Skip to content

Category: Security

“Smart” Door Lock Drilled Open in 4 Seconds

The most striking (you locksmiths will get that joke) thing about this is that an expensive “smart” lock was made with little to no physical security features in mind. I like how the article points out the difficulty of physically compromising a good-ole-fashioned steel, “dumb” mortise lock.

Is it true that “smart” lock manufacturers are forgetting about physical security when designing locks? Isn’t that the point of a lock?

Thoughts on OSCP being ‘outdated’

In recent weeks I have been reading comments online about the Penetration Testing with Kali Linux (PWK) course and OSCP exam taking a lot of flak for being “tool old” and using “outdated exploits that don’t even work anymore.”

I believe most of these comments are directed at the lab environment and course materials. It is true that you won’t find many systems in modern pentesting engagements that are exploitable with older things such as EternalBlue (MS17-010).

But that is beside the point.

The PWK and OSCP exam are all about teaching you how to think, solve problems, persevere, and develop a pentesting methodology that works for you.

It is true that Hack The Box (HTB) and other modern online capture-the-flag frameworks are more leading-edge in that regard, which is great, and they can certainly be an excellent way to augment and prepare for the PWK/OSCP journey.

But the point is that it really doesn’t matter if you drive a 2019 Ferrari 488 Spider or a 1996 Honda Accord, it is whether or not you figure out how to get to the destination.

OWASP Attack Surface Detector Project

When I did a short work stint at Secure Decisions in 2018, one of the projects I got to work on was helping to create the Attack Surface Detector plugin for ZAP and Burp Suite. I left that position before the project got published, but I am happy to see that it was a success.

Here it is in all its glory.

From the OWASP description:

The Attack Surface Detector tool uncovers the endpoints of a web application, the parameters these endpoints accept, and the data type of those parameters. This includes the unlinked endpoints a spider won’t find in client-side code, or optional parameters totally unused in client-side code. It also has the capability to calculate the changes in attack surface between two versions of an application.

There is a video that demonstrates the plugin, and yes, that is me doing the voice-over.

Kali Linux Dockerfile

Since recently discovering there is now an official Kali Linux docker image, I’ve been fiddling with it and tweaking my own setup to get it to how I like it for the things I use it for. I have a work version and a personal version. What follows is my personal version, used mostly for R&D, CTF challenges, and bug hunting in my free time.

My Kali Dockerfile (for Mac)

# The Kali linux base image
FROM kalilinux/kali-linux-docker

# Update all the things, then install my personal faves
RUN apt-get update && apt-get upgrade -y && apt-get dist-upgrade -y && apt-get install -y \
 cadaver \
 dirb \
 exploitdb \
 exploitdb-bin-sploits \
 git \
 gdb \
 gobuster \
 hashcat \
 hydra \
 man-db \
 medusa \
 minicom \
 nasm \
 nikto \
 nmap \
 sqlmap \
 sslscan \
 webshells \
 wpscan \
 wordlists 

# Create known_hosts for git cloning things I want
RUN mkdir /root/.ssh
RUN touch /root/.ssh/known_hosts
# Add host keys
RUN ssh-keyscan bitbucket.org >> /root/.ssh/known_hosts
RUN ssh-keyscan github.com >> /root/.ssh/known_hosts

# Clone git repos
RUN git clone https://github.com/danielmiessler/SecLists.git /opt/seclists
RUN git clone https://github.com/PowerShellMafia/PowerSploit.git /opt/powersploit
RUN git clone https://github.com/hashcat/hashcat /opt/hashcat
RUN git clone https://github.com/rebootuser/LinEnum /opt/linenum
RUN git clone https://github.com/maurosoria/dirsearch /opt/dirsearch
RUN git clone https://github.com/sdushantha/sherlock.git /opt/sherlock

# Other installs of things I need
RUN apt-get install -y \
    python-pip

RUN pip install pwntools

# Update ENV
ENV PATH=$PATH:/opt/powersploit
ENV PATH=$PATH:/opt/hashcat
ENV PATH=$PATH:/opt/dirsearch
ENV PATH=$PATH:/opt/sherlock

# Set entrypoint and working directory (Mac specific)
WORKDIR /Users/wchatham/kali/

# Expose ports 80 and 443
EXPOSE 80/tcp 443/tcp

Build it

docker build -t yourname/imagename path/to/theDockerfile 

(don’t actually put ‘Dockerfile’ in the path). Do change ‘imagename’ to something apropos, such as ‘kali’

Run it

docker run -ti -p 80:80 -p 443:443 -v /Users/yourname/Desktop:/root yourname/imagename

The above examples require you to replace ‘yourname’ with your Mac username

-ti
Indicates that we want a tty and to keep STDIN open for interactive processes

-p
Expose the listed ports

-v
Mount the defined folders to be shared from host to docker.

