technical
Autodafe fuzzer compile fix
I wanted to take a look at an old fuzzer called AutoDafe because its name popped up in several papers I read in regards to protocol and file formats fuzzing. The last version is from August 2006 which is far back in time, but still – it might be worthy looking at. It is available…
DLink dir655 rev B firmware reverse engineering – part 1
Intro Recently I stumbled upon Paul dot com blog post Reverse Engineering Firmware Primer and decided to see if I could repeat the process and to test my newly installed Debian VM packed with RE tools. Here is my take on the task. To repeat the steps one generally needs binwalk and cpio. Walk through…
Setting up capstone (Debian Wheezy)
Intro Recently I’ve decided to dedicate a fresh Debian environment for my RE tools and having binwalk seemed as a good idea so I can play with firmware binaries. I followed the general install instructions from the project wiki and it seemed that all the dependencies were installed. On starting the executable however I got…
Practical Reverse Engineering Exercises – Ch1-Ex2 – Write-Up
Intro This is the second post of a blog series following my progress with the “Practical Reverse Engineering: x86, x64, ARM, Windows Kernel, Reversing Tools, and Obfuscation”, Bruce Dang, Alexandre Gazet, Elias Bachaalany, Sebastien Josse, ISBN: 978-1-118-78731-1. The book includes number of exercises and the authors encourage the people to blog their solutions. The solutions…
Practical Reverse Engineering Exercises – Ch1-Ex1 – Write-Up
Intro This is the first post of what should be a blog series following my progress with the “Practical Reverse Engineering: x86, x64, ARM, Windows Kernel, Reversing Tools, and Obfuscation”, Bruce Dang, Alexandre Gazet, Elias Bachaalany, Sebastien Josse, ISBN: 978-1-118-78731-1. The book includes number of exercises and the authors encourage the people to blog their…
D3 experiments: Simple vulnerability summary representation
19 May Update I have improved a bit the host representation. Digging into d3 capabilities found several very useful capabilities like scales. Also utilising jQuery tipsy for nice hover text info display. That lead to v0.2 which could be found here. My first d3 experiment I have started experimenting with data visualisation recently using d3…
How to emulate Gaussian blur in iDraw
I am sorry but this is not a security related blog post. However I still consider some workarounds as “life hacks” and if someone could benefit the shared info I will be most than happy. I recently started using iDraw and while working on some of my old drawings made with InkSkape I have noticed…
Vulnerable web applications to play with
This is just a list with applicaitons and frameworks out there that could be used to test your web application pentesting kung fu skills or to test your automated tools. I am trying to keep copy of those with me, because projects tend to die. So if you find that some of the links is…
Doxygen & PHP static code analysis call graphs
This post is more to document my own “discovery” and not to get into the loop of researching the same topic again and again. And if someone finds it helpful its great. I was searching for PHP static code analysis tools that generate call graphs and for my surprise the tool that I found most useful…
HTTP Basic Authentication Dictionary and Brute-force attacks with Burp Suite
HTTP Basic Authentication brief explanation HTTP supports several authentication mechanisms. Upon a request for resource within a protected space the server should respond with authentication challenge using WWW-Authenticate header. In order to receive authorization the client should send requested identification information using Authorization header. When the client is not authorised a 401 “Unauthorised” response status…
Recent Posts
Tags
bruteforce bug bounty bug hunting Burp Suite d3 data leak data recovery dictionary entropy pool fix fuzzing hackaday image processing Journalistic tools log analysis malware mindmap online courses Practical Reverse Engineering randomness sandbox skype SQL injection SSL technical visualisaiton visualisation Vulnerability Management Wanda the fish Zeus