Authors

Jeff Ake

The Feeling Is Mutual: Elegant and Effective Authentication

Sep 21, 2021 | Jeff Ake

Jeremy Allen

Implementing a Password Strength Indicator

Jun 22, 2018 | Jeremy Allen

JWT, OAuth, and Algorithm Choices

Feb 27, 2018 | Jeremy Allen

MitM Using Golang, Meet Timmy

Nov 08, 2016 | Jeremy Allen

Securing M2M Gateways

Jun 10, 2016 | Jeremy Allen

Patching BL/BLX instructions in ARM

Oct 15, 2015 | Jeremy Allen

Brad Dixon

Taking the Offensive: Why Adversarial Testing is Key to a Strong Defense

Aug 23, 2024 | Brad Dixon

Attack Surfaces: Networks and Infrastructure

Jun 21, 2024 | Max Sobell, Brad Dixon

Attack Surfaces: Applications

Jun 14, 2024 | Max Sobell, Brad Dixon

Attack Surfaces: People

Jun 07, 2024 | Max Sobell, Brad Dixon

Understanding Your Attack Surface

May 31, 2024 | Max Sobell, Brad Dixon

Why Using Encryption To Hide Resource Identifiers Could Be a Bad Idea

Apr 28, 2024 | Brad Dixon

Common Misperceptions About Security Scanners

Jan 22, 2024 | Brad Dixon

The Adversarial Mindset

Jan 04, 2024 | Brad Dixon

Decrypt TLS traffic With mitmproxy and Wireshark

Apr 06, 2023 | Brad Dixon

Shell Escapes

Mar 02, 2023 | Brad Dixon

Cheating in eSports: How to Cheat at Virtual Cycling Using USB Hacks

Aug 09, 2019 | Brad Dixon

Should GNSS Be a Threat Vector in Your Threat Model?

Apr 03, 2018 | Brad Dixon

Android 7 Cellular MiTM

Oct 24, 2017 | Brad Dixon

Proxying WBXML Services

Sep 20, 2017 | Brad Dixon

pin2pwn: How to Root an Embedded Linux Box With a Sewing Needle

Aug 06, 2016 | Brad Dixon

IoT Hacking: Peeking in IPSEC tunnels With Wireshark

Oct 30, 2015 | Brad Dixon

Roman Faynberg

If the Phish Won’t Go to You, You Can Surely Come to the Phish

Oct 06, 2023 | Roman Faynberg

Simplify Incident Response With CI/CD and Other Code Access Auditing

Aug 29, 2022 | Roman Faynberg

Secrets in Broad Daylight, or How $500,000/Year Software Can Help Hackers Compromise Your Network

Apr 12, 2021 | Roman Faynberg

Wear’s the MitM?

Oct 19, 2016 | Roman Faynberg

Ángel Suárez-Bárcena Martín

Credentialed Windows Remote Code Execution Techniques

Feb 17, 2022 | Ángel Suárez-Bárcena Martín

Three Most Common Security Mistakes Seen During AWS Application Assessments

May 27, 2021 | Ángel Suárez-Bárcena Martín

Unintentionally Exposing Your Organization to MFA bypasses on Azure Active Directory

Apr 19, 2021 | Ángel Suárez-Bárcena Martín

Rule-Based Highlighter Plugin for BurpSuite

Feb 18, 2020 | Ángel Suárez-Bárcena Martín

Parsing Binaries With Kaitai Struct

Feb 01, 2019 | Ángel Suárez-Bárcena Martín

Writing a Simple ESP8266-Based Sniffer

Jul 26, 2018 | Ángel Suárez-Bárcena Martín

John Poch

OSINT: Subsidiary discovery

Sep 09, 2024 | John Poch

Network Monitoring With nmap

Nov 04, 2013 | John Poch

Austin Ralls

Scanning SMB Shares Harder With smbls v2

Apr 24, 2024 | Austin Ralls

Contest + Wargame: Exploiting Misconfigured Sudo

Sep 30, 2023 | Austin Ralls

Keeping an Eye on Your Public IP Space in Private

Jul 28, 2023 | Austin Ralls

How We Use BloodHound, and How It Can Help Defenders: 3 Ways IT Analysts Could Use BloodHound To Improve Windows Domain Security

Jan 10, 2022 | Austin Ralls

Inbox (1): Proper Email Authentication

Nov 18, 2021 | Austin Ralls

Scanning SMB Shares With smbls

Nov 03, 2021 | Austin Ralls

Be Careful With Your Testing Account Passwords

Jul 30, 2021 | Austin Ralls

In Praise of LAPS

Jun 30, 2021 | Austin Ralls

Backend DDoS Protection

Jan 27, 2021 | Austin Ralls

Dylan Ross

Request Mutation and Why WAFs Can’t (Always) Save You

May 24, 2024 | Dylan Ross

Man in the Middle: Viewing and Modifying Victim Traffic

Dec 19, 2023 | Dylan Ross

XSS Through DHCP: How Attackers Use Standards

Oct 26, 2022 | Dylan Ross

Danny Rosseau

AppArmor and Danger Daemon

Oct 09, 2024 | Danny Rosseau

SELinux: Danger Daemon

Sep 16, 2024 | Danny Rosseau

MacGyver Networking

Jun 24, 2024 | Danny Rosseau

Burpscript, the multi-language scripting extension for Burp Suite

Jun 03, 2024 | Danny Rosseau

Owning a Device With a Single Jump

Jan 13, 2020 | Danny Rosseau

Android Hard Coded Secrets

Aug 30, 2019 | Danny Rosseau

Command Injection With USB Peripherals

Aug 22, 2019 | Danny Rosseau

Intro to Inzure: New Security Tool for Azure Deployments

May 06, 2019 | Danny Rosseau

Max Sobell

Attack Surfaces: Networks and Infrastructure

Jun 21, 2024 | Max Sobell, Brad Dixon

Attack Surfaces: Applications

Jun 14, 2024 | Max Sobell, Brad Dixon

Attack Surfaces: People

Jun 07, 2024 | Max Sobell, Brad Dixon

Understanding Your Attack Surface

May 31, 2024 | Max Sobell, Brad Dixon

Q2 CIO Survey Results: A Battle on All Fronts

Apr 29, 2024 | Max Sobell

Guidance on Running a Bug Bounty Program

Apr 18, 2024 | Max Sobell

How To Save Time and Money in Your Remediation Process

Mar 13, 2024 | Max Sobell

AI in Practice: Early Adoption, ROI, & Data Privacy

Jan 25, 2024 | Max Sobell

NFC Edge Cases and Past Transgressions

Apr 15, 2016 | Max Sobell

Jesson Soto Ventura

Dumping Keys From the Linux Key Retention Service — Part 2

Dec 02, 2024 | Jesson Soto Ventura

Dumping Keys From the Linux Key Retention Service — Part 1

Oct 25, 2024 | Jesson Soto Ventura

Abusing WebViews To Steal Files via Email

Aug 19, 2019 | Jesson Soto Ventura

Mike Zusman

Security Assessment Color Palette

May 20, 2022 | Mike Zusman

Look Ma! Dotless Domain Names!

Aug 06, 2013 | Mike Zusman

Matthew Waddell

Working around unusual end-to-end cryptography with Burp and Burpscript

Dec 13, 2024 | Matthew Waddell