https://akimbocore.com/Recent content on Akimbo CoreHugoenTue, 04 Feb 2025 00:00:00 +0000https://akimbocore.com/knowledge-base/it-security-policies/akimbos-good-policy-guide/Tue, 04 Feb 2025 00:00:00 +0000https://akimbocore.com/knowledge-base/it-security-policies/akimbos-good-policy-guide/Version control, ownership, purpose, scope, plain English, exceptions and violations: the structure every policy needs.https://akimbocore.com/knowledge-base/it-security-policies/good-policy-guide-acceptable-use-policy/Tue, 04 Feb 2025 00:00:00 +0000https://akimbocore.com/knowledge-base/it-security-policies/good-policy-guide-acceptable-use-policy/Personal use, scope, monitoring rights and prohibited uses: the decisions an acceptable use policy has to make explicitly, with a starting template.https://akimbocore.com/knowledge-base/it-security-policies/good-policy-guide-ai-policy/Tue, 04 Feb 2025 00:00:00 +0000https://akimbocore.com/knowledge-base/it-security-policies/good-policy-guide-ai-policy/Decide what the policy is for first: banning tools, banning uses, or controlling data sharing. Then a starting template covering each.https://akimbocore.com/article/xz-backdoor-cve-2024-3094/Wed, 10 Apr 2024 00:00:00 +0100https://akimbocore.com/article/xz-backdoor-cve-2024-3094/There’s a lot of media articles out there covering CVE-2024-3094 and, as usual, a lot of them are hyped up and covered in annoying adverts.https://akimbocore.com/knowledge-base/web-security/http-security-headers/Tue, 09 Apr 2024 00:00:00 +0100https://akimbocore.com/knowledge-base/web-security/http-security-headers/Which response headers to set, what each one protects against, and why some older ones are now deprecated.https://akimbocore.com/knowledge-base/cryptography/tls-protocols-and-cipher-suites/Mon, 08 Apr 2024 00:00:00 +0100https://akimbocore.com/knowledge-base/cryptography/tls-protocols-and-cipher-suites/Which TLS versions and cipher suites to enable, which to disable, and the attacks behind each recommendation.https://akimbocore.com/knowledge-base/cryptography/certificate-lifespans/Fri, 22 Mar 2024 00:00:00 +0000https://akimbocore.com/knowledge-base/cryptography/certificate-lifespans/Why maximum certificate lifetimes keep being cut, the arguments on both sides, and what it means for how you manage renewals.https://akimbocore.com/knowledge-base/user-account-security/session-termination/Thu, 21 Mar 2024 00:00:00 +0000https://akimbocore.com/knowledge-base/user-account-security/session-termination/Inactivity and absolute timeouts, logging off properly, ending other sessions and handling simultaneous logins, without driving users to weaker passwords.https://akimbocore.com/knowledge-base/user-account-security/account-lockout/Mon, 11 Mar 2024 00:00:00 +0000https://akimbocore.com/knowledge-base/user-account-security/account-lockout/How account lockout prevents online password guessing, the denial of service it can introduce, and why exponential backoff beats a fixed lockout duration.https://akimbocore.com/knowledge-base/user-account-security/strong-passwords/Mon, 11 Mar 2024 00:00:00 +0000https://akimbocore.com/knowledge-base/user-account-security/strong-passwords/What makes a password strong, why complexity rules and forced rotation backfire, and what to require instead.https://akimbocore.com/article/what-do-you-mean-by-threat-actor/Sun, 07 Jan 2024 00:00:00 +0000https://akimbocore.com/article/what-do-you-mean-by-threat-actor/Habitually in our articles we use the term “Threat Actors” where you might expect us to use a term like “attacker” or “cybercriminal”.https://akimbocore.com/article/hardening-ssl-tls-common-x509-ssl-certificate-issues/Tue, 04 Jul 2023 00:00:00 +0100https://akimbocore.com/article/hardening-ssl-tls-common-x509-ssl-certificate-issues/I recently wrote a quick start guide to hardening SSL/TLS configurations. During that article I skipped over a big section: SSL Certificates. In this article, we’ll focus on the certificates themselves and the impact of common certificate issues.https://akimbocore.com/article/hardening-ssl-tls-common-ssl-security-issues-vulnerabilities/Mon, 03 Jul 2023 00:00:00 +0100https://akimbocore.com/article/hardening-ssl-tls-common-ssl-security-issues-vulnerabilities/Secure Sockets Layer (SSL) was a protocol designed to protect network traffic in transit, however it was superseded by Transport Layer Security (TLS) in 1999.https://akimbocore.com/article/hashcracking-with-hashcat-and-aws/Thu, 15 Dec 2022 00:00:00 +0000https://akimbocore.com/article/hashcracking-with-hashcat-and-aws/A couple of years ago I wrote an article about hashcracking with Hashcat and AWS; but that was back on Ubuntu 16.04 and it involved manually compiling the packages.https://akimbocore.com/article/webinar-your-security-awareness-training-sucks/Tue, 13 Dec 2022 00:00:00 +0000https://akimbocore.com/article/webinar-your-security-awareness-training-sucks/Akimbo hosted a Webinar to cover hints and tips about running more effective Security Awareness Training.https://akimbocore.com/article/preventing-username-enumeration/Thu, 01 Dec 2022 00:00:00 +0000https://akimbocore.com/article/preventing-username-enumeration/Username enumeration within web applications is a solvable problem, but I often see web administrators either ignore the issue because they don’t think it’s significant enough to address, or