In my previous post I talked about using the nmap NSE scripts or Hydra to search for systems with default passwords. My approach involved two steps: first learn via Burp how the authentication works (getting to know the form elements etc.) and then use this information as input for the brute force scripts.
A colleague pointed out that you can also use Burp suite for this last step.
Similar as with the previous approach, first … Read more.
I wrote a follow-up on using Burp for both the analysis and attack phase : Hunt for devices with default passwords (with Burp).
Using a strong and unique password for authentication is a key element in security. Unfortunately there are still a lot of devices installed with a default password. This post describes how you can find the web interface of these devices.
Before we start, it’s to important to list the three different web … Read more.
I published an article on How to Use Passive DNS to Inform Your Incident Response on the Security Intelligence blog.
This article gives you an insight on the different logging options for DNS traffic and how the historical records in passive DNS can help you during incident response. I included references to generating passive DNS data based on your traffic and which options you have for consuming it from a client perspective.
I recently had to explore MQTT. I had never heard of this protocol before. However some helpful resources provide a clear explanation what MQTT is about.
MQTT is a machine-to-machine (M2M)/”Internet of Things” connectivity protocol that uses a lightweight publish/subscribe messaging transport. MQTT works on top of TCP/IP and by default uses port tcp/1883.
A quick search on Shodan reveals that there are a lot of devices publicly available, primarily in the US and Asia. … Read more.
Twitter is a great source for conducting open source intelligence. One of my favorite tools is Tweetsniff from Xavier Mertens. It will grab a Twitter user timeline for further processing, for example in Elasticsearch.
Another tool that I recently discovered is Tinfoleak. Tinfoleak is build for Twitter intelligence analysis and provides you with an HTML file output.
I wanted to use Tinfoleak to build profiles of users to tune targeted phishing campaigns (spear phishing) for … Read more.
The Drupal team released a security advisory for all Drupal sites recommending all these sites to upgrade to the latest Drupal version.
The discovered vulnerability could lead to remote code execution in Drupal 7.x and 8.x.
I have a mindmap on this vulnerability
Further information from Drupal can be found at
Drupal core – Highly critical – Remote Code Execution – SA-CORE-2018-002 The FAQ on SA-CORE-2018-002
According to bojanz this vulnerability … Read more.
Another day, another supposedly large scale malware attack. This time it’s called BadRabbit.
2017-10-25 : Detection methods (Windows events) 2017-10-25 : YARA rules 2017-10-25 : Removed spreading via Eternalblue 2017-10-25 : Removed Petya link
Based on the information from ESET the malware targets
transportation organizations governmental organizations media outlets Russia fewer attacks in Ukraine, Turkey and Germany
The malware is delivered via a fake Adobe Flash update (drive-by attack)
hxxp://1dnscontrol.com/flash_install.php (block this URL) hxxp://1dnscontrol.com/install_flash_player.exe (block … Read more.
KRACKs (Key Reinstallation AttaCKs) is a number of vulnerabilities in WPA2, related to key handshakes between a client and an access point.
An attacker can trick a victim into reinstalling an already-in-use key. This key (the 3rd message in a 4-way handshake) is resent multiple times by the attacker and each time installed by the client, resetting the nonce. By forcing nonce reuse in this manner, the same encryption key is used with nonce values … Read more.
I recently bought a Philips Hue light system. It allows you to control your lights via a smartphone app and set the right colour mood. Setup is easy, you connect a light bridge to your home router, connect with the app and then setup the lights. The system also includes an API to build your own apps.
In 2015 I tweeted on an episode of CSI Cyber where “good” code automagically turned green whereas “bad” … Read more.
I published an article on IBM Security Intelligence on Using a Free Online Malware Analysis Sandbox to Dig Into Malicious Code.
The article is a follow-up on an earlier post from 2015 (Comparing Free Online Malware Analysis Sandboxes) where I compare the features of different free online malware sandbox solutions, how you can extract indicators of compromise and how you should integrate them within your incident management workflow. The free malware sandbox solutions reviewed are … Read more.