blog.dornea.nu

The BerlinSides is a conference from hacker for hacker.

In this post I’ll try to share an idea I’ve had regarding pentest reports.

In this post I’d like to show some handy way to improve your process of documentating your project.

I was recently playing around with D3 and discovered its dashboard posibilities. dashboarddude.com has a nice compilation of really fancy dashboards (I was mainly interested in D3 but voila… there are also other ways to do it).

When Random Isn’t Random Enough: Lessons from an Online Poker Exploit Technical Details Behind a 400Gbps NTP Amplification DDoS Attack Absolute Computatrace revisited Burp Co2 Porting Applications to 64bit ARM Price and Feature Comparison of Web Applicati…

Bitcoins the hard way: Using the raw Bitcoin protocol Modern Processors – A 90min guide The GSM security model Analyzing DarkComet in Memory Cryptography Breakthrough Could Make Software Unhackable Git tips from the trenches I Spent Two Hours Talking With…

How I lost my $50,000 Twitter username NSA BIOS Backdoor a.k.a.

Suterusu Rootkit: Inline Kernel Function Hooking on x86 and ARM Oldboot: the first bootkit on Android For the Love of Money Automated penetration testing in the Microsoft stack with OWASP ZAP TCP backdoor 32764 or how we could patch the Internet (or part…

Motivation # I’ve started this little project since I was mainly interested in the data my smartphone is sending all the time without my knowledge.

For better display results you can also have a look at the 24h Android Monitoring Jupyter Notebook.

InkTag: Secure Applications on an Untrusted Operating System Unicode Security Guide Hunting Botnets with ZMap EncFS Security Audit Hacking Tools Repository The Hacker Who Cracked the Code in Iron Man and The Social Network Operating System Tutorials The J…

Remote Code Execution exploit in WordPress 3.5.1 Dissection of Android malware MouaBad.P Linux: Keep An Eye On Your System With Glances Monitor A Forensic Overview of a Linux perlbot DNA seen through the eyes of a coder Infection of biological DNA with di…

Phalanx 2 Revealed: Using Volatility to Analyze an Advanced Linux Rootkit How We Decoded Some Nasty Multi-Level Encoded Malware LAYER 7 DDOS ATTACKS: DETECTION & MITIGATION Bypassing Internet Explorers Anti-Cross Site Scripting Filter On the 1st of Januar…

Android Root Detection Techniques Shmoocon 2013 Playlist INSECURE Mag 40 A society of phone Zombies Encrypted peer-to-peer web application platform for decentralized, privacy-preserving applications The UNIX system family tree: Research and BSD Found: Hac…

If you got IP ranges in this layout: x.x.x.1-255, y.y.y.42-120 etc., you could easily use this code to generate full IP adresses without any ranges: 1 2 3 4 5 6 7 8 9 10 11 12 13 14 15 16 17 18 19 20 21 22 23 ips = """ x.x.x.1-23 y.y.y.56-12 """ buf = Str…

To kill a centrifuge - A technical anlysis of what Stuxnets creators wanted to achieve Basic data structures and algorithms in the Linux kernel Hackers and software engineers geheimerkrieg.de(also have a look at the Videos) Password cracking: A mega colle…

Modern Userland Linux Exploitation Courseware: Also have a look at the presentation slides ELF Carver - Recovering Linux Binaries Catching and Understanding GSM-Signals SIM Card Forensics: An Introduction ZeroNights 2013 Materials exploit-exercises.com En…

The second operating system hiding in every mobile phone A Portscan by Email - HTTP Over X.509 Revisited BlackBerry and Windows Google BBS Terminal Top 10 Hacker Movies of all time Duplicity + S3: easy, cheap, encrypted, automated full-disk backups for yo…

Yet Another Android Master Key Bug tmuxp - manage tmux workspaces NSA files: Decoded (really good article) Analysis of an mbr*wserstats and counter.php infected webserver Have fun with Jenkins Commandline forensics of hacked PHP.net

Apache / PHP 5.x Remote Code Execution Exploit An introduction to elliptic curve cryptography A (Relatively Easy To Understand) Primer on Elliptic Curve Cryptography I Failed a Twitter Interview Former spy chief overheard giving off-the-record interview f…

FBI Tor Malware Analysis Intro into Reverse Engineering Course Dear undergraduated hacker Penetration Testing Practice Lab / Vulnerable Apps/Systems How Offensive Cyber Security is Changing the Industry

CorkaMix: This is indeed insane!

