Articles
Longer writing from the team: research, opinions and write-ups.
There’s a lot of media articles out there covering CVE-2024-3094 and, as usual, a lot of them are hyped up and covered in annoying adverts.
Habitually in our articles we use the term “Threat Actors” where you might expect us to use a term like “attacker” or “cybercriminal”.
I recently wrote a quick start guide to hardening SSL/TLS configurations. During that article I skipped over a big section: SSL Certificates. In this article, we’ll focus on the certificates themselves and the impact of common certificate issues.
Secure Sockets Layer (SSL) was a protocol designed to protect network traffic in transit, however it was superseded by Transport Layer Security (TLS) in 1999.
A couple of years ago I wrote an article about hashcracking with Hashcat and AWS; but that was back on Ubuntu 16.04 and it involved manually compiling the packages.
Akimbo hosted a Webinar to cover hints and tips about running more effective Security Awareness Training.
Username enumeration within web applications is a solvable problem, but I often see web administrators either ignore the issue because they don’t think it’s significant enough to address, or they think it’s not possible to fully address it.
An authentication factor is something that is supplied to verify an identity – the most common example of an authentication factor is a password, a secret word used to authenticate yourself for access to an account.
After publishing yesterday’s article about how frequently you should get a penetration test, I inadvertently started a discussion on Twitter about another aspect of penetration testing delivery: should you change providers, or should you stick with who you know?
With modern platforms such as WordPress, WooCommerce, Magento, and Shopify, it’s now easier than ever to create an online store.
It’s unlikely you will get a strong answer from most organisations as to how frequently you should test.
Choosing a PenTesting provider can be difficult, how do you know if they’re good at what they do and they’ll make working together easy?
Regular penetration testing (e.g. often annual) carried out by experienced professional testers can seem expensive – and in these times, when every penny counts, it’s easy to make the mistake of thinking that pen testing is poor value.
Ok, we get it: everyone is under pressure to squeeze every penny of value from any company expenditure nowadays.
Sweet32 describes a birthday attack on 64-bit block ciphers.
The use of Cipher Block Chaining (CBC) mode ciphers is “discouraged”.
Lucky 13 is a padding oracle vulnerability against CBC-mode ciphers in TLS that utilises a timing side-channel.
Padding Oracle On Downgraded Legacy Encryption (POODLE) is an attack against SSLv3.0.
BEAST is an attack that exploits several weaknesses within Transport Layer Security (TLS) 1.0 and older SSL protocols when using a CBC-mode cipher.
Browser Reconnaissance & Exfiltration via Adaptive Compression of Hypertext (BREACH) is a vulnerability similar in nature to CRIME, but where CRIME affected TLS/SPDY compression, BREACH affects HTTP compression.
Compression Ratio Info-leak Made Easy (CRIME) is a vulnerability in the compression used in Secure Sockets Layer (SSL) and Transport Layer Security (TLS).
Decrypting RSA with Obsolete and Weakened Encryption (DROWN) is a vulnerability in servers that support Secure Sockets Layer (SSL) version 2.0.
Factoring RSA Export Keys (FREAK) is an attack against “export ciphers suites” which are cipher suites that have intentionally limited security due to prior regulation within the United States.
An attack against RC4 was demonstrated in 2015. This attack affects the use of RC4 in several protocols, including within Transport Layer Security (TLS) used by web browsers and web applications but also within WPA-TKIP used by wireless networks.
Return of Bleichenbacher’s Oracle Threat (ROBOT) is a padding oracle vulnerability that allows a threat actor to illegitimately perform RSA decryption and signing operations with the private key of a TLS server.
Look, there’s a whole bunch of vulnerabilities in Secure Sockets Layer (SSL) and Transport Layer Security (TLS) and it can be difficult to keep up with them all, even if they have fancy names and logos!
On March 16th I had the pleasure of speaking at the Yorkshire Cyber Security Cluster about Vulnerability Management.
The Cache-Control HTTP server response header specifies whether the server response can be cached by the web browser and any interim devices such as web proxies.
The X-Frame-Options header can be used to specify whether a web browser should be allowed to render the target page in a frame (such as a frame, iframe, embed, or an object tag).
Akimbo hosted a Webinar to cover hints and tips about how to implement effective system hardening.
OWASP, or the Open Web Application Security Project, are a non-profit organisation that produces a range of articles, tools, and other resources on security topics.
On October 7th I had the pleasure of speaking at ScotSoft 2021 about Penetration Testing and breaking Web Applications.
Penetration Testing, often abbreviated to PenTesting, is a method of testing the security of a system through attempting to discover and actively exploit vulnerabilities within the system.
