Wwws on dubell.io

Wed, 24 Jun 2026 00:00:00 +0000

Vibe Recipes: Turning AI Coding Experience Into Reusable Blueprints

Sat, 06 Jun 2026 00:00:00 +0000

Here’s a concept I’ve been thinking about: vibe recipes.

Today, people are vibe coding. They have an idea, they fire up their preferred coding agent, and they start giving instructions and building the application they want to build.

This process can take a day. A week. Sometimes longer, before you end up with the result you’re looking for.

But during that time, you’ll encounter problems with the AI model. You’ll get incorrect results. You may have to repeat yourself. The AI might introduce bugs, introduce security vulnerabilities, misunderstand the business logic you’re trying to implement, or mess up the workflow entirely.

Building Your Personal Council of Experts

Sat, 24 Jan 2026 00:00:00 +0000

Introduction

My council of experts is three (or more) AI personas designed to argue from specific perspectives such as application security, and software development and software architecture.

The idea is that when you use, for example, Claude Code or some other coding agent to generate a development plan, the council will receive the plan and debate it amongst themselves. The output from the council is returned to the coding agent, and the plan can be updated if needed.

Stop using chat interfaces for your command line interfaces!

Tue, 01 Jul 2025 00:00:00 +0000

You are running an Nmap scan on a target, you encounter an unfamiliar service, what do you do? Alt-tab to your preferred AI, query: “what is this service and is there any known vulnerabilities?”, wait for the response, and then you continue your vulnerability research.

This workflow is fundamentally broken. We’re using AI as a glorified command line when it should be our always-on research assistant, integrated directly into our security workspace."

Leveraging BM25 and Vector Search in a Local RAG Application

Tue, 01 Apr 2025 00:00:00 +0000

As a consultant in cybersecurity, I write numerous of reports documenting security vulnerabilities discovered in the customer’s application or network. Sometimes, there’s a considerable amount of findings, and this requires me to focus more of my hours on writing the report, instead of discovering vulnerabilities. For example, I have written a report that contained 70+ security vulnerabilities. This took time to write and to QA (quality assurance).

To reduce hours spent on writing the report, I turned to AI. Can I use AI to automatically expand my raw notes into well defined security findings? Turns out that worked very well. With the right prompting and relevant model, expanding my raw notes into a well structured finding worked great.

Unicode's Secret Compartment: The Variation Selector Trick

Thu, 16 Jan 2025 00:00:00 +0000

I recently stumbled upon an article written by Paul Butler. It caught my eye because it described a method for hiding data in text using unicode variation selectors. The method does not distort the main text or add any characters that might give away the secret message. You can try it out here.

The idea is simple, by using variation selectors which are used to modify the presentation of the preceding character, you can inject a unicode variation selector that does not modify the preceding character and is ignored during rendering.

So you want to run AI models locally?

Wed, 15 Jan 2025 00:00:00 +0000

AI has undoubtedly been the center of human thought in 2024 and 2025. The improvement potential AI can bring to humanity is epic. However, there is a fundamental problem with the current state of AI. The best and brightest models often require immense computing power which the majority of people do not have. Instead, people are forced into using proprietary models and are also required to accept that their conversations will be mined and analysed.

DLL Hijacking in MobilePASS version 8.4.4.99

Fri, 09 Aug 2024 00:00:00 +0000

During an engagement, I identified a DLL hijacking vulnerability in MobilePASS for Windows, version 8.4.4.99. MobilePASS is a Two-factor authentication solution, which can run on Windows.

When MobilePASS is executed, it attempts to load etoken.dll from several locations, including the user’s desktop folder and the %APPDATA% directory.

This enables an attacker with local access to place a malicious etoken.dll in the directory where MobilePASS attempts to load it. As a result, the attacker can disguise their activity behind MobilePASS.