they think it’s not possible to fully address it.https://akimbocore.com/article/what-is-multi-factor-authentication-why-should-i-use-mfa/Wed, 09 Nov 2022 00:00:00 +0000https://akimbocore.com/article/what-is-multi-factor-authentication-why-should-i-use-mfa/An authentication factor is something that is supplied to verify an identity – the most common example of an authentication factor is a password, a secret word used to authenticate yourself for access to an account.https://akimbocore.com/article/penetration-testing-should-you-regularly-change-providers/Wed, 02 Nov 2022 00:00:00 +0000https://akimbocore.com/article/penetration-testing-should-you-regularly-change-providers/After publishing yesterday’s article about how frequently you should get a penetration test, I inadvertently started a discussion on Twitter about another aspect of penetration testing delivery: should you change providers, or should you stick with who you know?https://akimbocore.com/article/small-business-ecommerce-how-do-i-prevent-my-site-getting-hacked/Wed, 02 Nov 2022 00:00:00 +0000https://akimbocore.com/article/small-business-ecommerce-how-do-i-prevent-my-site-getting-hacked/With modern platforms such as WordPress, WooCommerce, Magento, and Shopify, it’s now easier than ever to create an online store.https://akimbocore.com/article/pen-testing-how-often-should-you-pentest/Fri, 28 Oct 2022 00:00:00 +0100https://akimbocore.com/article/pen-testing-how-often-should-you-pentest/It’s unlikely you will get a strong answer from most organisations as to how frequently you should test.https://akimbocore.com/article/selecting-a-pentest-provider-making-a-good-decision/Fri, 28 Oct 2022 00:00:00 +0100https://akimbocore.com/article/selecting-a-pentest-provider-making-a-good-decision/Choosing a PenTesting provider can be difficult, how do you know if they’re good at what they do and they’ll make working together easy?https://akimbocore.com/article/turn-pen-testing-from-cost-to-competitive-advantage/Thu, 27 Oct 2022 00:00:00 +0100https://akimbocore.com/article/turn-pen-testing-from-cost-to-competitive-advantage/Regular penetration testing (e.g. often annual) carried out by experienced professional testers can seem expensive – and in these times, when every penny counts, it’s easy to make the mistake of thinking that pen testing is poor value.https://akimbocore.com/article/penetration-testing-how-to-get-the-most-from-your-budget/Thu, 27 Oct 2022 00:00:00 +0100https://akimbocore.com/article/penetration-testing-how-to-get-the-most-from-your-budget/Ok, we get it: everyone is under pressure to squeeze every penny of value from any company expenditure nowadays.https://akimbocore.com/article/ssl-vunerability-sweet32/Thu, 27 Oct 2022 00:00:00 +0100https://akimbocore.com/article/ssl-vunerability-sweet32/Sweet32 describes a birthday attack on 64-bit block ciphers.https://akimbocore.com/article/ssl-vulnerability-cbc-mode-ciphers/Tue, 25 Oct 2022 00:00:00 +0100https://akimbocore.com/article/ssl-vulnerability-cbc-mode-ciphers/The use of Cipher Block Chaining (CBC) mode ciphers is “discouraged”.https://akimbocore.com/article/ssl-vulnerability-lucky13/Tue, 25 Oct 2022 00:00:00 +0100https://akimbocore.com/article/ssl-vulnerability-lucky13/Lucky 13 is a padding oracle vulnerability against CBC-mode ciphers in TLS that utilises a timing side-channel.https://akimbocore.com/article/ssl-vulnerability-ssl-tls-poodle/Tue, 25 Oct 2022 00:00:00 +0100https://akimbocore.com/article/ssl-vulnerability-ssl-tls-poodle/Padding Oracle On Downgraded Legacy Encryption (POODLE) is an attack against SSLv3.0.https://akimbocore.com/article/ssl-vulnerability-beast/Fri, 21 Oct 2022 00:00:00 +0100https://akimbocore.com/article/ssl-vulnerability-beast/BEAST is an attack that exploits several weaknesses within Transport Layer Security (TLS) 1.0 and older SSL protocols when using a CBC-mode cipher.https://akimbocore.com/article/ssl-vulnerability-breach/Fri, 21 Oct 2022 00:00:00 +0100https://akimbocore.com/article/ssl-vulnerability-breach/Browser Reconnaissance & Exfiltration via Adaptive Compression of Hypertext (BREACH) is a vulnerability similar in nature to CRIME, but where CRIME affected TLS/SPDY compression, BREACH affects HTTP compression.https://akimbocore.com/article/ssl-vulnerability-crime/Fri, 21 Oct 2022 00:00:00 +0100https://akimbocore.com/article/ssl-vulnerability-crime/Compression Ratio Info-leak Made Easy (CRIME) is a vulnerability in the compression used in Secure Sockets Layer (SSL) and Transport Layer Security (TLS).https://akimbocore.com/article/ssl-vulnerability-drown/Fri, 21 Oct 2022 00:00:00 +0100https://akimbocore.com/article/ssl-vulnerability-drown/Decrypting RSA with Obsolete and Weakened Encryption (DROWN) is a vulnerability in servers that support Secure Sockets Layer (SSL) version 2.0.https://akimbocore.com/article/ssl-vulnerability-freak/Fri, 21 Oct 2022 00:00:00 +0100https://akimbocore.com/article/ssl-vulnerability-freak/Factoring RSA Export Keys (FREAK) is an attack against “export ciphers suites” which are cipher suites that have intentionally limited security due to prior regulation within the United States.https://akimbocore.com/article/ssl-vulnerability-rc4-nomore/Fri, 21 Oct 2022 00:00:00 +0100https://akimbocore.com/article/ssl-vulnerability-rc4-nomore/An attack against RC4 was demonstrated in 2015. This