Technical

ECDSA Nonce Reuse Attack

Attacking cryptographic weaknesses is a dream hack for most penetration testers...

Bypassing Hardened Android Applications

Recently, we performed a penetration test on an Android application available...

Path Traversal to Remote Code Execution

In this blog post, Sanjay from the NotSoSecure Training team describes an...

NotSoCereal-Lab: A Deserialization exploit playground

TL;DR: NotSoSecure is releasing a new VM to hone your Deserialization skills...

WhitePaper Release: Defense against Client-Side Attacks

TL;DR: A new WhitePaper released /defense-against-client...

Tool Release: Serialized Payload Generator

TL;DR: A new tool released https://github.com/NotSoSecure/...

Project Launch : Tracking Browser Security Enhancements

TL;DR: NotSoSecure is releasing a new project to track security enhancements or...

Flutter based Mac OSX Thick Client SSL Pinning Bypass

During one of our recent thick client application penetration tests, Sanjay...

NotSoSecure @ HackerSummerCamp 2019

With each passing year NotSoSecure presence becomes bigger and better at...

Let’s Cook 'Compliance as Code' with Chef InSpec

Introduction The concept of DevSecOps has introduced an array of changes to our...

Security Architecture Review Of A Cloud Native Environment

Overview Due to its massive adoption, cloud computing has become a critical...

Semgrep A Practical Introduction

Static Application Security Testing or SAST is a testing methodology that...

Continuous Security Monitoring using ModSecurity & ELK

Recently, NotSoSecure got an opportunity to explore the working of monitoring...

Exploiting VLAN Double Tagging

We have all heard about VLAN double tagging attacks for a long time now. There...

Automating Pentests for Applications with Integrity Checks using Burp Suite Custom Extension

During one of our recent web application penetration testing assignments, @...

Hacking AWS Cognito Misconfigurations

In this blog, Sunil Yadav, our lead trainer for “Advanced Web Hacking” training...

Cloud Services Enumeration - AWS, Azure and GCP

TL;DR: We have built cloud enumeration scripts now available @ https://github....

SQL Injection Lab

In 2015, we launched a SQLi lab for attendees to learn SQLi. The challenges...

Identifying & Exploiting Leaked Azure Storage Keys

In this blog, Sunil Yadav, our lead trainer for “Advanced Web Hacking” training...

Achieving DevSecOps using AWS Cloud Native Services

In our previous article Achieving DevSecOps using Open-Source Tools we explored...

Exploiting ViewState Deserialization using Blacklist3r and YSoSerial.Net

In this blog post, Sanjay talks of various test cases to exploit ASP.NET...

Achieving DevSecOps with Open-Source Tools

Today, DevOps is enabling organisations to deploy changes to production...

Exploiting SSRF in AWS Elastic Beanstalk

In this blog, Sunil Yadav, our lead trainer for "Advanced Web Hacking "...

Hunting the Delegation Access

Active Directory (AD) delegation is a fascinating subject, and we have...

Project Blacklist3r

TL;DR The goal of this project is to accumulate the secret keys / secret...

Out of Band Exploitation (OOB) CheatSheet

Introduction: Out-Of-Band (OOB) technique provides an attacker with an...

Data Exfiltration via Formula Injection #Part1

Due to a recent intriguing client pentest we became increasingly interested in...

Analyzing CVE-2018-6376 - Joomla!, Second Order SQL Injection

Prefix While there are lots of security bugs disclosed each week, for us...

Anatomy of a Hack: SQLi to Enterprise Admin

We were recently engaged in a Red Team exercise in which the only information...

Vulnerable Docker VM

Ever fantasized about playing with docker misconfigurations, privilege...

Instrumenting Native Android Functions using Frida

In our previous post: Pentesting Android Application Using Frida, Rohit looked...

Maximum Password Length Reached!

A recent article by @mubix resurfaced the largely unknown fact that because...

One Rule to Rule Them All

Password cracking is a staple part of pentesting and with a few exceptions,...

Pwning with Responder - A Pentester's Guide

Overview: Responder is a great tool that every pentester needs in their arsenal...

MS17-010, the new MS08-067?

This past Good Friday, @ShadowBrokers group (https://steemit.com/shadowbrokers...

Anatomy of a Hack: SQLi via Crypto

Cryptography has various advantages including confidentiality of information....

Anatomy of a hack: Docker Registry

Docker is a popular container technology and has been very well accepted by...

Pentesting Android Apps Using Frida

Introduction to Frida In this blog post, Rohit Salecha guides newbie pentesters...

Active Directory Delegation and Manual Analysis

In many well secured environments you’ll probably find that the classic target...

Hacking Crypto For Fun and Profit

In this blog post we will discuss a case study where we were successful in...

Crafting your way through JSON Web Tokens

JSON Web Token is a compact mechanism used for transferring claims between two...

Bypassing Jailbreak Detection in iOS

In today’s connected modern world every organization wants to have a mobile...

ICMP Tunnels - A Case Study

On a recent Pen Test project, we encountered a situation where the outbound...

