Vulnerable Security

Solving the XSS challenge from Intigriti

Tue, 26 Nov 2019 00:00:01 +0000

Last week there was the XSS challenge published by @intigriti. The goal was to trigger your javascript code in the context of their domain “challenge.intigriti.io”.

My article was published in the Paged Out! #2

Sat, 16 Nov 2019 00:00:01 +0000

After I solved the picoCTF 2019 JavaScript Kiddie challenge I wrote about in my previous post, I thought it would be great to share this challenge with other people interested in the topic. It was one of the challenges with the lowest amount of solvers, as well.

picoCTF 2019 - JS Kiddie writeup

Thu, 24 Oct 2019 00:00:01 +0000

I posted my writeup on how to solve the picoCTF 2019 JavaScript Kiddie challenge from the web category. You can find there some basic cryptography and forensic. The goal of this challenge was to provide a valid key to decrypt PNG image. As a result of the successful decryption process, I received a QR Code image with the flag.

How to use Burp Suite with multiple profiles in Firefox

Tue, 27 Aug 2019 00:00:01 +0000

There is a few popular ways to run Burp Suite in the pentesting environment. The simplified approach is to have a dedicated web browser to use (only) with Burp.

Reverse Engineering a book cover - writeup

Fri, 03 Feb 2017 00:00:01 +0000

This writeup is really related to hacking and to be more precise cracking a real book cover. I bought this book some time ago as a pre-order.

SANS Holiday Hack Challenge 2016 - writeup

Thu, 05 Jan 2017 00:00:01 +0000

This year’s edition of SANS Holiday Hack Challenge 2016 was built around the story of Santa Claus disappearance and our objective is to find out who kidnapped him. I would categorize this challenge as the Capture The Flag (CTF) contest because there was a lot of different tasks, categories and flags (audio files, coins, quests).

How attackers exploit routers remotely?

Mon, 12 Dec 2016 00:00:01 +0000

There is no CVE assigned for that vulnerability yet. It was reported by Chad Dougherty. Vulnerability is trivial and allows any attacker to execute arbitrary command directly on your router. Payload for executing a command always works and the only requirement is to know the local IP address of your router (which is trivial to enumerate).

How to detect the Sparkle Updater vulnerability

Fri, 29 Jan 2016 00:00:02 +0000

In the previous article, I described how to hack OS X by abusing vulnerable application. The method was based on the MITM attack to elevate your privileges to that of the currently logged in user on the remote machine.

How I discovered a vulnerability in hundreds of Mac OS X applications

Fri, 29 Jan 2016 00:00:01 +0000

Lately, I was doing research connected with different updating strategies, and I tested a few applications working under Mac OS X. This short weekend research revealed that we have many insecure applications in the wild. As a result, I have found a vulnerability which allows an attacker take control of another computer on the same network (via MITM).