Sep 18Do SameSite Cookies Solve CSRF?Background SameSite attribute, as defined in RFC draft RFC6265bis, was introduced to improve browsers’ built-in protection against CSRF attacks by not including the cookies in certain cross-site requests, depending on the value of the attribute. Site is defined as a combination of scheme (i.e. http or https) and TLD+1 domain name…3 min read3 min read
Apr 21, 2022CVE Analysis of Popular Base ImagesBackground Modern cloud-native applications are often packaged as container images and run in container orchestration environments. A fairly typical security need for containerized applications is visibility into the known security vulnerabilities (I’ll be subsequently referring to them as CVEs for brevity) in the images. As companies mature their tooling and start…Docker3 min readDocker3 min read
May 6, 2021Install ZeroTier on Kali LinuxKali Linux is not one of the officially supported distros by the ZeroTier installer script, so if you just try to use it you will get an error message along the lines of: FAILED: unrecognized or ancient distribution: kali-rolling Kali Linux is based on Debian testing, so we can just…Kali1 min readKali1 min read
Jul 16, 20199 Ways to Backdoor a Linux BoxThis article is a result of playing SANS NetWars Continuous level 5 (attack/defense) for several weeks. When you get access to opponent’s machine, it is highly desirable to leave backdoors that allow you to get back in once your access is blocked. Below, I’m describing some of the techniques I’ve…Security7 min readSecurity7 min read
Jun 7, 2019From XXE to RCE with PHP/expect — The Missing LinkI’ve been experimenting with xxelab (https://github.com/jbarone/xxelab), a simple PHP web app demonstrating XXE attacks, trying to replicate code execution through expect:// PHP wrapper. (Shameless plug — my recently submitted pull request allows you to run xxelab in a Docker container). This technique is well described in a number of articles…Xxe3 min readXxe3 min read
May 23, 2019Getting Docker to work with a proxy serverI was recently configuring Docker on a machine that didn’t have direct access to the Internet and had to use proxy for outbound connectivity, and it turned out to be a non-trivial task. All of this info is scattered around the Internet, I’m just bringing it all together. Here’s the…Docker2 min readDocker2 min read
Apr 17, 2019Simple TLS ListenerOn occasion you need to listen for incoming connections and interact with the data being sent by the client. Most simple way might be with netcat (12345 is the port number to listen to): $ nc -lvnp 12345 (-l for listen, -v for verbose, this will let you know once…Ssl2 min readSsl2 min read
Nov 24, 2018cms2cmd — Universal CMS Plugin For Command ExecutionI just released cms2cmd, a CMS plugin that can be used with Drupal 7, Drupal 8, Joomla and Wordpress as a simple command execution mechanism. Occasionally during a CTF (or a pen test?) you might gain admin access to a CMS, which in most configurations gives you RCE. cms2cmd is…CMS2 min readCMS2 min read
Oct 13, 2018Introducing jdbc-backdoorBackground To connect to a database, Java applications usually use JDBC framework. Part of the framework is JDBC drivers, that are usually supplied by the DMBS vendor. Applications would often require administrator to download the needed JDBC driver separately due to the licensing restrictions not allowing the software vendor to redistribute…Java2 min readJava2 min read
May 18, 2018Installing System Load Indicators in KaliI like seeing CPU load on my boxes, so pretty much all of them have some sort of CPU load gadget enabled on startup. I noticed every time I have to configure this on a Kali box I’m struggling to remember the package names for what I have to install…Kali1 min readKali1 min read