Remote code execution via PHP [Unserialize]

At NotSoSecure, we conduct Pen Test/ Code Reviews on a day-to-day basis and we...

How Cross-Site WebSocket Hijacking could lead to full Session Compromise

WebSockets is an HTML5 feature providing full-duplex communications channel...

Malware Analysis

Issue System Administrator finds a suspicious dll running named as “COM...

Abusing Oracle's CREATE DATABASE LINK privilege for fun and profit!

Oracle database (like any other database) offers functionality to create a...

Pentesting Web Service with anti CSRF token using BurpPro

Recently we encountered a scenario where we were pen-testing a web service...

SqliLab CTF, Wrap Up!

As you would have noticed from the noise on twitter and other channels, the...

Oracle Hacks Added to SQLi Lab

We have just added some more awesome challenges in Sqli Lab and thought it...

Hacking Oracle XE from Web

Note: You can practice the below mentioned hack in our SQLi Lab In last few...

Penetration Testing: The Art or The Science?

So, I have been penetration testing for a while now. Over the years, I have...

Pwning Postgres 9.1

I recently came across a Postgres based SQL Injection in a web application. The...

The Art of Exploiting Injection Flaws@Black hat Vegas 2013

Hello All, The popular course on Injection Flaws will return to Las Vegas at...

A Collaboration worth mentioning..

Hello All, It has been a long time since you have heard from me :-( I am quite...

What to/not to expect from pentest

Hello, it has been a while since I posted something (nothing unusual), but I...

Black Hat Eu 2012

Hello All, as always it has been a while since I posted something. Some things...

Hacking Oracle From Web: Part 2

It has been a long time since I posted something. In 2010, I released a paper...

LDAP/XPATH Injection tools

At this year's Blackhat US, we conducted a small workshop titled "The Art of...

APPSECUSA CTF! Another Write Up

I recently came across the Appsec USA CTF. I must say it was a fantastic CTF...

BSQLBF v 2.7

An updated version is now available for download. This supports "-nomatch"...

Oracle CPU Jan 2011

Oracle recently patched a vulnerability which I reported in 2009. The...

Magento E-commerce Persistent XSS

In a recent pentest, I identified a critical security flaw within Magento...

Oracle CPU:October 2010

There are some very interesting issues fixed by Oracle in this month's Critical...

LFI..Code Exec..Remote Root!

Recently on a pentest i came accross an interesting Local file inclusion...

Blackhat 2010

Here are my slides from Blackhat 2010. Hacking Oracle From Web Apps 1 9 View...

bsqlbf v 2.6

The new version of bsqlbf is now available for download. The new addition is...

mysql exploitation with error messages

A colleague of mine(Aleks) forwarded me a russian presentation on exploiting...

Blackhat, Defcon 2010

This year, i will be talking at Blackhat and Defcon. The talk is titled "...

Infosec 2010

Its that time of the year. If you are attending Infosec 2010 in London, it will...

bsqlbf v2.5

I have updated bsqlbf and the latest version (2.5), has the following 2...

Hacking Oracle 11g

David Litchfield's slides from Blackhat DC 2010 are now online. Here is the...

Local File Inclusion with Magic_quotes_gpc enabled

So, lets look at a piece of code: <?php include('inc/'.$_GET['page'].'php...

Open Redirection

So, recently i encountered an application which was really secure against XSS...

IIS 0 day vulnerability in parsing files

Ferruh passed this onto me and this looks like a really interesting...

Exploiting Web Apps With Commerical Tools

For some reason, i never considered core impact an option for web application...

PHP exploitation with Stefen Esser

Stefen posted his slides on "Shocking News in PHP Exploitation". Besides...

DBMS_DEFER_SYS; CVE-2008-2592

The exploit for this vulnerability is in metasploit, but i could not find it on...

More on True And Error Blind Sql Injection

I have received a few emails from people asking me to explain what i mean by...

Bsqlbf v2.4

This is an updated version of bsqlbf. This now has the VALIDATE_REMOTE_RC()...

More on injecting PL/SQL from SQL Injections

David Litchfield yesterday released 3 papers describing security issues which...

Defcon 17 Slides, Demos and Tools

Here are my slides and video demonstrations which i presented at Defcon 17....

Oracle SYS.LT.COMPRESSWORKSPACETREE Exploit

This is slightly modified version of: milw0rm.com/exploits/7677 This is based...

Defcon 17: See you there

I will be giving a talk at Defcon this year. The Talk is about attacking Oracle...

Bsqlbf v 2.3 With Enhanced Oracle Exploitation

A new version of bsqlbf is now available. The following are the new additions...

More On Oracle O.S command execution

I wrote a small perl script to automate this process. The script 'ora_cmd_exec....

Oracle O.S command execution through web apps

I finally managed to get this working. Just followed the instructions on the...

Oracle privilege escalations from web app

There are a number of privilege escalation attacks known for oracle. These are...

Troopers 09

I attended troopers 09 in munich and it was a wonderful event. There were some...