Server-Side Request Forgery in HikCentral Professional <= V2.5.1

Tue, 14 May 2024 23:00:00 +0200

During an engagement, I encountered HikCentral Professional. I did not find any relevant CVEs and therefore decided to download the software and perform a quick analysis. Upon examining the related configuration files, I immediately identified a Server-Side Request Forgery (SSRF) in the NGINX configuration file. The SSRF allowed an attacker to proxy requests via HikCentral Professional, which could lead to severe consequences. For example, an attacker could use the vulnerability to reach into a private network and access internal services.

Rusty Beginnings: Error Handling in Rust

Fri, 26 Apr 2024 20:32:37 +0000

I never liked the verbosity of Rust. Rust code always looked messy and so different from what I am used to. But since I started learning Rust, I have begun to enjoy the language. However, one thing that has been more difficult than what I have imagined it to be, is error handling.

For example, in Go it is normal to return Error and simply set it nil if there is no error. In Rust however, error handling has far more expressive. As part of my rusty learning experience, I would like to document how to perform structured error handling which involves managing errors in a consistent and maintainable manner to create more robust code.

Hacking the Success Code: 6 Habits Every Penetration Tester Must Have

Thu, 05 Oct 2023 14:51:17 +0200

After have working professionally in cyber security as a penetration tester for half a decade (hacking scene for 10+), I feel I have learned a few things on how to improve your skill set, way of working and communicating with customers. I have also had the opportunity to work with some great people in cyber security from which I have learned considerably from.

In this article, I will present six habits which I believe represent a strong penetration tester. Let’s dive in!

Supercharge Your Integration Tests with the Power of Docker

Tue, 19 Sep 2023 12:25:17 +0200

In the beginning of my developer career, I learned to use in-memory databases for running integration tests. The in-memory database made it easy to spin up a local database which is often needed for integration testing. However, there are some drawbacks with this approach.

A Clever Illusion

Using an in-memory database does not reflect the real database running in production. The local database may look and feel like the real deal, but it’s essentially an illusion, and a clever one.

Learn AI or Get Left Behind

Tue, 12 Sep 2023 12:25:17 +0200

The AI boom has not gone unnoticed, ChatGPT captured everyone’s attention with its science fiction like behavior, and the generative image AIs have gone super nova, disrupting everything we knew about art.

We have not yet figured out what all this means for the future. One thing is clear though, if you want to be apart of the future, you’re going to need to learn AI.

Large language models (LLMs) have already taken people by storm and changed how people work. Professions like human resources, content writers, support and many more, have seen their respective fields disrupted beyond imagination. This is only the beginning, more professions are going to experience the same shock to their systems.

Deploying Django with Github Actions and Docker

Sat, 02 Sep 2023 14:51:17 +0200

In this article, you will learn how to deploy your Django application to your VPS using Github Actions.

If you want to, you can checkout one of my Django applications here, where I have implemented the steps described in this article. The main idea is that every time you create a “release”, Github will pick up newest release version and trigger a docker build for that release. The end result is quite amazing, because now you can simply run docker pull ghcr.io/<user>/repo:latest on your VPS to get the latest version. The article assumes a moderate level of understanding of docker.

Should you take a black box approach or a white box approach in penetration testing?

Sun, 20 Nov 2022 12:25:17 +0200

Lately, customers have been asking for a black box approach when performing a penetration test of their system/web application. During meetings, it has been clear to me that the stakeholders do not fully understand the differences between a white box and a black box approach and what benefits they provide. Therefore I would like to write down some of my thoughts on the subject, perhaps it will give an additional perspective when choosing between these approaches.

Measuring attack paths in web applications

Sat, 29 Oct 2022 14:51:17 +0200

Recently a customer asked us after our penetration test against their web application, the percentage of possible attack paths we had covered. It was a difficult question to answer because, a) the customer wanted us to focus on SQL injection and XSS (long story why) and b) it was a legacy application from 2003 containing a lot of code. The short answer I gave was that since the test was focused towards SQLi and XSS, naturally, some attack paths were not considered. The customer understood this and accepted it.

