GrimBlog

I recently needed to access an application which required mTLS using an automated browser to facilitate security testing.

Note: I performed this research as part of my R&D role at AppCheck, this blog post is cross posted here and on the company blog.

Some time ago I encountered an error in my python code interacting with a Postgresql database: psycopg2.ProgrammingError: can't adapt type 'method' The above exception was the direct cause of the following exception: ... sqlalchemy.exc.ProgrammingError:…

Some time ago I came across a site that was using xdLocalStorage after I had been looking into the security of HTML5 postMessage.

TLDR: Recently I had cause to revisit an old script I wrote to parse .DS_Store files I discover on web application tests.

TLDR: Domain Users permitted to authenticate to Microsoft SQL databases can use the limited privileges they are granted to run a stored procedure.

As you would expect, office printers are often identified when conducting a penetration test of an office network.

TLDR: There is a simple username enumeration issue in Office365’s ActiveSync, Microsoft do not consider this a vulnerability so I don’t expect they will fix it, I have written a script to exploit this which is available here: https://bitbucket.org/grimhac…

Recently I needed to parse some data embedded in HTML.

Believe it or not, despite the fact it is 2016 I am still finding LanManager (LM) hashes on internal networks during penetration tests.