attack affects the use of RC4 in several protocols, including within Transport Layer Security (TLS) used by web browsers and web applications but also within WPA-TKIP used by wireless networks.https://akimbocore.com/article/ssl-vulnerability-robot/Fri, 21 Oct 2022 00:00:00 +0100https://akimbocore.com/article/ssl-vulnerability-robot/Return of Bleichenbacher’s Oracle Threat (ROBOT) is a padding oracle vulnerability that allows a threat actor to illegitimately perform RSA decryption and signing operations with the private key of a TLS server.https://akimbocore.com/article/tls-ssl-vulnerabilities/Fri, 21 Oct 2022 00:00:00 +0100https://akimbocore.com/article/tls-ssl-vulnerabilities/Look, there’s a whole bunch of vulnerabilities in Secure Sockets Layer (SSL) and Transport Layer Security (TLS) and it can be difficult to keep up with them all, even if they have fancy names and logos!https://akimbocore.com/article/your-security-management-sucks/Wed, 16 Mar 2022 00:00:00 +0000https://akimbocore.com/article/your-security-management-sucks/On March 16th I had the pleasure of speaking at the Yorkshire Cyber Security Cluster about Vulnerability Management.https://akimbocore.com/article/http-security-headers-cache-control/Mon, 21 Feb 2022 00:00:00 +0000https://akimbocore.com/article/http-security-headers-cache-control/The Cache-Control HTTP server response header specifies whether the server response can be cached by the web browser and any interim devices such as web proxies.https://akimbocore.com/article/http-security-headers-x-frame-options-clickjacking/Mon, 21 Feb 2022 00:00:00 +0000https://akimbocore.com/article/http-security-headers-x-frame-options-clickjacking/The X-Frame-Options header can be used to specify whether a web browser should be allowed to render the target page in a frame (such as a frame, iframe, embed, or an object tag).https://akimbocore.com/article/webinar-your-system-hardening-sucks/Fri, 17 Dec 2021 00:00:00 +0000https://akimbocore.com/article/webinar-your-system-hardening-sucks/Akimbo hosted a Webinar to cover hints and tips about how to implement effective system hardening.https://akimbocore.com/article/owasp-top-10-2021/Fri, 03 Dec 2021 00:00:00 +0000https://akimbocore.com/article/owasp-top-10-2021/OWASP, or the Open Web Application Security Project, are a non-profit organisation that produces a range of articles, tools, and other resources on security topics.https://akimbocore.com/article/scotsoft-building-and-breaking-web-applications/Mon, 11 Oct 2021 00:00:00 +0100https://akimbocore.com/article/scotsoft-building-and-breaking-web-applications/On October 7th I had the pleasure of speaking at ScotSoft 2021 about Penetration Testing and breaking Web Applications.https://akimbocore.com/article/what-is-penetration-testing/Sun, 22 Aug 2021 00:00:00 +0100https://akimbocore.com/article/what-is-penetration-testing/Penetration Testing, often abbreviated to PenTesting, is a method of testing the security of a system through attempting to discover and actively exploit vulnerabilities within the system.https://akimbocore.com/article/example-malware-teardown/Fri, 06 Aug 2021 00:00:00 +0100https://akimbocore.com/article/example-malware-teardown/A follower sent me a suspicious looking file recently to get my opinion on its behaviour and to see if I could pull out a little detail on how it’s working.https://akimbocore.com/article/introduction-to-hardware-hacking/Fri, 06 Aug 2021 00:00:00 +0100https://akimbocore.com/article/introduction-to-hardware-hacking/I’m currently writing up a series on hardware hacking fundamentals, and before I get into the specifics – I thought it sensible to add a piece on why hardware security is important and to lay out the major themes of what I’ll be discussing.https://akimbocore.com/article/an-introduction-to-logic-analyzers/Fri, 06 Aug 2021 00:00:00 +0100https://akimbocore.com/article/an-introduction-to-logic-analyzers/Logic Analyzers are inexpensive devices that allow you to just take a look at what a small number of pins on a chip are up to.https://akimbocore.com/article/introduction-to-penetration-testing-aws/Fri, 06 Aug 2021 00:00:00 +0100https://akimbocore.com/article/introduction-to-penetration-testing-aws/When penetration testing Amazon Web Services (AWS) environments there are different perspectives the assessment could consider, some are very similar to external infrastructure/web application assessments and some are different.https://akimbocore.com/article/introduction-to-pentesting-azure/Fri, 06 Aug 2021 00:00:00 +0100https://akimbocore.com/article/introduction-to-pentesting-azure/I recently wrote an introduction to PenTesting an AWS Environment.https://akimbocore.com/article/british-airways-breach-2018/Fri, 06 Aug 2021 00:00:00 +0100https://akimbocore.com/article/british-airways-breach-2018/I wanted to talk a little bit about the British Airways breach; I won’t be focusing on the intention to fine from the ICO.https://akimbocore.com/article/calculating-subnets-and-cidr-quickly/Fri, 06 Aug 2021 00:00:00 +0100https://akimbocore.com/article/calculating-subnets-and-cidr-quickly/A friend of mine mentioned recently that he has to work out subnet masks in his head for an exam and commented in reality he’d just use a subnet calculator.https://akimbocore.com/article/calculating-the-details-of-awkward-subnets/Fri, 