My thoughts on Secure Code Review

Fri, 01 Jul 2022 09:51:17 +0200

In this article I would like to share my thoughts, methodologies and techniques on how I perform secure code review. By secure I mean code review with the purpose of finding unknown vulnerabilities. My focus is generally on web applications, but the ideas mentioned below apply to other types of software as well.

1. Understanding 👨‍🏫

Begin by understanding the application. Browse through the code and the application’s functionality until you have a clear intuition for what the application is capable of. By browsing the code, you get a feel for the quality and style of the code. By quality I mean: is there a lot of duplicate code, how are variables and functions named? Is there a lot of over-engineering going on? This may be an indication of unnecessary complexity that might contain vulnerabilities.

Python gems to look out for

Wed, 29 Jun 2022 00:00:00 +0000

A few weeks ago I was looking into Python specific code patterns that would lead to vulnerabilities. I was surprised when I found a few patterns that I hadn’t really thought about, most likely because I never write Python code like the examples I found. Nevertheless, I learned something new and thought I share it here.

Example One

Passing an untrusted string to an f-string while passing a dict as an argument to the logger, may give the attacker the possibility to read keys in the dict that should not be readable.

Unauthenticated LFI in Appwrite 0.5.0 <= 0.12.1

Tue, 22 Feb 2022 13:13:37 +0000

While exploring cyber space I stumbled upon a project called Appwrite. Looked interesting, started browsing the code. Eventually, I discovered an undisclosed vulnerability in one of the endpoints allowing an attacker to read local files on the system.

The endpoint /.well-known/acme-challenge is vulnerable against local file inclusion which allows an attacker to read arbitrary files on the system. The endpoint contains incorrect checks for verifying that file is located within a defined base path. Vulnerable versions include version 0.5.0 to 0.11.0. The vulnerability does not require authentication.

Overwriting HttpOnly cookies with Javascript

Mon, 01 Nov 2021 13:13:37 +0000

So I got in contact with Sam Anttila on twitter regarding his article about overwriting HttpOnly enabled cookies using Javascript, which should not be possible. I asked him if he had verified if Firefox exhibits the same behavior. He answered yes and the result was negative, but the test was done a long time ago and things could have changed. So I decided to try it out myself, as you should :)

Technical Analysis Of The Necr0 Python Malware

Mon, 20 Apr 2020 13:13:37 +0000

I recently got a hold of a malware sample written in python that dropped crypto currency miners, among other things. It was built with Python2.7 and was heavily obfuscated. I decided to analyse it and try to break it apart to understand it better and its capabilities.

In this article, I will show some parts of the malware and explain its purpose. I will also provide some detection techniques for detecting this specific malware.

SLAE 7: Creating your own crypter using golang

Mon, 27 Jan 2020 13:33:37 +0000

In this article, we will build a simple crypter for encrypting and decrypting shellcode. I chose to implement the crypter in Go using environmental keys.

I will not spend time implementing a fancy shellcode execution method in this article, only encryption and decryption methods are in scope for now.

Encryption

The encryption/decryption process is using AES GCM and a specific file in /etc/ concatenated with the current user logged in as the key. This is called Environmental Keying, meaning you use specific values found in the victim’s environment such as files, hostname or users. The purpose of this is to make sure that your malware only executes in a specific environment. This means the attacker needs to know some details about the environment before encrypting any shellcode.

SLAE 6: Creating polymorphic shellcode

Sun, 26 Jan 2020 13:33:37 +0000

The goal of this article is to create polymorphic verions of three different shellcodes from http://shell-storm.org. Polymorphic shellcode has the ability to mutate its code everytime it runs. The instructions changes while algorithm stays intact. The purpose is to evade signature based detections without manually change the shellcode.

We won’t be creating our own polymorphic engine in this article, instead we will manually modify these three shellcodes from shell-storm.org:

We are not allowed to increase the size more than 50%.

