Sites that do not implement secure cookie handling can end up exposing sensitive data to attackers, so it’s important to know the basics around cookie hygiene. Read on to see how sites can secure these values, how you can check the security of these values, remove them when needed, and an extra bit on how to win at the popular Wordle word game the first time, every time!

Continue reading

If you’re in charge of a domain that others visit on a regular basis, you want to ensure that users continue to trust that domain, after all, your domain is an extension of your brand, which is your business. So you want to keep phishers and attackers from creating fakes and copies of it to lure your customers away or tarnish your brand with false information.

Continue reading

This is a quick walkthrough of the beginner-ish CTF machine “The Planets:Mercury” on Vulnhub. ****Spoiler Alert**** ****Spoiler Alert**** Nmap Scan: It looks like we have a Python WSGIserver under port 8080, but browsing the root directory was a dud, so let’s see if we can enumerate any more info from a Nikto scan: Here we can see Nikto picked up directory browsing under the /SilverStream directory, so let’s take a look at that:

Continue reading

This is a walkthrough of the beginner-ish CTF machine “The Planets:Earth” on Vulnhub. ****Spoiler Alert**** ****Spoiler Alert**** Shaking off a lot of cobwebs here, ok, obligatory nmap scan of Earth shows the following open ports: Some notable items here are the two DNS names identified in the certificate under port 443 as Subject Alternative Names (SANs) as earth.local and terratest.earth.local. These need to be added to the /etc/hosts file for sure for additional testing of server header goodies.

Continue reading

regex

I’ll start off this post by saying that I DO NOT claim to be a “RegExpert” (Regular Expression Expert). I claim to be an expert in only a couple of things in life:

  1. Knowing how to give good doggos belly rubs.
  2. Not thinking of anything in particular.

But because neither of these things pays the bills (yet), I’ve found that a little knowledge in regular expressions is a good thing to have. Better, sometimes having resources in your back pocket can be useful.

I’ll show a couple of small examples here, but will also give some examples of resources that can help with some of the tricky situations where regex is needed.

Continue reading

Disinformation isn’t just a social engineering attack, it’s an buffer overflow attack of the mind.

Most people may not be familiar with an information security vulnerability called a buffer overflow. Here’s a small example:

bof

Buffer Overflow attacks work when a program needs to accept input from the user (think of a program that asks for your username, like the example above). The issue is that the programmer uses a function like strcpy() where the size of the destination is not specified. The problem here is two fold: 1. If you throw enough data into this input area, it can crash, resulting in a Denial of Service condition. 2. If you craft a specialized request, taking into account memory allocations, you can trick the program into running almost any code you want it to run.

Continue reading

Author's picture

The NullCereal Blog

Jake’s Nerdy News and Security Topics

System/Network/Security

Jax Beach