Harrison Mitchell's blogs, tools and whitepapers

The time my SaaS perimeter scanning tool coincidently broke out of a consultancy's internal GitHub

Untangling syshooks and spoofing call stacks to dodge EDR with the Certified Red Team Lead certification

Surely GPS devices strapped to children are secure?

3x mini course reviews including NVIDIA's "Exploring Adversarial Machine Learning" to misclassify frogs as cats

Earn money, claim territory, pat dogs.

Sifting every Firefox extension for malware and other interesting nuggets like a leaked French business database

Reflecting on five key common mistakes unearthed through 100 purple team engagements in Oceania

Reviewing recent Australian legislative changes pertaining to warrantless surveillance

Why Purple Team engagements are the way of the future

Introducing a new open-source tool for mastering the art of purple teaming

Free open-source web app for planning, executing and reporting Purple Team engagements

Bypassing M365 MFA policies by abusing common blindspots

Instantly search known TTP and associated commands for use in red (or purple!)

(Google|Apple) Maps let you easily search for places, but any complex queries and correlations were out of the question, until I met Overpass Turbo + OpenStreetMap

Providing websites direct access to the filesystem bypasses many browser sandbox and trust boundaries, surely it's implemented securely... right...?

How the NSEC and NSEC3 DNSSEC records can be abused by attackers to identify valid DNS entries

Using a "security feature" of DNSSEC signed zones to replicate traditional AXFR DNS zone transferring thanks to NSEC and NSEC3 walking

How effective is NSEC3 in reducing information disclosure?

How controls both physical and digital cannot stop spoofed licences, only training can; and trust in the digital age

My investigation into, and implementation of QOI - a nifty little lossless image codec comparable to PNG in size, but superior in speed

How an identified email misconfiguration allowed spoofing of emails from a federal Australian Government department

A hierarchical wiki software themed around Windows 95.

What percentage of Australian businesses are protected from easily-executed email spoofing attacks that cost firms over $81 million annually?

Clipboards are more than a text buffer, they're almost full databases.

Website with "www." are needlessly making a big mistake

Take a video, and put it in alphabetical order; be it a Taylor Swift song, or the entire Star Wars franchise

Makes a montage consisting of 1.5s clips from youtube based on the provided topic.

Generates metadata about public S3 bucket files without needing S3 command line tools or credentials.

How it came to be that Facebook chose to make your password 94x weaker than it need be.

The how and why generating the average face of a nation's population is harder than it sounds

Tricks browsers and users to get them to click on a misleading link.

Using a conglomerate of cutting edge technology, trim down the length of time university lectures take to digest.

The future of currency, contracts and trust, or at least as it's viewed from 2019

The basis of the internet and why it's no excuse to check your banking information on a public network, even if it's salty

Do you have photos that you only have printed and not saved in digital form?

How bouncing around like crazy makes your audio cleaner

The fundamentals of the USB interface, and the support for toasters

Converts an image into a line of text that, when opened looks like a corrupted file, unless you know how to decode it

Shows the shifting leaderboard of the ten most popular baby names in NSW by year from the 1950s-

Encodes messages in plain sight.

Turns a recorded lecture into a PDF with slides shown in the video.

Estimates pi based off calculating the difference between random raindrops landing on a square and circle with an equal diameter

Create a timelapse of all NSW traffic cameras provided from the RMS with views ranging from Pacific Highway to the Sydney Harbour Bridge, an easy way to see Sydney's real-time congestion at a glance

Plots all NSW speed cameras on a map by deobfuscating English descriptions of speed camera locations

A graphical representation of every single recorded daily temperature of Sydney since 1860

Using YOLO9000, classify objects in a video for use with computers that aren't compatible with CUDA by processing individual frames rather than a single video file

Displays the state of Sydney's traffic with a grid of public NSW traffic CCTV cameras

See every public transport vehicle in NSW moving live around a map with real time information on occupancy, traffic, whether the service caters for the disabled, what the next stop is etc...

Get the average colour of every frame in a video and create a lovely colour timeline