SLAE 5: Analyzing shellcode generated by msfvenom

Sat, 25 Jan 2020 13:33:37 +0000

In this article, I will analyse three shellcode samples generated by msfvenom, specifically:

linux/x86/read_file
linux/x86/adduser
linux/x86/shell/reverse_tcp

msfvenom --list payloads -a x86 --platform linux

Let’s see if there is something new we can learn from these samples :)

Analyzing linux/x86/read_file

First, we generate the executable like so:

msfvenom -p linux/x86/read_file -a x86 --platform linux PATH=/etc/passwd FD=2 -f elf -o read_file

I set the payload options PATH and FD to /etc/passwd and 2. Executing the program outputs the contents of /etc/passwd.

SLAE 4: Custom encoder for bypassing signature based detection

Fri, 24 Jan 2020 13:33:37 +0000

Malware detection techniques has improved a lot over the years. Today companies are investing in machine learning methods for detecting malware, which sounds pretty cool if you ask me. However, there is one method that has been used since the first anti-virus software, which is signature based detection.

When disassembling a program you can analyze the assembly instructions in order to understand the program from the lowest level. It’s also possible from the assembly code to identify a set of unique instructions that identifies a specific program. These unique instructions form the signature. The instructions can be anything that identifies a specific and unique behaviour in the program. An example could be a decryption routine that identifies a decryption stub used for decrypting shellcode.

SLAE 3: Egg hunting in Linux x86 Assembly

Wed, 22 Jan 2020 13:33:37 +0000

When writing exploits, you sometimes encounter a situation where your payload is too big, you can’t fit your payload inside the buffer. This is where “eggs” come in to play. The basic idea of egg hunting is to divide the payload in to two parts, part one is the hunter while part two is the hunted (the egg). The hunter is a set of instructions that searches the program’s virtual address space for a given pattern (the egg). Once it is found, the hunter will jump to the payload following the egg.

SLAE 2: Creating a reverse TCP shell in x86 Assembly

Tue, 21 Jan 2020 13:33:37 +0000

What is a reverse TCP shell?

A reverse TCP shell is a program that instead of listening for incoming connections, the program will connect to a remote system and provide a local shell. This is useful in situations where the victim system is behind NAT, meaning you can’t directly connect to it, instead the server will connect to you. For this reason, reverse TCP shells are usually prefered over bind shells.

SLAE 1: Creating a bind shell in x86 Assembly

Mon, 20 Jan 2020 13:33:37 +0000

What is a bind shell?

A Bind shell is simply a program that listens for incoming connections. When a connection is made, a local shell is redirected to the newly created connection, thereby giving access to the local machine. Bind shells are usually created for backdoor access, although they could also be used for legitimate purposes, e.g. system administration.

ok, nuff said, let’s boogie

Our program will follow these steps:

Hack The Box - Olympus Writeup

Thu, 15 Aug 2019 00:00:00 +0000

I begun by scanning the box to find some interesting ports.

PORT STATE SERVICE VERSION
22/tcp filtered ssh
53/tcp open domain (unknown banner: Bind)
80/tcp open http Apache httpd
2222/tcp open ssh (protocol 2.0)

Port 80 was open so I visited the site and found a picture of the almighty God Zeus. I checked the response headers in the developer console and noticed the xdebug variable. According to my google fu, it’s a PHP debugger which among other things, can be used to debug remote PHP applications.

Security Recommendations For Implementing BankID

Sun, 19 May 2019 20:32:37 +0000

This article was originally published at https://kits.se/blogg-2019-05-13/bankid-anyone

BankID is the leading identification solution in Sweden that allows companies and government agencies to authenticate individuals over the Internet. BankID offers an API which makes integration easy for companies.

In this article I will describe BankID API features which developers should use to limit the effectiveness of today’s phishing attacks against BankID. I will also cover how QR codes can be used as a method for authentication/signing with mobile BankID and how it can improve security.

My OSCP Review

Sun, 20 Jan 2019 00:00:00 +0000

In this blog post I’ll write about my experience taking the OSCP certification as well as some recommendations for people wanting to take the exam.

I got access to the OSCP lab network 2019-09-09 and lost access 2019-12-08. As you can see I chose 90 days of lab time. The number one thing I read in all the OSCP reviews out there was that do not underestimate the amount of time it takes to be successful in the lab network.

