Collaborate Disseminate
Following on from Why do mobile devices force user to type password after reboot?, I’ve noticed that my Pixel 6 Pro can access data after a restart. e.g. WhatsApp messages come through and notifications with previews show before the device… Continue reading How does Android 12 / Pixel 6 allow data access before encryption key entry?
Nessus is reporting that an “SSL Certificate Cannot Be Trusted”.
This is due to the intermediate certificate not being in the certificate bundle presented during the TLS/SSL handshake.
I’ve looked at a couple of similar thr… Continue reading Checking Intermediate Certificates Programatically
Is a permissive crossdomain.xml Flash policy analogous to a permissive CORS policy?
i.e. Is
<cross-domain-policy> <allow-access-from domain=”*” /> </cross-domain-policy>
the equivalent of
Access-Contro… Continue reading Crossdomain.xml – write access to domain
If I wish to run Nessus against a Windows server that is only accessible from another machine, I can setup an SSH tunnel like so:
ssh user@10.99.5.6 -L 127.0.0.1:445:10.0.0.45:445 -L 127.0.0.1:139:10.0.0.45:139
Then I would configure Ne… Continue reading Credentialed scanning through SSH tunnel
Similar to my previous question here, however I thought it was best to ask two separate questions rather than combining them into one.
From The Forrester Wave™: DDoS Services Providers,
Q3 2015 report, em mine:
Attack types defended
… Continue reading What is an Origin Error Attack?
The application I’m running a security assessment on encodes POST requests as follows:
POST /foo/save HTTP/1.1
Content-Type: application/x-www-form-urlencoded; charset=UTF-8
X-Requested-With: XMLHttpRequest
Content-Length: 6652
<snip&g… Continue reading JSON and form-urlencoded encoded payloads in Burp Intruder
If I try the sV (service detection) flag in nmap run via proxychains (socks5 server) it appears to give me a segmentation fault message:-
root@kali:~# proxychains nmap -n -sT -Pn X.X.X.X -p 22,80,222,10000 -sV
ProxyChains-3.1 (http://prox… Continue reading Proxychains + nmap = segmentation fault
I’ve got a Kali Linux box I use for pen testing.
I would like to configure my machine to DROP incoming packets, but only when I’m not listening on them.
e.g. if I run a netcat listener on port 80, I would like connections from the intern… Continue reading How to set iptables to drop packets that I’m not listening on?
I am running Kali Linux as a VM on my Windows machine which is NAT’d behind my company network, if I wish to pen test a website for a client and believe that a reverse shell is possible, what is a good way of achieving the connection?
Not… Continue reading Setup of Kali Linux for reverse shell connections over the internet