pentestercrab

2,279 karma · joined August 11, 2015

pentestercrabon Vulnerability in golang.org/x/crypto/salsa20

The relevant diff from the patch can be found here[1].

[1] https://go.googlesource.com/crypto/+/b7391e95e576cacdcdd4225...

pentestercrabon The Practical Guide to Hacking Bluetooth Low Energy

Anyone interested in BLE might also enjoy this blog post about the Fuze Multi-Card[0]. It mentions the tools btlejuice[1], gattacker[2] and crackle[3].

[0] https://www.elttam.com.au/blog/fuzereview/

[1] https://github.com/DigitalSecurity/btlejuice

[2] https://github.com/securing/gattacker

[3] https://github.com/mikeryan/crackle

pentestercrabon Original Hobo Nickel Society

Anyone interested in hobo nickels should take a look into the works of Roman Booteen[1], Aleksey Saburov[2] and Paolo Curcio (MrThe)[3]. They each have a unique style and their work is incredible for using hand push gravers.

[1] https://www.instagram.com/romanbooteen/

[2] https://www.saburovart.com/2016

[3] https://web.archive.org/web/20160323235021/http://www.mrtheh...

pentestercrabon The Search for the “perfect” Advent Calendar (involves Python and Processing)

My best so far, but not using the improvements above, just small tweaks to the code from the blog post:

  [[ 9 15  4 20  6 12]
   [18 23 11  1 22 17]
   [ 7  2 16 24  3  8]
   [13 21  5 10 19 14]]
  376.364049355

pentestercrabon Windows 95 – It's now safe to shutdown your computer

Another fun fact from @foone on Twitter[1]:

The "It's now safe to turn off your computer" screen is (sometimes) backed by DOS, meaning you can type in "mode co80" and get the DOS prompt back. You can also type any DOS commands blind, and they'll work, invisibly!

The referenced tweet below also includes a GIF of the behavior.

1: https://twitter.com/Foone/status/1018973818197430273

pentestercrabon Timing Analysis of Keystrokes and Timing Attacks on SSH (2001) [pdf]

Anyone interested in this will likely enjoy Don't Skype & Type![1] where researchers decoded keystrokes from background audio of Skype conversations. The best part is source code is available[2]. I wonder how many people are applying this to Twitch streamers or YouTube videos (especially any Talks at Google videos) today?

1. http://spritz.math.unipd.it/projects/dst/ 2. https://github.com/SPRITZ-Research-Group/Skype-Type

pentestercrabon Ruby 2.x Universal RCE Deserialization Gadget Chain

For anyone interested in gadget chains for other languages, these Github repos are quite interesting:

- Java: https://github.com/frohoff/ysoserial

- .NET: https://github.com/pwntester/ysoserial.net

- PHP: https://github.com/ambionics/phpggc

pentestercrabon Stop using JWT for sessions (2016)

This JSON Web Token Security Cheat Sheet[1] or this python script[2] are both quite useful when reviewing anything using of JWTs.

[1] https://assets.pentesterlab.com/jwt_security_cheatsheet/jwt_...

[2] https://github.com/ticarpi/jwt_tool

pentestercrabon Ghostbuster: Detecting the Presence of Hidden Eavesdroppers [pdf]

Anyone interested in this should read the book Spycatcher[1]. It covers a bit of this and was even banned in certain countries.

[1] https://en.wikipedia.org/wiki/Spycatcher

pentestercrabon AWS now supports U2F/Yubikeys

The Trezor [1] hardware device supports backing up (at initialization) and restoring of the secret seed which is quite useful. It can also be used as a password manager [2].

[1] https://blog.trezor.io/secure-two-factor-authentication-with... [2] https://trezor.io/passwords/

pentestercrabon The Shell Game – Non-Root Linux Rootkits (2010) [pdf]

Anyone interested in this topic should also make sure to check out the Procps-ng Audit Report by Qualys Security[1].

[1] https://www.openwall.com/lists/oss-security/2018/05/17/1

pentestercrabon Google Titan Security Key

If you want U2F with recovery, the Trezor from SatoshiLabs is a great option. Only issue is the cost is a bit higher than most hardware tokens.

pentestercrabon Xi-editor – A modern editor with a back end written in Rust

Interestingly, this project makes use of a conflict-free replicated data type (CRDT) data structure [1]. All the information on where they use this can be found on their page detailing their approach to async plugins and undo[2].

[1] https://en.wikipedia.org/wiki/Conflict-free_replicated_data_...

[2] http://google.github.io/xi-editor/docs/crdt.html

pentestercrabon Using LD_PRELOAD to cheat, inject features and investigate programs (2013)

There is a nice list of useful utilities called preeny that can be downloaded here[1].

1. https://github.com/zardus/preeny

pentestercrabon Intro to SDR and RF Signal Analysis

There is also meetup groups in San Francisco [1] and Melbourne (Australia) [2].

[1] https://www.meetup.com/en-US/Cyberspectrum/

[2] https://www.meetup.com/en-US/Cyberspectrum-Melbourne/

pentestercrabon Intro to SDR and RF Signal Analysis

For anyone interested in Software-defined radio (SDR) I can also highly recommend the Cyberspectrum YouTube channel [1].

[1] https://www.youtube.com/playlist?list=PLPmwwVknVIiXGzKhtimTM...