SEC-T CTF - G1bs0n Writeup

Sun, 17 Sep 2017 00:00:00 +0000

Hacking the gibson, one byte at the time…

UIUCTF - Are we out of the woods yet? Reversing 350p

Sun, 30 Apr 2017 00:00:00 +0000

It looks like this python script was run through a custom packer. It's just Python*, which means it must be easy to reverse, right?

*v3.6.1:69c0db5

https://www.youtube.com/watch?v=y8qQsXpcZXA

This was fun little challenge that our team (https://chalmersctf.se) solved together. You are presented with the file packed.py that contains the following code:

import marshal, zlib, base64, itertools
def xor_strings(_left, _k):
 out = b''
 for l, r in zip(_left, itertools.cycle(_k)):
 out += (l ^ ord(r)).to_bytes(1, byteorder='big')
 return out

def YET_eval_code(p1, p2):
 YET_code = marshal.loads(zlib.decompress(xor_strings(base64.b64decode(p2), p1)))
 eval(YET_code)

YET_eval_code("YET", b'IdkZDw77+o1N7Di7tKvNdbcGSyxAHBQCMDw12oRMcF9ROnVSwvKV+QF5+XW7ro70gu6ab7p1grlxNvbOLDMNXJpNfMagxOrwCrApxe8WxToZJ7Fo1LSzaO87HkVHachzv7ItMwuLq4nI5KBzqkyYmZaLf6NnIUN7OjslBoVvqbufNX+mk6G33qpKTDwzrwa5znSK1ARqs3rO2ayzgCgJFhtzrHHI5AvrFfqYL9brp6R76oobxtoLPuobrJa/qtJ9aEzLRviUqpozgaGn9b3hZzzJ1FgKoTprUzpjRKSqPUKKnqypcv77hOlQN7ylvLtgXbyp8uUikn+fu6+qu7EatZvLH7uq+ItqZKMCuvnDFvQv9KrnFpScbLApQ5rzvHpzvIqSm7qtk+WAhTd2TpkrK46eFhAJX+wDZCEBRlup/oqHNuPrwtPrQYKrCr6g2qdj7DpI+NvQij9CZ5CbrA6st+SiLLcxby9KLuQqpn/anzjP1e/ypYJbrrLdDBPqTJoLu4lWjLgt0Uavp3AkxGmdEvL+h/+JhpwCvOvFCLBOIDWU5Hrv9FArJXczYHFSNTsZR2wWp7G0h7EoVnor9bu9rpE3mF6rCRZp5gyutPGoP4mykp7As1p3fKWQ2COHQwB1cBrTy93iUvdvyoDiNYlHZ2Fgcr8zuRc6dKx1WtF052zhQuxMwo1eZ61u0k9XhOJPfBYeJ/QGU3yfiN4IHmgMOXznCRLgRmul7B+DYKLbXOHAHjYfvV+7RSQ1FrzxfFt/NWpaRTzKHvUltc4s3JiC4SvJpYQ5AiLrcF079BsC4ktOKZBrAU5Ys7n2kCYn6sbNd5uOlOMdEJXmL6t0UNpi7aXv0ntvswTVEyDCkgb3cUwDSxBREu3SKkQ+TSAaq6G6MRkHle9k9bJp5FwGMZBY9Gy605jyH7O6vKd5IkLX82SVQt6UVYmz4DHtTTP5wvWn9yf7HAb8X5pB4e1eoZQWjrsm56SjGvoGSGpqkei8yG32OecHjq4i8rBJu5hA1RgedxkKk2eNkhQnB9E8n1rE631x8sh+iY7YBfOvrGja0tPWHU5lQw3oBCsndS4fuHOgqeBGQz3xOIN51f2VG9N6in8xKP3iPxWBFPEZMi