Slides From OWASP Au 2009

Here are my slides from OWASP AU 2009. Owasp Au Rev4 View more presentations...

Bsqlbf v2.2

I finally managed to fix a few bugs and release a new version. Other than the...

My SQL Exfiltrating Data Over Out Of Band Channels(OOB)

Exfiltrating data over DNS is nowadays a very popular technique. This technique...

SQL Injection & The Friendly Error Messages

This post in particular is inspired by 2 things: 1. SFX Sql injection paper:...

MS-SQL [2000 & 2005] User Enumeration Via sp_who

In SQL server 2005, if you are not 'sa' you can't do much. This is primarily...

OWASP Australia 2009

Well, so i am giving a talk at OWASP Australia in february 2009. The title of...

IIS Users Who's Who

Its common to find vulnerabilities in file upload functionality, allowing a...

Truecrypt running as sudo

Recently, i was going through the following truecrypt page: https://en....

MySql Stored Procedures And Functions

Although, a lot has been written about oracle's stored procedure and the weak...

MS08-067

As everyone is talking about this, i thought i will also mention it here...

SNMP v3 Foo

Recently I encountered a snmp port which nmap said was open. Nmap version scan...

Windows 2003 Token Kidnapping Privilege Escalation

In case you haven't seen this exploit on milworm ( exploit-db.com/exploits/6705...

Gmail on iphone..notsosecure

burp logs showing http request If you are concerned about the security of...

SQL Column Truncation Vulnerabilities

I wonder how many web sites will get effected because of this issue. Stefan...

Injection in Order by, Group by Clause

Exploiting SQL Injections when the input goes in the order by clause, is a bit...

Input Length restriction in SQL Injections

Often While exploiting SQL Injections, one encounters restrictions on the...

Bsqlbf V2, Blind SQL Injection Brute Forcer

Bsqlbf was originally written by A. Ramos from 514.es and was intended to...

If Query Data Manipulation

Occasionally when exploiting SQL injections there are conditions when...

Getting Past the Comma(,) in Oracle SQL Injection

Recently i came across a SQL Injection against oracle database, where the...

Database Password Hashes Cracking

SQL Server 2000:- SELECT password from master.dbo.sysxlogins where name='sa'...

Xgrid Controller, Mac Unleashed

I have been using Mac OSX since last few months, and its fun to explore things...

Secure Cookies, are they really secure?

Consider the following scenarios:- Scenario:-1. The cookies in browser are set...

XSS In '302' Redirect Pages

I have found it difficult to exploit, xss in 302 HTTP response, primarily...

Session Fixation Attacks

Session Fixation is an attack technique that forces a user's session ID to an...

SQL Injection, Getting past the magic quote

I recently encountered a SQL Injection, against a MS-SQL database. It happened...

Apache Axis CRLF And Content Injection

Version tested:- 1.4 vendor's website:- http://ws.apache.org/axis/ Details:-...

SQL Injection And OOB

I attended this talk in defcon 15. So, if you have identified a SQL injection...

Exploiting SQL Injections In Insert Statements

Exploiting SQL Injections in Insert Statement, is not trivial as most of the...

Gforge SQL Injection

Original Advisory: portcullis-security.com/179.php The file /www/people/...

Yet Another Insecure Wordpress Code

Package:- wordpress 2.2.2.zip file:/wp-admin/admin- functions.php function...

Pen Testing Windows Active Directory

I have put together some thoughts on conducting a penetration test on a windows...

SQL Injection In Oracle

1. Finding table names select table_name from+user_tables Example:- 192.168....

SQL Injection And UTF 7 encoding

Query:- There is a web application vulnerable to SQL Injection, but the web...

Recommended Books For Pentesting

Although, i don't have the habit of reading books, here are a few books which...

Owning IIS 6.0 When Webserver Supports Put and Move HTTP Methods

Credits: ice and ferruh In IIS 6.0 you can upload the backdoor scripts but u...

Undisclosed Wordpress 2.0 Security Issues

I recently came across this security advisory and decided to find out what the...

wordpress admin-ajax.php Sql Injection

Apologies for not posting anything on my blog for so long. I saw this wordpress...

Ten Cents

Some information about MS-SQL server. You may find this info useful for...

MySql default [insecure] installation in debian

i recently updated my MySql server and i am currently using the version.5.0.38...

Abusing Trackback utility

I was researching a bit into the wordpress trackback utility. This is how it...

Wordpress 2.1.2 xmlrpc Security Issues

Wordpress 2.1.2 xmlrpc Multiple Vulnerabilities: Affected Versions: These...

Insecure Php coding

While testing a web application today, i noticed an unusual 302 HTTP response...

Cookie Analysis

Webscarab is perhaps the only tool i can think of for this. I use this tool to...

Man In The Middle Tools

This weekend as i have nothing better to do, lemme talk about my experiences...

Word Press: Md5 hash in Cookie

I realised word press uses a static cookie, even when u have not enabled...

Abusing TCP/IP name resolution in Windows to carry out phishing attacks.

I was playing with name resolution in windows and i found that it sends...