Curiosity in Practice
I have a couple of old Raspberry Pi’s 2 laying around and have been meaning to turn them into “Remote Access Terminals” to demonstrate what happens if you do not do effective egress filtering on your network. At a high level if an attacker can plug in one of these on your network and get internet access they … Read more
I have been playing with the GL.inet hardware lately and stumbled upon this project called NetAidKit that is built on the $25 6416 platform that offers a purpose built TOR and VPN router. After building the images using the instructions on their github page (here is the one I built if you trust me) all you have to … Read more
My friend Steve Lord recently introduced me to ultra portable GL-inet routers. I picked up the $25 GL-AR150 to hack around on. One of the first things I noticed while reading through their blog was that the hardware was the same as the wifipineapple nano and someone had already ported the firmware to work on the AR150. Updating the firmware is … Read more
After spending last night working on a Reverse DNS Function for Google Sheets I couldnt leave well enough alone and wrote Shodan2Sheets tonight using the shodan.io api. It provides a lot more information than the reverse lookup function and all you should have to do is copy your API key to C2 and then start filling in … Read more
Often in my job I am given spreadsheets of IP addresses that look like this: One of the first things I always want to do is find if they have a FQDN. Sadly Google … Read more
This weekend the infamous hacker and troll Weev decided it would be hilarious if he printed fascist flyers on open printers around the united states using this top secret APT string: cat payload.ps |netcat -q 0 ipadreess 9100 A lot of Colleges and Universities seem to have a problem with this. While I strongly disagree with the content that … Read more
My friend Scott pointed out the towels in most hotels now have RFID tags to help with inventory control: I also knew that my RSA Conference badge would have an RFID tag in it so it could be scanned on the expo floor: Since I never leave home without my Proxmark3 in my assault pack it was time to … Read more
The FBI has recently sued Apple to make them unlock the iphone of the San Bernardino Shooter (Here is Apple’s response.). The reason Apple needs help is because the phone has “Erase All Data After 10 Failed Passcode Attempts” turned on. Without that feature the government would have just built this robot to brute force the password … Read more
I have been meaning to pick up a Proxmark3 for the last couple of months to round out my RFID testing kit (while waiting for the chameleon mini to be released this summer). The problem is that most of the known suppliers are selling the Proxmark3 for around $420. I then found that Elechouse has their … Read more
Crashsafari.com is a website that overloads the browser with a self-generating text string which populates the address bar. After about 20 seconds or so it will force an iPhone to reboot, while significantly heating it up as the smartphone tries to handle the code of the site. The code of the website appears to generate an … Read more