06 Aug 2021 00:00:00 +0100https://akimbocore.com/article/calculating-the-details-of-awkward-subnets/I posted recently about calculating subnets and CIDR notation quickly, but I didn’t mention in that post how to quickly get the Network ID, first host and Broadcast address for a subnet given an awkward address.https://akimbocore.com/article/cross-site-request-forgery/Fri, 06 Aug 2021 00:00:00 +0100https://akimbocore.com/article/cross-site-request-forgery/Often abbreviated to CSRF and often pronounced as “Sea-Surf” is an attack against a Web Application that abuses an application’s trust in the user.https://akimbocore.com/article/custom-rules-for-john-the-ripper/Fri, 06 Aug 2021 00:00:00 +0100https://akimbocore.com/article/custom-rules-for-john-the-ripper/Whilst Hashcat is often provably faster than John the Ripper, John is still my favourite.https://akimbocore.com/article/equifax-breach-2017/Fri, 06 Aug 2021 00:00:00 +0100https://akimbocore.com/article/equifax-breach-2017/In 2017 Equifax were breached, the breach was discovered on July 29 and an announcement was published on Sept 7.https://akimbocore.com/article/extracting-flash-memory-using-jtag/Fri, 06 Aug 2021 00:00:00 +0100https://akimbocore.com/article/extracting-flash-memory-using-jtag/I previously mentioned dumping memory contents using SPI, with a BusPirate.https://akimbocore.com/article/finding-serial-interfaces-uart/Fri, 06 Aug 2021 00:00:00 +0100https://akimbocore.com/article/finding-serial-interfaces-uart/UART stands for Universal Asynchronous Receiver/Transmitter, however in the context of Hardware Hacking we’re generally looking for an serial interface which will give us text output from the system and possibly allow for command input.https://akimbocore.com/article/html5-cross-domain-messaging-postmessage-vulnerabilities/Fri, 06 Aug 2021 00:00:00 +0100https://akimbocore.com/article/html5-cross-domain-messaging-postmessage-vulnerabilities/HTML5 PostMessages (also known as: Web Messaging, or Cross Domain Messaging) is a method of passing arbitrary data between domains.https://akimbocore.com/article/html5-cross-origin-resource-sharing-cors-vulnerabilities/Fri, 06 Aug 2021 00:00:00 +0100https://akimbocore.com/article/html5-cross-origin-resource-sharing-cors-vulnerabilities/So by default SOP won’t allow bi-directional communications between two separate origins, however as applications scale up there may be a requirement to allow this kind of thing.https://akimbocore.com/article/http-header-injection/Fri, 06 Aug 2021 00:00:00 +0100https://akimbocore.com/article/http-header-injection/HTTP Header Injection vulnerabilities occur when user input is insecurely included within server response headers.https://akimbocore.com/article/http-security-headers-strict-transport-security-hsts/Fri, 06 Aug 2021 00:00:00 +0100https://akimbocore.com/article/http-security-headers-strict-transport-security-hsts/Transport Layer Security (TLS), and its deprecated predecessor Secure Sockets Layer (SSL), are protocols that can be used to protect information in transit – and are the underlying protocols used by HTTPS to protect web traffic.https://akimbocore.com/article/idor-insecure-direct-object-reference/Fri, 06 Aug 2021 00:00:00 +0100https://akimbocore.com/article/idor-insecure-direct-object-reference/In my experience Insecure Direct Object Reference is one of the least well known vulnerabilities out there, but it’s a very simply issue to explain.https://akimbocore.com/article/introduction-to-radio-hacking/Fri, 06 Aug 2021 00:00:00 +0100https://akimbocore.com/article/introduction-to-radio-hacking/In my introduction to hardware hacking, I mention that radio systems may be part of the attack surface for a hardware device penetration test.https://akimbocore.com/article/linux-privesc-abusing-suid/Fri, 06 Aug 2021 00:00:00 +0100https://akimbocore.com/article/linux-privesc-abusing-suid/Recently during a CTF I found a few users were unfamiliar with abusing setuid on executable on Linux systems for the purposes of privilege escalation.https://akimbocore.com/article/privilege-escalation-dll-hijacking/Fri, 06 Aug 2021 00:00:00 +0100https://akimbocore.com/article/privilege-escalation-dll-hijacking/I posted earlier about Privilege Escalation through Unquoted Service Paths and how it’s now rare to be able to exploit this in the real world due to the protected nature of the C:\Program Files and C:\Windows directories.https://akimbocore.com/article/privilege-escalation-insecure-service-permissions/Fri, 06 Aug 2021 00:00:00 +0100https://akimbocore.com/article/privilege-escalation-insecure-service-permissions/I’ve written a few articles recently about methods of escalating privileges on Windows machines, such as through DLL Hijacking and Unquoted Service Paths, so here I’m continuing the series with Privilege Escalation through Insecure Service configurations.https://akimbocore.com/article/privilege-escalation-unquoted-service-path/Fri, 06 Aug 2021 00:00:00 +0100https://akimbocore.com/article/privilege-escalation-unquoted-service-path/One method for escalating permission from Local/Domain User to Local Administrator, is “Unquoted Service paths”.https://akimbocore.com/article/sop-same-origin-policy/Fri, 06 Aug 2021 00:00:00 +0100https://akimbocore.com/article/sop-same-origin-policy/Same-Origin Policy (SOP) is a critical part of