Quantum computers have been widely discussed since the 1980s. Even though very few people have dealt with them by now, such devices steadily become a harsh reality threatening traditional cryptography. In response to this threat, computer engineers have developed post-quantum encryption algorithms. In this article, I will show how these algorithms are applied in OpenVPN and will give an overview of the current situation in the world of quantum technologies.
Read full article →First contact. Attacks against contactless cards
Contactless payment cards are very convenient: you just tap the terminal with your card, and a few seconds later, your phone rings indicating that the transaction is completed. But this convenience has a downside: malefactors can steal money from such cards. This article provides an overview of methods used to hack NFC (near-field communication) payment cards.
Read full article →Pentest in your own way. How to create a new testing methodology using OSCP and Hack The Box machines
Each aspiring pentester or information security enthusiast wants to advance at some point from reading exciting write-ups to practical tasks. How to do this in the best way and what should you pay attention to in the first place? In this article, I will describe my own pentesting journey and share some of my findings.
Read full article →Persistence cheatsheet. How to establish persistence on the target host and detect a compromise of your own system
Once you have got a shell on the target host, the first thing you have to do is make your presence in the system ‘persistent’. In many real-life situations, you have only one RCE attempt and cannot afford losing access due to some unexpected event.
Read full article →It’s a trap! How to create honeypots for stupid bots
If you had ever administered a server, you definitely know that the password-based authentication must be disabled or restricted: either by a whitelist, or a VPN gateway, or in some other way. We decided to conduct an experiment and check what happens if this simple step isn’t taken.
Read full article →Digging to the bottom. Escalating privileges to root with kernel exploitation techniques on a Hack The Box virtual machine
This article discusses one of the most sophisticated PWN topics: kernel exploitation in Linux. You are about to learn what tools are required for kernel debugging, what are LKM, KGDB, IOCTL, and TTY, and many other exciting things!
Read full article →The big heap adventure. Mastering heap exploitation techniques on a Hack The Box virtual machine
This article covers the following topics: memory management algorithms in Linux, heap exploitation techniques, and exploitation of the Use-After-Free (UAF) vulnerability on a host where all protection mechanisms are enabled. The target machine is RopeTwo, one of the most hardcore VMs on Hack The Box.
Read full article →