A follower sent me a suspicious looking file recently to get my opinion on its behaviour and to see if I could pull out a little detail on how it’s working.
I’m currently writing up a series on hardware hacking fundamentals, and before I get into the specifics – I thought it sensible to add a piece on why hardware security is important and to lay out the major themes of what I’ll be discussing.
Logic Analyzers are inexpensive devices that allow you to just take a look at what a small number of pins on a chip are up to.
When penetration testing Amazon Web Services (AWS) environments there are different perspectives the assessment could consider, some are very similar to external infrastructure/web application assessments and some are different.
I recently wrote an introduction to PenTesting an AWS Environment.
I wanted to talk a little bit about the British Airways breach; I won’t be focusing on the intention to fine from the ICO.
A friend of mine mentioned recently that he has to work out subnet masks in his head for an exam and commented in reality he’d just use a subnet calculator.
I posted recently about calculating subnets and CIDR notation quickly, but I didn’t mention in that post how to quickly get the Network ID, first host and Broadcast address for a subnet given an awkward address.
Often abbreviated to CSRF and often pronounced as “Sea-Surf” is an attack against a Web Application that abuses an application’s trust in the user.
Whilst Hashcat is often provably faster than John the Ripper, John is still my favourite.
In 2017 Equifax were breached, the breach was discovered on July 29 and an announcement was published on Sept 7.
I previously mentioned dumping memory contents using SPI, with a BusPirate.
UART stands for Universal Asynchronous Receiver/Transmitter, however in the context of Hardware Hacking we’re generally looking for an serial interface which will give us text output from the system and possibly allow for command input.
HTML5 PostMessages (also known as: Web Messaging, or Cross Domain Messaging) is a method of passing arbitrary data between domains.
So by default SOP won’t allow bi-directional communications between two separate origins, however as applications scale up there may be a requirement to allow this kind of thing.
HTTP Header Injection vulnerabilities occur when user input is insecurely included within server response headers.
Transport Layer Security (TLS), and its deprecated predecessor Secure Sockets Layer (SSL), are protocols that can be used to protect information in transit – and are the underlying protocols used by HTTPS to protect web traffic.
In my experience Insecure Direct Object Reference is one of the least well known vulnerabilities out there, but it’s a very simply issue to explain.
In my introduction to hardware hacking, I mention that radio systems may be part of the attack surface for a hardware device penetration test.
Recently during a CTF I found a few users were unfamiliar with abusing setuid on executable on Linux systems for the purposes of privilege escalation.
I posted earlier about Privilege Escalation through Unquoted Service Paths and how it’s now rare to be able to exploit this in the real world due to the protected nature of the C:\Program Files and C:\Windows directories.
I’ve written a few articles recently about methods of escalating privileges on Windows machines, such as through DLL Hijacking and Unquoted Service Paths, so here I’m continuing the series with Privilege Escalation through Insecure Service configurations.
One method for escalating permission from Local/Domain User to Local Administrator, is “Unquoted Service paths”.
Same-Origin Policy (SOP) is a critical part of the security implemented within a web browser.
Following a successful penetration test, you may have large amounts of data to exfiltrate from an environment specifically hardened to make it difficult to exfiltrate data.
Effectively filtering user input is one of the best ways to prevent an awful lot of web application vulnerabilities.
Many organisations “lock-down” their desktop environments to reduce the impact that malicious staff members and compromised accounts can have on the overall domain security.
Quick reference for exploiting SQL injection against Microsoft SQL Server: comments, version, users, databases, tables, columns and extracting data.
Quick reference for exploiting SQL injection against MySQL: comments, version, users, databases, tables, columns and extracting data.
Password rotation has previously been included within best practice guides as a method of minimising the risk of compromised passwords being valid at the time a threat actor attempts to use them.
Path Traversal, also known as Directory Traversal, is a vulnerability where a user can alter a path used by an application.
We’ve previously posted about manually finding and exploiting SQL injection vulnerabilities.
Command Injection vulnerabilities are a class of application security issue where an attacker can cause the application to execute an underlying operating system command.
We’ve previously written about many different techniques for Finding and Exploiting SQL Injection vulnerabilities.
Weak passwords are those which are predictable and can be easily guessed.
Certification Authority Authorization (CAA) is used to specify which Certificate Authorities may issue certificates for the domain.
Major outages in major public cloud providers such as Azure and AWS are rare, but they do happen.
Out-of-band exploitation refers to exploits where the extracted information is received over a connection other than the one the payload was delivered over.
In a previous article we discussed how bruteforcing Windows accounts is often easier than people expect.
We recently discussed how to break WPA2 keys very quickly using cloud computing.