the security implemented within a web browser.https://akimbocore.com/article/spoofing-packets-and-dns-exfiltration/Fri, 06 Aug 2021 00:00:00 +0100https://akimbocore.com/article/spoofing-packets-and-dns-exfiltration/Following a successful penetration test, you may have large amounts of data to exfiltrate from an environment specifically hardened to make it difficult to exfiltrate data.https://akimbocore.com/article/web-application-defence-filtering-user-input/Fri, 06 Aug 2021 00:00:00 +0100https://akimbocore.com/article/web-application-defence-filtering-user-input/Effectively filtering user input is one of the best ways to prevent an awful lot of web application vulnerabilities.https://akimbocore.com/article/windows-desktop-breakout/Fri, 06 Aug 2021 00:00:00 +0100https://akimbocore.com/article/windows-desktop-breakout/Many organisations “lock-down” their desktop environments to reduce the impact that malicious staff members and compromised accounts can have on the overall domain security.https://akimbocore.com/article/mssql-sql-injection-cheat-sheet/Thu, 05 Aug 2021 00:00:00 +0100https://akimbocore.com/article/mssql-sql-injection-cheat-sheet/Quick reference for exploiting SQL injection against Microsoft SQL Server: comments, version, users, databases, tables, columns and extracting data.https://akimbocore.com/article/mysql-sql-injection-cheat-sheet/Thu, 05 Aug 2021 00:00:00 +0100https://akimbocore.com/article/mysql-sql-injection-cheat-sheet/Quick reference for exploiting SQL injection against MySQL: comments, version, users, databases, tables, columns and extracting data.https://akimbocore.com/article/strong-passwords-rotation/Thu, 10 Jun 2021 00:00:00 +0100https://akimbocore.com/article/strong-passwords-rotation/Password rotation has previously been included within best practice guides as a method of minimising the risk of compromised passwords being valid at the time a threat actor attempts to use them.https://akimbocore.com/article/exploiting-path-traversal/Mon, 07 Jun 2021 00:00:00 +0100https://akimbocore.com/article/exploiting-path-traversal/Path Traversal, also known as Directory Traversal, is a vulnerability where a user can alter a path used by an application.https://akimbocore.com/article/exploiting-sql-injection-with-sqlmap/Mon, 07 Jun 2021 00:00:00 +0100https://akimbocore.com/article/exploiting-sql-injection-with-sqlmap/We’ve previously posted about manually finding and exploiting SQL injection vulnerabilities.https://akimbocore.com/article/finding-command-injection/Mon, 07 Jun 2021 00:00:00 +0100https://akimbocore.com/article/finding-command-injection/Command Injection vulnerabilities are a class of application security issue where an attacker can cause the application to execute an underlying operating system command.https://akimbocore.com/article/sql-injection-filter-evasion-with-sqlmap/Mon, 07 Jun 2021 00:00:00 +0100https://akimbocore.com/article/sql-injection-filter-evasion-with-sqlmap/We’ve previously written about many different techniques for Finding and Exploiting SQL Injection vulnerabilities.https://akimbocore.com/article/strong-passwords-complexity/Mon, 07 Jun 2021 00:00:00 +0100https://akimbocore.com/article/strong-passwords-complexity/Weak passwords are those which are predictable and can be easily guessed.https://akimbocore.com/article/certification-authority-authorization-caa/Wed, 14 Apr 2021 00:00:00 +0100https://akimbocore.com/article/certification-authority-authorization-caa/Certification Authority Authorization (CAA) is used to specify which Certificate Authorities may issue certificates for the domain.https://akimbocore.com/article/controlled-chaos/Wed, 10 Mar 2021 00:00:00 +0000https://akimbocore.com/article/controlled-chaos/Major outages in major public cloud providers such as Azure and AWS are rare, but they do happen.https://akimbocore.com/article/sql-injection-exploitation-out-of-band/Tue, 26 Jan 2021 00:00:00 +0000https://akimbocore.com/article/sql-injection-exploitation-out-of-band/Out-of-band exploitation refers to exploits where the extracted information is received over a connection other than the one the payload was delivered over.https://akimbocore.com/article/preventing-windows-account-brute-forcing/Sat, 23 Jan 2021 00:00:00 +0000https://akimbocore.com/article/preventing-windows-account-brute-forcing/In a previous article we discussed how bruteforcing Windows accounts is often easier than people expect.https://akimbocore.com/article/securing-wireless-networks/Sat, 23 Jan 2021 00:00:00 +0000https://akimbocore.com/article/securing-wireless-networks/We recently discussed how to break WPA2 keys very quickly using cloud computing.https://akimbocore.com/article/strong-passwords-three-random-words/Sat, 23 Jan 2021 00:00:00 +0000https://akimbocore.com/article/strong-passwords-three-random-words/When performing security tests, we very often come across weak passwords.https://akimbocore.com/article/fixing-sql-injection/Fri, 22 Jan 2021 00:00:00 +0000https://akimbocore.com/article/fixing-sql-injection/SQL Injection is a vulnerability that occurs where user supplied input is insecurely concatenated into an SQL query.https://akimbocore.com/article/fixing-llmnr-and-netbios-ns-spoofing/Thu, 21 Jan 2021 00:00:00 +0000https://akimbocore.com/article/fixing-llmnr-and-netbios-ns-spoofing/In our article LLMNR and NetBIOS-NS