After 3 months of good preparation I passed a challenging GIAC Certification for the GXPN – GIAC Exploit Researcher and Advanced Penetration Tester. The highlights for me were to learn and really understand how to defeat Windows and Linux stack protection, find common mistakes in cryptography implementation and in general to create and customize the tools to make them work…
2 CommentsCategory: AppSec
Since Kali Linux is not available as an app in the Microsoft App Store, the installation as subsystem requires to run a few commands. 1. First, the subsystem feature must be activated via PowerShell (if not already activated). Enable-WindowsOptionalFeature -Online -FeatureName Microsoft-Windows-Subsystem-Linux 2. Kali Linux is downloaded as an AppX file. We can find a file that is always up…
Leave a Comment
This article is about installing Sqreen on the hosting and web server management system Plesk. Sqreen is a Web-Application-Firewall (WAF) and Runtime-Application-Self-Protection (RASP) solution. Sqreen is easy to install and works out of the box. The onboarding process guides you very well step-by-step through the whole setup and while setting up your first application you learn about each config. This…
Leave a Comment
WordPress ist das weit verbreitetste CMS überhaupt. Doch nach der ersten Betriebsnahme denken die meisten nicht weiter an die Sicherheit. Deshalb sind Schwachstellen in WordPress besonders lukrativ. Veraltete Versionen, für welche öffentliche Schwachstellen bekannt sind, werden durch sogenannte Crawler und Bots erkannt und angegriffen. Dies passiert meist vollautomatisch. Oft ist das Ziel dieser automatisierten Angriffe das CMS dazu zu missbrauchen,…
1 Comment
For WordPress there are very comprehensive scanning tools like WPScan. Unfortunately it is not quite the same with the CMS TYPO3. Typo3 describes in its Security Guideline detailed measures to secure the Typo3 instance. Beside the use of secure passwords, always current versions etc. there is also a great area about permissions and access restriction. Let’s hope people are following…
Leave a Comment
I installed the Pi-hole on a Raspberry Pi. Pi-hole is a DNS server for your home network. I have it running on a Raspberry Pi 1, so it’s nice to have a use for my old Raspberry here. It also runs on a Raspberry Zero. Pi-hole is a DNS sinkhole (/blackhole) and is used to block unwanted domains without installing…
2 Comments
Two months ago I found a security issue in the Firefox integrated Password Manager and reported it. It was so obvious that I was really surprised. Of course, I was not the first to find this vulnerability. After I reported it, I was informed that it was known and that a bugfix for Firefox 73 was already available in beta.…
Leave a Comment
By chance I found in my Google Analytics analysis that my blog was visited by Google employees. My blog must have been linked to their internal “Mentor” page, because the HTTP referrer shows the domain “mentor.corp.google.com”, which comes from Google’s intranet. A browser automatically sends the last visited page in the header field “Referer”. A tracking service, in this case…
Leave a Comment
Letztens wurde mir die folgende SMS an mein Handy gesendet. Auf der verlinkten Seite war eine Nachbildung der Postbank Banking Seite erreichbar. Also eine Phishing-Seite, die versucht hat mein Kennwort abzufangen. Durch die richtigen Gegenmaßnahmen konnte die Phishing-Seite schnell vom Netz genommen werden. Der Inhalt der SMS war wie folgt: Aufgrund einer Änderung unserer Geschäftsbedingungen müssen Sie ihr BestSign-Gerät erneut…
Leave a Comment
Um die dynamischen Scans von OWASP Zed Attack Proxy (ZAP) in die Build-Pipeline zu integrieren kann das SonarQube ZAP Plugin eingesetzt werden. Der folgenden Beitrag dient als Schritt-für-Schritt Installationsanleitung vom Aufsetzen der VM bis zum fertigen Report. Passend zu diesem Beitrag auch: Dynamische Analyse mit OWASP ZAP Übersicht verwendeter Programmversionen Zur Übersicht werden hier die Versionsnummern der verwendeten Programme aufgelistet.…
Leave a Comment