I like encryption downgrade attacks and sslstrip. I hear a lot about attacks that are based on tricking clients to accepting a false certificate but I really like attacks that are based on weaknesses in the program logic itself. Enter CVE-2015-3152 (yes it lists the CVE as Read More …
When faced with a large task, project, or looming deadline I often whip out the quote, either audibly or internally, “How do you eat an elephant?” Asking this rhetorical question is immediately self-answered with a booming, “One bite (byte) at a time.” Well when looking Read More …
Today I completed the GIAC GPEN certification. The test took approximately 2:30, was open book, and more difficult than I assumed! For those that have taken a SANS course and a GIAC exam, you know the importance of a thorough index! Since these tests are Read More …
I’ve setup a lot of hacklabs at work and for personal use they started out as physical networks and migrated to virtualized networks. However I’ve always wanted to set one up on my mid-2012 MacBook Pro rather than the thinkpad, panasonic, or other laptop. I’ve Read More …
Well after a great week of pentesting instruction in SANS 560 with instructor Eric Conrad, we got to compete in the class CTF. After several hours of intense exploiting, pivoting, and extracting data, our team “heard the call” of victory! For those going into the class, Read More …