has passed, I finally need to do it for me, to put it on paper how it happened. How I got busted by the FBI. On a warm summer day in mid-2012, I was asleep in my bed...
Iptables Configuration Tips and Tricks
Intro The built-in (kernel level) linux firewall, iptables, can be daunting to attempt to use, however is a simple redirection filter in practice. I have used iptables from everything from securin...
Simple x86_64 buffer overflow in gdb
Background We will be debugging a C buffer overflow in gdb to attain higher privileges. The basic idea behind a C buffer overflow is pretty simple. You have a buffer, a chunk of memory reserved...
Bash wildcard expansion globbing abuse
Background A lot of my research into bugs goes unfounded, and very seldom do I find a bug by actually looking for it, so much as it was just a typo or something. So when I realized that the wildc...
A shadow-utils BoF whitepaper
Background A while back an old friend had asked me if I had a chfn bug. I could see why he wanted one, I mean, a suid 0 binary on every system? Wow yeah, but sadly no, at the time I did not have o...
Networks with OpenVPN and Suricata
Intro Most of my recent posts have been centered around red team security, but this article will be more from a blue team perspective of network security. I’ll cover setting up an offsite server...
The time I enumerated every GitHub admin
Finding the design flaw While playing with the GitHub API querying different things, I had a light bulb go off. If you can query any GitHub user via API, and see their administrator access level, ...
Web app exploitation techniques
Background This is intended to be a concise cheat sheet for common web application exploitation techniques. Most of these techniques are well known, but hopefully, this can serve as a place to b...
Advanced Fuzzing Techniques in ansvif
Prerequisites This article references both ansvif and radamsa which need to be downloaded from github and gitlab respectively and compiled for all this to work. Update: I have another artilce on ...