Markuta

iStat Menu version < 7.20.5 has a local privilege escalation vulnerability due to insecure world-writable permissions set by the install helper component.

The official respository for cloudflared package has a new hostname in it's baseurl which is not resolving properly.

A short guide on how to get IPv6 VPN working on Unifi Gateway Ultra using socat.

The popular MFA provider Authy by Twilio doesn't support exporting TOTP tokens.

Hacking the Amazon eero 6 (3rd gen 2020) wireless device part 2.

A short blog on how to install and run the latest version (23.05 on ARMv8) of OpenWRT, with the LuCI web management, using QEMU.

A technical blog post on finding and exploiting an authenticated JDBC deserialization vulnerability in JSCAPE MFT Server to gain remote command execution.

Hacking the Amazon eero 6 (3rd gen 2020) wireless device, part 1.

PayPal announced support for Passkeys in October 2022.

How to block .zip top-level domains (TLDs) with pfSense and pfBlocker-NG.

A short blog on how to get root on an emulated device running Android 12 with rootAVD.

The recent (2022) compromise of Lastpass included email addresses, home addresses, names, and encrypted customer vaults.

How to bypass certificate pinning on ProtonVPN macOS app using Frida.

Comparing root detection on 24 banking apps using the latest version of Magisk v24.3 on a Google Pixel 3a running Android 10.

A fun little weekend project on how I found a unique Hyundai Vehicle Identification Number (VIN) from a list of 42,873,633.

EV charging company exposing 140K of customers’ data through their mobile app.

A guide on setting up pfSense and IPv6 on HyperOptic.

Working with Frida and Magiskhide on a rooted Android device.

How to setup a Hugo website using Cloudflare Pages and Github.

A how-to guide on setting up a self hosted Bitwarden server using a Raspberry Pi.

A fresh new Jekyll theme called klisé for Markuta.com.

How I found a XSS bug on Spotify's Podcasters subdomain.

A guide on how to use a TP-Link Archer T2U Nano AC600 wireless adapter, along with the mitmproxy tool to create a intercepting set-up for inspecting, modifying and monitoring encrypted HTTPS traffic.

How to acquire a live memory image dump from a Linux system using the LiME Kernel Module.

This guide shows how to install and build a MIPS (Little Endian) Debian Stretch (9.4) image for running under QEMU virtualization software.

A how to guide on setting up Nzyme and Graylog v2.3.2 using a Docker compose file.

The BBC Online still forces users to use insecure HTTP by way of redirection.

Review of the KeyGrabber Nano USB Keylogger.

The recent Kali Linux Kernel update version 4.12.12-2kali1 completely broke wireless functionality resulting in poor performance and range issues.

A handful of useful bash shell aliases that I've been using for years.

What I personally use for Password management and a comparison against cracking encrypted databases files with other password managers.

Review of Alfa AWUS052NH Dual-Band (2.4GHz and 5GHz) wireless USB adapter.

How to configure Web Servers (Nginx, Apache, IIS, OpenLitespeed and Lighttpd) to Force HTTPS by default.

A simple technique to append PHP code to files that have been processed by IonCube or Zend Guard.

Getting round poor UEFI implentation support for booting into Debian Stretch.

Adjusting Dynamips CPU usage in an virtual environment.