+LRYByR/PdMBDcm2xgLS2dAX650nh3uf/nwR4okZAn5Kesl17aJFtxRH/wIeiewc5v/ma77CKa3sdEKB6QYXT8V6DzlI9AVLCwlY4wbGrQJ50FwaXCexviMm+SvK/mar/wg7R4n9DJkqQG9ttSOiD4JNGxlciIU+8l1yFvSIwx2lZv95BGkoeUJWtNeHwDjsze/d3pLJL5WS5uxGeQxSaRf33/ZQ3hC1ImnSOj7CvgCzX+ONPZ015B/DbPO4If9B0KSAIXMnZRvNDN3Vj6rRTaZIpG5ILBqMAAYP//GSoFybXk9TF/OvD0SuN6TYpXyA9LrTF5RN1aezlNzGbT+d2uLRxdh0CRjRPnXACEAIU8oz9X3DT8emRPIaSi7UZ2LXiwUjT7MNIfIv76rNNAAjc7M3+0umCXiRBn51xRkFA+jAe88B6ZY0z/gpCyrNeV+3bAKkPLAR0bslOTfh69TwE23FONJ9uw1OSnE/lfcY5fJUL/l/37lfhB/fbtciyOhw5dQbM+0h8FgAjc3OkxrlIpyW0PYTa0VTJPzmgnCQxpKwCnFEUd22j4Wv/t38NeqsAVdNB2sVUlPFSn4/ls9EW57sddKVwZBIK9QX577WWHsM+8C0b1bN/ebkyTxaIAguZ/35b0Tzcbh/UNScwgDbXKtjLGvu5mKG0GBFfcg3NkDnmF6YCxztszEwX72DinUfpAk3AhnIpSJMMco//VTrg2JiuHNPrtdfYpNiadE3dvIBQTqu/VNId0uYEaxEEGnWl6LoBGKLPVK6NpUM7gwZzTHMCUiTAtyXXQ2OCAi272ZFfkhc10+YwkguyQb+VT+VjZqmCJKn4HT/bOG4XoM5ROd36u5cvdWE7goOyetdbcgfdqoZB6cwUvqSqdAMuvOA6z7vtrI3dbLBj7sbv5DlYe2omV2tGhTy++usTqOBL9PutSEI6ebG+MMtkfB52mDRb0QYkykqfkm3Fdy6ODbJ96wYknnY0Qr52e5clvtLHJ4aCzzHNK+d/c4i0NuLYtUTliEBdROV535dzoPAPcl98gN0DsWFBAFmAsNEkOUFRhvP4kk3FT23/MGakbnm6a2IN7G6vgsl1yaQb9BQfODdtnh8SYkyVHqhUfYdh5LuNV3qYT7O2WSo33y8n3XBhQ/gSGAe7ALRNhfD3HQtgVcH2WyoL/kmRi/WohIfjf6MA2jPHPQckasFxwKVc5rwS6/N0F4EJAAkFYDiODN/29r5uMQtnjtB/6gdZNT/Umjr8QkdRFgCKwX2mB/K1kf+5AZfIATOgZ9+gAd0/veeClPhYU7m6D99OS7zctg4NR8LCivwxjPI4UcfuTqf3i2Dk5ebw+Y35RKdwSkRgJxHMh13GeoPPuW1S90qYsyfGDg6KCgBt6qyP60lX/BbNOASutLMLxnQBZgNkISVfVsuz2vUlAWsq0E4ZEqd+JoOn6BkRQvpQ9Ltb0o8nEwj0jjEpyXMZ56RMXEay0IyG5WvJD1309fKdyTlidj74Hw/B8yEeK3CvPVCwsvsQlvIbeVxnqCN1SE1LDa5Q2dEO0H9CP9Brs9F9Afr182V0/XNkyghuLvPOEatSbo86KO8DI+flZ80gIBZ09DD2Ojxoy+Bz73L8UQV3mAUV8kbYuMA02J34BSFX8qhAhM+ACgjtT7JnFgt3x9Bz0h0SJZl3VxhrcK/Ynqw1pAEHE2exvnVRhX9tNTibRXhA/LZEc0xholsdG73ZG4xi4I2s7DnidKX0w1jLXPaXIuRP5esIV2ygPM1j1veSroeuovIaOpa9V5jyUokJoJZfPzrzForzrXL+k/mFXFKkqorXEjIbKpzuuuJjTvrpWCUQt2Q==')

We could quickly deduce that there was an embedded python program encoded with base64. In order to reveal the program we decompiled YET_code variable with dis.