Hope that’s useful to someone!

Hat tip: https://www.pentestpartners.com/security-blog/docker-for-hackers-a-pen-testers-guide/

Online Safety: Top Tips for Parents

Each generation of parents has something different to worry about — something that has changed since they were young. You might have had internet access when you were a teenager. It might have been an invaluable source when it came to tackling big homework projects, and you might have even made friends in the odd teen-friendly chat room. But, times have changed, and most of us look back glad that social media wasn’t a big deal when we were younger.

You might have had a Facebook page. But, the internet wasn’t like it is now. Nowadays, it’s a massive part of everyday lives. We’ve all heard horror stories about children and teenagers being bullied online and about the darker parts of the internet we’re all keen to avoid. As a parent today, the internet is one of our biggest concerns as our children grow. Even very young children have tablets and some level of internet access, which only grows as they do. Let’s take a look at some tips to help you to keep your family safe online.

Explore Together

Remember, it’s better that your children learn about the internet with you, instead of picking up bits and bobs here and there. When they are young, and first getting online, do it together. Show them some websites and apps that you think they’d enjoy and give them a little freedom to explore with you.

Put Safety Measures in Place

However much you trust your children, it’s never a good idea to let them out on the web alone without putting any safety measures in place. Set parental controls on younger children’s devices. Turn off in-app chat and location settings and use your own app to monitor their usage, these are inexpensive and widely available. For older kids, you might want to speak to them about setting their own safety and explain the importance of keeping some things private and hidden.

Talk About the Risks

You won’t want to tell very young children the worst horror stories out there. But, you can explain to slightly older children that the internet can be dangerous. You can tell them about people trying to contact them online and explain some of the risks. Tell them what they need to watch out for, and teach them how to report any suspicious activity.

Don’t Be Too Critical

If you are too critical, or too overprotective, it will become a secret. They’ll start to hide their internet usage from you. They’ll spend their time online behind closed doors. They won’t want to speak to you about it, and they won’t be comfortable coming to you if they are worried. Remember, children are curious, and that’s fine. Try to be understanding and supportive, even if you are worried or don’t approve.

Encourage them to Trust Their Instincts

Instinct is essential when it comes to safety. If someone started talking to you online, you’d get a feel for the situation straight away, and it’s essential that your children learn to do the same.

Chat With Them

Take an interest in their usage. Ask about games they play and the sites they use. Let them tell you about the things that they enjoy, and take an active interest, even if it means you have to listen to too many Minecraft tales. It’ll help to keep your relationship open and honest.

The InfoSec World Has a Python 2.7 Problem

Welcome to 2019, everyone! The future is bright, and I am sure we will all experience a lot of fun and unexpected things in the world of security. So far this year, we haven’t see anything along the lines of Specre/Meltdown, which helped usher in 2018.

One thing I did realize is that the turning of the calendar to this new year, remarkably, means that there is less than one year until Python 2.7 is officially “unsupported.”

Just check the Python 2.7 Countdown clock if you don’t believe me. Everything should be well on the way to Python 3 by now. Or so you would hope.

I find it somewhat humorous (mildly) that the infosec community still relies so heavily on Python 2.7, given its impending doom. I still see new tools being actively developed in this version of Python crossing my news feed almost daily. So many things on Kali Linux rely on Python 2.7.

I have oberved that longstanding, popular open source stalwarts of the trade have shown little interest in moving to 3.x.

I really have no idea what to do about this, other than encourage contributors to migrate, and to lend a hand if and where possible. But it’s getting really late, and I still have to use python2.7 far too much in my day-to-day pentesting and security research life.

How about a New Year Resolution?