Web3 has been on fire this past year, we’re witnessing an emerging sector of innovation in its infancy. Similar to the rise of Web2 (version of the internet most of us know) in the ’90s and ’00s with the “.com” boom, Web3 is experiencing rapid growth in demand for domains. …

We as security practitioners often remind others, good cyber hygiene and best practices in security controls will go a long way in effectively defending against ransomware and malware in general. …

By design ransomware is a relatively “noisy” form of malware and its kill chain presents multiple opportunities for network defenders to successfully detect and mitigate this type of threat. …

Back in 2017 I sat and passed my CISSP exam, it was my first year practicing cyber security. At some point in my early career I decided that instead of wasting time obtaining entry level certifications, I was going to command some respect and obtain the most sought after certifications…

Tunnel traffic through a compromised jump host to reach otherwise unreachable internal networks or hosts (pivot). As seen in network penetration testing environments. prerequisite: access via SSH to jump host. TARGET1 = jump host ; TARGET2 = jump target set SSH dynamic port forward, ssh -D1080 root@<TARGET1/> Check locally that…

a niche remote code execution via deserialization on Apache Tomcat Affected versions: Apache Tomcat 10.x < 10.0.0-M5 Apache Tomcat 9.x < 9.0.35 Apache Tomcat 8.x < 8.5.55 Apache Tomcat 7.x < 7.0.104 i.e. versions pre-April 2020 Prerequisites to be vulnerable: The attacker is able to upload a file with arbitrary…

Buff is a Windows machine rated as “Easy” on HackTheBox weighed toward CVEs. Webshells, file transfers and SSH tunnel port forwarding. After a quick scan for all ports, we see an Apache webserver with PHP on port 8080. Nmap scan report for 10.x.x.x Host is up (0.15s latency). Not shown: 999 filtered…

An often unpracticed Red Team operation scenario involving malicious browser extensions. For the testing team, the end result is a cloud-hosted C2 server with an operational CursedChrome deployment using Nginx reverse proxy for web session theft. For the purpose of this assessment a deliberately malicious proof-of-concept extension code is used…

Penetration testing vs red teaming key takeaways & principles One of the most frequently blogged about topics in the security industry is discussing the key differences and roles of a vulnerability assessment versus a penetration test. With the security industry evolving and organizations slowly adopting their own offensive security capabilities…