VolgaCTF - Bloody Feedback writeup

Tue, 28 Mar 2017 00:00:00 +0000

Bloody Feedback

Send your feedback at bloody-feedback.quals.2017.volgactf.ru

DO. NOT. USE. SQLMAP
Otherwise your IP will be banned

The challenge basically has two functions, 1) Send feedback and 2) view the status of the sent feedback. There is also page that cotains “Top Messages” which is the feedback people send in. When you send feedback you get a token back which you can use to see if the feedback has been processed or not.

VolgaCTF - Share Point writeup

Tue, 28 Mar 2017 00:00:00 +0000

Share Point

Look! I wrote a good service for sharing your files with your friends, enjoy)
share-point.quals.2017.volgactf.ru

The challenge begun by signing in to the control panel by simply entering random account details. Once logged in you had the ability to upload files and share them with an other user. Since the site only had one functionality, uploading files, I assumed the goal had to be to upload a web shell and find the flag on the file system.

Chalmers CTF

Wed, 01 Feb 2017 00:00:00 +0000

Hey, long time since last post, been busy with university and starting Chalmers very first CTF team: Chalmers CTF!!

Check out our website for information: https://chalmersctf.se

SEC-T CTF - Confusion Writeup

Sat, 10 Sep 2016 00:00:00 +0000

This time I participated in the SEC-T CTF event and it was pretty fun! I played with a group of people from my university and we managed to get quite some points. But I didn’t manage to solve some of the challenges on time. However this didn’t stop from trying to solve them once the event was over!

One of the challenges I was hooked on was called Confusion. The reason why was because it seemed like an “easy” challenge but for some reason I couldn’t figure it out! The challenge began by downloading the following image:

Exploiting weak Content Security Policy (CSP) rules for fun and profit

Thu, 21 Jul 2016 00:00:00 +0000

This article is based on my findings during a bug bounty. I was looking for any input bugs which could trigger a XSS but didn’t find any until I tested the file upload functionality. Users had the option to drag&drop images into the company’s website and place it in their gallery, however by specifying an image like this:

1<img src="https://hackerdomain.hax/img.php" onerror="this.src=alert(1)"/>

And dropping it into the website trigged an XSS.

Before I continue my report I will first cover what CSP is and what it tries to accomplish. If you feel you are already experienced in the area you can skip to the next section.

Creating SYN flood attacks with Python

Wed, 22 Jun 2016 00:00:00 +0000

Today it’s very easy for people to download tools that overwhelm computer systems (denial of service) in order to take them offline. There are different types of attacks that can be used to create a denial of service attack, one of them is the SYN flood attack which this article will cover. I will also show how to develop your own SYN flooder and some protection mitigations.

What is a SYN flood attack?

The SYN flood attack works by the attacker opening multiple “half made” connections and not responding to any SYN_ACK packets. In order to understand the SYN flood attack it is vital to understand the TCP 3-way handshake first.

Monitoring your server with Monit

Sun, 12 Jun 2016 00:00:00 +0000

I run a couple of services on my server, some of them are web, teamspeak, irc and an openvpn server. I need to be notified if any of these services becomes unresponsive for some reason. This is where Monit comes in.

What is Monit?

Monit is a small Open Source utility for managing and monitoring Unix systems. Monit conducts automatic maintenance and repair and can execute meaningful causal actions in error situations.

Securityfest CTF - Defacer Challenge Writeup

Wed, 08 Jun 2016 00:00:00 +0000

I actually learned something entirely new on this challenge, I decided I had to do a writeup to share my findings.

