Posts

Mr. Robot Season 2 Episode 9 - “Rubber Duckie, You’re The One” - I was fascinated by this piece of technology when I first saw it many years ago. Then I looked it up on the internet to learn more about it, and it turned out to be HID, or Human Interface Device. It basically imitates users and executes code or performs actions in their place. Since the real rubber ducky was out of my budget, I looked for alternatives and discovered that similar behaviour to the rubber ducky can be achieved using a less expensive piece of hardware - the Raspberry Pi Pico (7$)....

Last Updated on 2nd Feb 2023. Containers? Why do we need containers over VMs - Efficient Resource Consumption between containers Once License for services/OS Low Compute Overhead What does docker engine does? Emulates Filesystem Gives each container unique process ID Isolation of container process Communication between the architecture components - Components Docker client (The one user interacts with) Docker Host Docker Daemon Images Containers Registry Docker client using serveral API calls sends the commands to Docker Engine which is being forwarded to containerd....

Have you ever wondered, why your file is not working after downloading it from the internet? How does system know if the file is downloaded from the internet? The answers to this is Zone.Identifiers. What are Zone Identifiers? Zone Identifiers is an alternate data stream that points, from where the file came on the users' computer. Note: Alternate Data Streams are included with files on WIndows. This is typically the case with downloaded and blocked files....

Configure Network Using ip Command in Ubuntu Server Temporary Method - $ ip a # to get the interface name after connecting LAN $ sudo ip a add 192.168.1.8/24 dev <network-interface-name> $ ip link set dev <network-interface-name> up $ sudo ip route add default via 192.168.1.1 Permanent Solution - Ref: https://netplan.io/examples/ $ vim /etc/netplan/00-installer-config.yaml network: version: 2 ethernets: enx1027f579a565: dhcp4: false addresses: [192.168.1.10/24] nameservers: addresses: [8.8.8.8,8.8.4.4,192.168.1.1] routes: - to: default via: 192....

gRPC is a framework which is being used to build scalable and fast APIs. The framework from which it derives most of its positives is from the protocol it uses - HTTP/2. Apart from HTTP/2, it uses protocol buffer (protobuf) for the communication. gRPC can be useful in circumstances like - large-scale microservices connections real-time communication Low power & low bandwidth systems Multi-language environments Why Should We Care? Let’s talk Benefits The use of HTTP/2 over the TLS end-to-end encryption connection in gRPC ensures API security....

An interesting discussion, led me to realize this is one of the commonly discussed topic and I thought a blog post for it might be helpful for someone. Cross-site request forgery and Cross-site scripting are both client side attacks which performs action on behalf of users. Just some context here - Cross-site scripting (or XSS) allows an attacker to execute arbitrary JavaScript within the browser of a victim user....

WinjaCTF at c0c0n [2021]: I developed an easy challenge - called “Anonymous” - the challenge was based upon browser forensics. TL;DR Intended Way - Download the zip > Extract it > Navigate the Linux directory structure > To find a directory called .config > google-chrome > Default > Open the History File in SQL Browser > Search for URLs and upon up the URL to get a file with the name - formatted like flag....

If you have used Burp’s collaborator client for your Out-of-band testing, you know it’s awesome. Then why there is a need for a personal collaborator client? There are a few things that need to be addressed. Companies have started to blacklist burp collaborator’s domain, making it difficult for OOB vulnerabilities detection. ( Read here ) Collaborator client is not available for the community/free edition of BurpSuite. This brings the need for having a personal collaborator client, with no to minimal investments, that will help us in the detection of any out-of-band/blind vulnerabilities, and I have linked an amazing cheatsheet below that will guide in OOB Exploitation....