Hackers Courted by Government for Cyber Security Jobs - Rolling Stone We scanned the Internet for port 22 Hosting backdoors in hardware (Ksplice Blog) Distributed systems for fun and profit Analyzing an Android Webview Exploit

nmap NSE hacking for IT security professionals The Wretched Google Interview Experience Why I left Google I Left Google And Lived To Happily Tell About It The NSA’s Cryptographic Capabilities Linux Trojan “Hand of Thief” ungloved You’re Smart.

Recently a colleague of mine at nullsecurity.net released a new scanning tool called wnmap.

To whom it may concern…

57 startup lessons Hacking Transcend WiFi SD Cards Hacking the OS X Kernel for Fun and Profiles Here’s what you find when you scan the entire Internet in an hour noteZilla: Interactive,clickable, sheet music Linux x86 Program Start Up (How the heck do we…

OK, first some explanations: systemd is a modern sysvinit & RC replacement for Linux systems.

This weeks links… Hard disk hacking: Learn interesting stuff about hard disks Russia’s Massive Malware Industry Revealed BGP spoofing – why nothing on the internet is actually secure JACLYN KONZELMANN, Why I Quit Microsoft To Join A 5 Person Start Up In T…

Android Bug 82119321: A comprehensive description of the recent Android bug also known as the signature bug FOOAS: Fuck Of As A Service localtunnel: Access your local web server through the internet [A Tour Inside CloudFlare’s Latest Generation Servers}(h…

I really love Burp.

Root Cause Analysis Integer Overflows: Nice analysis!

As I’m using my Kindle 3 on daily basis I wanted to go behind the limits and check for some new features.

This weeks links: Self interview after leaving the NetBSD board: I still like NetBSD a lot but what Julio writes in his blog makes me feel sad about the whole project.

Dinge, die ein informatikstudent niemals sagen würde: ich hab sonnenbrand meine freundin… …lass uns das mit pointern lösen yey, ein beweis!

This weeks top links: The most sophisticated Android Trojan: Really nice analysis.

How the Prime Meridian Changed the World: Not technical stuff but worth reading.

Anatomy of a hack: How crackers ransack passwords like qeadzcwrsfxv1331 This is definetely link of the month!

First Glimpse into the Soul of Tamagotchi: Remember my post about 29C3?

A binary analysis, count me if you can: Really impressive skills!

Introduction # AltoroMutual is an vulnerable-by-design web application created by WatchFire (now AppScan Standard) as a demo test application for their BlackBox Scanner.

Solution for http://www.overthewire.org/wargames/vortex/vortex1.shtml.

Solution for level2: Here is the code: 1 2 3 4 5 6 7 8 9 10 #include <stdlib.h> #include <stdio.h> #include <sys/types.h> int main(int argc, char **argv) { char *args[] = { "/bin/tar", "cf", "/tmp/ownership.$$.tar", argv[1], argv[2], argv[3] }; execv(args…

Description # “The 29th Chaos Communication Congress (29C3) is an annual four-day conference on technology, society and utopia.

This is probably the most useful command when it comes to splitting large mp3 files.

Why Nginx?

Received from Mr.Sh3ll: hi.my name is saied. if u permit.i want upload shell in ur site for access from another site on this server. i promise dont damage ur site if u accept. send email to me.and i will send u shell and u upload. dont worry WTF?

I thought this could be useful for other Namecheap customers.

Ich musste das veröffentlichen.

I always knew DNS/ICMP traffic is mostly allowed and un-monitored.