If you read my previous Securityfest CTF writeup you perhaps know that these challenges were from securityfest held in Sweden, which I attended. I did not solve this particular challenge on time in order to win any prizes, but that didn’t stop me from trying to solve it.

The challenge is to get the flag by defacing this website http://alienzon.com/ which is protected by (simple) WAF. I actually spent 4-5 hours on this challenge testing different attack vectors that did not work. I tried SQL injections and XSS attacks all over the place but no joy. So I turned to the place where I thought would be the correct path because it most the most odd part of the website. It was on the Fun Stuff page under Be a hero in a star story! section. The odd thing about this part is that when you enter your name and click submit, the post request looks like this:

Securityfest CTF - Coresec challenge writeup

Mon, 06 Jun 2016 00:00:00 +0000

This challenge was produced by Coresec Systems and was released during Securityfest. I would liked to have spent more time on it during the event but couldn’t really find any time for it. Now the event is over and first year of university is completed, I decided to try to finish the challenge. It was quite tricky at some points but now when I think about it in hindsight, the challenge itself was actually fairly simple. Okey, nuff said let’s boogie!

Using Amazon S3 for your static site? One thing to keep in mind

Mon, 04 Apr 2016 00:00:00 +0000

Amazon is a great service for hosting your static website. The way it works is by creating a S3 bucket with the name of your website, uploading your files to the bucket and changing the permissions so that the bucket can be read by the internet.

So long as your domain points to this bucket, you are all good. However, as you may have realized, if you delete this bucket your website will display an error saying something like:

Basics of netstat

Tue, 15 Sep 2015 00:00:00 +0000

Netstat is a network tool available in most versions of Windwos, Mac OS X and Linux. You can use Netstat to view network information and statistics about the network you are currently connected to.

You could view information about incoming/outgoing connections, routing table, protocol statistics and interfaces.

On linux netstat has been deprecated, the command ss should be used instead. The difference between the two is that ss can display more information about TCP and connection states.

LogRhythm's Blackhat challenge - Write up

Sat, 08 Aug 2015 00:00:00 +0000

For Blackhat 2015, LogRhythm Labs had a forensics contest for analyzing a .pcap file and finding the secret missile launch code. Find the password and enter the contest to win one of these:

I really wanted to win this!

Analyzing the PCAP with WireShark

I downloaded the .pcap file and loaded it into wireshark. I begun by checking the Protocol Hierarchy under Statistics to get a view on the protocols used.

Alien: Isolation

Tue, 21 Jul 2015 00:00:00 +0000

I bought this game during the summer sale 2015, it had a 75% discount and lots of positive reviews. I told my girlfriend that we should play it together so she can experience different types of games rather than playing candy crush all day…

Anyway, the first levels aren’t that bad, you start out combating other stranded humans on board one of the ships. A few “holy shit” here and there but nothing too scary. One thing I noticed in the beginning was these weird noises which sounded like they were coming from the ventilation shafts. Like something was tumbling around up there, following me. I soon discovered who was making the noises…

Digital Steganography

Sat, 02 May 2015 00:00:00 +0000

There are many ways to conceal a message from untrusted entities, encryption is the far most used method for making sure no one but the intended receiver can read the message. However, there is an other method not widely used today and that is Steganography. In historical times people hid secret messages in all kinds of places where guards for example wouldn’t look. I remember reading about a method where a “king” would have one his messengers shave their head and then they would write the message on the head and wait for the hair to grow back. Whoever waited for this message wasn’t in a hurry…

Dashing Dashboard

Tue, 24 Feb 2015 00:00:00 +0000

(Note: Not my dashboard above)

Not long ago I set up a dashboard for our office to show statistics about sales and such. The software we decided to use was Dashing.io. Dashing is a Sinatra based framework written in ruby that lets you build beautiful dashboards.

I had no previous experience with ruby but it went well, as it was mostly syntax that differed from what I was used to.

No Such Agency

Wed, 18 Feb 2015 00:00:00 +0000

Thoughts on the NSA leaks and what it means for the world