HackDig : Dig high-quality web security articles for hacker

Some crypto challenges: Author writeup from BSidesSF CTF

Hey everybody, This is yet another author's writeup for BSidesSF CTF challenges! This one will focus on three crypto challenges I wrote: mainframe, mixer, and decrypto! mainframe - bad password reset .block1 { color: red; background-color: #3b3d37; border: 2px solid #17242b; margin: 2px; } .block2 { color: orange; background-color:
Publish At:2019-09-19 17:55 | Read:474 | Comments:0 | Tags:Conferences Crypto Passwords Tools

Bitscout – The Free Remote Digital Forensics Tool Builder

Being a malware researcher means you are always busy with the struggle against mountains of malware and cyberattacks around the world. Over the past decade, the number of daily new malware findings raised up to unimaginable heights: with hundreds of thousands of malware samples per day! However, while there are some rare and dangerous malware, not every samp
Publish At:2017-07-06 06:45 | Read:3780 | Comments:0 | Tags:Software Bitscout Forensics Tools

ConverterNET v0.1 Released

I spent the past several months porting Converter to the .NET Framework and am finally able to release a public version of it. Many of the original functions are present and I’ve added a few more things to the menu. Several conveniences have also been included that may not be very obvious: + Forms are non-modal so you can have multiple forms open at
Publish At:2017-06-25 11:55 | Read:3198 | Comments:0 | Tags:Tools converter converterNET

Going the other way with padding oracles: Encrypting arbitrary data!

A long time ago, I wrote a couple blogs that went into a lot of detail on how to use padding oracle vulnerabilities to decrypt an encrypted string of data. It's pretty important to understand to use a padding oracle vulnerability for decryption before reading this, so I'd suggest going there for a refresher. When I wrote that blog and the Poracle tool origin
Publish At:2016-12-20 02:45 | Read:4940 | Comments:0 | Tags:Crypto Hacking Tools

Deobfuscating the Nemucod Downloader Script

Matt Decker from hybrid-cloudblog.com sent me this script he received via email and asked for help deobfuscating this so here we go… Here’s the WSF file he sent me: About half-way down the script, I come across this. Two variables should have caught your eye. Doing a search for the first variable name, I end up at the variable “vistaR
Publish At:2016-10-22 19:50 | Read:5310 | Comments:0 | Tags:Malscript Tools difference calculator javascript deobfuscati

KNXmap: A KNXnet/IP Scanning and Auditing Tool

Users of the KNX, a standard for home automation bus systems, may already have come across KNXnet/IP (also known as EIBnet/IP): It is an extension for KNX that defines Ethernet as a communication medium for KNX which allows communication with KNX buses over IP driven networks. Additionally, it enables one to couple multiple bus installations over IP gateways
Publish At:2016-09-05 10:50 | Read:4391 | Comments:0 | Tags:Announcements Tools Uncategorized IoT KNX python

The Key to Cyber Security May be A.I. Combined with Human Minds

Maintaining a secure company network can be a daunting task, and that’s putting it lightly. The number of cyber threats out there seem to be multiplying by the day, while the incidents of cyber attacks have become a common headline. Just ask Target or Sony about the damage that can come from infiltration by cyber criminals and hackers. And those headlines ap
Publish At:2016-08-14 23:30 | Read:4108 | Comments:0 | Tags:Featured Articles Security Awareness A.I Cyber Security Huma

Pentesting Webservices with Net.TCP Binding

Hi all, Most of you that are  pentesters  may have already tested plenty of webservices using SOAP (Simple Object Access Protocol) for communication. Typically, such SOAP messages are transferred over HTTP (Hypertext Transfer Protocol) and are encapsulated in XML (Extensible Markup Language). Microsoft has developed different representations of this protocol
Publish At:2016-08-02 22:10 | Read:4100 | Comments:0 | Tags:Security Tools negotiate net.tcp python wcf webservice

Gotta Catch ‘Em All! – WORLDWIDE! (or how to spoof GPS to cheat at Pokémon GO)

The moment, when your team leader asks you to cheat at Pokémon GO…everyone knows it, right? No? Well, I do
Publish At:2016-07-16 09:35 | Read:3323 | Comments:0 | Tags:ERNW Insecurity Tools dvb-t gps HackRF michael ossman pokemo

Locky JS and URL Revealer

From various reports, it appears that the malicious Javascript files sent via email that pull Locky down is back. Let’s see what these scripts look like: At the bottom of the script, is this function that reverses the string above, joins the characters, then evaluates it: eval(aBN3DmdER7P.split(”).reverse().join(”)); Since we’re deal
Publish At:2016-06-23 09:05 | Read:6069 | Comments:0 | Tags:Malicious Email Malscript Tools downloader javascript locky

SAMLReQuest Burpsuite Extention

Security Assertion Markup Language (SAML) is an XML standard for exchanging authentication and authorization data between a Service Provider (SP) and an  Identification Provider (IdP). SAML is used in many Single Sign-On (SSO) implementations, when a user is authenticated once by IdP to access multiple related SPs. When a user requests to access a SP, it cre
Publish At:2016-06-06 19:35 | Read:3567 | Comments:0 | Tags:Tools burp SAML

Implementing an Obsolete VPN Protocol on Top of HTTP: Because Why Not?

Recently I’ve started some research on MikroTik’s RouterOS, the operating system that ships with RouterBOARD devices. As I’m running such a device myself, one day I got curious about security vulnerabilities that have been reported on the operating system and the running services as it comes with tons of features. Searching for known vulner
Publish At:2016-05-31 16:40 | Read:3323 | Comments:0 | Tags:Tools crypto javascript MS-CHAP-V2 PPTP python RC4 RouterOS

Some Notes on Utilizing Telco Networks for Penetration Tests

After a couple of years in pentesting Telco Networks, I’d like to give you some insight into our pentesting methodology and setup we are using for testing “Mobile and Telecommunication Devices”. I am not talking about pentesting professional providers’ equipment (as in previous blogposts), it is about pentesting of devices that have a
Publish At:2016-05-25 14:40 | Read:3951 | Comments:0 | Tags:Security Tools 2G gsm IoT pentest sms Telco

Introduction of a new hardware guy

Hi folks! We couldn’t be more proud to welcome such a predestined #1 hardware hacking victim, than VICTor is! Before Brian and I gave a lecture on hardware hacking last week at DHBW Mosbach, we felt, that we needed a custom victim which is fully documented and provides a good “hackability” to the students. Surely we could also have used som
Publish At:2016-05-18 18:25 | Read:3662 | Comments:0 | Tags:ERNW Security Tools Uncategorized arduino circuit hacking ha

Discover the Unknown: Analyzing an IoT Device

This blog post will give a brief overview about how a simple IoT device can be assessed. It will show a basic methodology, what tools can be used for different tasks and how to solve problems that may arise during analyses. It is aimed at readers that are interested in how such a device can be assessed, those with general interest in reverse engineering or t
Publish At:2016-04-12 14:20 | Read:6332 | Comments:0 | Tags:Tools AES crypto IoT network nmap NSE reversing


Share high-quality web security related articles with you:)


Tag Cloud