Spoofing with Responder we stepped you through how to exploit a very common issue on Windows networks.https://akimbocore.com/article/fixing-cross-site-scripting-xss/Sun, 25 Oct 2020 00:00:00 +0100https://akimbocore.com/article/fixing-cross-site-scripting-xss/This issue comes about where user supplied input is included within server responses without filtration or encoding.https://akimbocore.com/article/fixing-dom-xss/Sun, 25 Oct 2020 00:00:00 +0100https://akimbocore.com/article/fixing-dom-xss/Whilst Reflected and Stored XSS can generally be addressed through server-side user input encoding (such as through the PHP htmlentities() function) or with browser protections such as Content-Security-Policy, this is not sufficient for DOM-XSS.https://akimbocore.com/article/an-introduction-to-ipv6/Mon, 19 Oct 2020 00:00:00 +0100https://akimbocore.com/article/an-introduction-to-ipv6/IPv6 is not new, RFC1883 discussed the protocol back in 1995.https://akimbocore.com/article/asrep-roasting/Mon, 19 Oct 2020 00:00:00 +0100https://akimbocore.com/article/asrep-roasting/If an Active Directory user has pre-authentication disabled, a vulnerability is exposed which can allow a threat actor to perform an offline bruteforce attack against that user’s password.https://akimbocore.com/article/becoming-a-penetration-tester/Mon, 19 Oct 2020 00:00:00 +0100https://akimbocore.com/article/becoming-a-penetration-tester/Breaking into Penetration Testing can be a daunting career move; so in this article we talked about ways you can make your first move towards a career in this industry.https://akimbocore.com/article/breaking-enterprise-wireless/Mon, 19 Oct 2020 00:00:00 +0100https://akimbocore.com/article/breaking-enterprise-wireless/In our previous posts we discussed how WEP is completely broken, known weaknesses with WPA, and bruteforcing WPA using AWS.https://akimbocore.com/article/bruteforcing-kerberos/Mon, 19 Oct 2020 00:00:00 +0100https://akimbocore.com/article/bruteforcing-kerberos/It is possible to brute-force Windows accounts directly, using tools like Metasploit using modules such as smblogin, which will target port 445 (SMB).https://akimbocore.com/article/bruteforcing-windows-accounts/Mon, 19 Oct 2020 00:00:00 +0100https://akimbocore.com/article/bruteforcing-windows-accounts/A common configuration on Windows Active Directory accounts is to have an account lockout threshold of say, 5 invalid attempts, and an observation window of 30 minutes.https://akimbocore.com/article/extracting-domain-hashes-vssadmin/Mon, 19 Oct 2020 00:00:00 +0100https://akimbocore.com/article/extracting-domain-hashes-vssadmin/We covered extracting domain hashes with Mimikatz previously, but that’s not always the best approach – for example where anti-virus is getting in the way.https://akimbocore.com/article/finding-dom-xss/Mon, 19 Oct 2020 00:00:00 +0100https://akimbocore.com/article/finding-dom-xss/We’ve previously written about Reflected and Stored Cross-site Scripting, however this time we want to tackle DOM-Based Cross-site Scripting, or DOM-XSS for short.https://akimbocore.com/article/finding-sql-injection/Mon, 19 Oct 2020 00:00:00 +0100https://akimbocore.com/article/finding-sql-injection/SQL Injection is an old vulnerability; first published on Christmas Day 1998 in Phrack Magazine 54.https://akimbocore.com/article/hashcracking-with-aws/Mon, 19 Oct 2020 00:00:00 +0100https://akimbocore.com/article/hashcracking-with-aws/Heya! I wrote this article back in mid-2020 for Ubuntu 18.04; it’s now the future and that’s an old version and no longer supported after April 30, 2023.https://akimbocore.com/article/http-security-headers-content-security-policy-csp/Mon, 19 Oct 2020 00:00:00 +0100https://akimbocore.com/article/http-security-headers-content-security-policy-csp/Content Security Policy (CSP) allows the application to restrict the location of resources to an allow-list of approved locations, including where scripts can be loaded from and when the application may be framed.https://akimbocore.com/article/kerberoasting/Mon, 19 Oct 2020 00:00:00 +0100https://akimbocore.com/article/kerberoasting/Any domain user within Active Directory can request a service ticket (TGS) for any service that has an SPN (Service Principal Name).https://akimbocore.com/article/link-local-multicast-name-resolution-llmnr-netbios-ns-spoofing-with-responder/Mon, 19 Oct 2020 00:00:00 +0100https://akimbocore.com/article/link-local-multicast-name-resolution-llmnr-netbios-ns-spoofing-with-responder/Link-Local Multicast Name Resolution (LLMNR) and NetBIOS-Name Service (NBT-NS) are name resolution protocols that are enabled by default on Windows machines.https://akimbocore.com/article/network-mapping-with-nmap/Mon, 19 Oct 2020 00:00:00 +0100https://akimbocore.com/article/network-mapping-with-nmap/Before being able to determine if systems are vulnerable, it’s critical to first find as many active systems within the scope as possible and to accurately determine what services those systems expose.https://akimbocore.com/article/privilege-escalation-extracting-passwords-with-mimikatz/Mon, 19 Oct 2020 00:00:00 +0100https://akimbocore.com/article/privilege-escalation-extracting-passwords-with-mimikatz/We recently published an article on using Incognito for privilege escalation as part of a short series on using