Reading Time: 6 minutes Hello! In this post I will walk you through my attempt at fingerprinting GreyNoise sensors. Before diving in, I want to give a huge shout out to GreyNoise, they greatly support the community by providing free API access to anyone! <3 If you don’t know what GreyNoise is, it’s a large collection of distributed servers … Continue reading “Fingerprinting GreyNoise Intelligence Sensors”
Reading Time: 2 minutes HASSH is an SSH fingerprinting method developed by Salesforce. HASSH allows SSH servers to fingerprint SSH clients attempting to connect by examining the client’s handshake data, such as which ciphers the client is asking to use, etc. An inverse fingerprinting is also possible by using HASSHServer. HASSH is a similar idea to JA3 / JA3S … Continue reading “Evading SSH Fingerprinting (HASSH) with Arbitrary Ciphers”
Reading Time: < 1 minute Recently, I’ve been playing around with Open Policy Agent (a.k.a. OPA), an open source project by CNCF that decouples policy enforcement from decision making. To practice its implementation, I created a proof of concept for Python’s Bottle framework, a simple web framework that doesn’t have Authorization by default, seemed like a good candidate for OPA! … Continue reading “Open Policy Agent for Bottle Web Framework”
Reading Time: < 1 minute GraphQL has been a technology I’ve been focusing a lot on in my day job. GraphQL is a query language made by Facebook, and can be an alternative to REST. I have spent quite some time researching how to defend GraphQL properly. My journey into researching GraphQL included searching for a Damn Vulnerable version of … Continue reading “Damn Vulnerable GraphQL Application”
Reading Time: 9 minutes Table of Contents Background Building the Automation Results Attribution Remediation Final Thoughts Credits Background A while back, I watched a 2019 DEFCON talk by Ben Morris on exposed EBS volumes on AWS. EBS Volumes are attachable block storage devices, essentially virtual disks. Here is the short problem statement the talk discusses (watch it if you haven’t, it’s … Continue reading “Hunting for Sensitive Data in Public Amazon Images (AMI)”
Reading Time: 4 minutes Background For an upcoming episode of McAfee’s Hackable podcast, I was provided with a Furbo – a dog food tossing device, for a security review. Equipped with a 160 degree High Definition camera and night vision capabilities, Furbo is a dog camera capable of tossing food with a swipe of a button through your phone. Furbo was … Continue reading “Remote Hacking of Furbo Dog Camera”
