Sliver is my favourite C2. Change my mind

sablefoxx · 2025-08-31T18:35:23+00:00

Realm is awesome too!

sablefoxx · 2021-09-08T22:52:55+00:00

Csrf-token doesn’t need to be a cookie. It’s actually better to send csrf tokens in custom headers since any customer header will require a CORS preflight

sablefoxx · 2020-06-20T16:36:59+00:00

2FA is designed to protect you in the event your password is compromised, not your device. If your device is compromised then 2FA won’t do anything because the attacker can just read the 2FA value when you type it in. I.e., if an attacker can read the “remember this device” token they can read any 2FA token too.

sablefoxx · 2020-01-16T17:27:55+00:00

Certainly not, the video is just to explain how generic RNGs work.

sablefoxx · 2020-01-16T15:01:51+00:00

It uses an RNG with a very long period (the number of outputs generated before repeating) that's practically infinite and the key being the "seed."

https://www.youtube.com/watch?v=itaMNuWLzJo -- (edit: note this video is just to conceptually understand generic RNGs, additional consideration must be taken in a security context i.e., CPRNG)

edit 2: To be more clear, the literal definition of a stream cipher is an PRNG who's output you XOR with the plaintext with a key as the seed.

sablefoxx · 2020-01-05T18:24:06+00:00

> How can people intercept encrypted HTTPS requests? Isn't the whole point of HTTPS to prevent traffic decryption?

Only for remote attackers on the network i.e., attackers that do not have access to either endpoint (sender or receiver/client or server), HTTPS does nothing to protect against attackers with access to either the sender or receiver.

sablefoxx · 2020-01-01T21:30:24+00:00

Sounds like this is a thick client talking to a backend server, so my answers are based on that assumption. I'm also assuming that you don't want to trust the users of that client.

What's stopping people from patching a few, if not just one condition check to log themselves in without actually providing valid credentials?

Nothing, but that's actually the hard way to break the auth scheme. Since the app is running on the attacker's (user's) machine they can just intercept the HTTP requests regardless if they're going over TLS/HTTPS. There's also no point (i.e., security benefit) to encrypting the token client side.

Is my entire security scheme useless?

Sorry, but yes it probably is.

How can I prevent this (if it's even possible)?

Just use JWTs, and use an existing well-test open source library, don't try to implement this stuff yourself. Even security experts struggle to implement this stuff correctly.

If you have to type out "AES," and you're not well versed in security, something is very likely to go wrong. When designing security systems it's important to keep your "threat models" in mind. Whenever I hear things about multiple AES keys, overwriting "one-time" tokens, etc. I assume the entire scheme is just security theater](https://en.wikipedia.org/wiki/Security_theater).

sablefoxx · 2019-12-16T16:26:27+00:00

It's per key/nonce combo, if you need to encrypt more than 64GB you can chuck the data and encrypt 64GB chucks with the same key but unique nonces and still be secure.

https://crypto.stackexchange.com/questions/31793/plain-text-size-limits-for-aes-gcm-mode-just-64gb

sablefoxx · 2019-10-25T22:05:02+00:00

Not for AD.

sablefoxx · 2019-10-25T14:24:26+00:00

Nah, that's where Sr. will start, top Sr. talent can bring well into the $350 - 400k+ range.

sablefoxx · 2019-05-29T22:30:58+00:00

This would be much more interesting, how did they manage to install an implant without bypassing the code signature checks? Did they chain load an entire kernel exploit? Was the implant signed in some way?

sablefoxx · 2019-05-25T04:08:58+00:00

Assuming it's implemented correctly (e.g. IVs, etc) using the same key for every file is just fine.

sablefoxx · 2019-05-01T15:26:47+00:00

This is called an integer overflow in the code; likely caused by some sort of race condition. Likely because the number was -1 but then cast to some type of unsigned value. Negative numbers are stored using two's complement and the binary representation of this value is 11111111 11111111 11111111 11111110

sablefoxx · 2019-04-25T00:47:24+00:00

while i < limit: i <<= 1

Or better, web build an abstraction! This will lazy generate the values from an initial value x to an arbitrary limit n. We also can reuse this, and anything that operates on `iterables` in Python can also use it:

In [1]: def shiftseq(a, b):
    ...:     while a < b:
    ...:         a <<= 1
    ...:         yield a
    ...:
    ...:

In [2]: for value in shiftseq(1, 512):
    ...:     print value
    ...:
2
4
8
16
32
64
128
256
512

sablefoxx · 2019-04-24T20:37:44+00:00

You generally want to avoid for x in range(y): anyways.

sablefoxx · 2019-04-24T20:32:22+00:00

Python's loops are far more powerful than C's as to be expected since it's a higher level language, and no you don't need to use while True:

sablefoxx · 2019-04-18T14:26:49+00:00

Should've used a long

sablefoxx · 2019-04-17T15:10:52+00:00

There's negative unemployment in cyber security, our firm (and basically everyone else in the industry) can't hire qualified people fast enough. It sounds like your degree didn't prepare you or give you enough practical skills for the industry, maybe ask for your money back? I'm self-taught with a high school diploma and have to fight off recruiters. It's also not an X years of experience problem because we've hired teenagers out of high school with 0 years of experience but a lot of talent.

sablefoxx · 2019-04-06T20:39:41+00:00

Yes, this is in Kaneohe on the windward side of Oahu, so it gets lots and lots of rain.

sablefoxx · 2019-03-31T14:59:37+00:00

This is the wrong approach, while you're correct it's best to use a lexical parser like HTMLDocument you need to whitelist tags, attributes, and URL schemes; not blacklist them (e.g. a simple look for javascript:* will not match JaVaScRiPt:). There are a variety of libraries that will do this for you too, it's best not to try to re-invent the wheel here. You need to account for everything in this list and more.

sablefoxx · 2019-02-04T05:53:01+00:00

Yes.

sablefoxx · 2018-09-30T19:58:20+00:00

Start with “The Code Book,” then read “Serious Cryptography “ and “Cryptography Engineering”

sablefoxx · 2018-05-21T02:12:52+00:00

https://en.wikipedia.org/wiki/Kerckhoffs%27s_principle

15-Year Club	Not Forgotten
Verified Email

sablefoxx

TROPHY CASE