Metasploit.https://akimbocore.com/article/privilege-escalation-with-incognito/Mon, 19 Oct 2020 00:00:00 +0100https://akimbocore.com/article/privilege-escalation-with-incognito/Incognito is a tool which can be used for privilege escalation, typically from Local Administrator to Domain Administrator.https://akimbocore.com/article/sql-injection-exploitation-blind-boolean/Mon, 19 Oct 2020 00:00:00 +0100https://akimbocore.com/article/sql-injection-exploitation-blind-boolean/Blind injection refers to exploits where the output of the payload is not directly displayed within application output, but the threat actor is able to infer what the output was.https://akimbocore.com/article/sql-injection-exploitation-error-based/Mon, 19 Oct 2020 00:00:00 +0100https://akimbocore.com/article/sql-injection-exploitation-error-based/With error-based injection, data can be extracted from the database where an error message can be crafted which contains confidential data.https://akimbocore.com/article/sql-injection-exploitation-time-based/Mon, 19 Oct 2020 00:00:00 +0100https://akimbocore.com/article/sql-injection-exploitation-time-based/In terms of crafting payloads, Time-based injection is very similar to Blind-Boolean injection. That is to say that extracting data from the database is generally done one character at a time.https://akimbocore.com/article/sql-injection-exploitation-union-based/Mon, 19 Oct 2020 00:00:00 +0100https://akimbocore.com/article/sql-injection-exploitation-union-based/UNION SELECT statements can be used for retrieving the results of a second SELECT statement by appending it to the end of another query. This is useful for SQL injection as it allows you to append a query to the end of a query executed by a developer.https://akimbocore.com/article/talktalk-breach-2015/Mon, 19 Oct 2020 00:00:00 +0100https://akimbocore.com/article/talktalk-breach-2015/TalkTalk suffered a series of security issues in 2015. Right from the start of the year people were discussing an increased number of scam calls.https://akimbocore.com/article/target-breach-2013/Mon, 19 Oct 2020 00:00:00 +0100https://akimbocore.com/article/target-breach-2013/Target were breached in 2013. The story was initially broken by Brian Krebs in a post published on 18 December 2013 and titled “Sources: Target investigating Data Breach”.https://akimbocore.com/article/introduction-to-metasploit/Mon, 19 Oct 2020 00:00:00 +0100https://akimbocore.com/article/introduction-to-metasploit/Metasploit is an exploitation framework. It’s a core tool of the penetration tester’s toolset and we use it for several of our vulnerability demonstrations, so it makes sense to write a quick “introduction to” for Metasploit.https://akimbocore.com/article/wireless-security-wep/Mon, 19 Oct 2020 00:00:00 +0100https://akimbocore.com/article/wireless-security-wep/It’s well known that the WiFi security protocol WEP is broken.https://akimbocore.com/article/wireless-security-wpa/Mon, 19 Oct 2020 00:00:00 +0100https://akimbocore.com/article/wireless-security-wpa/We previously spoke about WiFi security and how utterly broken WEP is.https://akimbocore.com/article/xxe-xml-external-entity-injection/Mon, 19 Oct 2020 00:00:00 +0100https://akimbocore.com/article/xxe-xml-external-entity-injection/XML Entity Injection is a powerful vulnerability that can allow for confidential data theft and in rare cases command execution.https://akimbocore.com/article/extracting-domain-hashes-mimikatz/Wed, 14 Oct 2020 00:00:00 +0100https://akimbocore.com/article/extracting-domain-hashes-mimikatz/During Penetration Tests, a common late-stage activity is to compromise the Domain Controller and extract all account password hashes.https://akimbocore.com/article/sub-resource-integrity-sri/Sat, 02 May 2020 00:00:00 +0100https://akimbocore.com/article/sub-resource-integrity-sri/Hosting web application content such as dynamic scripts and stylesheets on third parties such as Content Delivery Networks (CDNs) can allow for significant improvements to site performance and can reduce bandwidth costs.https://akimbocore.com/article/linux-path-traversal-cheat-sheet/Fri, 14 Feb 2020 00:00:00 +0000https://akimbocore.com/article/linux-path-traversal-cheat-sheet/Got a path/directory traversal or file disclosure vulnerability on a Linux-server and need to know some interesting files to hunt for?https://akimbocore.com/article/windows-path-traversal-cheat-sheet/Fri, 14 Feb 2020 00:00:00 +0000https://akimbocore.com/article/windows-path-traversal-cheat-sheet/Got a path/directory traversal or file disclosure vulnerability on a Windows-server and need to know some interesting files to hunt for?https://akimbocore.com/article/hackers-on-hackers/Sat, 01 Oct 2016 00:00:00 +0100https://akimbocore.com/article/hackers-on-hackers/So it’s 10:30pm on a Sunday and the wonderful Jake Davis has asked me to give my thoughts on the ludicrous movie that is “Hackers” (1995).https://akimbocore.com/article/lulzsec-5-years-on/Sun, 26 Jun 2016 00:00:00 +0100https://akimbocore.com/article/lulzsec-5-years-on/LulzSec were an international hacking crew and today marks 5 years since the end of their most well-known campaign: the “50 Days of Lulz”.https://akimbocore.com/article/privilege-escalation-group-policy-preference-passwords/Fri, 11 Dec 2015 00:00:00 +0000https://akimbocore.com/article/privilege-escalation-group-policy-preference-passwords/Group