In the ever-evolving cybersecurity landscape, the spotlight is often cast on external threats, while the danger that can arise from within our organizations tends to stay hidden in the shadows. Insider threats posed by employees, contractors, and even third-party vendors can have devastating consequences if left unchecked. These threats can…

This is a short & simple post about automating the dynamic application security testing (DAST) of a service API. Usually performed as part of an Application or Product Security effort. Our tool of choice for this testing is OWASP ZAP, it’s an open-source web application security scanner. I prefer using…

Web3 has been on fire this past year, we’re witnessing an emerging sector of innovation in its infancy. Similar to the rise of Web2 (version of the internet most of us know) in the ’90s and ’00s with the “.com” boom, Web3 is experiencing rapid growth in demand for domains. …

We as security practitioners often remind others, good cyber hygiene and best practices in security controls will go a long way in effectively defending against ransomware and malware in general. In this follow up post, we analyze several key delivery techniques utilized by most ransomware variants and provide “best bang…

By design ransomware is a relatively “noisy” form of malware and its kill chain presents multiple opportunities for network defenders to successfully detect and mitigate this type of threat. By mapping out the steps of the ransomware intrusion, we may better understand the malware itself and increase our capability of…

Back in 2017 I sat and passed my CISSP exam, it was my first year practicing cyber security. At some point in my early career I decided that instead of wasting time obtaining entry level certifications, I was going to command some respect and obtain the most sought after certifications…

Tunnel traffic through a compromised jump host to reach otherwise unreachable internal networks or hosts (pivot). As seen in network penetration testing environments. prerequisite: access via SSH to jump host. TARGET1 = jump host ; TARGET2 = jump target set SSH dynamic port forward, ssh -D1080 root@<TARGET1/> Check locally that…

a niche remote code execution via deserialization on Apache Tomcat Affected versions: Apache Tomcat 10.x < 10.0.0-M5 Apache Tomcat 9.x < 9.0.35 Apache Tomcat 8.x < 8.5.55 Apache Tomcat 7.x < 7.0.104 i.e. versions pre-April 2020 Prerequisites to be vulnerable: The attacker is able to upload a file with arbitrary…

Buff is a Windows machine rated as “Easy” on HackTheBox weighed toward CVEs. This machine perfectly mimics a standard network pentest scenario and process. Web shells, file transfers, and SSH tunnel port forwarding. Start off with an Nmap port scan of the machine. After a quick scan for all ports…