Curiosity in Practice
jgamblin From time to time I have the need to test or verify a web application vulnerability through the TOR network using BurpSuite. The easiest way to do this to use the pre-bundled TOR Browser. Configuration is fairly easy: Download, Install and Start the TOR Browser: Verify that the SOCKS proxy is started on 127.0.0.1:9150 Configure Burp (Options > … Read more
Last month I got a new iPhone. This month I realized I forgot my Xbox One password when I tried to log in to download some Games With Gold. I didnt think this would be a problem. I forget and rest passwords all the time. So I go through the normal steps and have it send me … Read more
On Wednesday night I tweeted this: If you are using TrueCrypt you should stop. Hashcat is now optimized to crack TrueCrypt volumes. https://t.co/voBdtKuuHW — Jerry Gamblin (@JGamblin) December 10, 2015 I started getting retweets and replies like this on Friday from people I respect (and a bunch from people I don’t know): https://twitter.com/kylemaxwell/status/675420596025585664 https://twitter.com/averagesecguy/status/674768017864134657 So people … Read more
HID proximity cards encode a facility code and internal card number in hex on most cards. Decoding it is extremely easy and should take less than a minute. Equipent Needed: Omnikey Reader (I like the 5025CL) RFIDIOT BRIVO Card Calculator Steps: Run isotype.py from the RFIDIot tool kit and copy the ID: Past the ID … Read more
As part of my research into RFID security I came across the “EM4100 RFID Cloner kit” by KBEmbedded which outside of having a terrible name is an amazing low-frequency (125 kHz) self-contained RFID cloner that can store and replay 16 cards. I was lucky enough to be in the Portland area this week and be able to … Read more