Policy Preferences (GPP) was an addition to Group Policy to extend its capabilities to, among other things, allow an administrator to configure local administrator accounts, services or scheduled tasks, and mount network drives when a user logs in.https://akimbocore.com/services/cybersecurity-training/building-and-breaking-networks-and-infrastructure/Mon, 01 Jan 0001 00:00:00 +0000https://akimbocore.com/services/cybersecurity-training/building-and-breaking-networks-and-infrastructure/For the people who run the network. How infrastructure is attacked and hardened, hands on, against the same weaknesses we find in internal assessments.https://akimbocore.com/services/cybersecurity-training/building-and-breaking-web-applications/Mon, 01 Jan 0001 00:00:00 +0000https://akimbocore.com/services/cybersecurity-training/building-and-breaking-web-applications/For development teams. The attacker’s perspective on web applications so engineers understand how attacks take place and build more secure applications from the start.https://akimbocore.com/services/penetration-testing/cloud-security-reviews/Mon, 01 Jan 0001 00:00:00 +0000https://akimbocore.com/services/penetration-testing/cloud-security-reviews/A deep dive into your cloud configuration, across AWS, Azure, GCP, and more.https://akimbocore.com/services/cybersecurity-consultancy/cybersecurity-maturity-assessment/Mon, 01 Jan 0001 00:00:00 +0000https://akimbocore.com/services/cybersecurity-consultancy/cybersecurity-maturity-assessment/An independent review of how your organisation approaches security: policy, risk and asset management, user accounts, hardening, vulnerability management, detection, and response and recovery.https://akimbocore.com/services/penetration-testing/device-build-reviews/Mon, 01 Jan 0001 00:00:00 +0000https://akimbocore.com/services/penetration-testing/device-build-reviews/A security review of your key devices, including servers and corporate laptops or desktops.https://akimbocore.com/services/penetration-testing/firewall-security-reviews/Mon, 01 Jan 0001 00:00:00 +0000https://akimbocore.com/services/penetration-testing/firewall-security-reviews/A manual review of your firewall rulesets, firmware, and configuration.https://akimbocore.com/people/holly-grace-williams/Mon, 01 Jan 0001 00:00:00 +0000https://akimbocore.com/people/holly-grace-williams/Holly Grace Williams is the Managing Director at Akimbo Core, a cybersecurity firm based in the UK. She has been working in cybersecurity since 2007, with a focus on penetration testing, training, and cybersecurity consultancy.https://akimbocore.com/services/cybersecurity-consultancy/incident-response-scenario-testing/Mon, 01 Jan 0001 00:00:00 +0000https://akimbocore.com/services/cybersecurity-consultancy/incident-response-scenario-testing/Exercise the plan against realistic scenarios so the response team builds muscle memory before it’s needed. Hosted remotely or on site, with a debrief of what worked and what didn’t.https://akimbocore.com/services/cybersecurity-training/incident-response-training/Mon, 01 Jan 0001 00:00:00 +0000https://akimbocore.com/services/cybersecurity-training/incident-response-training/For the people who will be on the call. Planning and preparation, the essential processes, and best practice for responding to a live incident, hosted remotely or on site.https://akimbocore.com/services/cybersecurity-consultancy/incident-response-workshop-and-plan-development/Mon, 01 Jan 0001 00:00:00 +0000https://akimbocore.com/services/cybersecurity-consultancy/incident-response-workshop-and-plan-development/A half-day incident response workshop, a review of your current plan, and development of the documentation that improves your response maturity, including scenario-specific playbooks.https://akimbocore.com/services/penetration-testing/infrastructure-penetration-testing/Mon, 01 Jan 0001 00:00:00 +0000https://akimbocore.com/services/penetration-testing/infrastructure-penetration-testing/Security testing of servers, workstations, routers, and switches. Internally or internet-facing.https://akimbocore.com/services/penetration-testing/mobile-application-penetration-testing/Mon, 01 Jan 0001 00:00:00 +0000https://akimbocore.com/services/penetration-testing/mobile-application-penetration-testing/Security testing of iOS and Android applications and their supporting APIs.https://akimbocore.com/services/cybersecurity-training/security-awareness-training/Mon, 01 Jan 0001 00:00:00 +0000https://akimbocore.com/services/cybersecurity-training/security-awareness-training/For everyone else. Hacker motivations, social engineering and phishing, physical security, remote working, wireless, passwords and multi-factor. Delivered by ethical hackers with a live demo, not a slide deck of rules.https://akimbocore.com/services/penetration-testing/web-application-penetration-testing/Mon, 01 Jan 0001 00:00:00 +0000https://akimbocore.com/services/penetration-testing/web-application-penetration-testing/Human-led penetration testing of web apps and APIs. OWASP coverage and beyond.https://akimbocore.com/services/penetration-testing/wireless-penetration-testing/Mon, 01 Jan 0001 00:00:00 +0000https://akimbocore.com/services/penetration-testing/wireless-penetration-testing/Testing of the authentication, encryption, and segmentation of your wireless networks.