When performing security tests, we very often come across weak passwords.
SQL Injection is a vulnerability that occurs where user supplied input is insecurely concatenated into an SQL query.
In our article LLMNR and NetBIOS-NS Spoofing with Responder we stepped you through how to exploit a very common issue on Windows networks.
This issue comes about where user supplied input is included within server responses without filtration or encoding.
Whilst Reflected and Stored XSS can generally be addressed through server-side user input encoding (such as through the PHP htmlentities() function) or with browser protections such as Content-Security-Policy, this is not sufficient for DOM-XSS.
IPv6 is not new, RFC1883 discussed the protocol back in 1995.
If an Active Directory user has pre-authentication disabled, a vulnerability is exposed which can allow a threat actor to perform an offline bruteforce attack against that user’s password.
Breaking into Penetration Testing can be a daunting career move; so in this article we talked about ways you can make your first move towards a career in this industry.
In our previous posts we discussed how WEP is completely broken, known weaknesses with WPA, and bruteforcing WPA using AWS.
It is possible to brute-force Windows accounts directly, using tools like Metasploit using modules such as smblogin, which will target port 445 (SMB).
A common configuration on Windows Active Directory accounts is to have an account lockout threshold of say, 5 invalid attempts, and an observation window of 30 minutes.
We covered extracting domain hashes with Mimikatz previously, but that’s not always the best approach – for example where anti-virus is getting in the way.
We’ve previously written about Reflected and Stored Cross-site Scripting, however this time we want to tackle DOM-Based Cross-site Scripting, or DOM-XSS for short.
SQL Injection is an old vulnerability; first published on Christmas Day 1998 in Phrack Magazine 54.
Heya! I wrote this article back in mid-2020 for Ubuntu 18.04; it’s now the future and that’s an old version and no longer supported after April 30, 2023.
Content Security Policy (CSP) allows the application to restrict the location of resources to an allow-list of approved locations, including where scripts can be loaded from and when the application may be framed.
Any domain user within Active Directory can request a service ticket (TGS) for any service that has an SPN (Service Principal Name).
Link-Local Multicast Name Resolution (LLMNR) and NetBIOS-Name Service (NBT-NS) are name resolution protocols that are enabled by default on Windows machines.
Before being able to determine if systems are vulnerable, it’s critical to first find as many active systems within the scope as possible and to accurately determine what services those systems expose.
We recently published an article on using Incognito for privilege escalation as part of a short series on using Metasploit.
Incognito is a tool which can be used for privilege escalation, typically from Local Administrator to Domain Administrator.
Blind injection refers to exploits where the output of the payload is not directly displayed within application output, but the threat actor is able to infer what the output was.
With error-based injection, data can be extracted from the database where an error message can be crafted which contains confidential data.
In terms of crafting payloads, Time-based injection is very similar to Blind-Boolean injection. That is to say that extracting data from the database is generally done one character at a time.
UNION SELECT statements can be used for retrieving the results of a second SELECT statement by appending it to the end of another query. This is useful for SQL injection as it allows you to append a query to the end of a query executed by a developer.
TalkTalk suffered a series of security issues in 2015. Right from the start of the year people were discussing an increased number of scam calls.
Target were breached in 2013. The story was initially broken by Brian Krebs in a post published on 18 December 2013 and titled “Sources: Target investigating Data Breach”.
Metasploit is an exploitation framework. It’s a core tool of the penetration tester’s toolset and we use it for several of our vulnerability demonstrations, so it makes sense to write a quick “introduction to” for Metasploit.
It’s well known that the WiFi security protocol WEP is broken.
We previously spoke about WiFi security and how utterly broken WEP is.
XML Entity Injection is a powerful vulnerability that can allow for confidential data theft and in rare cases command execution.
During Penetration Tests, a common late-stage activity is to compromise the Domain Controller and extract all account password hashes.
Hosting web application content such as dynamic scripts and stylesheets on third parties such as Content Delivery Networks (CDNs) can allow for significant improvements to site performance and can reduce bandwidth costs.
Got a path/directory traversal or file disclosure vulnerability on a Linux-server and need to know some interesting files to hunt for?
Got a path/directory traversal or file disclosure vulnerability on a Windows-server and need to know some interesting files to hunt for?
So it’s 10:30pm on a Sunday and the wonderful Jake Davis has asked me to give my thoughts on the ludicrous movie that is “Hackers” (1995).
LulzSec were an international hacking crew and today marks 5 years since the end of their most well-known campaign: the “50 Days of Lulz”.
Nothing matches that. Try a different word.
The knowledge base has the short, practical guidance we hand to clients.