ROCA – Return of Coppersmith’s Attack

So it is big in the news this week, ROCA, what’s the deal? I’m not going to cover this in detail yet, however here is what you need to know now: The ROCA vulnerability (tracked as CVE-2017-15361) enables computation of RSA private keys from their public certificate/key counterparts.  The flaw affects the implementation of RSA …

Continue reading ‘ROCA – Return of Coppersmith’s Attack’ »

Deny access to all .php files in a folder using htaccess

In order to further harden a folder, for example an ‘uploads’ folder as used by WordPress, it maybe appropriate to block the execution of key file types. If you have a specific folder where content can be more easily written, blocking execution of script files will help reduce the chance of an attacker executing a …

Continue reading ‘Deny access to all .php files in a folder using htaccess’ »

Samsung S6 won’t charge – Only white lighting bolt battery symbol, no charge light!

So I had a Samsung S6 that would not charge, when you plugged it in, the white lighting bolt battery symbol came on but no charge led light. I suspected the charger or cable, but that didn’t help. I fast came to the conclusion it could be the USB port. Reset Keys! I then found …

Continue reading ‘Samsung S6 won’t charge – Only white lighting bolt battery symbol, no charge light!’ »

Cisco ASA Unicast Reverse Path Forwarding Verification Was Disabled

If you have had a firewall audit, and your report states that ‘Unicast Reverse Path Forwarding Verification Was Disabled’ on your Cisco ASA then read on. “Network administrators can use Unicast Reverse Path Forwarding (Unicast RPF) to help limit the malicious traffic on an enterprise network. This security feature works by enabling a router to …

Continue reading ‘Cisco ASA Unicast Reverse Path Forwarding Verification Was Disabled’ »

Formatting JSON with the Python JSON Tool

When working with web server JSON responses, if they span several lines with no ‘new line’ formatting they can be difficult to read. When JSON responses end up on the command line, it is possible to format them for easier reading. Here I use a short output from the jsontest.com site as an example. Copyable …

Continue reading ‘Formatting JSON with the Python JSON Tool’ »

Building a UK Street / Road Name Wordlist

If you need to create custom dictionaries or wordlists, there are many options, in this case we were looking for UK specific street / road names. You do not need to ‘scrape’ open street map for data, it is not ideal from their point of view or yours. As the data is open, they do …

Continue reading ‘Building a UK Street / Road Name Wordlist’ »

Monitoring network traffic with port mirroring

If you would like to monitor the traffic between two network devices or network segments, you will need to obtain access to the packet flow between the two hosts or network segments.  In a virtual lab environment we have a number of options, and normally the opportunity to reconfigure things to get access. In a …

Continue reading ‘Monitoring network traffic with port mirroring’ »

Firefox Captive Portal Detection and Burp Suite

If you get requests like this in Burp, and you don’t need or want them…… you need to disable captive portal detection. Eg: GET /success.txt HTTP/1.1 Host: detectportal.firefox.com There isn’t a easy checkbox to configure this, however it is possible to disable using about:config. In a new tab, type about:config in the address bar and …

Continue reading ‘Firefox Captive Portal Detection and Burp Suite’ »